These ten ideas come up across all three domains.
- Risk appetite and tolerance
- How much AI risk the organisation will accept. Each AI use case is judged against it.
- AI life cycle
- Design or procurement, training, testing, implementation, maintenance and decommissioning. Each stage has its own risks.
- Model drift
- A model's results change over time as data and conditions change, so it needs monitoring.
- Bias and trustworthiness
- Unfair or unreliable outputs, linked to ethics, privacy, safety and ESG impacts.
- AI risk scenarios
- Realistic cases of threats, vulnerabilities and attacks on AI systems, used to rate likelihood and impact.
- Risk treatment
- The choice to reduce, transfer, avoid or accept an AI risk once it is assessed.
- Controls management
- Evaluating, selecting and validating controls so risk stays within tolerance.
- Risk metrics and reporting
- Measures that show whether AI risk is rising, reported to the board, management and operations.
- Supply chain and third-party risk
- Risks from vendors, models and data sources, including contract terms on data use and intellectual property.
- Human oversight
- Checks at critical decision points where people can review, question or override AI.