AI Risk Appetite Statement

How to use this document

• What it is for. It sets, in a single place, how much AI risk [ORGANIZATION NAME] accepts, who may accept it and under which conditions. The other AI governance documents say "within the risk appetite" and point here; they do not define it again.
• Who should own it. The AI lead drafts and maintains it; Management approves it (in organizations with an AI committee, on the committee's proposal).
• Decisions to take first. Before adopting it, decide the stance for each risk category (Section 5), the tolerance indicators and thresholds (Section 7), the maximum duration of a risk acceptance (Section 9) and the amounts that trigger escalation (in the "AI Governance Operating Model").
• Fields to complete. Replace the bracketed text: [ORGANIZATION NAME], [OWNER], [AI COMMITTEE], [DATE], [APPROVED BY] and each [COMPLETE]. Suggested values are indicative: adjust them to your size, sector and experience.
• Levels. Paragraphs marked [BASIC LEVEL] serve organizations of fewer than ~50 people that only use AI inside purchased software; those marked [REINFORCED LEVEL] serve anyone running high-risk systems, in a regulated sector, or hosting, training or deploying agents in production. Unmarked content applies to everyone.
• Country variants. None. Section 8 maps the internal scale to legal categories; keep only the rows for the rules that apply to your organization (see "Related regulatory references").
• Review. Ask Legal, Information security and the data protection officer (or the country's equivalent role) to review Sections 5, 6 and 8 before approval.
• Approval and publication. Approve it formally, record it in "Version history" and share it with system owners, purchasing leads and AI committee members.

AI Risk Appetite Statement

Field	Value
Organization	[LEGAL ENTITY NAME]
Statement owner	[OWNER] (AI lead)
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY] (at least once a year)

1. Purpose and scope

1.1 This statement sets the level of risk [ORGANIZATION NAME] is willing to take to obtain value from artificial intelligence, the limits it does not accept under any circumstances and who decides when a risk approaches those limits.

1.2 It applies to every AI system the organization uses, buys, integrates, hosts, trains or deploys, including AI features of software already purchased, agents and open-weight models, in every function and country.

1.3 It is the single reference for risk appetite across the other AI governance documents. When another document says "within the risk appetite," it means this statement.

2. General statement

2.1 [ORGANIZATION NAME] wants to use AI to improve its service, its productivity and its decision-making. It accepts the risks of fast adoption provided they are visible, have an owner, can be reversed and are proportionate to the benefit.

2.2 The organization has an open appetite for low-risk internal uses that save time, a cautious appetite for uses that process personal data or reach customers, a minimal appetite for uses that influence decisions about people and a zero appetite for prohibited practices and the limits in Section 6.

2.3 No financial or schedule benefit justifies accepting a risk outside this statement without the express decision of whoever is responsible under Section 4.