AI Risk Management Procedure

How to use this document

• What it is for. This is a base procedure to identify, analyze, evaluate, treat, accept and review the risks of AI systems throughout their life cycle, with defined criteria, a risk register and escalation rules. Its structure follows the functions of the NIST AI RMF (govern, map, measure and manage), a publicly available reference.
• Who should own it. The AI lead maintains the procedure and the risk register; the AI committee (or management, in small organizations) accepts high residual risks. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Risk appetite is not set here: it is approved in the "AI Risk Appetite Statement", and who decides and by when is set in the "AI Governance Operating Model". Before adopting this procedure, confirm both are approved, decide the maximum validity of acceptances (Section 8.6) and whether the procedure plugs into existing enterprise risk management or runs on its own.
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. Check "Related regulatory references" to identify laws that require risk analyses, impact assessments or specific methodologies in your country or industry, and connect them in Section 12.
• Review. Ask Legal, the data protection officer and information security to validate the scales and the links to other processes.
• Approval and publication. Have it approved by [AI COMMITTEE] or senior management, record the approval in "Version history" and share it with AI system owners and technical teams.

AI Risk Management Procedure

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Procedure owner	[OWNER]
Applicable risk appetite	Current AI Risk Appetite Statement
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]

1. Purpose

1.1 This procedure sets out how [ORGANIZATION NAME] identifies, analyzes, evaluates, treats, accepts, monitors and communicates the risks associated with the AI systems it develops, acquires, integrates or uses.

1.2 Its goal is that every relevant risk has an owner, a documented assessment, a treatment with a deadline and an acceptance decision made by someone with authority to make it.

2. Scope

2.1 It applies to all AI systems recorded in the AI system inventory, during every phase of their life cycle: concept, design, data collection, development or acquisition, validation, deployment, operation, change and retirement.

2.2 It covers machine learning models, language models and other generative AI systems, agents that take actions, training, validation and test data, the supporting infrastructure, and third-party services integrated through an API or as software.

2.3 AI risks that are also privacy, information security, continuity or compliance risks are recorded once and coordinated with the corresponding process (Section 12).