Key facts
- Definition: identifying, assessing, treating and monitoring the risks AI systems create across their lifecycle.
- It is a continuous loop, not a one-off assessment — risks change as models, data and uses change.
- A risk-management system is mandatory for high-risk AI under EU AI Act Article 9.
- Reference frameworks: ISO/IEC 42001, ISO/IEC 23894 and the NIST AI Risk Management Framework.
- The core artefact is an AI risk register linked to your AI inventory.
Why does AI need its own risk management?
AI learns from data, can be opaque, and its outputs can drift as data and use change. That introduces risks — bias, inaccuracy, security weaknesses, privacy harms and effects on people's rights — that general IT risk processes were not designed to catch. AI risk management adapts familiar risk practice to those specifics.
What are the steps in the AI risk lifecycle?
Identify the risks each system poses; assess their likelihood and impact; treat them by avoiding, reducing, transferring or accepting; and monitor the residual risk. Because AI changes over time, you re-assess on a set cadence and whenever something material changes.
What does the EU AI Act require?
For high-risk AI, Article 9 of the EU AI Act requires a continuous, documented risk-management system across the whole lifecycle: identifying and evaluating risks to health, safety and fundamental rights, adopting mitigations, and testing that they work.
Which frameworks can you use?
ISO/IEC 42001 embeds risk management in a certifiable management system; ISO/IEC 23894 gives AI-specific risk guidance built on ISO 31000; and the NIST AI RMF offers a widely used voluntary structure (Govern, Map, Measure, Manage). Pick one as your spine and stay consistent. See our AI risk management guide.
How do you build an AI risk register?
Start from your AI inventory. For each system, record the risks, an owner, the likelihood and impact, the mitigations, and the residual risk after controls. Keep it live and reviewed — it is what turns assessment into action and gives you auditable evidence.
Frequently asked questions
What is AI risk management?
The ongoing process of identifying, assessing, treating and monitoring the risks an organisation's AI systems create for people, the business and compliance.
Does the EU AI Act require AI risk management?
Yes — Article 9 requires a continuous, documented risk-management system for high-risk AI systems across their lifecycle.
What frameworks help with AI risk management?
ISO/IEC 42001, ISO/IEC 23894 and the NIST AI Risk Management Framework all provide structured, widely used approaches.
What is an AI risk register?
A live record of each AI system's risks, owners, likelihood, impact, mitigations and residual risk — the practical core of AI risk management.
How is AI risk management different from normal IT risk?
It adds AI-specific risks — bias, drift, opacity, data and fundamental-rights impacts — that traditional IT risk processes were not designed to catch.
Where do you start with AI risk management?
Build an AI inventory, then run a first risk assessment on your highest-risk and customer-facing systems.
Related pages
Sources
Last updated 19 June 2026.