AI Risk Management

Risk depends on context: a plausible incorrect sentence has different consequences in a creative draft, a maintenance instruction or an automated action. AI risk management considers the model, data, tools, deployment and human response as one system. NIST's AI Risk Management Framework organizes work through Govern, Map, Measure and Manage functions. This is distinct from a single safety filter or model evaluation. Evaluations provide evidence about selected behavior; risk management determines its significance, responsibilities and response. It also separates a known control from an untested assumption that the control will work.

The practitioner maps intended use and affected parties, identifies plausible failure pathways and records impact and uncertainty. They assign owners, select preventive or detective controls and test whether those controls interrupt the relevant pathway. They define escalation, monitoring and review conditions, preserving a record of decisions and residual risk. Useful work produces a living risk register and response plan connected to actual system behavior, including clear authority to restrict or stop a capability when evidence changes.

A register can become paperwork if controls are not implemented or reviewed. Likelihood estimates may be uncertain, and rare failures can escape routine evaluation. Content filtering addresses only part of the system's risk. Check control effectiveness, owner authority and escalation behavior. Risk management cannot promise the absence of harm; it supports explicit, revisable decisions about a defined use and the evidence available to its accountable operators.