Control · C-051 · Strategy & Risk Appetite
AI risk appetite statement and limits
The board approves a statement of the AI risk the organisation will accept, with measurable limits that trigger escalation when they are approached.
- Control type
- Directive
- Family
- Risks addressed
- 4
- Audience
- Board · Heads-of
- Frameworks
- Clause 6 · GOVERN 1 · Principle 2
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it does
It turns the board's attitude to AI risk into something approvers can apply. The statement says which uses are out of bounds, how much autonomy is acceptable in which decisions, and what level of error, complaint or incident is tolerable, each with a measure and a limit. The board owns it; the chief risk officer maintains it. It is set before significant AI use and reviewed at least once a year.
How to implement it
- Draft the statement from the organisation's existing risk appetite framework, so AI is a part of it and not a rival to it.
- State prohibited uses, and uses that need approval at a named level.
- Set measurable limits, such as the share of high-tier systems overdue for review.
- Give each limit an early-warning level and an owner.
- Connect the limits to the reporting the board receives.
- Review after any serious incident and at each annual cycle.
Evidence it operates
Design: a board-approved statement with measures and limits. Operation: reporting that shows the position against each limit; minutes recording a breach or near-breach and the decision taken; evidence that an approval was refused or escalated by reference to the statement.
Where it fits
Set at the top, before individual systems are considered. It is the primary control for undefined AI risk appetite, gives the AI policy its force, and is reported against through AI risk reporting to the board. The AI risk appetite statement template is a starting point.
Limits
A statement made of adjectives constrains nothing, and limits that are never approached were probably set too loosely. Appetite expressed for the organisation as a whole still has to be translated for each business area. It records the board's intention and does not by itself change what teams do.
Risks this mitigates
Primary mappings
- Undefined AI risk appetite Medium
- Sets the appetite and measurable limits. No statement exists of how much AI risk the organisation will accept, so approvals are inconsistent and nothing triggers escalation.
Supporting mappings
- Environmental footprint of AI Medium
- Sets the limits and commitments the footprint is judged against. The energy, water and hardware that training and running AI require conflict with the organisation's environmental commitments, or go unmeasured and undisclosed.
- No documented AI policy High
- States how much risk the policy is meant to keep within. The organisation uses AI without a policy, approved by top management, that states what is permitted, what is required and who decides.
- Workforce displacement and job quality Medium
- Sets the organisation's stance on workforce impact. AI deployment removes roles or makes the remaining work worse, without assessment, involvement of the people affected or a plan for transition.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| ISO/IEC 42001:2023 | Clause 6 | Planning & risk Risk criteria. |
| NIST AI Risk Management Framework (AI RMF 1.0) | GOVERN 1 | Policies, processes and practices for AI risk are in place and effective Risk tolerance. |
| SS1/23: Model Risk Management Principles for Banks | Principle 2 | Model risk governance Board-set appetite. |
Related terms
How to cite
Axiom Verity (2026). AI risk appetite statement and limits. Reference Library, C-051. https://axiom-verity.com/controls/ai-risk-appetite-statement. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.