AI TRiSM (AI Trust, Risk and Security Management)

One analyst's name for the whole discipline

AI TRiSM stands for AI Trust, Risk and Security Management. Gartner coined it and has listed it among its top strategic technology trends since 2023. It is not a standard, a framework you can be certified against, or a regulation. It is a category label for the set of practices and products that keep an AI system doing what it was approved to do once it is running, and a vocabulary for talking to vendors who sell into that category.

That matters for how to use the term. A board paper that says the organisation "has AI TRiSM" has said less than one that says it has an AI acceptable use policy, monitoring and logging on every production model, and output validation on every model that touches a customer. The category is useful for scoping a procurement conversation. The controls are what an auditor will ask to see.

What it covers

Gartner has described the category in more than one way since it introduced the term, which is one reason a search for the "core TRiSM terms" returns inconsistent answers, and its current material is behind a subscription. What is stable across the descriptions is the ground the category claims: four areas, all of them about a system that is already running rather than one being approved.

• Governance of the system. Policy, ownership, inventory, and the approval path a system goes through before and after deployment. On this site that is the governance framework entry and the ownership and accountability control.
• Inspection and enforcement at runtime. Checking inputs and outputs while the system is live: prompt-injection detection, content filtering, policy enforcement at the point of use. The register's output validation guardrails and system prompt hardening sit here.
• Governance of the information the system sees. What data the model can retrieve and reveal, and on what lawful basis. Data minimisation and lawful basis review and vector store access controls.
• The stack underneath. The supply chain of models, weights, dependencies and hosting. Third-party model due diligence and model artefact signing.

None of these areas is new. What the label adds is the insistence that they be run together, on live systems, rather than as a pre-deployment review that is never repeated. For the exact current wording of the pillars, go to Gartner; this entry does not reproduce it.

TRiSM vocabulary, mapped to this glossary

The terms that recur in TRiSM material, and where each is defined on this site.

• Trust, in this usage, is the aggregate of explainability, model interpretability, transparency and fairness, evidenced rather than asserted.
• Risk is the register: what can go wrong, mapped to the controls that reduce it. The AI risk register is the site's version, with risk appetite as the threshold-setting mechanism above it.
• Security covers the LLM-specific attack surface: prompt injection, jailbreak, data poisoning and adversarial attack.
• ModelOps is the operational lifecycle: model deployment, model versioning, model monitoring and the detection of model drift.
• Runtime enforcement is what a guardrail does: the control, not the concept, at output validation guardrails.
• AI application security is the OWASP LLM Top 10 by another name; the register maps every relevant risk to its 2026 clause.

If a vendor uses a TRiSM term that is not on this list, ask which control it corresponds to. If they cannot say, it is a feature name, not a control.

What the label does not give you

It is not evidence. Buying a product in the TRiSM category does not discharge any obligation. The EU AI Act, ISO/IEC 42001 and the PRA do not recognise the term; they recognise controls, records and named owners.

It is vendor-shaped. The category was defined by the analyst firm that rates the vendors in it, and its boundaries move with the market. A governance programme built on the category's shape will be reorganised every time the category is.

It does not set appetite. TRiSM describes how to keep a system within bounds. It says nothing about where the bounds should be, which is the board's job and the subject of setting an AI risk appetite.

Used with those limits understood, it is a reasonable shorthand for a procurement conversation and a poor foundation for a governance one.

Where it sits in the register

The category exists because of two register entries. AI lifecycle controls gap is the failure TRiSM's "run it together, on live systems" insistence is aimed at: controls that exist at approval and lapse in operation. Unclear AI ownership and accountability is what a category label cannot fix and a control can: the ownership and accountability framework names who runs each layer. AI system monitoring and logging is the control that turns runtime inspection from a product feature into a record.