Risk · R-091 · Governance & Accountability
Undefined AI risk appetite
No statement exists of how much AI risk the organisation will accept, so approvals are inconsistent and nothing triggers escalation.
- Severity
- Medium
- Audience
- Board · Heads-of
- Frameworks
- Clause 6 · GOVERN 1 · Principle 2
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-10
What it is
Risk appetite is the board's statement of the amount and kind of risk it is willing to take in pursuit of its objectives, expressed with limits that can be measured. For AI it answers questions such as which uses are out of bounds, how much autonomy is acceptable in customer-facing decisions, and what level of error is tolerable where. Without it each approval is a fresh negotiation.
How it happens
- The existing appetite framework does not mention AI.
- Appetite is expressed in adjectives with no measures.
- The board has not discussed AI as a risk.
- Limits exist and are not connected to any reporting.
Why it matters
Decisions vary with who is asked. Nobody can say whether the organisation is inside or outside its tolerance, so nothing prompts escalation until an incident does. A stated appetite is also what gives the policy its force.
Warning signs
- Approvers cannot cite a limit they are applying.
- Similar proposals receive different answers.
- No AI measures appear in risk reporting to the board.
- Risk acceptances are made at working level.
Mitigating controls
Primary controls
- AI risk appetite statement and limits Directive
- Sets the appetite and measurable limits. The board approves a statement of the AI risk the organisation will accept, with measurable limits that trigger escalation when they are approached.
Supporting controls
- AI risk reporting to the board Detective
- Reports the position against those limits. Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| ISO/IEC 42001:2023 | Clause 6 | Planning & risk Risk criteria in planning. |
| NIST AI Risk Management Framework (AI RMF 1.0) | GOVERN 1 | Policies, processes and practices for AI risk are in place and effective Risk tolerance is set by governance. |
| SS1/23: Model Risk Management Principles for Banks | Principle 2 | Model risk governance Board-set model risk appetite. |
Sources
- SS1/23: Model Risk Management Principles for Banks Bank of England PRA · official text
- ISO/IEC 42001:2023 – AI management systems ISO/IEC · framework
- NIST AI Risk Management Framework (AI RMF 1.0) NIST · framework
Related terms
How to cite
Axiom Verity (2026). Undefined AI risk appetite. Reference Library, R-091. https://axiom-verity.com/risks/undefined-ai-risk-appetite. Reviewed 2026-11-10.
Found an error or a better source? Report a correction.