AI Governance Engineer
GitHub

Risk management

By Updated

The organised practice of steering an organisation's decisions with its risks in view 1: identify, assess, treat and monitor, in a loop. For high-risk systems the AI Act requires a documented risk management system across the lifecycle 2.

Developed in
ch. 13, The loop: identify, assess, treat, monitor
Chapters
ch. 13, Risk Management
Contrast with
Model risk management
Source
2 numbered references, listed below

Where it is used

16 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Risk management: mentions per chapter68 mentions of the term across 16 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter01 Definition: 5 mentions01 Definition502 Why Now: 1 mention02 Why Now104 The Stack: 1 mention04 The Stack106 The Role: 1 mention06 The Role107 Maturity Model: 1 mention07 Maturity Model108 Regulatory Map: 10 mentions08 Regulatory Map1010 Reading List: 4 mentions10 Reading List411 AI Defined: 2 mentions11 AI Defined212 Governance Program: 1 mention12 Governance Program113 Risk Management: 15 mentions13 Risk Management1514 Development: 3 mentions14 Development316 Fairness & XAI: 2 mentions16 Fairness & XAI217 Incidents: 1 mention17 Incidents118 EU AI Act: 2 mentions18 EU AI Act221 AI Laws Worldwide: 11 mentions21 AI Laws Worldwide1122 Principles & Standards: 8 mentions22 Principles & Standards8No mentions in the other 7 chaptersSource: the Body of Knowledgev0.5.0
Risk management: mentions per chapter68 mentions of the term across 16 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter0001 Definition: 5 mentions50102 Why Now: 1 mention1020304 The Stack: 1 mention1040506 The Role: 1 mention10607 Maturity Model: 1 mention10708 Regulatory Map: 10 mentions100810 Reading List: 4 mentions41011 AI Defined: 2 mentions21112 Governance Program: 1 mention11213 Risk Management: 15 mentions151314 Development: 3 mentions3141516 Fairness & XAI: 2 mentions21617 Incidents: 1 mention11718 EU AI Act: 2 mentions218192021 AI Laws Worldwide: 11 mentions112122 Principles & Standards: 8 mentions82223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Risk management per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition5No
02 Why Now1No
03 Values & Principles0No
04 The Stack1No
05 Patterns0No
06 The Role1No
07 Maturity Model1No
08 Regulatory Map10No
10 Reading List4No
11 AI Defined2No
12 Governance Program1No
13 Risk Management15Yes
14 Development3No
15 Deployment0No
16 Fairness & XAI2No
17 Incidents1No
18 EU AI Act2No
19 Privacy & AI0No
20 Existing Law0No
21 AI Laws Worldwide11No
22 Principles & Standards8No
23 AI Agents0No
Risk management: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastRisk managementRelated terms (6)AI Act (EU) · RelatedAI Act (EU)AI RMF functions · RelatedAI RMF functionsCEN-CENELEC JTC 21 · RelatedCEN-CENELEC JTC 21NIST AI RMF · RelatedNIST AI RMFRisk register · RelatedRisk registerTechnical documentation (Annex IV) · RelatedTechnical documentationContrast with (1)Model risk management · ContrastModel risk management
Risk management: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastRelated terms (6)AI Act (EU) · RelatedAI Act (EU)AI RMF functions · RelatedAI RMF functionsCEN-CENELEC JTC 21 · RelatedCEN-CENELEC JTC 21NIST AI RMF · RelatedNIST AI RMFRisk register · RelatedRisk registerTechnical documentation (Annex IV) · RelatedTechnical documentationContrast with (1)Model risk management · ContrastModel risk managementRiskmanagement
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Risk management
FamilyItemRelation
Related termsAI Act (EU)Related
Related termsAI RMF functionsRelated
Related termsCEN-CENELEC JTC 21Related
Related termsNIST AI RMFRelated
Related termsRisk registerRelated
Related termsTechnical documentation (Annex IV)Related
Contrast withModel risk managementContrast
  • Technical documentation (Annex IV)

    The provider's technical file for a high-risk AI system, drawn up before placing on the market and kept up to date under Article 11: description, development…

  • CEN-CENELEC JTC 21

    The joint technical committee of the European standardisation organisations CEN and CENELEC that drafts the AI Act harmonised standards, including EN 18286 on…

  • AI RMF functions

    The four core functions of the NIST AI Risk Management Framework (Govern, Map, Measure, Manage), used throughout the book as a mapping target for controls.

  • Risk register

    The evidence record of the risk loop: one versioned file per risk, keyed to a registry id, with ratings, treatment, controls that resolve to evidence, owner…

  • AI Act (EU)

    Regulation (EU) 2024/1689, the EU's horizontal, risk-tiered law for AI, amended by the Digital Omnibus.

  • NIST AI RMF

    The NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1, January 2023): voluntary guidance organised as a Core of four functions…

Sources

  1. [1] ISO 31073:2022, Risk management: Vocabulary (replaced ISO Guide 73:2009, withdrawn; referenced by identifier only). ISO/TC 262. 2022-02. https://www.iso.org/standard/79637.html (verified: primary)
  2. [2] Regulation (EU) 2024/1689 (AI Act), consolidated text as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 Jul 2026; definitions in Art. 3, incl. 3(1), 3(3) to 3(14), 3(14b), 3(20), 3(22), 3(23), 3(29) to 3(32), 3(49), 3(55) to 3(57), 3(60), 3(61), 3(63), 3(68); Arts. 4, 5, 6 (incl. 6(3) third subparagraph, profiling), 9, 10, 11, 13, 14, 15, 17, 22 to 27 (incl. 26(11)), 40, 41, 43, 47, 48, 50, 53 (incl. 53(1)(c)), 55, 57, 60, 72, 73, 86; Annexes I, III, IV). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Risk management. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/risk-management. CC BY 4.0

BibTeX

@misc{aige2026riskmanagement,
  author  = {Jorge García Aibar},
  title   = {{Risk management}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/risk-management}
}