AI RISK ENGINEERING

Govern risk.
As part of the system.

Risk is not a compliance appendix. It is an operating layer spanning ownership, data, permissions, evaluation, monitoring, human control and recovery.

REVIEWED SEP 06, 2026PRACTITIONER-LED

GOVERNMAPMEASUREMANAGE

PRODUCTION READINESS

Can this system safely move beyond pilot?

Score operating evidence from 0 absent to 3 tested with evidence. This is a review aid, not a certification.

8/ 24PILOT ONLY

Named business + technical ownersRepresentative evaluation datasetIdentity, permissions + data controlsTracing, logging + monitoringHuman escalation + approval pathsRollback, revocation + incident responseLatency, cost + capacity targetsChange management + review cadence

NIST-ALIGNED LIFECYCLE

Govern

Ownership, policy, acceptable use, escalation and decision rights.

Map

Users, data, dependencies, impacts and consequence of failure.

Measure

Validity, reliability, security, privacy, fairness and oversight.

Manage

Prioritize controls, monitor residual risk and change or stop the system.

NIST AI RMF resources ↗

TRUSTWORTHINESS CHECK

Eight questions every AI system should be able to answer.

ValidityDoes it perform under realistic conditions?SafetyCan failure cause material harm?SecurityCan users, data or tools be manipulated?PrivacyIs data use and retention appropriate?AccountabilityWho owns outcomes and incidents?TransparencyCan users understand AI involvement?FairnessAre impacts evaluated across relevant groups?Human oversightCan people review, interrupt and correct?