Risk Governance
Create an AI risk governance loop with ownership, scoring, approval, and review.
Written and reviewed by Eric Han · Co-founder & CTO, reopt
Key takeaways
- Risk governance turns AI uncertainty into decisions about which systems can ship, which controls are mandatory, and which residual risks leadership accepts.
- Maintain governance artifacts: AI system register, risk register, control catalog, approval record, and a review cadence.
- Score risk across data sensitivity, user impact, autonomy, external exposure, and reversibility.
- No high-risk AI feature should ship without a named owner, documented controls, residual risk decision, monitoring plan, and incident contact.
Internal scores and legal classification
Scoring dimensions and thresholds are internal prioritization examples. A low score does not exclude a prohibited or legally high-risk use. Classify EU high-risk and Korean high-impact uses under their respective legal criteria.
EU AI Act dates as of October 23, 2026
The AI Omnibus entered into force on July 27, 2026; its changes are no longer only a proposal.
| Date | Scope |
|---|---|
| February 2, 2025 | Article 5 prohibitions began applying |
| August 2, 2025 | GPAI model rules began applying; track transition provisions separately |
| July 27, 2026 | Omnibus simplifies company AI literacy requirements and strengthens Commission/Member State promotion |
| August 2, 2026 | Article 50 transparency obligations apply |
| December 2, 2026 | Limited Article 50(2) grace period ends for systems placed on the market before August 2 |
| December 2, 2027 | Annex III high-risk AI rules apply |
| August 2, 2028 | Annex I product-embedded high-risk AI rules apply |
Article 4 literacy is distinct from Article 5 prohibitions. Keep training as an operational control while reassessing the amended legal requirement. Postponing high-risk rules does not postpone Article 50.
AI Omnibus entry into force · Article 50 FAQ
Risk governance turns AI uncertainty into decisions. It gives teams a way to decide which systems can ship, which controls are mandatory, and which residual risks leadership accepts.
Governance Artifacts
| Artifact | Purpose |
|---|---|
| AI system register | Inventory AI features, models, tools, and owners |
| Risk register | Track risk, likelihood, impact, owner, and status |
| Control catalog | Define required controls for each risk class |
| Approval record | Show who accepted risk and under what condition |
| Review cadence | Reassess risk after incidents, changes, or quarterly review |
Risk Scoring
| Dimension | Question |
|---|---|
| Data sensitivity | What data can the system access or infer? |
| User impact | Can output affect rights, money, safety, or employment? |
| Autonomy | Can the system take actions without human approval? |
| External exposure | Can untrusted users influence prompts or inputs? |
| Reversibility | Can wrong actions be undone quickly? |
Operating Rule
No high-risk AI feature should ship without a named owner, documented controls, residual risk decision, monitoring plan, and incident contact.