title: “Risk Acceptance” description: “Governance of residual AI risk and controlled risk acceptance decisions within the AIGO lifecycle.”
Risk Acceptance
Risk acceptance provides a formal governance mechanism for deciding whether residual AI risk can be accepted under defined conditions. Risk acceptance does not mean that a risk is eliminated or that the underlying risk no longer exists. It is a documented governance decision that the remaining risk is acceptable to the authorized decision-maker within a defined context, subject to applicable requirements, conditions, and review. Within AIGO, risk acceptance connects risk assessment, control effectiveness, governance authority, approval, monitoring, and continual review.Purpose
AI systems may retain residual risk even after reasonable controls and treatments have been implemented. Organizations therefore need a controlled process for deciding: * whether residual risk can be accepted * who has authority to accept it * what evidence supports the decision * what conditions apply * how long the acceptance remains valid * when the decision must be reviewed * what monitoring is required * what events invalidate or trigger reassessment of the acceptance Risk acceptance should be treated as a governance decision rather than an informal acknowledgement of risk.Residual risk
Residual risk is the risk that remains after applicable risk treatment and controls have been considered or implemented. A representative relationship is: inherent risk → risk treatment → controls → residual risk → acceptance decision Risk acceptance should therefore normally occur after sufficient risk assessment and treatment activity has taken place. Acceptance should not be used as a substitute for implementing reasonably appropriate controls or addressing known governance deficiencies.When risk acceptance may be appropriate
Risk acceptance may be appropriate where: * reasonable risk treatment has been implemented * further treatment is disproportionate or impractical * the remaining risk is understood * the applicable decision authority permits acceptance * applicable requirements allow acceptance * sufficient evidence supports the decision * conditions and limitations are defined * appropriate monitoring is established Whether a risk may be accepted depends on the organization’s governance model and applicable requirements. Some risks or obligations may not be capable of being waived simply through organizational risk acceptance.When risk acceptance should not be used
Risk acceptance should not be used to: * bypass mandatory legal or regulatory requirements * conceal unresolved governance deficiencies * avoid required controls * replace required approval * ignore significant evidence * avoid incident response * indefinitely defer remediation * override requirements that the decision-maker does not have authority to waive Where a risk cannot legitimately be accepted, the organization should follow the applicable escalation, remediation, restriction, suspension, or other governance process.Acceptance authority
Risk acceptance should be made by an authorized decision-maker. Authority should be determined according to factors such as: * organizational governance structure * risk level * AI system classification * business impact * stakeholder impact * applicable requirements * delegated authority * financial or operational significance * regulatory significance The person accepting the risk should have sufficient authority and accountability for the decision. Acceptance authority should not be inferred solely from technical ownership of the AI system.Acceptance criteria
Organizations should establish criteria for determining when residual risk may be accepted. Criteria may include: * residual risk rating * control effectiveness * remaining exposure * available treatment options * cost and feasibility of additional treatment * affected stakeholders * business justification * operational necessity * applicable requirements * assurance findings * monitoring capability * time limitation * required approval authority Criteria should be documented so that similar decisions can be evaluated consistently.Risk acceptance workflow
A practical AIGO risk acceptance workflow is: 1. Identify the residual risk 2. Confirm risk assessment 3. Review risk treatment 4. Evaluate applicable controls 5. Determine whether further treatment is required 6. Determine acceptance eligibility 7. Identify the authorized decision-maker 8. Prepare the acceptance decision 9. Define conditions and limitations 10. Approve the acceptance 11. Record supporting evidence 12. Monitor the accepted risk 13. Review or renew the acceptance 14. Close, modify, or revoke the acceptance when required The workflow should be proportionate to the significance of the risk.1. Identify the residual risk
The organization should identify the specific risk being considered for acceptance. The risk record should identify, as applicable: * affected AI system * risk identity * risk description * risk source * affected stakeholders * potential impact * likelihood * severity * existing controls * treatment activities * residual risk The acceptance decision should refer to the specific risk record rather than describing the risk only in general terms.2. Confirm risk assessment
Before accepting residual risk, the organization should confirm that the underlying risk assessment remains appropriate. The assessment should consider whether: * the risk description remains accurate * likelihood remains appropriate * impact remains appropriate * assumptions remain valid * relevant stakeholders have been considered * new information has emerged * applicable requirements have changed * known incidents affect the assessment If the assessment is no longer current, it should be updated before the acceptance decision. See Risk Assessment.3. Review risk treatment
The organization should determine what treatment has already been applied. Treatment may include: * reducing the risk * modifying the AI system * changing intended use * implementing controls * adding human oversight * restricting deployment * changing operating conditions * transferring certain risks where appropriate * avoiding the activity The organization should document why additional treatment is or is not required.4. Evaluate applicable controls
The decision-maker should have sufficient information about the controls addressing the risk. This may include: * applicable controls * implementation status * control effectiveness * control assessment results * deficiencies * supporting evidence * remediation status A risk should not be accepted merely because controls are listed as existing. The organization should consider whether the controls are actually implemented and operating as intended. See Control Assessment.5. Determine whether further treatment is required
Before acceptance, the organization should consider whether additional treatment is reasonably necessary. Potential actions include: * implementing additional controls * strengthening existing controls * restricting system use * changing deployment conditions * improving monitoring * obtaining additional assurance * changing the system * changing the intended use * reducing exposure * delaying deployment If additional treatment is required before acceptance, the acceptance decision should identify the required actions and their owners.6. Determine acceptance eligibility
Not every residual risk should automatically be eligible for acceptance. The organization should determine whether: * the risk is within the decision-maker’s authority * applicable requirements permit acceptance * required controls are in place * necessary evidence exists * required assurance has been completed * required stakeholders have been considered * acceptance criteria are satisfied Where acceptance is not permitted, the risk should follow the appropriate governance path instead.7. Identify the authorized decision-maker
The acceptance record should identify the person or governance body authorized to make the decision. The decision-maker should have: * appropriate authority * sufficient information * appropriate accountability * visibility into relevant risks and consequences Where organizational governance requires multiple approvals, all required decision authorities should be identified.8. Prepare the acceptance decision
The acceptance request should provide sufficient information for an informed decision. It may include: * AI system * risk * residual risk * risk treatment * applicable controls * control effectiveness * evidence * affected stakeholders * business or operational justification * applicable requirements * available alternatives * proposed conditions * monitoring requirements * proposed acceptance period The objective is to make the basis for the decision transparent and reviewable.9. Define conditions and limitations
Risk acceptance may be unconditional or conditional depending on the governance context. Conditions may include: * additional controls * restricted use * deployment limitations * enhanced monitoring * additional evidence * remediation actions * review dates * assurance requirements * incident escalation requirements * change-management requirements Conditions should be specific enough to be monitored and evaluated.10. Approve the acceptance
The authorized decision-maker should formally approve or reject the acceptance request. Possible outcomes include: * accepted * accepted with conditions * rejected * deferred pending additional information * returned for additional risk treatment The decision should be recorded with the date, decision authority, rationale, and applicable conditions. Risk acceptance should not be inferred merely from continued operation of the AI system.11. Record supporting evidence
The acceptance decision should be supported by appropriate evidence. Evidence may include: * risk assessment * control assessments * test results * monitoring results * assurance findings * business justification * stakeholder analysis * applicable requirements analysis * remediation records * approval records The evidence should be linked to the acceptance record where possible.Decision traceability
AIGO emphasizes traceability between governance decisions and the information supporting them. A representative relationship is: AI system → risk → treatment → controls → evidence → residual risk → acceptance decision → monitoring This allows the organization to reconstruct why a risk was accepted and determine whether the underlying conditions remain valid.Acceptance period
Risk acceptance should have an appropriate validity period where practicable. The period may depend on: * risk level * system criticality * rate of change * control maturity * monitoring capability * organizational policy * applicable requirements * expected changes Long-lived acceptance decisions should be subject to periodic review. An acceptance should not be treated as permanently valid simply because the original decision remains documented.Monitoring accepted risk
Accepted risks should remain subject to appropriate monitoring. Monitoring may consider: * changes in risk exposure * control performance * incidents * system changes * stakeholder impact * new evidence * emerging risks * changes in applicable requirements Monitoring results may trigger reassessment or revocation of the acceptance. See AI Monitoring.Events that trigger review
A risk acceptance should be reviewed when material conditions change. Triggers may include: * changes to the AI system * changes to intended use * changes to deployment context * material changes in risk * control failures * significant incidents * new evidence * assurance findings * changes in affected stakeholders * changes in applicable requirements * expiration of the acceptance period * changes to organizational risk criteria A review trigger does not necessarily mean the acceptance must be revoked. It means the organization should determine whether the original decision remains appropriate.Revocation or modification
An acceptance may need to be: * renewed * modified * suspended * revoked * replaced by a new decision Revocation or modification may be appropriate where: * residual risk increases materially * controls become ineffective * acceptance conditions are not satisfied * new requirements prohibit the activity * a significant incident occurs * the AI system materially changes * assumptions supporting the decision become invalid The resulting decision should maintain traceability to the original acceptance.Relationship to approval
Risk acceptance and AI governance approval are related but distinct. Risk acceptance concerns whether specified residual risk is accepted by an authorized decision-maker. Governance approval authorizes a defined system, activity, or lifecycle decision according to the organization’s governance model. An approval may depend on risk acceptance, and a risk acceptance may require approval. The organization should define how these decisions interact. See AI Governance Approval.Relationship to change management
Material changes may invalidate or require review of an existing risk acceptance. For example, changes to: * system capabilities * intended use * deployment environment * affected stakeholders * data * controls * operating conditions may alter the underlying risk. Change management should therefore identify whether existing risk acceptances remain valid. See AI Change Management.Relationship to incident management
A significant incident may demonstrate that assumptions underlying an accepted risk are no longer valid. Incident management may therefore trigger: * risk reassessment * review of the acceptance * additional controls * temporary restriction * suspension * revocation * additional assurance See AI Incident Management.Relationship to assurance
Assurance may evaluate whether risk acceptance processes are appropriately designed and consistently applied. Assurance may examine: * acceptance authority * decision criteria * supporting evidence * control effectiveness * acceptance conditions * monitoring * review frequency * expired acceptances * remediation * decision traceability See AI Governance Assurance.Machine-readable representation
AIGO provides a machine-readable governance structure for representing risk information and its relationships to other governed records. The risk acceptance decision may be associated with: * AI system * risk * controls * assessments * evidence * approval * monitoring * assurance * changes * incidents The canonical risk structure is:schemas/02-risk/02-AIGO-Risk-Schema-v0.1.json
Where the implementation requires a distinct acceptance record, the organization should follow the applicable AIGO schema and governance architecture rather than creating an incompatible parallel representation.
Acceptance artifacts
A practical risk acceptance implementation may produce: 1. residual risk assessment 2. risk treatment review 3. control assessment 4. acceptance request 5. decision authority record 6. acceptance decision 7. conditions and limitations 8. supporting evidence 9. monitoring requirements 10. review date 11. review records 12. modification or revocation records where applicable Organizations may combine artifacts where appropriate, provided that required traceability is maintained.Implementation resources
The canonical procedure is:guidance/02-procedures/11-AIGO-AI-Risk-Acceptance-Procedure-v0.1.md
The relevant risk structure is:
schemas/02-risk/02-AIGO-Risk-Schema-v0.1.json
The implementation should also use the applicable approval, evidence, monitoring, and assurance resources where those activities are required.