Skip to content

Governance

Risk management: what AI regulations require

Risk tolerance, register, treatment and residual risk.

28 requirements · 12 regulations · 14 checks

Requirements by regulation

EUAI Act3

EX-003

Risk management Art. 9

EX-007

Transparency to deployers Art. 13

EX-032

GPAI obligations with systemic risk Art. 55

CoECoE Convention1

COE-16

Risk and impact management framework (HUDERIA) Art. 16

EUDORA1

DORA-05

ICT risk framework under the management body's responsibility Art. 5, 6

USNIST AI RMF11

GOVERN-1.3

Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization's risk tolerance. GOVERN

GOVERN-1.4

The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities. GOVERN

GOVERN-5.2

Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation. GOVERN

MAP-1.5

Organizational risk tolerances are determined and documented. MAP

MEASURE-1.1

Approaches and metrics for measurement of AI risks enumerated during the map function are selected for implementation starting with the most significant AI risks. The risks or trustworthiness characteristics that will not - or cannot - be measured are properly documented. MEASURE

MEASURE-3.1

Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts. MEASURE

MEASURE-3.2

Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available. MEASURE

MEASURE-4.1

Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented. MEASURE

MANAGE-1.2

Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods. MANAGE

MANAGE-1.3

Responses to the AI risks deemed high priority, as identified by the map function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting. MANAGE

MANAGE-2.1

Resources required to manage AI risks are taken into account - along with viable non-AI alternative systems, approaches, or methods - to reduce the magnitude or likelihood of potential impacts. MANAGE

COColorado AI Act1

CO-05

Risk management policy and programme §6-1-1703(2)

TXTRAIGA1

TX-04

Safe harbour: alignment with NIST AI RMF §552.105

CASB 531

SB53-01

Publish a frontier AI framework (thresholds, mitigations, governance, weight security) §22757.12(a)

BRPL 23383

BR-01

Preliminary assessment Arts. 12, 29

BR-16

Value-chain cooperation Arts. 18 §3, 32

BR-17

General-purpose and generative AI Arts. 29, 30

KRAI Basic Act3

KR-03

Self-assess whether the system is high-impact Art. 33

KR-04

High-impact measures: risk management, explainability, user protection, oversight, documentation Art. 34

KR-06

Safety of high-compute models Art. 32

JPAI Promotion Act1

JP-02

Common principles: human-centric, safety, fairness, privacy, security, transparency, accountability Guidelines, part 2

CNChina GenAI1

CN-02

Security assessment before public launch GenAI Art. 17

INTLISO 420011

ISO-6.1.2

AI risk assessment and treatment, Statement of Applicability Cl. 6.1.2, 6.1.3

Checks in this theme

Most shared first

Code	Check	Used by
VER-003-01	Documented and up-to-date risk register	AI Act CoE Convention ISO 42001 AI Basic Act NIST AI RMF Colorado AI Act
CHK-POL-RISK	An AI risk-management policy and process are established through transparent, documented controls	DORA ISO 42001 AI Promotion Act NIST AI RMF Colorado AI Act TRAIGA
VER-032-G-02	Systemic risks assessed and mitigation measures documented	AI Act PL 2338 AI Basic Act SB 53
VER-003-02	Residual risks communicated to deployers	AI Act PL 2338 Colorado AI Act
CHK-RISK-RESPONSE	Risk treatment is prioritized and high-priority responses are planned and documented	ISO 42001 NIST AI RMF
VER-003-03	Residual risks read and understood by the deployer	AI Act
VER-003-04	Complementary mitigation measures in place	AI Act
CHK-BR-PRELIM	Preliminary assessment carried out and kept on record	PL 2338
CHK-RISK-TOLERANCE	Risk tolerances are defined and AI systems are assigned to risk levels	NIST AI RMF
CHK-MEASURE-PLAN	Measurement approaches and metrics are selected and connected to context; unmeasured risks documented	NIST AI RMF
CHK-ALT	Required resources and viable non-AI alternatives are considered	NIST AI RMF
NEW-ISO42001-02	Annex A Statement of Applicability kept up to date	ISO 42001
NEW-US-CA-SB53-01	Frontier AI framework published and reviewed yearly	SB 53
NEW-CN-02	CAC security assessment completed	China GenAI

Related themes

Governance & accountability Inventory & categorisation Literacy & competence Quality & conformity

Run these requirements across all your AI systems

TrustFlow inventories your systems, qualifies them under each regulation and collects evidence once for every referential.