AI Risk Management and Classification as Code

All courses / AI Governance / Module 3 / Chapter 8

Learning objectives

After the lesson the participant can:

• Classify a use case with the six-step decision tree, citing the article behind every answer.
• Explain why the profiling question is asked separately from the Article 6(3) derogation.
• Draft a risk register entry that links a hazard to controls, assessments, an owner and review triggers.
• Describe how a versioned risk appetite statement becomes the threshold a deployment gate enforces.

Key concepts

Classification decision tree

Six questions in order: is it an AI system under Article 3(1), is it a prohibited practice under Article 5, is it high-risk under Article 6, does the Article 6(3) derogation apply, do Article 50 transparency duties apply, and is the organisation provider or deployer.

AI Decision Record

A version-controlled record, kept for every AI system, that states its intended purpose, user population, data, model, usage mode and the organisation's role, and that changes through reviewed commits. It serves as the use-case descriptor the policy evaluates.

Excluded uses

The list in a descriptor of uses the system must not be put to. Naming them makes drifting into them a visible change of intended purpose, which re-runs the classification.

Risk register as code

Each entry is a YAML document validated against a schema, reviewed through a pull request and linked by identifier to system, controls, evidence and assessments. Its review triggers name the events that force re-evaluation, and a stale entry counts as an open risk.

Risk appetite as data

The board-level declaration of acceptable risk expressed as rules per tier, with required assessments and a maximum residual rating. Versioned, it shows the appetite in force when a system was approved and lists the systems that no longer fit when it tightens.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Teams often describe a system as only prioritising. Why does the chapter treat that description with suspicion, and which of your systems would it apply to?
2. The substantial-modification rule does not decide that a change is substantial; it decides that a human must make the judgement. What is gained by drawing the line between machine and legal judgement there?
3. No committee meets at deployment, because its work happened when it approved the policy, the appetite and the legal interpretation. What would your risk committee have to give up, and what would it gain, to work that way?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. In Nordvik Region's questionnaire for the benefits-triage system, why can the Article 6(3) derogation not apply?

   1. Because the Region is a body governed by public law
   2. Because the system profiles natural persons, which excludes every derogation ground
   3. Because the supplier, as provider, would have to document the derogation and register the system
   4. Because the system interacts directly with applicants
   Show the answer

   B. Because the system profiles natural persons, which excludes every derogation ground
   The derogation never applies where the system profiles natural persons. Q6 is asked separately because this is the answer most often missed when a team describes its system as only prioritising.

2. How does the chapter implement the requirement in Article 9 for regular review of risks?

   1. As an annual workshop with the risk committee and the system owner, minuted in the register
   2. As a quarterly report from the model provider to the deployer
   3. As a review by legal counsel at each contract renewal
   4. As triggered review: a commit that changes model, data or purpose re-opens the entries
   Show the answer

   D. As triggered review: a commit that changes model, data or purpose re-opens the entries
   In an Architecture as Code practice, regular is implemented as triggered. The pipeline downgrades the entry to review required, assigns it to the owner and blocks promotion until the residual rating is reaffirmed or revised.

3. What does the gate do with a register entry whose last review date plus review period has passed?

   1. It treats the stale entry as an open risk
   2. It deletes the entry and asks the owner to file a new one
   3. It lowers the residual rating by one level until reviewed
   4. It ignores the entry, since the classification is unchanged
   Show the answer

   A. It treats the stale entry as an open risk
   An entry past its review period is stale, and the gate treats stale entries as open risks. This mirrors the drift detection that Architecture as Code applies to infrastructure.