AI Risk Appetite Framework: Boundaries, Tolerances, and Escalation

An appetite statement should begin with business context and affected stakeholders, then describe boundaries in decision language. Some conditions may be categorically unacceptable, such as an agent making irreversible high-value payments without authorization. Others may be acceptable only with verified controls, constrained users, monitoring, and a defined fallback. Tolerances make the boundary operational by identifying measurable conditions that trigger review or escalation.

Use multiple exposure dimensions instead of averaging fundamentally different consequences. Consider severity, scale, duration, reversibility, affected groups, decision consequence, data sensitivity, privilege, autonomy, supplier dependency, detectability, control evidence, and uncertainty. Define which dimensions can be traded off and which act as hard stops or mandatory escalation triggers.

For each material scenario, compare inherent and residual exposure with the relevant appetite dimension. State the evidence supporting control reliance, information gaps, confidence, dependencies, and whether exposure could aggregate across systems or suppliers. The risk owner recommends treatment, but acceptance authority should follow approved delegation and remain independent of the team seeking deployment where consequence warrants challenge.

A tolerance breach is a governance event, not merely a red dashboard cell. Define immediate containment, notification, investigation, decision authority, interim safeguards, time to resolution, and evidence required to return within tolerance. Repeated near-breaches may justify a lower limit, stronger monitoring, or a portfolio-level response even when no single event crosses the threshold.

Thresholds should be observable, attributable, and connected to an authorized response. Useful measures may include affected population, transaction value, decision consequence, sensitive-data volume, privileged access, output error, harmful outcome, override, complaint, incident, control failure, service concentration, recovery time, or unresolved uncertainty. Define the source, calculation, frequency, owner, exclusions, and action before using a number as a tolerance. A percentage without a reliable denominator can create false precision.

Combine quantitative limits with qualitative hard stops. A system may remain below an error-rate tolerance yet produce one unacceptable discriminatory, unsafe, fraudulent, or irreversible outcome. Conversely, a breached operational metric may not mean the use is outside enterprise appetite if the breach was detected, contained, and resolved within an approved recovery tolerance. The framework should say which conditions mandate suspension, which permit time-bound remediation, and which require senior interpretation.

Apply appetite at the scenario and portfolio levels. Several individually acceptable assistants may create an unacceptable concentration in one supplier, model provider, data pipeline, or business process. Common-mode failure, correlated misinformation, shared security dependencies, and simultaneous contract change are portfolio exposures. Inventory relationships and supplier mappings should therefore support aggregation rather than leaving every acceptance isolated.

When evidence is incomplete, distinguish exposure from confidence. Management can decide to restrict operation, gather evidence, use conservative assumptions, or accept uncertainty within delegated authority. It should not translate missing monitoring or untested controls into a lower residual score. Record the uncertainty, decision date, information required, interim safeguards, and trigger for reassessment.

Test proposed appetite statements against representative decisions before approval. Use one low-impact employee assistant, one consequential customer use, one supplier-dependent service, and one autonomous workflow. If different reviewers cannot reach a consistent route, the boundary may lack definitions, thresholds, or authority. Record the examples as interpretation aids without allowing them to replace assessment of the actual facts.

Appetite needs observable indicators and reliable populations. Link statements to risk-register scenarios, inventory attributes, control evidence, incidents, exceptions, and portfolio concentrations. Management reporting should distinguish exposure within appetite, conditional acceptance, temporary breach, unknown status, and outside-appetite operation rather than presenting a single average rating.

Review appetite at least on the enterprise risk cycle and after material strategic, portfolio, regulatory, incident, technology, or control changes. Preserve changes to definitions and thresholds so historical decisions remain interpretable. Where data quality is weak, report the uncertainty rather than treating missing exposure as within appetite.

Use an AI risk assessment to define the scenario and residual exposure before applying appetite.

Calibration of rating criteria belongs in the AI risk scoring framework.

Preserve scenario, controls, monitoring, and treatment in the AI risk register.

Where exposure is conditionally permitted, operate the AI risk acceptance workflow.