Who Is Allowed to Accept AI Risk?

THE QUESTION NOBODY REHEARSES

Every AI governance program can produce a risk register. Far fewer can answer the follow-up: who was entitled to accept this risk, and how do you know? That question arrives from a board member, an auditor, or a regulator — and a name typed into a spreadsheet cell is not an answer.

RISK ACCEPTANCE IS AN AUTHORITY, NOT A SIGNATURE

Accepting leftover risk commits the organization. Treat it as a delegated power with limits:

Define it by residual risk level: A low residual risk can stop with the system owner. A high residual risk belongs to an executive or the governance council. Set the threshold once, in writing.

Separate it from approval: The person who approves an AI use case is not automatically the person who may accept the risk it leaves behind. Splitting the two keeps one enthusiastic sponsor from clearing their own path.

Bound delegation: Delegation is useful and dangerous. Cap what a delegate may accept, and put an end date on the delegation.

Enforce separation of duties: The author of a control assessment should not be the sole approver of the risk that assessment measures.

MAKE THE RULE PICK THE APPROVER

A written policy that names approvers is only as good as the memory of whoever routes the work. Generate approval routes from the authority model instead, so the right approver is selected by the rule rather than recalled by a person. When a use case, AI system, control, or policy version moves to approval, the route is derived from role, asset type, and residual risk level.

Preview before you publish: Changing who may approve what changes every route that follows. Show the impact of an authority change before it takes effect.

PLAN FOR THE SATURDAY DECISION

Something will need a decision outside normal hours. The answer is not an informal exception; it is time-bounded emergency authority.

Grant it to a named person: Emergency powers belong to someone specific, on a visible countdown.

Let it expire on its own: Temporary authority that requires someone to remember to revoke it is permanent authority.

Review it afterwards: A retrospective review closes the loop and turns an urgent decision into a defensible one.

RECORD THE NO, NOT JUST THE YES

Examiners increasingly ask what you turned down. A program that can only show approvals looks like a rubber stamp. Record refusals with the same rigor — the request, the authority, the reason, the date — and the record starts working for you.

WHAT GOOD LOOKS LIKE

An authority matrix: Who may approve what, and who may accept residual risk at each level. Generated routes: Approvals that follow the matrix automatically. A decision register: Approvals, refusals, and the authority behind each. Bounded exceptions: Waivers with owners and expiry dates. An exportable bundle: Councils, decisions, exceptions, and the authority model in one pack.

RAIC ships all five as working software in Governance Operations & Decision Rights.

NEXT STEPS

Start a free trial: raic.rhindoncyber.com/pricing
Book a demo: raic.rhindoncyber.com/demo
Partner and MSP inquiries: [email protected]