MBA AI Risk and Governance Concept Card Template

AI Risk and Governance Concept Card: [Your course, case or organisation]

A concept card for the governance of artificial intelligence as a general manager needs it: how the NIST AI Risk Management Framework 1.0 (January 2023) and its Generative AI Profile (NIST AI 600-1, July 2024), the AI management system standard ISO/IEC 42001:2023 and the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the "Digital Omnibus on AI") fit together; how to classify a use case; how to build and score an AI risk register; and how to put a cost on a risk so that controls can be prioritised. It is for MBA students in an AI for managers or ethics course and for managers who own AI systems. Worked example A is fully solved, Worked example B is half solved and Exercise C is left for you, with a separate answer key. Facts about laws and standards are dated October 2026; check the consolidated text and the official pages before relying on them. Fictional examples: Northfield Outdoor Co., Corvane Robotics, Tallow Creek Medical Center. Replace every [bracketed] value and every row marked Example. This is a learning aid, not legal advice.

Document control

Contents

• When to use it
• The idea in plain language
• Frameworks and law at a glance
• Formulas and notation
• Assumptions and limits
• How managers use it
• Worked example A (fully solved): Northfield contact-centre assistant
• Worked example B (half solved): Corvane spare-parts agent
• Exercise C (unsolved): Tallow Creek documentation assistant
• Decision diagram
• Governance templates in this library
• Connections to other cards
• Common mistakes and misconceptions
• Self-test questions
• My notes and next steps
• Sources and further reading
• Answer key
• Revision history
• Standard and licence note

When to use it

One-sentence rule: every AI system needs a named owner, a classification of what it may do and to whom, a scored risk register with controls, and evidence that the controls work, kept up to date for as long as the system runs.

The idea in plain language

Risk is the chance that an AI system causes harm, multiplied by how bad the harm would be. AI adds familiar risks (privacy, security, vendor failure) and some that are specific: confident but false outputs, unfair treatment of groups, behaviour that changes when data drift, manipulation through inputs (prompt injection), people trusting the system too much, and, with agents, actions taken at machine speed. Governance is the set of roles, policies and routines that decide which AI uses are allowed, who owns each system, how risks are assessed and accepted, and how problems are found and fixed. Risk management is one activity inside governance.

Three layers. Think of AI governance in three layers. Law sets binding duties that differ by jurisdiction and by your role (for example provider or deployer under the EU AI Act). Standards and frameworks describe good practice: some are voluntary guidance (NIST AI RMF), some can be certified by an auditor (ISO/IEC 42001). Internal policy turns both into rules for your firm: an acceptable use policy, an intake and approval process, a risk appetite, a register of systems. Managers live mostly in the third layer, but must know enough of the first two to ask the right questions.

The lifecycle view. Risk is not assessed once. It is assessed at intake (is this use allowed at all?), before launch (are the controls in place and tested?), and in operation (do monitoring and incident handling work?). Every material change to the model, data, tools or use triggers a reassessment.

Who is accountable. Accountability sits with a named business owner, not with "the data science team" or "the vendor". Buying an AI system does not transfer the risk: the deployer still answers for how it is used.

Frameworks and law at a glance

NIST AI RMF in one paragraph. Govern sets culture, policies, roles and accountability across the organisation. Map establishes the context of a specific system: purpose, users, people affected, benefits and risks. Measure assesses and tracks the risks with quantitative and qualitative methods. Manage prioritises and treats the risks, and plans response and recovery. The seven characteristics of trustworthy AI are: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. As of October 2026, NIST's AI RMF page states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan; check https://www.nist.gov/itl/ai-risk-management-framework for the current status.

The 12 generative AI risks in NIST AI 600-1 (short names): CBRN information or capabilities; confabulation; dangerous, violent or hateful content; data privacy; environmental impacts; harmful bias and homogenisation; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading or abusive content; value chain and component integration. ai-data/genai-risk-profile uses them as a screening table.

ISO/IEC 42001 in one paragraph. It specifies requirements for an AI management system, in the same high-level structure as ISO/IEC 27001 and ISO 9001, so it fits into existing management systems. An organisation defines scope, sets an AI policy and objectives, assesses AI risks and impacts, selects controls (Annex A lists reference controls, and a Statement of Applicability records which apply), operates them, audits and reviews them, and improves. It can be certified by an accredited body. ISO texts are copyrighted: this card names clauses only.

EU AI Act timeline (summary; check the consolidated text on EUR-Lex for the dates that apply to you):

Roles. A provider develops an AI system or model and places it on the market under its own name; a deployer uses an AI system under its authority. Deployers of high-risk systems must, among other duties, use them according to the instructions, assign human oversight to competent people, monitor operation, keep the logs under their control, and inform workers' representatives and affected workers before using a high-risk system at the workplace (Art. 26). Some deployers must also carry out a fundamental rights impact assessment (Art. 27; see ai-data/ai-act-fria).

Penalties (summary): up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations, with lower ceilings for smaller firms (check Art. 99 as amended).

Other jurisdictions regulate AI differently (sector rules, state laws, guidance from regulators). Record each system's applicable rules in compliance/ai-regulatory-applicability-register.

Formulas and notation

Risk score on 1 to 5 scales:

$R = L \times I, \qquad R \in \{1, \dots, 25\}$

Bands used in this card Example: 1 to 4 Low, 5 to 9 Medium, 10 to 14 High, 15 to 25 Very high.

Risk reduction from inherent score $R_0$ to residual score $R_1$: $\Delta = 1 - R_1 / R_0$.

Expected annual loss for a frequency-driven risk:

$ALE = N \times p_{err} \times p_{reach} \times p_{harm} \times c$

Control decision. A control with yearly cost $K$ is worth adding on financial grounds when $ALE_0 - ALE_1 > K$; risks to people's rights, safety or legal compliance are treated whether or not this holds.

Assumptions and limits

• Ordinal scales are not ratios. A score of 12 is not twice as bad as 6; use scores to rank and to trigger actions, not for arithmetic beyond that.
• Ratings need anchors. Define what each likelihood and impact level means in money, people and time, or two raters will score the same risk differently.
• The worst impact dimension counts. A risk with low financial impact but serious harm to a person is a serious risk.
• Expected loss suits frequent, measurable events. Rare, severe events (a data breach, a discriminatory decision pattern) need scenario analysis and judgment, not an average.
• Legal classification is not a risk score. A system can be legally high-risk with a low internal score, or minimal risk under the law but high risk to the brand. Track both.
• Laws and standards change. The EU AI Act was amended in 2026 and NIST is revising the AI RMF; date every reference.

How managers use it

A workable AI governance routine has six parts. (1) An inventory of AI systems in use, including vendor tools and AI features inside existing software. (2) An intake and classification step for every new use (ai-data/ai-use-case-intake), with a fast lane for low-risk uses so that people do not route around the process. (3) A risk assessment proportionate to the tier (ai-data/ai-risk-assessment, ai-data/genai-risk-profile), with a named owner who accepts the residual risk. (4) A launch review that checks the controls are in place and tested (ai-data/ai-launch-review, ai-data/ai-red-team). (5) Monitoring and incident handling in operation (ai-data/ai-incident-report). (6) Reporting to an AI or risk committee and, for material systems, to the board. Policies (ai-data/ai-usage-policy) and AI literacy (ai-data/ai-literacy-plan) support all six. Firms that want external assurance align the routine with ISO/IEC 42001 and seek certification.

Worked example A (fully solved): Northfield contact-centre assistant

Situation (fictional). Northfield Outdoor Co. plans to roll out a generative AI assistant that drafts replies for its 220 contact-centre agents (see the mini-case in mba/mba-ai-for-managers-guide). The vendor's model runs in the vendor's cloud; agents review and send each reply. About 1,000,000 contacts a year would be assisted. The pilot showed policy errors in 3.1% of suggested replies. Northfield sells in the EU, so the EU AI Act applies to its use.

Step 1. Classify. The assistant is not a prohibited practice and its intended purpose (drafting service replies that an agent reviews) is not in an Annex III area, so it is not high-risk on that basis. Because agents review and send each reply, it does not interact directly with customers; if Northfield later lets it chat with customers directly, the Art. 50 transparency duties apply. One proposed extension changes the picture: using the assistant's data to rate agents' performance would likely fall in the Annex III employment area (AI used to monitor and evaluate workers). That use would then probably be high-risk, with deployer duties from 2 December 2027 and worker information duties, but the classification, including whether an Art. 6(3) exception applies, needs a legal assessment of the actual design. The register below treats that as risk AIR-07.

Step 2. Risk register (L and I on 1 to 5; residual after the listed controls):

Excel, with L and I in D and E: inherent =D2*E2; band =IF(F2<=4,"Low",IF(F2<=9,"Medium",IF(F2<=14,"High","Very high"))). Totals: inherent 69, residual 36, a 47.8% reduction (=1-SUM(residual)/SUM(inherent)). Four risks start High; none remains High after controls.

Step 3. Put a number on AIR-01. Of 1,000,000 assisted contacts, 3.1% contain a policy error; 20% of those reach the customer unchanged; 30% of those lead to a refund, goodwill credit or complaint costing USD 25 on average:

$ALE_0 = 1{,}000{,}000 \times 0.031 \times 0.20 \times 0.30 \times 25 = 46{,}500$

That is 31,000 errors, 6,200 reaching customers and 1,860 costly events. With the controls, the error rate is expected to fall to 1.2% and the share reaching customers to 10%: 12,000 errors, 1,200 reaching customers, 360 costly events, $ALE_1 =$ USD 9,000. Excel: =N*p_err*p_reach*p_harm*c. The controls cost about USD 22,000 a year (part of a knowledge-base editor's time), so they reduce expected loss by USD 37,500 for a net USD 15,500, before counting the reputational benefit.

Conclusion. Approve the roll-out with the listed controls, accept the residual Medium risks with named owners, and refuse the agent-rating extension unless it goes through a separate high-risk assessment. Review the register after every vendor model update and at least every six months.

Worked example B (half solved): Corvane spare-parts agent

Situation (fictional). Corvane Robotics wants an AI agent to reorder spare parts: it reads stock levels and supplier emails, chooses quantities and places orders up to USD 5,000 without approval. It would place about 12,000 orders a year. In a test, 2% of orders were wrong (wrong part or excess quantity), at an average cost of USD 180 each.

1. Complete the empty scores and bands.
2. Compute the expected annual loss of AIR-B1 now, and after controls that cut wrong orders to 0.5%.
3. Which NIST AI RMF function does each control mainly serve?
4. Why must the USD 5,000 limit be enforced in the ordering system rather than in the agent's instructions?
5. Is this agent high-risk under the EU AI Act? What would you check?

Exercise C (unsolved): Tallow Creek documentation assistant

Situation (fictional). Tallow Creek Medical Center, a regional hospital, considers an "ambient" assistant that listens to doctor-patient consultations (with consent), drafts the clinical note and suggests diagnosis codes for billing. Doctors review and sign each note. The vendor's model runs in the vendor's cloud. Some of the hospital's patients are EU residents treated at a partner clinic in the EU.

1. Break the system into its uses (transcription, note drafting, code suggestion) and say for each who could be harmed and how.
2. Which questions would you put to legal counsel to classify the system under the EU AI Act? Consider whether any part could be a medical device (Annex I) and whether billing codes affect access to services.
3. Build a register of at least five risks with L, I, inherent and residual scores and named owners. Use at least three NIST AI 600-1 categories.
4. Quantify one risk with an expected annual loss, stating every assumption.
5. Design the human oversight: what must the doctor check, how will you know whether doctors are rubber-stamping (see mba/mba-ai-decision-making-card), and what is the stop rule?
6. Which ISO/IEC 42001 elements would the hospital need if it sought certification?

Decision diagram

The diagram shows the order of the EU AI Act screening questions, followed by the internal risk process that applies to every system whatever its legal tier.

Governance templates in this library

Connections to other cards

Common mistakes and misconceptions

1. "The vendor is responsible." The deployer still has duties and still bears the reputational and customer harm.
2. "A human signs off, so it is not high-risk." Classification depends on the intended use (Annex III areas, Annex I products), not on whether a human is involved.
3. Treating NIST AI RMF as a law or as certifiable. It is voluntary guidance; ISO/IEC 42001 is the certifiable management system standard; the EU AI Act is law.
4. One assessment at launch. Risks change with model updates, new data, new users and new tools; reassess on change and on a schedule.
5. Doing arithmetic with ordinal scores. Use scores to rank and trigger actions; quantify with expected loss where data allow.
6. Rating only financial impact. Harm to people's rights, safety or livelihood can be severe even when the money is small.
7. Enforcing limits in prompts. Instructions to a model are not controls; enforce authority limits in the systems the agent calls.
8. No inventory. You cannot govern AI you do not know you use; AI features inside existing software count.
9. Undated legal facts. The EU AI Act was amended in 2026; write the date you checked next to every legal statement.
10. Governance that blocks everything. Without a fast lane for low-risk uses, staff use unapproved tools instead.

Self-test questions

1. Name the four functions of the NIST AI RMF and say what each does in one phrase.
2. Which of these is law, which voluntary guidance and which certifiable: EU AI Act, NIST AI RMF 1.0, ISO/IEC 42001?
3. Name five of the 12 risks in NIST AI 600-1.
4. A risk has L = 4 and I = 4. What is its score and band in this card? And L = 3, I = 3?
5. From which date do the high-risk obligations apply to Annex III systems under the amended EU AI Act, and from which to Annex I systems?
6. Distinguish provider and deployer, and give two deployer duties for high-risk systems.
7. Why could the same assistant be minimal risk for drafting replies but high-risk when used to rate agents?
8. Compute the ALE of an error that occurs in 1% of 200,000 transactions, reaches the customer half the time and costs USD 40 in a quarter of those cases.
9. Why is an instruction in the agent's prompt not an adequate spending control?
10. Name four elements of a workable AI governance routine.

My notes and next steps

Sources and further reading

• National Institute of Standards and Technology (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. https://www.nist.gov/itl/ai-risk-management-framework
• National Institute of Standards and Technology (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1. https://doi.org/10.6028/NIST.AI.600-1
• ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (named by number; text copyrighted).
• ISO/IEC 23894:2023, Information technology, Artificial intelligence, Guidance on risk management.
• Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI); consolidated text on EUR-Lex, https://eur-lex.europa.eu
• ISO 31000:2018, Risk management, Guidelines (named by number).
• Textbooks and books for further reading (named only): Iansiti and Lakhani, Competing in the Age of AI; Agrawal, Gans and Goldfarb, Power and Prediction; Hubbard, The Failure of Risk Management.
• Open resource: the NIST AI RMF Playbook and the NIST AI Resource Center (airc.nist.gov), free online.

Answer key

Worked example B. (1) AIR-B1 residual $2 \times 2 = 4$ Low. AIR-B2 inherent $2 \times 4 = 8$ Medium. AIR-B3 inherent $3 \times 4 = 12$ High, residual $2 \times 3 = 6$ Medium. AIR-B4 residual $1 \times 3 = 3$ Low. (2) $ALE_0 = 12{,}000 \times 0.02 \times 180 =$ USD 43,200; after controls $12{,}000 \times 0.005 \times 180 =$ USD 10,800 (here every wrong order reaches the business, so $p_{reach} = p_{harm} = 1$). (3) Quantity limits and anomaly alerts: Manage (with Measure for the alerts); hard spending limit: Manage; treating email as data and allow-listing: Manage, informed by Map (knowing the inputs); tool-call logging: Measure and Govern (accountability). (4) A model can be manipulated or can misread instructions, so a limit written in a prompt can be bypassed; a limit enforced by the ordering system holds whatever the agent decides. (5) Probably not: ordering spare parts is not an Annex III area and the agent is not a safety component of a regulated product. Check that it does not affect safety functions of the robots and record the reasoning; the internal risk process still applies.

Self-test.

1. Govern: culture, policies and accountability. Map: context and risks of a specific system. Measure: assess and track risks. Manage: prioritise, treat and respond.
2. EU AI Act: law. NIST AI RMF 1.0: voluntary guidance. ISO/IEC 42001: certifiable management system standard.
3. Any five of: CBRN information or capabilities; confabulation; dangerous, violent or hateful content; data privacy; environmental impacts; harmful bias and homogenisation; human-AI configuration; information integrity; information security; intellectual property; obscene, degrading or abusive content; value chain and component integration.
4. 16, Very high; 9, Medium.
5. 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (check the consolidated text).
6. A provider develops a system or model and places it on the market under its name; a deployer uses it under its authority. Deployer duties include using it according to the instructions, assigning competent human oversight, monitoring, keeping logs and informing workers before workplace use.
7. Classification follows the intended purpose. Drafting replies is not an Annex III use; monitoring and evaluating workers is listed in the Annex III employment area, so the rating use is likely high-risk, subject to a legal assessment of the design and of any Art. 6(3) exception.
8. $200{,}000 \times 0.01 \times 0.5 \times 0.25 \times 40 =$ USD 10,000.
9. The model may be manipulated (for example by prompt injection) or may misinterpret the instruction; a control must be enforced outside the model, in the system that executes the action.
10. Any four of: inventory, intake and classification, risk assessment with an owner, launch review, monitoring and incident handling, reporting to a committee or the board (supported by policy and AI literacy).

Revision history

Standard and licence note

Based on NIST AI 100-1 (AI RMF 1.0, January 2023) and NIST AI 600-1 (Generative AI Profile, July 2024), public US government works, and on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, whose texts are free to reuse; structure aligned with ISO/IEC 42001:2023 and ISO/IEC 23894:2023, which are named by number only because ISO texts are copyrighted. Facts were checked in October 2026; the text, examples, numbers and questions are original, no text of any law or standard is reproduced, and Northfield Outdoor Co., Corvane Robotics and Tallow Creek Medical Center are fictional. The template is independent and not affiliated with or endorsed by NIST, ISO, the European Union, any business school or any vendor. Check the current official texts before you rely on any date or duty. This is a learning aid, not legal advice. Template licence: MIT.