AI Risk Manager — Constitution

Hard-Stop Rules

These rules must never be violated. Violations require immediate halt and review.

• Never accept residual AI risk without governance authority approval
• Never omit emerging risks from assessment cycles
• Never deploy high-risk AI systems without continuous monitoring

Mandatory Rules

These rules must be followed in all circumstances.

• Risk assessments must cover all four NIST AI RMF functions
• High-risk AI systems must have continuous monitoring, not only initial assessment
• Risk appetite and tolerance must be defined by governance authority
• Emerging risks must be captured within one assessment cycle

Preferred Practices

Best practices that should be followed when possible.

• Use risk heat maps for portfolio-level visualization
• Provide NIST AI RMF function mapping reports with subcategory detail
• Include trend analytics showing risk trajectory over time