AI Risk Management

The frameworks organizations use to find, rate and treat AI risk.

ISO/IEC 42001 shaped the responsible-AI practice of 36% of organizations surveyed for the 2026 AI Index and the NIST AI RMF 33%. Firms with no responsible-AI policy fell from 24% to 11% in a year.

Frameworks shaping responsible-AI practice: GDPR 60%; ISO/IEC 42001 36%; NIST AI RMF 33%; No regulatory influence 12%; No responsible-AI policy 11%. Stanford AI Index 2026 survey FRAMEWORKS SHAPING RESPONSIBLE-AI PRACTICE GDPR 60% ISO/IEC 42001 36% NIST AI RMF 33% No regulatory influence 12% No responsible-AI policy 11% SHARE OF ORGANIZATIONS, 2025 STANFORD AI INDEX 2026 SURVEY
Organizational AI adoption
88%
Growth in AI governance roles
+17%
EU high-risk start date
Dec 2027
TC260 risk grades
5

Evidence

NIST is revising its framework while China adds graded risk levels

Documented cases: AI Risk Management
DateCaseCountryWhat happenedSource
Jul 26, 2024NIST AI 600-1 Generative AI ProfileUnited StatesCompanion profile to AI RMF 1.0 for generative AI risksSource
Sep 15, 2025TC260 Framework 2.0ChinaGrades risk on five levels by scenario, intelligence level and scaleSource
Apr 7, 2026NIST critical infrastructure profile concept noteUnited StatesFirst sector profile; AI RMF revision underwaySource
Jun 29, 2026Council approval of the AI OmnibusEUDelays Article 9 risk management duties to Dec 2027 and Aug 2028Source

Rules

Only the EU makes risk management mandatory, and not until December 2027

Rules that address risk management
RuleJurisdictionWhat it requiresStatus
NIST AI RMF 1.0 and AI 600-1USGovern, map, measure and manage functionsUnder revision 2026
ISO/IEC 42001InternationalCertifiable AI management systemPublished 2023
ISO/IEC 23894InternationalAI risk management guidance on ISO 31000Published 2023
EU AI Act Article 9EULifecycle risk management for high-risk systemsDec 2, 2027
AI Safety Governance Framework 2.0ChinaGraded risk managementSep 2025

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Risks Hub
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (0 linked); ai_attack_surface.csv
Key sources
NIST AI 600-1 Generative AI Profile
TC260 Framework 2.0
NIST critical infrastructure profile concept note
Council approval of the AI Omnibus
Last verified
October 2026