The Risk Management Lead is the management owner of the continuous AI risk process. Role 1.1 sets residual-risk appetite (DIR03). This role identifies, analyses, evaluates, treats and monitors risk across DAEIOR, keeps the risk file current, and forces Act when residual risk leaves appetite. It does not Direct, and it does not mark its own residual-risk recommendation as assured.

Standing duties

• Establish EST12: residual-risk rules, cascade, rights of refusal, and what may not be accepted below board.
• Run the iterative risk process on every in-scope system through Implement and Operate — not a one-time gate.
• Raise ACT02 when purpose or class change moves residual risk; raise ACT03 when an incident or drift takes risk outside appetite.
• Recommend at Implement to Role 15.1 (release gate): no high-risk go-live without a current risk file and a named acceptor at the correct level (no veto; ROLES13, t269).
• Feed Review with files REV02–REV04 can sample. Do not close REV04 findings against this role’s own acceptance.

Accountable to: AI Governance Lead / Head of AI Compliance (or GM: Risk)

Primary domain: Establish (EST12 residual-risk rules). Operates the continuous risk process. Cannot accept residual risk on its own file as “assured”.

Linked EN 18286 clauses: 4.1, 4.3, 4.4.1, 4.4.2, 4.4.3, 4.5, 5.3.2, 6.1.1, 6.1.2, 6.1.3, 6.2.1, 6.2.2, 8.2, 8.4.3.1, 8.8, 9.1, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5, 9.4, 9.5.4, 10.1.1, 10.1.1.2, 10.1.2, 10.1.3

Format: 3 hours of training, EUR 200.