This chapter turns AI risk management from a periodic workshop into an executable part of the delivery pipeline. Chapter 3 mapped the risk-based structure of the AI Act, and Part II examined the suppliers on which an organisation's AI depends. Part III begins here because classification decides which of the Act's obligations apply to a given system, including those a supplier must help the organisation meet. The chapter shows how to express the risk classification of Regulation (EU) 2024/1689 (the AI Act) as a decision tree that a policy engine can evaluate, how to keep the risk register in version control, and how to re-run both whenever a model, a dataset, or an intended purpose changes. Readers who know Risk as Code from Architecture as Code (Chapter 9C) will recognise the method; what changes is that the risks arise from data, probabilistic behaviour, and fundamental rights rather than from misconfigured infrastructure alone (66, Nordqvist, 2025).
Classical IT risk management assumes that a system does what its code says and that a control, once implemented, stays implemented; neither holds for AI. A model's behaviour is a statistical property of its training data, so a risk absent at release can appear after retraining, and the harms that matter, such as discrimination or wrongful denial of a benefit, land on individuals outside the organisation. Two frameworks structure the problem: ISO/IEC 23894:2023, which adapts the ISO 31000 risk process to AI (33, ISO/IEC, 2023), and the NIST AI Risk Management Framework, which organises the work into Govern, Map, Measure, and Manage (36, NIST, 2023).
ISO/IEC 23894 names AI-specific sources of risk, such as automation, opacity, and risks that emerge across the lifecycle, and the NIST generative AI profile, NIST AI 600-1, adds risks such as confabulation, information integrity, harmful bias and homogenisation, and value-chain risks arising from components the organisation did not build (37, NIST, 2024).
Primary topics explored
- Why AI risk management needs its own discipline
- The AI Act classification as a decision tree
- Impact assessments as pipeline inputs
- The risk register as code
- Continuous re-evaluation when models and data change
- Risk appetite statements as data
About AI Governance
AI Governance is Book 2 of The Transformed Architecture. It shows how large European enterprises and public authorities decide what artificial intelligence is used for, classify and manage its risks, meet the obligations of the EU AI Act and its neighbours, choose and contract their suppliers, organise the forums that take decisions, and produce the evidence that shows it is all true.
It builds on the conclusions of Architecture as Code.
Chief risk and compliance officers, AI governance boards, CIOs and chief architects, and senior officials in public authorities.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 8: AI Risk Management and Classification as Code in AI Governance gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Risk, Governance, Trust and Assurance” and is one of 32 drawn from the manuscript.