AI Governance Engineer
GitHub

Residual risk

By Updated

What is left of a risk once treatment is applied 1. The EU AI Act requires residual risk per hazard and overall to be judged acceptable for high-risk systems 2. A residual rating credits only controls whose evidence is current.

Developed in
ch. 13, Inherent risk, residual risk and who accepts it
Chapters
ch. 13, Risk Management
Contrast with
Inherent risk · Risk tolerance
Source
2 numbered references, listed below

Where it is used

8 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Residual risk: mentions per chapter31 mentions of the term across 8 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter08 Regulatory Map: 2 mentions08 Regulatory Map210 Reading List: 1 mention10 Reading List112 Governance Program: 8 mentions12 Governance Program813 Risk Management: 12 mentions13 Risk Management1214 Development: 1 mention14 Development115 Deployment: 4 mentions15 Deployment416 Fairness & XAI: 1 mention16 Fairness & XAI119 Privacy & AI: 2 mentions19 Privacy & AI2No mentions in the other 15 chaptersSource: the Body of Knowledgev0.5.0
Residual risk: mentions per chapter31 mentions of the term across 8 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter000102030405060708 Regulatory Map: 2 mentions20810 Reading List: 1 mention1101112 Governance Program: 8 mentions81213 Risk Management: 12 mentions121314 Development: 1 mention11415 Deployment: 4 mentions41516 Fairness & XAI: 1 mention116171819 Privacy & AI: 2 mentions21920212223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Residual risk per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition0No
02 Why Now0No
03 Values & Principles0No
04 The Stack0No
05 Patterns0No
06 The Role0No
07 Maturity Model0No
08 Regulatory Map2No
10 Reading List1No
11 AI Defined0No
12 Governance Program8No
13 Risk Management12Yes
14 Development1No
15 Deployment4No
16 Fairness & XAI1No
17 Incidents0No
18 EU AI Act0No
19 Privacy & AI2No
20 Existing Law0No
21 AI Laws Worldwide0No
22 Principles & Standards0No
23 AI Agents0No

Patterns that use this term

One pattern page uses the term.

Residual risk: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern01 Govern-as-CodeResidual riskRelated terms (3)AI Act (EU) · RelatedAI Act (EU)AI governance committee · RelatedAI governance committeeCritical Capability Level (CCL) · RelatedCritical Capability Level (CCL)Contrast with (2)Inherent risk · ContrastInherent riskRisk tolerance · ContrastRisk tolerancePatterns using it (1)FRIA-as-Code, 1 mention · Uses the termFRIA-as-Code
Residual risk: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern01 Govern-as-CodeRelated terms (3)AI Act (EU) · RelatedAI Act (EU)AI governance committee · RelatedAI governance committeeCritical Capability Level (CCL) · RelatedCritical Capability Level (CCL)Contrast with (2)Inherent risk · ContrastInherent riskRisk tolerance · ContrastRisk tolerancePatterns using it (1)FRIA-as-Code, 1 mention · Uses the termFRIA-as-CodeResidual risk
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Residual risk
FamilyItemRelation
Related termsAI Act (EU)Related
Related termsAI governance committeeRelated
Related termsCritical Capability Level (CCL)Related
Contrast withInherent riskContrast
Contrast withRisk toleranceContrast
Patterns using itFRIA-as-Code, 1 mentionUses the term
  • Critical Capability Level (CCL)

    In Google DeepMind's Frontier Safety Framework, a capability level at which a model may pose a heightened risk of severe harm without mitigations; reaching…

  • AI governance committee

    The cross-functional body that takes the decisions a gate cannot: accepting residual risk above a product owner's authority, granting exceptions, weighing…

  • AI Act (EU)

    Regulation (EU) 2024/1689, the EU's horizontal, risk-tiered law for AI, amended by the Digital Omnibus.

Sources

  1. [1] Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (risk tolerance and residual risk; seven trustworthy characteristics; transparency answers "what happened", explainability "how", interpretability "why"; MAP 1.1 intended purposes; MANAGE 1.1 go/no-go determination; profiles). NIST. 2023-01-26. https://doi.org/10.6028/NIST.AI.100-1 (verified: primary)
  2. [2] Regulation (EU) 2024/1689 (AI Act), consolidated text as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 Jul 2026; definitions in Art. 3, incl. 3(1), 3(3) to 3(14), 3(14b), 3(20), 3(22), 3(23), 3(29) to 3(32), 3(49), 3(55) to 3(57), 3(60), 3(61), 3(63), 3(68); Arts. 4, 5, 6 (incl. 6(3) third subparagraph, profiling), 9, 10, 11, 13, 14, 15, 17, 22 to 27 (incl. 26(11)), 40, 41, 43, 47, 48, 50, 53 (incl. 53(1)(c)), 55, 57, 60, 72, 73, 86; Annexes I, III, IV). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Residual risk. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/residual-risk. CC BY 4.0

BibTeX

@misc{aige2026residualrisk,
  author  = {Jorge García Aibar},
  title   = {{Residual risk}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/residual-risk}
}