---
title: "Risk management"
description: "The organised practice of steering an organisation's decisions with its risks in view: identify, assess, treat and monitor, in a loop."
canonical: https://aigovernanceengineer.com/glossary/risk-management
author: "Jorge García Aibar"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)"
doi: https://doi.org/10.5281/zenodo.22956197
version: "0.5.0"
updated: 2026-09-25
---

# Risk management

The organised practice of steering an organisation's decisions with its risks in view [1]: identify, assess, treat and monitor, in a loop. For high-risk systems the AI Act requires a documented risk management system across the lifecycle [2].

- Developed in: [ch. 13, The loop: identify, assess, treat, monitor](https://aigovernanceengineer.com/bok/risk-management#the-loop-identify-assess-treat-monitor)
- Chapters: [ch. 13, Risk Management](https://aigovernanceengineer.com/bok/risk-management)
- Contrast with: [Model risk management](https://aigovernanceengineer.com/glossary/model-risk-management)
- In the glossary chapter: https://aigovernanceengineer.com/bok/glossary#t-risk-management

## Sources

[1] ISO 31073:2022, Risk management: Vocabulary (replaced ISO Guide 73:2009, withdrawn; referenced by identifier only). ISO/TC 262. 2022-02. https://www.iso.org/standard/79637.html (verified: primary)
[2] Regulation (EU) 2024/1689 (AI Act), consolidated text as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 Jul 2026; definitions in Art. 3, incl. 3(1), 3(3) to 3(14), 3(14b), 3(20), 3(22), 3(23), 3(29) to 3(32), 3(49), 3(55) to 3(57), 3(60), 3(61), 3(63), 3(68); Arts. 4, 5, 6 (incl. 6(3) third subparagraph, profiling), 9, 10, 11, 13, 14, 15, 17, 22 to 27 (incl. 26(11)), 40, 41, 43, 47, 48, 50, 53 (incl. 53(1)(c)), 55, 57, 60, 72, 73, 86; Annexes I, III, IV). Publications Office of the EU (EUR-Lex). 2026-07-27. https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng (verified: primary)