Written by: Jason Veen
Published:
AI Risk Management Plan: Why Sampling Misses the Answer That Matters
The plan is finished. It runs to forty pages. It maps to a published framework, names an owner for every risk, and carries a signature. An audit committee has seen it. By every test an enterprise risk function applies, it is a good plan.
Then someone asks a plain question. A customer is reading an answer from the company's AI assistant right now. Which part of this plan acted on that answer?
Trace it through. The register scored the risk that the assistant produces off-standard language, assigned an owner, and set a mitigation. The key risk indicator will sample a few hundred outputs next quarter and report a rate. The interaction log captured the words. Every one of those instruments is real. Every one of them sits downstream of the customer.
That is the finding worth having before the next board meeting. The plan is not weak. It is a reporting instrument that has been asked to do a controlling job. The distance between those two is one control. It acts at one point, on one unit the plan has no row for.
Key Takeaways:
- A plan built on a risk register and sampled indicators can establish how often a customer-facing system goes off standard. It cannot act on any single answer.
- NIST has AI RMF 1.0 under revision as part of the White House AI Action Plan. A plan mapped clause by clause to a moving document is a plan that gets reopened.
- A register row carries a likelihood and an impact. A statement to a customer is not a risk. It is an instance, and the register has no row shape that fits it.
- Check which entry in the plan acts on an individual output. Check what it is measured against. Check whether it acts before the customer reads the answer.
What Belongs in an AI Risk Management Plan
An AI risk management plan needs three entries. Most plans carry two of them.
The first is the system: what is deployed, where, on whose authority, under what approval, with which limitations recorded. The second is the risks around that system. Vendor concentration, data residency, model procurement, a training-data dispute, the decision to deploy at all. These are discrete, consequential and low in frequency. A risk register holds them well, and most plans hold them well.
The third is a control that acts on an individual customer-facing output at the moment it is released. Not a score for the system. Not a rate measured on a sample next quarter. An evaluation of the specific statement, against a standard the organization owns, before it reaches a person. The result is written to a record that can be re-run.
Most plans stop after the second. The third is absent not because anyone decided against it, but because the register offered nowhere to put it. That is the gap, and it is narrow enough to name precisely. One control, at one point, on one unit.
The Instrument Your Plan Was Mapped to Is Moving
NIST released the AI Risk Management Framework, AI RMF 1.0, on 26 January 2023, for voluntary use. NIST's framework page states that AI RMF 1.0 "is being revised as part of the White House AI Action Plan." NIST publishes no scope for that revision and no date for it.
That matters for a practical reason rather than a regulatory one. AI RMF is voluntary and is not law, so nothing compels a rewrite. But a plan mapped clause by clause to a document under revision is a plan that gets reopened. Reopening is when a sponsor reads what the plan contains rather than confirming that it exists.
That reading is worth doing properly, because the usual one checks coverage. Coverage asks whether every clause has a corresponding entry. The more useful question is what each entry does, and when. Trace a single customer answer through the plan end to end. The shape of the thing becomes clear quickly.
Here is what that reading finds. A customer-facing system was approved at deployment, and the approval covered the system. At interaction time it composes a statement in answer to a question nobody anticipated. Nothing reviews that statement, because the plan's review runs on the system, on a cycle.
The register entry and its score are logged. The sampled indicator is logged. The transcript is logged. The statement renders to the customer.
Between composition and delivery, no instrument in the plan evaluated it against anything.
In regulated sectors the same shape has already been examined under supervisory guidance rather than voluntary frameworks. For that reading, see how the same gap appears under banking supervisory guidance.
One Statement, Traced Through a Finished Plan
The workflow below is a composite, assembled to show the sequence. It is not any named organization's process and it is not a verified incident.
A mid-sized enterprise runs an AI assistant in its customer service channel. The risk function maintains the AI risk management plan. The register carries a row reading "AI system generates inaccurate or off-brand customer communication." Likelihood medium, impact high, owner the business lead, mitigation "prompt controls, human escalation, quarterly review." A key risk indicator tracks a hallucination rate on sampled outputs. The plan was approved in March and is reviewed in July.
On a Tuesday in May a customer asks whether a fee applies if they close an account early. The assistant retrieves the product terms, composes an answer, and tells the customer the fee is waived in their circumstances. The product terms do not say that. The sentence is fluent, confident, and specific enough to act on.
Nothing in the plan sits between that sentence and the customer. The deployment approval was granted two months earlier, for the configuration. The quarterly review is eight weeks away. The sampled indicator draws two hundred outputs from a population of ninety thousand, and this statement is not among them. The transcript records the words.
The customer closes the account expecting no fee. The organization learns what its assistant said when the customer calls to contest the charge.
Now read the plan again with that call in hand. Every control it names performed exactly as designed. The register scored a risk that was real. The indicator will, in July, report a rate that is probably accurate. The escalation path worked for the conversations somebody escalated. What the plan cannot do, at any point in that sequence, is act on the sentence. Its instruments were built to count, and counting is what they did.
Why the Register Is the Right Instrument for the Wrong Unit
Registers work. That has to be said without hedging, because the argument depends on it. A register is the correct instrument for a discrete risk. It suits a risk that may or may not occur, has an identifiable owner, and carries a consequence worth scoring. Most of what sits in an AI risk register belongs there.
The published frameworks reach the output too, and it is worth being exact about that. AI RMF is voluntary, and within it the MEASURE function is explicit. NIST AI 100-1 calls for assurance criteria measured and demonstrated for conditions similar to the deployment setting, at MEASURE 2.3. Before deployment, it calls for a system to be demonstrated valid and reliable, at MEASURE 2.5. It calls for monitoring in production, at MEASURE 2.4. Read together, those three measure the system: its criteria, its validity before deployment, its behavior in production.
MEASURE 2.9 reaches the output itself. It states that "the AI model is explained, validated, and documented, and AI system output is interpreted within its context ..." The framework names measurement itself.
What the framework declines to supply is the criterion. Section 1.2.2 reads: "While the AI RMF can be used to prioritize risk, it does not prescribe risk tolerance." Both quotations come from AI RMF 1.0, the voluntary framework now under revision. So the plan inherits a duty to measure and no instrument that acts on one answer. Who defines the criterion is a separate question. See what the published AI governance frameworks require of an AI output, and what they leave to you.
Two limits follow. They are limits of the plan, not of the frameworks.
The First Limit Is the Unit a Register Can Hold
A register row carries a likelihood, which presumes an event that may or may not occur. For a system generating language continuously, off-standard output is not a probability. It is a rate. The honest row would read "likelihood: certain," which no matrix can use.
So the risk gets written one level up, at the system. The register can hold it there. No control reaches the answer there.
The Second Limit Is Sampling in Generative AI Risk Management
The strongest objection to the argument belongs here. Put it the way a risk executive would. Sampling is how your control functions work: SOX testing samples, credit review samples, quality assurance samples. Inspecting every output is a standard none of them has ever met, and it is not a serious proposal.
That objection is right about sampling and wrong about the population. Sampling is sound where the defect is systematic. An item found in the sample stands for the items not drawn. Generative defects are instance-specific. The sentence that invents a fee waiver does not recur in the next thousand outputs. Finding nothing in a sample is evidence about the outputs drawn and no others.
The most developed of the published templates makes the point by itself. Risk Publishing's AI risk register template sets hallucination-rate thresholds of above 5% amber and above 15% red, on sampled outputs. That is a real advance on a static score. It is still arithmetic performed on statements customers have already read. An amber reading at six percent says that six in every hundred sampled outputs carried fabricated or unverifiable information. Every one of them had already been read.
Sampling also assumes inspection costs enough to ration. Evaluating a short text against a fixed benchmark does not. Cost is the main reason control functions sampled, and for this class of artifact that cost has largely fallen away. An inspector carries its own error rate, which is why the evaluation has to be deterministic and its benchmark versioned. A verdict that re-runs and returns the same result can be checked. A sampled rate cannot.
AI Risk Controls That Act on the Answer
What the plan is missing is not another risk. It is an entry of a different kind. A control, with its own unit, its own timing, and its own record.
LuxeDetect™ is AI Brand Integrity Infrastructure: the independent, deterministic brand-integrity release gate governing every AI-generated output across the enterprise AI stack.
Five properties separate that entry from the rows already in the register.
It is independent. The system that generates the language does not grade its own work. Evaluation sits outside the generating model, so the verdict is not a function of the thing being judged.
It is measured against a standard the organization owns. In-scope outputs are routed through the brand-owned LF1000 Brand Benchmark and evaluated deterministically against the LuxeFactor™ methodology. The benchmark is versioned, and versioning is what allows a verdict to be re-run later and return the same result.
It works across the stack. The control is not confined to one platform or one model. It acts before release. The evaluation happens between composition and delivery. That is the only point where an answer can still be held or routed. After delivery the statement cannot be recalled, and every instrument downstream of that moment is reporting.
It writes a record. The decision, its rationale and the benchmark version are logged. That record answers a question the register cannot. Not what the risk was scored at, but what controlled this answer.
LuxeDetect™ does not generate or rewrite the content it evaluates. It does not replace a risk register or an enterprise risk function. It does not constitute compliance with any framework or regulation. The register keeps the risks it holds well. The structural point is narrower than a verdict on anyone's tooling. The enterprise stack still lacks a consistent, independent control layer that verifies AI-generated language against the brand's own standard before release. A plan that adds that layer stops reporting on its customer-facing AI output and begins governing it.
Five Questions to Ask of Your AI Risk Management Plan
Read these in order, against the plan you have.
- Which entry in this plan acts on an individual customer-facing output? A weak answer points to the deployment approval, or to the escalation path. Both act on the system, or on the conversations a person already noticed. If no entry names the individual output as its unit, the plan has no control at the release point.
- What is that entry measured against, and who owns that definition? A weak answer is "our policy" or "the model's safety settings." A control needs a benchmark specific enough that two reviewers reach the same verdict. The organization owns that benchmark, not the vendor whose model is being judged.
- At what point in the workflow does it act, and is that before or after the customer reads the answer? A weak answer is any answer expressed as a review cycle or a reporting cadence. Quarterly, monthly and weekly are all after. Ask for the step in the sequence, not the frequency.
- What does it write to the audit record, and could the verdict be re-run? A weak answer is a transcript. A transcript records what was said. A verdict records what was decided and why. An evaluation whose criterion changed cannot be compared across periods. If the benchmark version is absent from the record, the result cannot be reproduced. A result that cannot be reproduced is an opinion with a timestamp.
- For every other entry, is the unit a risk or an instance, and does the register's row shape fit it? A weak answer treats the two as the same thing. Vendor concentration is a risk and belongs in the register. The sentence a customer reads is an instance. A plan that files both in one structure has already lost the second one.
A plan that answers all five cleanly is doing a controlling job. A plan that answers the first three with cycles, and the fourth with a transcript, is reporting accurately. That distinction is worth putting in front of whoever signed it.
Frequently Asked Questions
What Should an AI Risk Management Plan Include?
The system, the risks around it, and a control that acts on individual customer-facing output at release. Most plans carry the first two in a register and a set of indicators. Check for the third by name. It is the only entry whose unit is a single answer rather than a system or a sample. A plan without it can report on its customer-facing AI and cannot govern it.
What Goes in an AI Risk Register?
Discrete risks with owners and consequences. Vendor concentration, data residency, model procurement, a training-data dispute, the deployment decision itself. Published templates from VerityAI, Risk Publishing and The Neural Base all structure these as likelihood against impact. For this class of risk that structure works. What does not fit is the individual customer-facing statement, which carries no likelihood because it has already happened. Scoring it as a risk records that off-standard answers occur. It does not reach any particular one.
How Do You Measure AI Risk?
Two ways, answering different questions. Measuring the system tells you whether it performs within tolerance. That is what AI RMF 1.0's MEASURE clauses call for, in a framework intended for voluntary use. Measuring the output tells you whether one specific statement met the organization's standard. A plan can do the first thoroughly and hold no reading at all on the second. Most plans measure the system, because that is what the register and the indicators were built to measure. NIST sets no tolerance either way. AI RMF 1.0, the version now under revision, states that the framework "does not prescribe risk tolerance."
Can You Sample AI Outputs for Quality?
Yes, and it is worth doing, but it answers a narrower question than it appears to. Sampling establishes a rate across the population sampled. It does not establish anything about the outputs that were not drawn, because generative defects are instance-specific rather than systematic. A clean sample is evidence about the answers that were drawn and no others. Treat the reading as a measurement of the system, never as assurance about any answer a customer received.
Where to Start
Take the plan to whoever owns it and ask question one. If no entry acts on an individual output, you have found a missing control, not a flaw in the register. The same argument runs into content operations, in the companion piece on why content governance cannot start after publish.
Evaluation without enforcement is reporting.
Request early access to LuxeDetect™ for a control that acts on each answer before release.
AI content risk is not solved after publication; it has to be controlled before release.