An AI risk appetite statement describes the types and levels of AI-related risk an organisation is willing to accept while pursuing its objectives. A useful statement turns broad principles into decision thresholds, limits and escalation rules that can guide real choices about AI systems.

Risk appetite is set by the organisation’s governing body and should reflect its purpose, legal obligations, resources and the people affected by its decisions. It is not a declaration that AI is either safe or unsafe. Different uses create different exposures: a tool that drafts internal summaries does not carry the same consequences as a system that influences access to work, healthcare, credit or essential services.

Make the statement operational

A statement without specific thresholds is a press release, not a governance instrument. Terms such as “responsible”, “low risk” or “human-centred” express intent, but do not tell a team when a proposed use needs approval, what residual risk may be accepted or who can stop deployment. A useful appetite statement defines measurable or observable boundaries and explains what happens when they are exceeded.

Thresholds may address the severity and reversibility of possible harm, the quality of evidence, permitted levels of human review, data sensitivity, model performance or reliance on a single provider. They should also identify non-negotiable limits, such as prohibited uses or decisions that cannot be delegated to an automated system under the organisation’s policy. The wording needs to remain understandable to board members, system owners and technical teams.

Connect appetite to decisions

For a proposed AI use, the owner can document the intended benefit, affected groups, key risks, evidence and controls, then compare residual risk with the agreed limits. If a limit is exceeded or evidence is weak, the next step should be clear: obtain additional assurance, narrow the use, add controls, seek approval at a higher level or decline the deployment. This makes risk appetite part of a decision process rather than a document kept separately from operations.

Appetite also needs to reflect uncertainty. A system may perform well in testing but encounter unfamiliar inputs or changing conditions after release. Organisations can set tighter limits while evidence is limited, require staged deployment and define the signals that trigger a pause or reassessment. Appetite does not replace ongoing monitoring or the duty to act when actual harm appears.

Review the statement as the organisation’s uses, obligations and risk landscape evolve. A sound approach links enterprise-level boundaries to system-level tolerances without pretending that one number can describe every form of AI risk. Named owners need to know which decisions they may make themselves and which require escalation to senior leaders or the board.