Board sessions · available now
Supervisors and boards now expect AI to be overseen within appetite, with clearly defined triggers. The AI Risk Appetite sessions take the board through eight decisions over two sessions, and record them as statements, tolerances and triggers that an assessment, a provider and a control can all measure against.
Eight decisions
Each decision is the board's own position. The sessions and the app give no view on what the appetite should be.
01
What each AI may do, from helping staff draft to acting on systems unattended.
02
What failure could do, from immaterial to critical-operation disruption.
03
What evidence the board expects for each combination of authority and consequence.
04
How much gap between expected and obtainable evidence the board will accept, and for how long.
05
How AI in use but not on the register is treated.
06
Offshore processing, and dependence on one provider, platform or model.
07
The thresholds that require a defined response, by whom, within what time.
08
When the appetite is revisited: annually, and on material change.
Three layers
The AI appetite sits inside the risk appetite statement and risk framework you already have. It adds AI-specific statements; it does not create a separate regime.
| Layer | What it is | Set by | Example: an insurer |
|---|---|---|---|
| Appetite statement | A board-level statement of how much AI risk of a given kind the entity will accept | The board, on the CRO's recommendation | "We accept no AI-driven claims denial without human review." |
| Tolerance | A measurable limit that puts the statement into effect, for a given authority and consequence | The CRO, with actuarial calibration | Share of claims declined by an AI model in a month does not exceed a set level |
| Trigger | A threshold short of, or at, the tolerance that requires a defined response within a defined time | The CRO, with the business owner | Notice to the CRO within a set time if the declined share moves a set amount above its baseline |
The example is illustrative. Every limit, threshold and level is the board's to set, calibrated from your own data and loss history.
The tolerance matrix
Each cell gives the default treatment. The board may tighten any cell; loosening a default is recorded with reasons. The treatments mirror the evidence ladder in the AI Use Assessment, so a tolerance and the evidence that shows it holds are set together.
| Authority \ consequence | Immaterial | Contract breach | Financial loss | Customer harm | Critical-operation disruption |
|---|---|---|---|---|---|
| Productivity | Disclose | Disclose | Attest | Attest | Attest |
| Analytical | Disclose | Attest | Attest | Human review | Human review |
| Decision | Attest | Limit + trigger | Limit + trigger | Human review | Limit + trigger |
| Transactional | Attest | Limit + audit | Limit + audit | Limit + audit | Limit + audit |
| Agentic | Limit + trigger | Continuous measure | Continuous measure | Continuous measure | Not permitted without control |
| Actuating | Limit + trigger | Deterministic control | Deterministic control | Deterministic control | Deterministic control |
Triggers and escalation
| Level | When it applies | Response |
|---|---|---|
| Watch | A measure moves toward its tolerance | The business owner investigates and records the cause |
| Escalate | A trigger threshold is crossed | The owner proposes action; the CRO decides whether to restrict the AI's authority |
| Breach | A tolerance is exceeded | AI authority restricted or suspended; incident process; board informed |
| Supervisory | An incident meets your supervisor's notification threshold | Notify as required; counsel engaged |
Notification thresholds and timings are set by your supervisor's standards, and confirmed by counsel.
Principles
Limits are set in advance, versioned and signed, so performance is measured against a fixed reference.
Each action can be within limits while the pattern drifts. Tolerances cover single actions and period measures.
The same appetite applies to AI inside providers, as far as your rights reasonably reach.
A tolerance a provider cannot measure cannot be evidenced. Each states what is measured, and by whom.
What it produces
Statements by risk category, each with an appetite level and an accountable person.
Each tolerance with its measure, baseline and period, and who measures it.
What the AI Use Assessment tests each arrangement against, and the operating points controls enforce.
Sessions are facilitated by your board risk adviser, or by large law firms and board risk advisers in alliance with Triodian.
The app
Eight decisions with ten checks, from the board's starting position to a working appetite. No client data leaves the browser. The worked example uses a fictional insurer; the same eight decisions apply to mining, manufacturing and defence.