Dimension 3: Risk Intelligence¶
Synchronized from the canonical website on 2026-09-06.
“Not 'identify and manage risks' — that's structural and boring. What do you DO with risk data? And what do you do when you don't have it?”
← Shadow AI Proliferation · Regulatory Volatility
STANDARDS — ENACTED GOVERNANCE¶
Risk Data → Decision Change¶
When risk data reaches a decision-maker, something observably changes. If risk data circulates without altering behavior, governance is decorative. Test: name the last governance decision that changed because of risk data. If you can't, risk intelligence is absent.
Decision Under Acknowledged Uncertainty¶
Most AI risk data doesn't exist yet — failure modes are novel, precedent is thin. The standard: make explicit decisions under acknowledged uncertainty. “We don't know the risk profile; here's how we're proceeding; here's what we're watching.” Deploying without acknowledging the gap and freezing until certainty arrives are both governance failures.
AI Risk Literacy¶
Can the people making governance decisions read the risk landscape? Not technical risk (that's engineering) — organizational risk: reputational exposure, regulatory surface, business-model disruption. Risk literacy is a capability, not a compliance checkbox.
MEASURES — THREE-LAYER ASSESSMENT¶
Self-Report¶
“When did risk data last change a governance decision?” “What's your biggest AI risk where you lack adequate data?” Diagnostic: “I can't remember” + “we have it covered” = absent risk intelligence.
Evidence Layer¶
Decision change log: governance decisions modified by risk data in 90 days. Acknowledged uncertainty register: deployments with explicitly documented unknowns. Risk literacy scores. Incident response time + governance modification rate post-incident.
Behavioral Observation¶
When risk data is presented, does the room engage or glaze? When data is absent, does someone name the gap — or does the decision proceed as if certainty existed? The quality of the uncertainty conversation is the observable.