Most organisations are adopting artificial intelligence by accident. A risk-based approach replaces the accidental with the deliberate — without slowing the business down.
The phrase adopting AI is misleading. Organisations do not adopt artificial intelligence the way they once adopted email or the cloud. They adopt dozens of small, situated uses of AI — a marketing team that drafts copy with a large language model, a finance team that summarises supplier contracts, an engineer who pastes a stack trace into a chat interface, a customer service platform that quietly added a generative feature in its last release.
Each of those uses is a decision with consequences. Looked at individually they are small. Looked at collectively they add up to a new layer of organisational behaviour that nobody has yet documented, governed or measured. The risk-based approach is the discipline of looking at the layer.
A risk-based approach does not mean writing a long policy document and asking everyone to read it. It means making four questions routine for any meaningful use of AI:
This is the same discipline that ISO/IEC 27005, ISO 31000 and ISO/IEC 42001 all describe in different vocabularies (ISO 2018; ISO/IEC 2022; ISO/IEC 2023). It is not new. What is new is applying it to a technology whose outputs are probabilistic rather than deterministic.
Risk taxonomies in this area are still maturing, but five categories cover the vast majority of real-world incidents seen across regulated industries (NIST 2023):
If you can describe an AI use case in terms of these five, you can start to manage it. If you cannot, the use case is not yet understood well enough to authorise.
The same pattern works whether the use case is an enterprise procurement or a single person trying a browser extension.
1. Inventory. Write the use case down. Who uses it, for what, on which data, hosted where, with which alternatives. Most organisations have never compiled this list. The act of compiling it surfaces 60–80 per cent of the easy wins.
2. Classify. Decide where the use case sits on the harm spectrum. The EU AI Act formalises this as prohibited, high-risk, limited-risk and minimal-risk (European Parliament 2024). Even outside the EU, the tiering is a useful internal discipline.
3. Treat. Apply controls proportionate to the classification. A marketing tool drafting blog copy does not need the same controls as a model that recommends loan decisions. The point is proportionality, not uniformity.
4. Monitor. AI risk is not a one-off assessment. Models drift, vendors change features, and the data the model sees changes with the business. Build the review into the calendar from day one.
The most common obstacle is not technical. It is the absence of a single person who owns the question are we comfortable with this? for any given AI use case. When that ownership is missing, three things happen: every team makes its own decision, no two decisions agree, and when something goes wrong the post-mortem is unable to identify a responsible party. A risk-based approach exists primarily to fix that.
The second most common obstacle is treating AI governance as a separate workstream from existing information security and data protection. It is not. The asset register, the supplier register, the risk register and the incident register all already exist for most organisations of any size. AI adds rows, not new registers.
ISO-STANDARD.app gives you one workspace to inventory AI use cases, classify them against the EU AI Act, link them to the controls that treat the risk and produce the evidence reviewers expect — without standing up a parallel programme.
ISO-STANDARD.app ships a ready-to-adopt ISO 42001 workspace with the risk register, controls catalogue, policies and audit-ready exports already wired together — no spreadsheet sprawl, no consultant lock-in.
Prefer a conversation? Email hello@iso-standard.app — a real human responds within one business day.
