In Plain English: Residual Risk

Let me translate another useful phrase: residual risk.

In grants work, we'd put controls in place — reviews, approvals, checks — and then ask the honest question: what risk is still left? No control is perfect. Residual risk is the risk that remains after you've done everything reasonable. The discipline wasn't eliminating it. It was naming it, writing it down, and making sure leadership signed off on living with it.

AI governance needs this phrase desperately.

Every AI system carries residual risk. The model might be wrong in ways testing didn't catch. The data might shift. People might misuse a tool that works perfectly. Frameworks like the NIST AI Risk Management Framework, published in January 2023, are built around this honesty: measure the risk, manage what you can, and be explicit about what remains.

Here's the practice: after your safeguards are in place, write one paragraph. What could still go wrong? Who accepted that risk, and when? Revisit it regularly.

Pretending risk is zero is how organizations get blindsided. Naming what's left is how grown-ups govern.

I explain frameworks; I don't give legal counsel.