AI risk appetite needs an exception workflow, not just a board statement

Three current signals point to the same operating gap

On October 15, the Financial Stability Board finalized 12 sound practices for responsible AI adoption in financial institutions. The first practice asks boards and senior management to align AI adoption with business strategy and risk appetite. On October 7, the Monetary Authority of Singapore issued final AI risk-management guidelines with examples of qualitative statements and quantitative measures. The gap is what happens on Tuesday morning when one of those measures breaks.

The FSB practices are not binding rules. They are an international standard-setter's non-binding recommendations. MAS' final guidelines are supervisory expectations for financial institutions in scope, with Sections 3 and 4 taking effect on October 7, 2027 and Sections 5 and 6 on October 7, 2028. HKMA's October 15 ART framework is a current supervisory direction for Hong Kong banks and points toward material-agent registries, intent-anchored accountability, and intervention mechanisms. A global policy cannot erase those differences.

The useful convergence is operational. Boards should set direction and appetite. Management should implement limits and escalation. Materiality should drive control depth. Human oversight must reflect autonomy and consequence. Third-party concentration, performance, cyber risk, and incidents require ongoing evidence. Those principles become real only when a warning or breach enters an owned case with a clock.

This guide begins after the AI risk materiality and inventory workflow has identified and classified a use case. It does not build another inventory. It handles the moment when a previously approved use approaches a limit, crosses it, suffers an incident, enters a prohibited state, accumulates provider concentration, or outlives an exception.

Name the states before arguing about severity

Teams often call every adverse signal an “exception.” That collapses different authority and response paths. An early warning may permit investigation while service continues. A prohibited use may require immediate stop. An incident may trigger preservation and notification duties even when a dashboard metric remains within appetite.

A case may carry multiple states. A performance breach can also be an incident; an expiring exception can also conceal an overdue control fix. Preserve every applicable label and route the strictest immediate requirement. Do not let a less severe label overwrite a material one.

Write measures that can be recomputed independently

MAS gives unusually concrete examples. A financial institution may define limits on the number or financial impact of AI-related incidents, the number of material AI use cases dependent on a single provider, or the number of material use cases breaching performance thresholds. These examples are not universal required metrics. They show what an actionable measure looks like.

Each threshold needs a data contract. Record metric ID, definition, numerator, denominator, units, direction, population, aggregation, warning, breach, source, owner, frequency, effective date, policy version, and data-quality rules. A percentage without its denominator can improve simply because records disappeared. A count without materiality can hide one severe event inside a calm portfolio.

ai_risk_measure:
  id: provider_concentration_material_use_cases
  definition: material AI use cases dependent on one provider
  population_snapshot: ai_inventory_2026_10_17_0900Z
  numerator_rule: primary_or_non_substitutable_provider == provider_id
  denominator_rule: material_use_case == true
  early_warning: 8
  breach: 10
  direction: lower_is_better
  source_owner: third_party_risk
  review_frequency: monthly_and_event_driven
  exception_authority: board_risk_committee
  evidence_retention: 7_years
  effective_policy: AI_RAF_v4.2

Keep portfolio measures and named material cases together. A board may need both “three material uses breached performance limits” and the stable IDs, business processes, customers, exposure, duration, containment, owner, and remediation for each. Aggregation supports oversight; it must not anonymize accountability.

Use early-warning bands deliberately. They provide time to reduce volume, test fallback, add review, or repair monitoring before a hard limit is crossed. They are not permission to postpone a known incident or prohibited use.

Separate signal, decision, action, and evidence

controlled sources + inventory + policy versions
                    |
                    v
          deterministic measurement
                    |
                    v
warning / breach / incident classifier
                    |
        +-----------+-----------+
        |                       |
        v                       v
 immediate containment     evidence packet
        |                       |
        +-----------+-----------+
                    v
          independent challenge
                    |
                    v
 human disposition + authority check
  continue | constrain | suspend | exception
                    |
                    v
 remediation + monitoring + expiry
                    |
                    v
 independent retest + closure approval

The AI may help reconcile records, identify missing fields, draft a timeline, compare policy versions, and format options. Keep quantitative thresholds deterministic and reproducible. Preserve source extracts and calculation code. The model's narrative is not the measurement.

Containment and exception are separate decisions. Containment reduces immediate exposure: remove tool access, switch to read-only, reduce population, increase review, revert a model, route to fallback, or suspend the use. An exception accepts residual risk for a narrow period while remediation proceeds. A team should not request permission to continue at full exposure merely because it has opened a ticket.

A valid exception binds to exact scope. Name the use-case ID, model or system version, provider, population, volume, jurisdiction, breached measure, compensating controls, monitoring, owner, start, expiry, revocation triggers, remediation milestones, and authority. “Until resolved” is not an expiry date.

Closure is another independent gate. Recompute the measure, retest the control, confirm affected-case remediation, remove temporary access, complete notifications, and obtain named approval. One good measurement after a bad week does not prove a structural fix.

Use the three lines without turning them into a relay race

MAS expects senior management to establish escalation for material AI risks and exceptions, update the board on material issues, and define responsibilities across functions. Its examples map naturally to three lines, but the lines should work from the same evidence packet rather than handing off opaque summaries.

Global groups need a local view. MAS says local senior management remains accountable for Singapore-specific considerations and should have timely data, escalation paths, and the ability to demonstrate how it discharged oversight. Apply the same logic wherever local obligations or customer impacts differ: group control can support local accountability, not replace it.

Worked example: a provider concentration limit breaks after a model migration

A financial institution permits no more than nine material AI use cases to depend on one provider without a tested substitute. The monthly inventory shows eight. A portfolio reconciliation finds two embedded AI features in critical SaaS products that were omitted because the vendor marketed them as workflow automation. The verified count is ten, which breaches the limit.

The measurement owner preserves the old and corrected populations, the vendor evidence, calculation, and policy version. The two new records affect customer communications and fraud operations. One feature can be disabled; the other is embedded and contractually hard to separate. The event is an appetite breach and an inventory-control failure. It is not yet an incident because no failure or harm has been identified.

The dashboard shows the portfolio breach and the named case. It does not average concentration against strong fairness or security measures. The committee sees the alternative, cost, exposure, controls, expiry, and remediation. That is a risk decision. “Vendor strategy under review” is not.

Common failure modes

Run a 30-day pilot on material use cases

Days 1-5 - Authority and measures. Confirm the applicable appetite statements, prohibited uses, authority matrix, notification paths, and source hierarchy. Select five to ten material use cases. Rewrite each measure with numerator, denominator, units, warning, breach, source, owner, frequency, and policy version.

Days 6-10 - Population and calculation. Freeze the inventory snapshot. Reconcile models, systems, vendors, embedded features, incidents, exceptions, and remediation. Implement deterministic calculations and data-quality checks. Produce a parallel manual result.

Days 11-15 - Scenarios. Simulate a performance breach, provider concentration breach, AI incident, prohibited use, stale measurement, and expiring exception. Test classification, containment authority, evidence preservation, escalation clocks, and group/local routing.

Days 16-22 - Human challenge. Run cases through business, first line, second line, specialist functions, management, and committee gates. Measure missing evidence, reclassification, decision time, conditions, dissent, and wrong-authority routing.

Days 23-27 - Closure. Repair at least one simulated control failure. Recompute, retest, remediate affected records, remove temporary access, and collect closure approval. Verify that expired exceptions block continuation.

Days 28-30 - Decision. Report coverage, false alerts, real blind spots, time to containment, overdue actions, exceptions nearing expiry, and evidence quality. Approve expansion only if the workflow surfaces named material cases and can stop or constrain use when authority requires it.

Useful metrics include percentage of measures with reproducible calculations, inventory-to-measure coverage, false and missed alerts, time from signal to containment, time to independent challenge, overdue remediation, exceptions renewed, conditions violated, cases closed without retest, and local issues missing from group reporting.

FAQ

What is an AI risk appetite exception workflow?

It is the controlled path from a warning, threshold breach, incident, prohibited use, or expiring exception through validation, containment, independent challenge, approval, remediation, escalation, and evidence-based closure.

Are the FSB sound practices legally binding?

No. They are non-binding recommendations. Institutions must separately determine which laws, supervisory expectations, contracts, and internal policies apply to a specific entity and use case.

When do the MAS guidelines take effect?

The final document says Sections 3 and 4 take effect on October 7, 2027. Sections 5 and 6 take effect on October 7, 2028. Earlier readiness work should be labeled preparation, not current compliance proof.

Can the AI prepare the exception?

It can assemble supplied evidence, reformat controlled calculations, identify missing fields, and draft options. It must not set appetite, interpret law conclusively, accept residual risk, approve itself, or close the case.

How is this different from an AI inventory?

The inventory establishes population, ownership, materiality, and lifecycle evidence. This workflow begins when an approved use approaches or crosses a boundary and manages the decision until verified closure.