Enterprise-Wide AI Risk Management (EW-AiRM™)

EW-AiRM™ (Enterprise-wide AI Risk Management) is an open, three-layer framework for governing AI risk across an organisation. It is developed by Markus Krebsz and stewarded by the Human-Ai.Institute, an independent think tank run by De-Risking Solutions Ltd in the United Kingdom.It is designed to extend an organisation’s existing enterprise risk management (ERM) framework to cover AI, rather than replace it. It is aimed at boards, regulators and risk practitioners. 

It is the direct successor to HAiPECR™, listed in this catalogue since April 2023. The framework builds on earlier conduct-risk instruments presented through the UNECE Working Party 6, the Global Conduct Risk Paradigm and the Universal Conduct Risk Paradigm, published via the United Nations UNECE Working Party 6 in 2017 and includes ECE/TRADE/486.  

The framework has three layers. The strategic layer covers strategic (board-level governance, risk appetite and accountability), operational (day-to-day risk identification, assessment, controls and monitoring across the AI lifecycle), and Resilience (eight AI Black Swans, incident response, recovery and preparedness for low probability, high impact events). Six supporting pillars span governance, risk, controls, culture, assurance and resilience. They are designed to integrate with existing enterprise risk management, not sit alongside it. Five non-negotiables set the minimum governance conditions for any deployment.

EW-AiRM™ is evidence-based and quantified. It incorporates the MIT AI Risk Repository, maintained by the MIT FutureTech team, covering more than 1,700 catalogued AI risks across 7 domains and 24 subdomains, with 831 mapped controls. A master risk-to-controls mapping enables organisations to move from abstract principles to concrete, testable control environments. The framework also defines eight categories of AI Black Swan events (including multi-agent emergence and the quantum cryptographic transition) for tail-risk resilience planning, and five Non-Negotiables setting the minimum governance conditions for any deployment.

Implementation is proportionate through three tiers (Core, Standard and Full), allowing SMEs, corporates, financial institutions, public bodies and NGOs to adopt the same architecture at a depth appropriate to their exposure. Progress is monitored through KXIs (Key X Indicators), an umbrella for performance, risk and control indicators. The framework is published in full as a Wiley Finance book, Enterprise-Wide AI Risk Management, and supported by IRM and IOR practitioner training, an online course, an implementation toolkit and assessment tooling, all accessible via the framework website. It is designed to remain interoperable with the EU AI Act, ISO/IEC 42001, the NIST AI RMF and the Council of Europe Framework Convention on AI.