EW-AiRM — Enterprise-Wide AI Risk Management

EW-AiRM — Enterprise-Wide AI Risk Management — 69% of in-scope requirements covered.

12 requirements · 8 in scope (3 enforced · 5 designed) · 4 out-of-scope (outside KYE™’s authority layer). The 69% is weighted over the in-scope base.

EW-AiRM: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. system-approval-not-action-authority · enforced

    An enterprise-wide AI-risk sign-off approves a SYSTEM for use; it does NOT grant per-action authority — every…

    Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  2. non-negotiable-named-accountability · enforced

    EW-AiRM non-negotiable: a single, named, accountable owner for the AI system — accountability that cannot be…

    Audit events: kye.purpose.request.v1 · Constitution: 00 index

  3. f-critical-no-averaging-override · enforced

    EW-AiRM F-Critical rule: a critical failure condition cannot be averaged away by strong scores elsewhere…

    Audit events: kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  4. non-negotiable-tested-human-override · designed

    EW-AiRM non-negotiable: a tested human override / off-switch on the AI system

    Audit events: kye.purpose.admissibility.v1 · Constitution: 36 governedui

  5. residual-risk-acceptance-as-authority-condition · designed

    The board's accepted residual-risk statement is consumed as a runtime authority CONDITION — actions outside…

    Audit events: kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  6. documented-haipecr-consumption · designed

    The HAiPECR pre-deployment evidence record is consumed as a deploy-gate / action-policy input

    Audit events: kye.purpose.request.v1 · Constitution: 70 framework mapping rail

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Human-AI Institute / Markus Krebsz — Enterprise-Wide AI Risk Management (EW-AiRM); risk-taxonomy substrate: MIT AI Risk Repository (https://airisk.mit.edu/). · License: EW-AiRM is an expert governance framework authored by Markus Krebsz / the Human-AI Institute. The KYE™ registry paraphrases each requirement's runtime-facing intent and cites the framework for mapping purposes only; it does not reproduce the framework text.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
System approval vs per-action authority (the boundary)11000100%
Non-negotiable — named accountability11000100%
Non-negotiable — no score-averaging over a critical failure11000100%
Non-negotiable — tested human override1010050%
Residual-risk acceptance → runtime condition1010050%
HAiPECR record consumption1010050%
Non-negotiable — named incident route1010050%
Black-Swan resilience — runtime evidence1010050%
Board risk-appetite quantification100000%
Organisational-readiness assessment100000%
AI-necessity assessment100000%
MIT AI Risk Repository taxonomy100000%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
ewairm.system-approval-not-action-authorityAn enterprise-wide AI-risk sign-off approves a SYSTEM for use; it does NOT grant per-action authority — every consequential action is still admissibility-checked at the moment it is attemptedenforcedengines: internal, internal, internal
audit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
ewairm.non-negotiable-named-accountabilityEW-AiRM non-negotiable: a single, named, accountable owner for the AI system — accountability that cannot be diffused across a committeeenforcedengines: internal
audit_events: kye.purpose.request.v1
constitution_refs: constitution/00-INDEX.md
ewairm.f-critical-no-averaging-overrideEW-AiRM F-Critical rule: a critical failure condition cannot be averaged away by strong scores elsewhere — one hard fail fails the wholeenforcedengines: internal, internal
audit_events: kye.purpose.admissibility.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
ewairm.non-negotiable-tested-human-overrideEW-AiRM non-negotiable: a tested human override / off-switch on the AI systemdesignedengines: internal, internal
audit_events: kye.purpose.admissibility.v1
constitution_refs: constitution/36-GOVERNEDUI.md
ewairm.residual-risk-acceptance-as-authority-conditionThe board's accepted residual-risk statement is consumed as a runtime authority CONDITION — actions outside the accepted envelope are denieddesignedengines: internal
audit_events: kye.purpose.admissibility.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
ewairm.documented-haipecr-consumptionThe HAiPECR pre-deployment evidence record is consumed as a deploy-gate / action-policy inputdesignedengines: internal
audit_events: kye.purpose.request.v1
constitution_refs: constitution/70-FRAMEWORK-MAPPING-RAIL.md
ewairm.non-negotiable-named-incident-routeEW-AiRM non-negotiable: a named incident-escalation and contestability route for the AI systemdesignedengines: internal
audit_events: kye.evidence.decision_map.v1
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md, constitution/61-RIGHTS-DISPUTES-DISCLOSURE-RAIL.md
ewairm.black-swan-runtime-resilience-evidenceRuntime resilience evidence under tail (Black-Swan) conditions — replay-provable behaviour when a dependency or scenario degradesdesignedengines: internal
audit_events: kye.evidence.pack.v1
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/51-NO-SPOF.md
ewairm.board-risk-appetite-quantificationQuantifying the board's AI risk appetite and translating it into risk-tolerance thresholdsout-of-scope(no enforcement cited)
ewairm.organisational-readiness-assessmentAssessing organisational readiness (people, process, culture, governance maturity) to adopt the AI systemout-of-scope(no enforcement cited)
ewairm.ai-necessity-assessmentAssessing whether AI is necessary and appropriate for the use-case at all (the necessity / proportionality question)out-of-scope(no enforcement cited)
ewairm.mit-risk-taxonomy-classificationClassifying AI risks against the MIT AI Risk Repository taxonomy substrateout-of-scope(no enforcement cited)

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.