Enterprise Risk Management for AI
The one-paragraph answer
COSO ERM AI compliance is the integration of AI risks into the Committee of Sponsoring Organizations of the Treadway Commission's Enterprise Risk Management framework. COSO ERM (Enterprise Risk Management, Integrating with Strategy and Performance, 2017) is the reference framework for enterprise risk management. Adding AI risks to the ERM inventory, integrating them with strategy, and reporting them to the board is what mature governance looks like.
Companies with mature COSO ERM programs treat AI as a new risk category to integrate rather than a separate program to build. But integrating AI properly requires understanding both COSO ERM structure and AI-specific risks. Most ERM teams have not been trained on AI risks; most AI teams have not been trained on ERM. Bridging the two is the work.
Board oversight, operating structure, values, human capital. Directly connects to Director Oversight for AI.
Risk appetite, strategy alignment, business context. AI adoption strategy must be aligned with risk appetite.
Risk identification, assessment, prioritization, response, portfolio view. AI risks must be inventoried and prioritized alongside other enterprise risks.
Substantial change assessment, continual review. AI risks change rapidly; ERM revision cycles need to match.
Risk-relevant information, internal and external reporting. AI risk reporting to the board is now a standard ERM function.
Boards, audit committees, and rating agencies expect ERM coverage of AI. Insurance underwriters price against ERM maturity. Enterprise buyers assess ERM in vendor diligence. Integrating AI into COSO ERM is how mature governance shows up.
The academic literature on COSO ERM AI is ahead of most corporate practice, and it is unusually blunt. Two findings are worth putting in front of any executive who thinks this is a compliance formality.
“no responsibility, and therefore accountability, is taken due to the lack of understanding of the full socio-technological system”
That is the gap between having AI and governing it. The second finding is the one that tends to change the room.
“organizational culture and structure impact the effectiveness of responsible AI initiatives in practice”
Neither of these is a fringe position. Both come from peer-reviewed work, and both describe the condition most organisations are actually in when the question about COSO ERM AI arrives from the board, the buyer, or the regulator.
This is the sequence that works, and it is not the sequence most organisations choose. They start with the framework and work backwards toward reality. Start with reality.
Done in this order, COSO ERM AI becomes tractable. Done out of order, it becomes a document nobody uses and a control nobody exercises.
Complementary. Use COSO ERM for enterprise integration. Use NIST AI RMF or ISO/IEC 42001 for AI-specific practices. Cross-reference clearly.
The AI Steering Committee Charter™ and Board Reporting Package™ from Volume III of The Operating Discipline for AI Library™ are designed to integrate with COSO ERM structures.
The instinct when a new risk category arrives is to stand up a new program. Resist it. COSO ERM AI integration means AI risks are identified, assessed, prioritised, and reported alongside every other enterprise risk, competing for the same attention and the same capital. A separate AI risk process produces a separate AI risk report that the board reads separately and weighs against nothing. That is how a risk gets managed in isolation and mispriced against the rest of the portfolio.
COSO puts risk appetite at the centre of strategy. Very few boards have articulated an AI risk appetite. What use cases are permitted? Which are prohibited outright? What level of autonomy is acceptable, and where must a human decide? What accuracy is good enough, and good enough for what? Without written answers, every AI decision is made ad hoc by whoever is closest to it, which is precisely the condition COSO ERM AI integration exists to prevent.
Quarterly AI risk reporting to the board or a designated committee, covering the AI inventory, material changes, incidents, third-party exposure, and regulatory developments. Annual review of the AI risk appetite itself. Minutes that record the questions directors asked, not just the papers they received. This cadence serves COSO ERM AI integration and simultaneously builds the record that Caremark oversight requires, which is why doing it once serves two purposes.
The authoritative texts and agency pages behind this summary. We keep this page current, but where a compliance decision turns on exact wording, read the source. Anything concerning COSO ERM AI that carries legal consequence should be confirmed against the enrolled text or the issuing body, not against a secondary summary, including this one.
The AI Business Enablement Audit™ measures your organization against every framework in this library, including COSO ERM and AI, and delivers a defensible governance dossier. Start or finish your audit below.
Start or finish your AI Audit →