Operational (it breaks the workflow), ethical & reputational (it harms people or trust), regulatory (it breaks a rule), security (it leaks or is attacked). Each family has different owners, different mitigations, and a different meeting where it gets discussed — map your live AI uses onto the four and assign names.

Banks have run model risk management for decades; AI inherits the discipline: an inventory of every model and vendor in production, a validation note per entry (what it touches, what it must never do), scheduled re-checks, and the monitoring that notices silent degradation before customers do.

The EU AI Act's risk tiers, sector rules that bite harder than the horizontal law, and the two duties almost everyone already has: disclosure and data protection. A quarterly radar review with legal — not a law degree, a checklist and a calendar.

When (not if) an AI system causes harm — wrong output shipped, private data surfaced, a decision that should have had a human — the difference is rehearsal: detect (who notices?), contain (kill switch, who holds it?), notify (customers, regulator, board), learn (feed the post-mortem into the risk map).