Governance framework & guidance
What Risk Acceptance means
Acceptance does not mean the Risk has disappeared. It means the organisation has consciously decided that the residual position can be tolerated under the stated circumstances.
Keep it separate from AI Use Approval
Risk Acceptance answers: Are we prepared to tolerate this residual Risk? AI Use Approval answers: Should this organisational AI Use be permitted to proceed? A Use may have several Risks, unresolved Actions, specialist concerns or conditions. Accepting one Risk therefore cannot automatically approve the whole Use.
When should acceptance be revisited?
A material change, reassessment, incident, control failure, changed residual rating or expiry of a review condition may mean the original acceptance no longer reflects current circumstances. Swell preserves the original decision while allowing a new governance decision to be recorded.
Deterministic rules do not accept Risk
Swell can identify conditions, calculate governed risk positions and require an acceptance decision, but the organisation remains responsible for the judgement. Deterministic logic supports consistency; it does not replace accountable human authority.
Using Swell AI
What should be recorded?
- The Risk being accepted and its current residual rating.
- The person with authority to accept it.
- The rationale for the decision.
- Any conditions, monitoring or review requirements.
- The date and governance context in which the decision was made.