Governance framework & guidance
What is an AI Risk?
An AI Risk describes uncertainty about something that could occur in connection with an AI Use and the consequences that could follow. Risk considers both likelihood and consequence and must be understood in the context of the organisational use.
Australian Government guidance recommends a fit-for-purpose approach to AI-specific risk management, organisational risk tolerance, risk assessment, treatment and reassessment over the AI lifecycle.
An AI Use is not automatically a Risk
An AI Use is an organisational activity involving AI. A Risk is an identified uncertainty or potential event requiring risk management. Swell does not create a Risk merely because an AI Use exists, preventing the Risk Register from becoming a second copy of the AI Register.
AI Uses awaiting Formal Assessment remain visible separately so the organisation can see the governance gap without manufacturing risks that have not yet been established.
Inherent and residual Risk
Inherent Risk describes the position before relevant controls are relied upon. Residual Risk describes the position after eligible and effective controls have been considered.
A Control does not reduce residual risk merely because a Control record exists. Its relevance, implementation, ownership, evidence, verification and effectiveness matter.
Understanding the Risk Matrix
Swell provides a visual Risk Matrix showing the organisation’s current AI-risk position. The customer-facing view uses Low, Medium and High likelihood and consequence for clear presentation while preserving the more detailed governed risk data underneath.
Each matrix cell shows its risk band and the number of current applicable Risks. The matrix supports both inherent and residual views and is a visual summary, not a replacement for the detailed Risk Register.
Risk treatment
- Accept — tolerate the Risk without further action where appropriately authorised.
- Avoid — stop or change the activity to remove the Risk.
- Mitigate — apply Controls or Actions to reduce likelihood or consequence.
- Transfer — shift or share aspects of the consequence with another party where appropriate.
Risk Acceptance is not AI Use Approval
Risk Acceptance asks whether the organisation is prepared to accept a particular residual Risk. AI Use Approval asks the broader question of whether the organisational Use should be permitted to proceed.
Accepting a Risk does not automatically approve the underlying AI Use.
Using Swell AI
How authoritative Risks are created
Formal AI Risks arise from governed facts and deterministic rules rather than a generative model reading free text and deciding what sounds risky. The relationship remains traceable from AI Use → Assessment → Rule Result → Risk → Risk Rating.
A lightweight Report AI Concern workflow can capture an employee’s plain-language concern, but authoritative risk logic only uses confirmed structured information.