The designated accountable risk authority: Who should resolve the approval uncertainty before deployment?

Residual-risk approval belongs to the designated accountable authority, not automatically to technical, procurement, or documentation personnel.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. The procurement officer who negotiated the vendor contract.

   Procurement can address contractual matters but is not necessarily authorized to decide whether residual impact risk is acceptable.
2. The reviewer who checked application-level documentation.

   Documentation review supports oversight, but reviewing evidence does not itself establish authority to approve residual disparate-impact risk.
3. The designated accountable risk authority. ✓

   Residual risk requires an authorized decision-maker who can accept, reject, or require further treatment within organizational governance.
4. The model developer who tuned the mitigation.

   The developer can provide technical evidence but may lack authority and independence to accept residual organizational risk.

How to remember it

Residual-risk approval belongs to the designated accountable authority, not automatically to technical, procurement, or documentation personnel.

More Understanding How to Govern AI Development questions

• Test adversarial misuse across both workflows: Before approval, which evidence best addresses both foreseeable →
• Measure efficiency gains alongside computing resource use: Which evidence should resolve the environmental →
• Use defect-task fit and two-second latency as selection: Which requirement should guide model selection? →
• All 426 Understanding How to Govern AI Development questions →