Residual Risk
The harm that remains after your controls have done their work: the errors a threshold still lets through, the failure mode an eval measured and could not remove, the segment where reliability is lowest. It never reaches zero, so it is always accepted by somebody; the governance question is whether that acceptance was a considered decision or a default.
Defined in 7 GAGE programs, which carry 22 distinct definitions of it. The wording above is taught in Certified AI Governance Professional (CAIGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
The harm that remains after your controls have done their work: the errors a threshold still lets through, the failure mode an eval measured and could not remove, the segment where reliability is lowest. It never reaches zero, so it is always accepted by somebody; the governance question is whether that acceptance was a considered decision or a default.
A known, unaddressed weakness that an organization has chosen, deliberately, not to fully remediate right now, because of cost, competing priorities, or business impact. Defensible only when documented explicitly, with a named person who accepted the risk and, where possible, a review date; indistinguishable from an undiscovered gap when left silent.
The risk that remains after elimination and engineering controls have reduced a hazard as far as reasonably achievable. A well-designed workcell still carries some residual risk; the correct practice is to document and manage it explicitly rather than claim a false zero.
The risk that remains after mitigations are applied. A complete assessment names the highest residual Risk Priority, the person who accepts it, and the review date; the EU AI Act requires acceptable residual risk for high-risk systems (Article 9).
The risk that remains after compensating controls have been applied, distinct from risk that has been closed at its root cause. A governance record should name residual risk explicitly rather than implying a compensating control has eliminated it.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Risk Assessment in AI Decisions · Critical Thinking and Context Engineering, Certified AI Practitioner: Workplace Foundations
- Building Your Context Engineering Portfolio: Capstone Project · Critical Thinking and Context Engineering, Certified AI Practitioner: Workplace Foundations
- The Parts That Make an Agent Act · The Agent, Deconstructed, Certified Agentic AI Governance Professional (CAAGP)
- What to Test · Testing and Red-Teaming, Certified Agentic AI Governance Professional (CAAGP)
- Testing What You Did Not Build · Testing and Red-Teaming, Certified Agentic AI Governance Professional (CAAGP)
- Pass, Fail, or Accept · Testing and Red-Teaming, Certified Agentic AI Governance Professional (CAAGP)
- Governance that survives: rebuilding the estate's defenses so the next attack finds less · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
- Fixing the model, breaking it again: why fixes are never free · Build Before You Govern, Certified AI Governance Professional (CAIGP)
- Third-party data and the vendor claims you must verify yourself · Data Reality, Certified AI Governance Professional (CAIGP)
- The trust boundary: what this system may decide alone and where a human signs · Evaluation and Trust, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where Residual Risk starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Knows when to trust, verify, escalate or override an AI recommendation, and stays accountable for the decision.
2 lessons on this page teach it as a primary outcome.
Defines who reviews AI outputs, what they check, when they can override, and how to keep review from becoming a rubber stamp.
One lesson on this page teach it as a primary outcome.
Reviews purpose, data, affected people, accuracy, bias, security, oversight, vendors and law for a use case, scores likelihood and impact, and documents residual risk.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Product Manager, responsible product editionneeds it at depth · 3 open postings this week
- Ethical AI Specialistneeds working knowledge · 5 open postings this week
- Operations Manager, AI-readyneeds it at depth
- Responsible AI Leadneeds it at depth · 7 open postings this week
- Autonomous Systems Governance Lead, robotics and physical AI editionneeds working knowledge
- AI Literacy Leadneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act Article 14; NIST AI RMF GOVERN; ISO/IEC 42001 Annex A; NIST AI RMF MAP and MEASURE.
One interview question about it
A model recommends a decision that affects a person. What do you check before you act on it, and when do you overrule it?
Asked of candidates for judgment when ai supports a decision. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Operations, claims, customer service and administration carries it as a claim to back up: Deciding when to escalate a case is judgment under uncertainty.
- Privacy and data protection carries it as work you can show: A DPIA is an impact assessment; the AI version adds accuracy, bias and oversight.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.