Risk Mitigation Hierarchy for AI: A Comprehensive Guide
Risk Mitigation Hierarchy for AI
Why Is This Important?
As AI systems become increasingly embedded in critical decision-making processes across industries, the potential for harm — whether to individuals, organizations, or society at large — grows significantly. The Risk Mitigation Hierarchy for AI provides a structured, prioritized framework for addressing these risks systematically. Understanding this hierarchy is essential because:
• It ensures that the most effective risk controls are considered first, rather than defaulting to less reliable measures.
• It aligns AI governance with established safety engineering principles used in occupational health, environmental protection, and other mature disciplines.
• It helps organizations demonstrate due diligence and responsible AI practices to regulators, stakeholders, and the public.
• It is a core concept in AI governance frameworks, including those tested in the AIGP (AI Governance Professional) certification exam.
What Is the Risk Mitigation Hierarchy for AI?
The Risk Mitigation Hierarchy for AI is an ordered set of strategies for reducing or eliminating risks associated with AI systems. It is adapted from the traditional hierarchy of controls used in workplace safety and engineering, and applies these principles specifically to the AI lifecycle. The hierarchy prioritizes interventions from most effective to least effective:
1. Elimination
The most effective control is to remove the risk entirely. In the AI context, this means deciding not to develop, deploy, or use an AI system when the risks are deemed too high or when the use case does not justify the potential harm.
Examples:
• Deciding not to deploy a facial recognition system in contexts where it could lead to mass surveillance or disproportionate harm to marginalized communities.
• Choosing not to automate certain high-stakes decisions (e.g., criminal sentencing) where AI limitations could cause irreversible harm.
• Abandoning an AI project after a risk assessment reveals unacceptable bias that cannot be adequately corrected.
2. Substitution
If elimination is not feasible or desirable, the next best approach is to replace the high-risk AI system or component with a less risky alternative. This could mean using a simpler model, a different technology, or a non-AI solution that achieves similar objectives with lower risk.
Examples:
• Replacing a complex deep learning model (which is opaque and difficult to audit) with a more interpretable model such as a decision tree or logistic regression, especially in high-stakes domains like healthcare or lending.
• Substituting an autonomous AI decision-making system with a decision-support tool that keeps a human in the loop.
• Using rule-based systems instead of machine learning for tasks where transparency and predictability are paramount.
3. Engineering Controls
Engineering controls involve building technical safeguards directly into the AI system to reduce risk. These are systemic measures that do not rely on individual human behavior to be effective.
Examples:
• Implementing robust testing, validation, and monitoring pipelines to detect model drift, bias, or performance degradation.
• Building in technical constraints such as output filters, confidence thresholds, or guardrails that prevent the system from taking certain actions.
• Employing differential privacy, federated learning, or data anonymization techniques to protect personal data.
• Designing fail-safe mechanisms that default to a safe state when the AI system encounters unexpected inputs or errors.
• Red-teaming and adversarial testing to identify vulnerabilities before deployment.
4. Administrative Controls
Administrative controls involve policies, procedures, training, and governance structures that guide how people interact with and oversee AI systems. They are less reliable than engineering controls because they depend on consistent human compliance.
Examples:
• Establishing AI governance committees, ethics boards, or review panels to oversee AI development and deployment decisions.
• Creating and enforcing AI use policies, acceptable use guidelines, and standard operating procedures.
• Providing training and awareness programs for employees who develop, deploy, or interact with AI systems.
• Conducting regular impact assessments (e.g., Data Protection Impact Assessments, Algorithmic Impact Assessments).
• Implementing incident response plans and escalation procedures for AI-related failures or harms.
• Maintaining documentation, audit trails, and model cards for transparency and accountability.
5. Warnings and Personal Protective Equipment (PPE) Equivalent
In traditional safety hierarchies, the least effective control is PPE — protective equipment that the individual must use correctly. In the AI context, the equivalent includes warnings, disclosures, notices, and end-user controls that place the burden of risk management on the individual user or affected person.
Examples:
• Providing transparency notices or disclosures that inform users they are interacting with an AI system.
• Displaying confidence scores, uncertainty indicators, or explanations alongside AI-generated recommendations.
• Offering opt-out mechanisms or user-controlled settings that allow individuals to limit AI-driven personalization or automated decisions.
• Publishing model limitations and known biases in user-facing documentation.
How Does the Hierarchy Work in Practice?
The hierarchy should be applied sequentially, starting from the top. Organizations should first ask whether the risk can be eliminated entirely. If not, they should explore substitution, then engineering controls, then administrative controls, and only rely on warnings and user-level protections as a last resort or as a supplementary layer.
In practice, a layered approach is common and often necessary: most real-world AI deployments will use a combination of controls from multiple levels of the hierarchy. However, the key principle is that organizations should not default to lower-tier controls (like disclosures or training alone) when higher-tier controls (like elimination, substitution, or engineering safeguards) are feasible.
Key Principles to Remember:
• Higher-level controls are more effective because they reduce or remove the hazard at its source rather than relying on human behavior.
• Lower-level controls are supplementary, not substitutes for higher-level controls.
• The hierarchy applies across the entire AI lifecycle — from design and development through deployment, monitoring, and decommissioning.
• Risk mitigation should be proportionate to the severity and likelihood of potential harms.
• The hierarchy supports the principle of prevention over cure — it is better to prevent harm than to remediate it after it occurs.
Relationship to AI Governance Frameworks
The Risk Mitigation Hierarchy aligns with and supports several prominent AI governance frameworks:
• NIST AI Risk Management Framework (AI RMF): Emphasizes identifying, assessing, and managing AI risks through a structured approach, consistent with hierarchical risk mitigation.
• EU AI Act: Classifies AI systems by risk level (unacceptable, high, limited, minimal) and prescribes controls proportionate to the risk — effectively applying elements of the hierarchy (elimination for unacceptable risks, engineering and administrative controls for high-risk systems, transparency obligations for limited-risk systems).
• ISO/IEC 23894 (AI Risk Management): Provides guidance on AI risk management that aligns with hierarchical control strategies.
• OECD AI Principles: Promote robustness, safety, transparency, and accountability — all of which are addressed by different levels of the hierarchy.
Exam Tips: Answering Questions on Risk Mitigation Hierarchy for AI1. Know the Order and Be Able to Rank ControlsExam questions may present you with several possible risk mitigation strategies and ask you to identify which is
most effective or should be prioritized. Always remember the order:
Elimination → Substitution → Engineering Controls → Administrative Controls → Warnings/User-Level Protections. The correct answer will typically favor higher-level controls.
2. Distinguish Between LevelsBe prepared to classify specific actions into the correct level of the hierarchy. For example:
• Deciding not to build an AI system = Elimination
• Using a simpler, more interpretable model = Substitution
• Adding bias detection algorithms = Engineering Control
• Creating an AI ethics policy = Administrative Control
• Providing a disclosure notice to users = Warning/PPE equivalent
3. Watch for Scenario-Based QuestionsThe exam may present a scenario where an organization is deploying an AI system and ask what they should do first, or what the best approach is. Apply the hierarchy from the top down. If a question describes an organization that jumps straight to training employees or posting disclosures without considering whether the AI system should be deployed at all, recognize this as an inadequate approach.
4. Understand That Controls Are LayeredSome questions may test whether you understand that multiple levels of the hierarchy can (and often should) be applied simultaneously. The hierarchy does not mean you only pick one level — it means you prioritize higher levels and supplement with lower ones as needed.
5. Connect to Broader AI Governance ConceptsBe ready to link the hierarchy to related concepts such as:
•
Risk assessment and impact assessment (you need to assess risks before applying the hierarchy)
•
Proportionality (controls should match the risk level)
•
Human oversight and human-in-the-loop (relates to substitution and engineering controls)
•
Transparency and explainability (relates to engineering controls and warnings)
•
Accountability structures (relates to administrative controls)
6. Remember the Safety Engineering OriginsIf a question references the traditional hierarchy of controls from occupational health and safety (OHS) or asks about the origin of the concept, know that the AI risk mitigation hierarchy is
adapted from the well-established hierarchy of controls (often depicted as an inverted triangle) used in workplace safety for decades.
7. Anticipate Tricky Answer ChoicesBe wary of answer options that sound responsible but represent lower-tier controls. For instance, "provide comprehensive training to all AI developers" sounds good but is an administrative control. If elimination or a technical safeguard is also available as an option, the higher-tier control is the better answer.
8. Use Process of EliminationIf you are unsure, eliminate answers that represent the lowest levels of the hierarchy first. The exam typically rewards answers that reflect proactive, systemic, and preventive approaches over reactive, individual-dependent, or disclosure-only measures.
9. Think About Context and FeasibilitySome questions may present situations where elimination or substitution is not realistic. In those cases, the best answer may be engineering controls supplemented by administrative controls. Always consider what is
feasible and proportionate given the scenario described.
10. Key Vocabulary to Know• Hierarchy of controls
• Elimination, substitution, engineering controls, administrative controls, PPE/warnings
• Defense in depth (layered controls)
• Residual risk (risk remaining after controls are applied)
• Proportionality
• Human-in-the-loop / Human-on-the-loop / Human-in-command
• Fail-safe / fail-secure mechanisms
Summary Mnemonic: E-S-E-A-WEliminate → Substitute → Engineer → Administer → WarnRemember this order, and you will be well-equipped to handle any exam question on the Risk Mitigation Hierarchy for AI.
