Residual Risk

Residual risk is the level of risk that remains after controls and mitigations have been applied to an AI system. No safeguard eliminates risk completely, so organizations must document what is left over, decide whether it is acceptable, and assign someone to own it. For compliance and legal teams, residual risk is the figure regulators, auditors, and boards ask about when they want to know whether a company's AI deployments are genuinely under control.

1 item

ResearchUS2026-11-07

External AI Audits Cannot Stand Alone, California Frameworks Show

A Law360/MLex commentary by Maria Dinzeo and Amy Miller examines California's emerging independent AI audit frameworks. It finds that current evaluation methods cannot reliably confirm that advanced AI models are safe. The analysis concludes that external audit reports should be treated as one layer of evidence, not a substitute for internal controls, continuous monitoring, and residual-risk acceptance. Compliance teams that treat an audit certificate as a compliance endpoint face unresolved governance exposure.

independent audit California AI safety assurance AI governance residual risk continuous monitoring