Skip to main content
Bureau of AI
Category: Risk Assessment & Analysis

Emergent Risk

Also known as: Emerging Risk
Simply put

Emergent risk refers to a risk that is new, poorly understood, or evolving, and whose potential to cause harm is not yet fully known. Such risks may not have a significant impact on an organization today but are marked by high uncertainty and the possibility of growing substantially in importance. Because knowledge about these risks is often weak, they can be easy to overlook even though they should be tracked.

Formal definition

As commonly defined across enterprise risk management sources, an emergent (or emerging) risk is a risk that is poorly understood or evolving in areas where the available body of knowledge is weak, and which is expected to grow greatly in significance over time. Practitioner definitions typically emphasize three features: limited current impact, high uncertainty, and rapid or unforeseen development, distinguishing it from established risks that are already characterized and controlled. Note that usage is not fully standardized: the terms 'emergent risk' and 'emerging risk' are often used interchangeably, and specific definitions vary by source and organizational context. This entry is drawn from general risk-management references in the evidence and does not reflect a single authoritative or regulatory definition; the AI-specific application of the concept is out of scope of the sources provided.

Why it matters

Emergent risks matter because organizations tend to allocate attention and controls toward risks that are already characterized and measurable, leaving newer or poorly understood exposures under-monitored. As commonly defined in enterprise risk management sources, an emergent risk may have limited impact today yet carry high uncertainty and the potential to grow substantially in significance. This combination makes such risks easy to overlook precisely when early tracking would be most valuable, because the body of available knowledge about them is still weak.

The challenge is compounded by the fact that emergent risks resist the quantification that established risk processes depend on. Where a characterized risk can be measured, controlled, and monitored against thresholds, an emergent risk often lacks the historical data or shared definitions needed to size it. This means governance and risk functions must decide how to keep a risk 'on the radar' before its likelihood and impact are fully understood, rather than waiting for it to become measurable.

Usage is not fully standardized: the sources treat 'emergent risk' and 'emerging risk' largely interchangeably, and specific definitions vary by source and organizational context. Practitioners should therefore be careful to confirm which definition a given framework or organization is using before relying on the term in policy or reporting, since a mismatch in scope can affect how a risk is escalated and tracked.

Who it's relevant to

Enterprise Risk Managers
Those responsible for organization-wide risk registers must decide how to capture risks that are not yet significant but carry high uncertainty and potential for rapid growth. The emergent risk concept gives them a category for tracking exposures that do not fit established, quantifiable risk processes.
Risk and Audit Functions
Functions charged with oversight benefit from a defined way to surface risks characterized by weak available knowledge, so that these are kept visible and monitored rather than overlooked because they cannot yet be measured against thresholds.
Governance and Oversight Bodies
Boards and committees that set risk appetite and oversight priorities need to understand that emergent risks may warrant attention despite limited current impact. Recognizing the distinction between emergent and established risks helps ensure early-stage exposures are contemplated in governance discussions.
Policy and Compliance Specialists
Because the terms 'emergent risk' and 'emerging risk' are used interchangeably and defined differently across sources, professionals drafting or interpreting internal policy should confirm the specific definition in use within their organization to avoid inconsistent scoping and escalation.

Inside Emergent Risk

Unanticipated behavior
Emergent risk typically refers to risk arising from AI system behaviors, capabilities, or failure modes that were not foreseen during design, development, or initial validation. The defining feature is that the risk was not identified in advance rather than that it is necessarily novel in kind.
System-level and interaction effects
Such risks often surface from interactions between model components, data, deployment context, or human users rather than from a single isolated component. This distinguishes emergent risk from a static inventory of known model risks assessed in isolation.
Temporal and post-deployment dimension
Emergent risks frequently become observable only after deployment, as conditions shift, usage patterns change, or the model encounters inputs outside those anticipated during development. This overlaps with, but should not be conflated with, model performance degradation, which concerns declining accuracy against expected metrics rather than the appearance of previously unidentified risks.
Relationship to inherent and residual risk
Emergent risk complicates conventional inherent-versus-residual risk framing, because a risk that was never identified cannot have been fully captured in an inherent risk assessment or offset by designed controls. It is best treated as a reason to revisit those assessments rather than as a substitute for them.
Governance versus model risk management framing
Emergent risk sits at the intersection of AI governance (the organizational structures and oversight needed to detect and escalate the unexpected) and model risk management (the measurement, monitoring, and control of model-related risks). The distinction matters: governance provides the accountability to surface emergent risk, while model risk management provides the technical monitoring, and neither alone is sufficient.

Common questions

Answers to the questions practitioners most commonly ask about Emergent Risk.

Is emergent risk the same as a risk that was simply missed during initial assessment?
Not necessarily. Emergent risk, as commonly used, refers to risk that arises or becomes material through the interaction, deployment, or evolution of an AI system over time, rather than a known risk that was overlooked during initial assessment. A missed risk was present and identifiable at the outset; an emergent risk may not have been reasonably foreseeable given the system's state, data, or operating context at that time. In practice the two can be difficult to distinguish after the fact, and organizations should be cautious about relabeling assessment gaps as emergent risk, since doing so can obscure weaknesses in the original risk identification process.
Does identifying emergent risk mean the model itself has failed or its performance has degraded?
No. Emergent risk should not be conflated with model performance degradation. Performance degradation refers to a measurable decline in a model's predictive or operational quality over time, often against defined metrics. Emergent risk is broader: it can arise even when a model performs as designed, for example through new uses, changed operating environments, interactions with other systems, or downstream harms that were not contemplated. A model can meet its performance thresholds while still giving rise to emergent risk, and conversely degradation is only one possible source of emergent risk among several.
How can an organization detect emergent risk when it was not foreseeable at the outset?
Because emergent risk may not be visible at initial assessment, many frameworks emphasize ongoing monitoring rather than one-time evaluation. Common practices include periodic re-review of the system's use cases and operating context, monitoring of inputs and outputs for drift or unexpected patterns, incident and near-miss reporting channels, and feedback mechanisms from users and affected parties. These measures reduce the likelihood that emergent risk goes undetected, but they do not eliminate it; detection depends on the scope and sensitivity of the monitoring in place.
Who is responsible for managing emergent risk across the lines of defense?
Responsibility is typically distributed rather than assigned to a single function. In a common three-lines model, the first line (those who own and operate the system) is often positioned to detect emergent risk during day-to-day use, the second line (independent risk and compliance functions) sets monitoring expectations and challenges risk assessments, and the third line (internal audit) provides independent assurance over whether the process is working. The precise allocation varies by organization and is not standardized across all frameworks, so roles should be defined explicitly rather than assumed.
How should emergent risk be documented and escalated once identified?
Practices vary, but organizations commonly capture emergent risk through their existing risk register or issue-tracking process, recording what was identified, when, its potential impact, and the difference from previously assessed risks. Escalation thresholds are typically defined in advance so that risks meeting certain severity or likelihood criteria are raised to appropriate governance bodies. Clear documentation also supports later distinction between genuinely emergent risk and gaps in the original assessment. The specific documentation and escalation requirements depend on the organization's governance structure and any applicable framework or guidance.
How does managing emergent risk relate to residual risk in ongoing governance?
Emergent risk that is identified and not fully mitigated contributes to the residual risk that remains after controls are applied. Because emergent risk can change the risk profile of a system after deployment, treating residual risk as a fixed, one-time figure can be misleading. In many frameworks, residual risk is re-evaluated as new or emergent risks are identified, so ongoing monitoring feeds back into periodic reassessment. Governance controls in this area are intended to reduce and manage emergent and residual risk, not to eliminate it.

Common misconceptions

Emergent risk is the same as model performance degradation.
These are distinct. Performance degradation refers to a measurable decline against expected metrics for a known objective, whereas emergent risk refers to risks that were not identified in advance and may involve behaviors or failure modes outside the original monitoring scope. Degradation can be an emergent risk, but not all emergent risk is degradation.
A thorough inherent risk assessment eliminates emergent risk.
By definition, emergent risk includes what was not anticipated, so it cannot be fully captured by an upfront assessment. Assessments reduce and structure known risk; they do not remove the possibility that unanticipated risk will surface later, which is why ongoing monitoring and re-assessment are commonly emphasized.
Emergent risk is a single, standardized regulatory term with one authoritative definition.
The concept is used across AI governance and model risk management contexts and its precise meaning varies by framework and sector. As commonly defined it centers on unanticipated risk, but practitioners should treat its scope as context-dependent rather than fixed, and should not assume any specific regulatory instrument mandates a particular definition.

Best practices

Establish ongoing post-deployment monitoring that can surface behaviors and failure modes outside the original validation scope, rather than relying solely on pre-deployment assessment.
Maintain clear escalation and accountability pathways so that unanticipated behaviors observed by first-line users or operators reach second-line risk functions and, where appropriate, oversight bodies.
Periodically revisit inherent and residual risk assessments as usage, data, and deployment context evolve, treating them as living documents rather than one-time exercises.
Distinguish in monitoring design between performance degradation against known metrics and signals of previously unidentified risk, since detecting the latter often requires broader, less metric-bound observation.
Document assumptions and known limitations of each model at deployment, so that later deviations from those assumptions can be recognized as candidate emergent risks.
Coordinate governance and model risk management functions so that organizational oversight and technical monitoring reinforce each other in detecting and responding to unanticipated risk.