A fictional freight forwarder first requires a person to approve every AI action, then watches the queue break on a storm day. Match authority to consequence and reversibility, size approval capacity, and name who answers for each decision.
Selecting mitigation does not prove risk has fallen. Track operating controls, implementation milestones, and the authority for carrying remaining exposure.
Keep undecided risks visible. Record the next action and owner alongside the estimate, then preserve approval conditions and implementation evidence.
Connect broad risk appetite to specific outcomes, measurable conditions, and delegated authority. A limit alone does not authorize acceptance.
Expected value can inform a one-time decision. Whether the mean is sufficient depends on utility, tail losses, constraints, and who bears the harm.
Basel III is a minimum standard, not a statute. What binds a bank is whatever its own regulator adopted, which may be stricter and may arrive later.