Forking paths of AI governance – how risk management frameworks shape the politics of AI

‘Risk’ is omnipresent in the governance of artificial intelligence (AI). It structures the EU’s AI Act and stands central in US policy frameworks and AI governance initiatives of the OECD. We analyze how risk management frameworks, as dominant policy tools, shape the politics of AI. Empirically, we focus on the leading risk management frameworks: the US NIST AI Risk Management Framework and the ISO/IEC Risk Management Standards, as well as the harmonizing work in the OECD. We show how risk management in AI is both performative and productive. It is performative as it reformats the governance object – AI risks – and limits which AI-related concerns count as problematic and as worthy of policy intervention. At the same time, AI risk management is productive. Through the semblance of administrative control, it enables the development and diffusion of AI products even in the face of uncertainties and conflicts about AI’s societal impact.