  Organizations that develop and deploy artificial intelligence (AI) systems
need to manage the associated risks - for economic, legal, and ethical reasons.
However, it is not always clear who is responsible for AI risk management. The
Three Lines of Defense (3LoD) model, which is considered best practice in many
industries, might offer a solution. It is a risk management framework that
helps organizations to assign and coordinate risk management roles and
responsibilities. In this article, I suggest ways in which AI companies could
implement the model. I also discuss how the model could help reduce risks from
AI: it could identify and close gaps in risk coverage, increase the
effectiveness of risk management practices, and enable the board of directors
to oversee management more effectively. The article is intended to inform
decision-makers at leading AI companies, regulators, and standard-setting
bodies.
