Executive briefThe same model can tidy notes or commit money

One team uses a general-purpose model to summarise internal meeting notes for twelve trained employees. Nothing leaves the firm, no system is updated and every reader can correct the draft. Another team connects the same model to a payment tool serving thousands of accounts. A plausible error can become an external commitment within seconds and propagate before an operator sees it. Calling both deployments “medium-risk generative AI” conceals the control problem.

Risk-tiering should begin with the business decision or action, the interests it can affect and a set of credible consequence scenarios. It then asks how quickly exposure develops, where it concentrates, who can detect it, whether authority can be frozen, which state can be restored, how affected cases are found and what redress remains possible. The model is one dependency inside this system, not the unit that receives the tier.

The original mechanism proposed here is the Consequence and Recovery Record. Its twelve parts define a scenario-level case file. A Consequence-Recovery Plane preserves two dimensions that an additive heat map would blur. Five operational tiers allocate evidence, authority, exposure and recovery proof. The highest controlling condition remains visible instead of being averaged down by favourable but unrelated properties.

Probability still matters for scenario selection, monitoring capacity and exposure estimation. It does not make an unsupported multiplication of ordinal likelihood and impact meaningful, nor can a low estimate excuse a credible catastrophic path with no recovery. Evidence confidence should be attached to the claim. Uncertainty widens the case for containment or learning; it is not a convenient zero.

The strongest rival: use a few simple categories

A short legal or policy taxonomy can be easier to teach, audit and enforce than an elaborate internal system. Bespoke tiers invite scoring games, boundary shopping and governance theatre. Some uses should simply be prohibited; some decisions should always require named human authority. This rival defines the guardrail for the method: internal tiering never weakens a mandatory classification, prohibition or sector rule, and no use needs a complex record when a simpler binding rule already settles the control.

Consequence and Recovery RecordTwelve parts describe a scenario without manufacturing precision

The record is completed for each material scenario, not once for a broad “use case”. A customer-communication capability may have a routine factual-error scenario and a concentrated vulnerability scenario with a different recovery path. Recording both prevents the average case from becoming a hiding place for the controlling one.

Consequence-Recovery PlaneKeep severity and demonstrated recovery visibly separate

The horizontal axis represents recovery confidence, from no credible path through described and partially tested controls to independently demonstrated recovery within the required time. Confidence is specific to a scenario and deployment version. A successful exercise for one population or tool does not transfer automatically to another.

The vertical axis represents consequence bands: bounded operational inconvenience; meaningful customer, workforce or enterprise harm; material financial, rights, safety or service harm; and prohibited, unacceptable or practically irrecoverable consequence. Severity is supported by evidence and affected-interest analysis, not a universal exchange rate between unlike harms.

Plot the credible scenarios rather than one blended point. A summary error may sit low with strong recovery, while an accidental sensitive disclosure from the same capability sits higher and farther left. The controlling scenario is the highest credible consequence whose recovery proof is insufficient. Strong cost controls, good latency or easy restoration for other scenarios cannot drag it into a lower tier.

Movement on the plane requires new evidence or a changed exposure, not persuasive language. A live recovery exercise can move a scenario right. Granting tool authority, multiplying volume or connecting a counterparty can move it upward or reveal faster propagation. Removing live authority and operating in shadow may reduce current exposure while the team proves detection and correction.

Five operational tiersIntensity rises across control, evidence, authority and exposure

Tier A, bounded and reversible, covers low-consequence effects with visible errors, a contained population and proven correction. Standard inventory, change control, testing, monitoring and user correction remain necessary. Low tier does not mean no governance.

Tier B, managed exposure, covers meaningful but bounded consequences where detection, containment and redress have been tested. Release limits, enhanced evaluation, named monitoring, incident triggers and periodic recovery exercises constrain exposure. Growth is conditional on evidence rather than time in service.

Tier C, consequential authority, covers material customer, rights, financial, safety or operational effects. Independent evidence and a named human authority sit before commitment. The human must have time, information and power to intervene; their mere appearance in a workflow does not lower the tier.

Tier D, unproven recovery, applies when a severe or rapidly propagating credible scenario lacks demonstrated detection, containment, restoration or redress. The use remains in shadow, simulation or tightly restricted exposure designed to prove the missing capability. An untested runbook does not count as recovery.

Tier E, inadmissible under current controls, covers prohibited, unacceptable or practically unrecoverable uses. Better monitoring or an approval checkbox cannot compensate for the controlling condition. Reconsideration requires a changed purpose, authority, architecture or consequence path, not a higher appetite statement.

PropagationA single output can become a distributed business effect

Consequence changes when a model output is consumed. A flawed recommendation may be caught by a sceptical analyst, copied into a queue, accepted by a rules engine, executed by a tool, transmitted to a counterparty and repeated across a population. Each boundary adds authority, volume, delay and a possible point of detection or containment.

Map the full propagation path: evidence and context, model contribution, human or workflow decision, tool call, system write, external commitment, downstream dependency and affected population. Mark fan-out, asynchronous branches, caches, retries and derived records. Detection at the model gateway may miss a later misuse; rollback of the originating service may leave committed payments, messages or decisions intact.

Speed is not throughput alone. It includes time to irreversible effect and time before a correction becomes practically ineffective. A false customer message is visible immediately yet can be shared widely. A biased workforce ranking may propagate slowly but distribute exclusion across months before any individual can observe the pattern. Both need consequence-specific signals.

Concentration matters beside totals. Ten thousand minor inconveniences are not interchangeable with ten denials concentrated in a vulnerable group, nor is average performance evidence that an affected tail is safe. Define the eligible population, exposed population and relevant intersections. Assurance samples the controlling subgroups and pathways rather than reporting one aggregate rate.

Recovery chainRollback is not restoration, and restoration is not redress

Detection establishes that a scenario may be occurring and identifies its boundaries. Containment stops new exposure, freezes authority and isolates uncertain state. Restoration returns systems, records and service to a verified condition. Correction identifies and repairs affected cases. Redress provides notice, explanation, appeal, compensation or another appropriate remedy. Residual-harm assessment records what cannot be restored.

Each link needs an owner, target time, input, output and exercise. A detection dashboard without decision authority does not contain. A model rollback does not reverse tool effects. A restored ledger does not tell customers that an adverse decision was wrong. A notification does not make a lost opportunity whole. Recovery confidence is bounded by the weakest necessary link.

Consider a customer communication that incorrectly states a deadline. The team restores the template and corrects the website within an hour. Some customers have already acted, missed alternatives or lost trust. Technical rollback succeeds, but full recovery requires identification of recipients, a clear correction, relief for affected cases and monitoring for conduct outcomes. Residual harm remains visible even after the incident ticket closes.

Restoration targets should cover state and meaning. Reconcile queued and in-flight decisions, duplicate or missing actions, cached content, downstream copies and evidence continuity. Test both planned rollback and messy partial failure. Record the point beyond which reversal is impossible and the fallback for people whose cases cannot be reconstructed.

Overrides and authorityAn internal tier cannot grant legal or moral permission

Legal and policy classifications answer questions set by their own scope. The EU AI Act contains prohibited-practice and high-risk provisions with defined actors, systems and timing. Canada's Algorithmic Impact Assessment applies within its federal administrative-decision context and links impact levels to requirements. An enterprise consequence tier is neither classification. It can allocate stricter internal controls, but it cannot declare compliance or downgrade a binding category.

Begin with an override gate. Ask whether the purpose or practice is prohibited, whether a mandatory legal or sector classification applies, and whether policy reserves the decision for an authorised person. Record the source, scope advice and owner. If the override says do not deploy, the internal plane does not reopen the case. If it requires human authority, the tier can strengthen evidence and recovery around that boundary but cannot automate it away.

Sector context changes credible consequences. Model-risk guidance stresses inventory, validation, governance and effective challenge in applicable financial institutions. Medical-device guidance treats the total product lifecycle and the performance of the human-AI team as material. Operational-resilience principles focus on critical operations, tolerances and interdependencies. These are prompts for contextual analysis, not universal claims that every deployment belongs to those regimes.

Human authority is assigned before consequential commitment in Tier C, but it is not an automatic mitigation. Confirm that the person is competent, independent enough, given material evidence, protected from automation bias, allowed sufficient time and able to stop or change the action. Where machine speed defeats intervention, reduce autonomy, cap volume, delay commitment or move the use into Tier D.

Recovery proofExercise the controlling scenario, not a comfortable substitute

A recovery exercise begins with the exact scenario: affected population, propagation graph, unavailable components, corrupted or uncertain state, time to harm and residual duties. Observers inject the failure without advance operational choreography. The team must detect, declare, freeze authority, contain fan-out, reconcile state, identify affected cases, restore service, communicate and begin remedy inside declared targets.

Evidence includes timestamps from independent sources, policy and model versions, queue and tool state, affected-case counts, unresolved records, notification coverage, human decisions, recovery deviations and residual harm. Independent challenge asks whether the exercise proved the claimed scenario or merely demonstrated a prepared happy path. A tabletop supports learning but does not equal live technical and operational proof.

Recovery proof expires. Changes to model, context, data, tool, authority, population, geography, volume, autonomy, supplier, policy or recovery dependency can invalidate part of it. The owner maps which scenarios and recovery links are affected, narrows exposure if needed and reclassifies before the changed capability resumes full operation.

Confidence should be recorded claim by claim. A team may have strong evidence that a kill switch stops new tool calls, moderate evidence that downstream counterparties honour cancellation and weak evidence that every affected customer can be identified. Calling the whole recovery plan “tested” destroys that information. The case file links each claim to method, environment, sample, observer, date, limitations and expiry. Where evidence is missing, the tier reflects the unproven link rather than management confidence or the completeness of the document.

Tier disputes deserve a controlled appeal. A product owner may contest scenario credibility, an affected-interest representative may challenge population boundaries, or operations may show that a target cannot be met. The review forum examines the exact contested claim and evidence, not a negotiated average. Until resolution, the stricter credible condition governs exposure. The decision receipt records dissent, rationale, conditions and the evidence that could change the result. This prevents commercial urgency from becoming an undocumented risk acceptance while allowing genuine new information to move a scenario on the plane.

Independent challenge is proportionate but real. Tier A may need peer review and routine assurance sampling. Tier B requires someone outside delivery to examine the controlling scenario and recovery exercise. Tiers C and D require authority and assurance capable of rejecting release. Tier E decisions should be tested for consistent enforcement and unauthorised workarounds. Independence is about the power and incentives to challenge the claim, not merely the organisational label of the reviewer.

NIST SP 800-61 Rev. 3 integrates incident response with cybersecurity risk management. SP 800-34 addresses contingency planning and testing, while SP 800-160 Volume 2 addresses cyber-resilient systems. Basel operational-resilience principles emphasise critical operations, tolerance and interdependencies. They support disciplined preparation and recovery, but a specific AI consequence still needs its own affected-case and redress design.

Ten worked casesClassify credible effects, not impressive technology

These cases illustrate control allocation. Each has multiple possible scenarios; the table names the controlling one under the stated conditions. A real review completes all twelve fields, confirms any override and records why weaker alternatives fail.

Interactive instrumentConsequence and Recovery Tiering Board

Select a case or alter its evidence. The Board returns exactly one of five operational outcomes. It reports a controlling scenario and non-compensable condition rather than a risk score, and it never claims that the internal tier establishes legal compliance.

Executive operating cadenceKeep tiers attached to live authority and recovery evidence

The Consequence and Recovery Record, Plane, five tiers and Tiering Board are this article's synthesis. NIST, ISO and OECD provide broader risk, management and classification structures. European Union and Canadian sources demonstrate legally or administratively significant categories. NIST contingency and resilience publications and Basel principles support recovery discipline. Sector guidance shows why context changes the required evidence.

The inventory should name capability, business decision, model and non-model dependencies, authority, affected population, controlling scenario, current tier, override, last exercise, evidence expiry and accountable owner. Review Tier C through E exposures more frequently than stable Tier A uses, but also use event triggers. An annual calendar is not enough when an agent gains a payment tool tomorrow.

At release, confirm that the implemented authority and exposure match the tier receipt. At operation, monitor controlling scenarios and control limits rather than generic model health alone. At incident, preserve decision and action evidence, identify affected cases and invoke the recovery chain. After exercise or incident, update scenario credibility, residual harm and the tier instead of closing only the technical ticket.

Boards should see the distribution of capabilities by tier, the credible scenarios controlling Tier C through E, expired recovery proof, non-compensable conditions, overdue redress, concentration and material reclassifications. They should not see a single average risk number that permits numerous easy controls to offset one unrecoverable path.

Current source status checked on 2 September 2026 includes NIST SP 800-61 Rev. 3, published in April 2025, alongside the live NIST AI RMF and GenAI Profile records, OECD classification framework, Government of Canada Algorithmic Impact Assessment, Basel operational-resilience principles and FDA-led medical-device guidance. The Federal Reserve, OCC and FDIC Revised Guidance on Model Risk Management of April 2026 supersedes SR letter 11-7. Pin the actual versions and legal advice used in each classification.

The practical standard is to tier what the deployed capability can cause, not what its model is called. Make credible consequence, propagation and affected interests explicit. Demand evidence for detection, containment, restoration, correction and redress. Treat residual harm as real after systems recover. Where recovery is unproven, remove live authority and learn in shadow. Where the use is prohibited or practically irrecoverable, do not deploy it under current controls.

Source recordWorks cited

1. NIST. Artificial Intelligence Risk Management Framework.
2. NIST. Generative Artificial Intelligence Profile.
3. ISO. ISO/IEC 23894.
4. ISO. ISO/IEC 42001.
5. ISO. ISO 31000 Risk management.
6. OECD. Framework for the Classification of AI Systems.
7. European Union. Regulation (EU) 2024/1689.
8. Government of Canada. Algorithmic Impact Assessment.
9. NIST. SP 800-30 Rev. 1.
10. NIST. SP 800-61 Rev. 3.
11. NIST. SP 800-34 Rev. 1.
12. NIST. SP 800-160 Vol. 2 Rev. 1.
13. Basel Committee on Banking Supervision. Principles for operational resilience.
14. Federal Reserve, OCC and FDIC. Revised Guidance on Model Risk Management.
15. FDA, Health Canada and MHRA. Good Machine Learning Practice for Medical Device Development.
16. European Union. Regulation (EU) 2022/2554.
17. UK Health and Safety Executive. Legal requirements and ALARP guidance.