The Responsible AI Portfolio Indicator: A Governance Framework for Portfolio-Level Investigation of Responsible AI Risk in Regulated Enterprises

Responsible AI governance frameworks establish obligations at the system level. A system either passes its fairness assessment or it does not. A system either has a current responsible use assessment or it does not. What no existing framework requires, and what no existing governance instrument provides, is a portfolio-level view of the pattern of responsible AI risk across an organisation’s active AI estate. This paper introduces the Responsible AI Portfolio Indicator (RAPI) as a governance instrument that addresses this gap. The RAPI is not a composite score or an aggregate index. It is a structured investigation trigger: a quarterly portfolio-level pattern map of responsible AI risk that surfaces which systems carry material risk across which governance dimensions, enabling the organisation’s Chief AI Officer (CAIO) and Chief Risk Officer (CRO) to direct investigation and remediation resources to the highest-risk concentrations before formal KRI escalation thresholds are breached. The paper argues that the absence of a portfolio investigation trigger is a structural gap in all major responsible AI governance frameworks, including ISO/IEC 42001:2023, the EU AI Act, GDPR, APRA CPS 230, the NIST AI RMF, and the IMDA Model AI Governance Framework for Agentic AI, and that this gap is not remedied by the system-level obligations those frameworks impose. The paper demonstrates that the RAPI’s seven governance dimensions — harm potential, fairness and non-discrimination, transparency and explainability, data and privacy, human dignity and autonomy, systemic and societal impact, and regulatory and reputational risk — are independently grounded in the responsible AI literature and do not require composite weighting to serve their governance function. The RAPI closes a gap that compliance-oriented governance frameworks are structurally unable to close: the gap between knowing that individual systems are assessed and knowing where the organisation’s responsible AI risk is concentrated.