AI Risk Management Needs a Better Model