AI Risk Register
A register for the risks of the AI systems you use or build, with scores, ratings, owners and actions, and a summary of what is still open.
Free to use, and nothing is sent anywhere.
What each sheet holds
- A Register sheet with a row for each risk: the system, what could go wrong and to whom, category, likelihood, impact, owner, controls in place, action, due date, status and date last reviewed
- A score and a rating worked out from likelihood and impact, with the limits for High and Medium on a Settings sheet you can change
- A Scales sheet saying what each level of likelihood and impact means, in terms of wrong output and who it reaches
- Categories from data quality and model accuracy through privacy, supplier and fairness, as lists you can edit
- A Summary sheet counting the risks still open, by rating and by category, and marked example rows to overwrite
How to keep it alive
- 01
Agree what the levels mean before anyone scores
Read the Scales sheet aloud with the people who will score. Where levels seem to fit equally, the workbook says to take the higher. Keep that rule or replace it, but choose.
- 02
Write each risk so a stranger could check it
Say what goes wrong and to whom. A risk called model risk has no owner. A wrong refund answer sent and acted on before anyone sees it does.
- 03
Review it on a date, and record the date
Use the Summary to see what is open and fill in the last-reviewed column. A register nobody reviews becomes a record of last year's worries.
Limits
A register holds the risks someone thought of, which falls short of all of them. The scores are judgments, so the rating is only as sound as the scoring. It is not legal advice, an audit or a compliance record.
On this page
Is a register the right tool yet?
A register is cheap to start and easy to fill with noise. It earns its place under some conditions and wastes effort under others.
A register fits when
- A system is live, or about to be, and someone can name who answers for it
- People have opinions about what could go wrong and none has been written down
- A risk or compliance lead needs one place to show what is open and who owns it
- A board or auditor has asked how AI risk is tracked
Look elsewhere when
- No system exists yet, in which case the governance policy and its approval route come first
- The need is a go or no-go on one system, which a scored review of that system answers better
- The aim is evidence for a regulator, because the register is a working aid and carries no certification
The cost is attention. Every row is a row someone must review on a date, so a short register with owners who answer beats a long one with owners in name only.
What sits beside the register?
A register shows what is open. The AI Governance Assessment on this site shows who owns the decisions around your AI, and the AI Governance Policy Starter Template gives those owners a written rule to follow. Our report on who owns an AI system after launch explains why the owner column is the one that decides whether the rest gets read.
What do people ask before starting an AI risk register?
Do we need an AI risk register yet?
You do once a system is live, or about to be, and someone can name who answers for it. It also helps when a risk lead needs a shared place to show what is open. If no system exists yet, the governance policy and its approval route come first.
How should I write a risk so the register is useful?
Say what goes wrong and to whom, so a stranger could check it. Model risk has no owner, but a wrong refund answer that is sent and acted on before anyone sees it does. Then ask the named owner whether they know and have agreed.
How do I decide what each likelihood and impact level means?
Agree it before anyone scores, by reading the scales aloud with the people who will score. They describe each level in terms of wrong output and who it reaches. Where levels seem to fit equally, the workbook says to take the higher; keep that rule or replace it.
Does filling in the register make us compliant?
No. The register is a working aid, not a compliance record. It holds the risks someone thought of, and its ratings are only as sound as the scoring. It is not legal advice or an audit, and it carries no certification, so it will not stand as regulator evidence alone.
Building the register for a real system?
Describe what you are weighing in a few lines. A senior practitioner replies with a suggested first conversation.