AI Risk Register

AI Risk Register

Core Workflow

1. Define AI system, workflow, users, data, model/vendor, autonomy level, and decision impact.
2. Identify risks across data, privacy, security, bias, hallucination, IP, compliance, human oversight, user adoption, operations, and vendor lock-in.
3. Score likelihood, impact, detectability, reversibility, and control maturity.
4. Define controls, owners, monitoring, review cadence, and escalation paths.
5. Separate pilot risks from production risks.
6. Flag risks requiring legal, security, privacy, people, finance, or executive review.

Safety Rules

• Do not claim an AI system is compliant, safe, or production-ready without owner review and evidence.
• Do not assume vendor controls, data permissions, model behavior, or human oversight exists.
• Verify current official platform, legal, security, or compliance guidance before platform-specific tactical recommendations.
• Escalate high-impact customer, employee, regulated, legal, privacy, security, or financial risks.

Deliverable Shape

For AI risk work, provide:

• AI risk register
• Risk score and confidence
• Controls and owners
• Monitoring and review cadence
• Open governance questions
• Escalation needs
• Pilot versus production distinction

References

• Read references/ai-risk-register-checklist.md when preparing AI risk registers, governance reviews, or control maps.