A living document that lists all the known risks of an AI system — what could go wrong, how serious it is, what is being done about it, and who is responsible.
A living document that lists all the known risks of an AI system — what could go wrong, how serious it is, what is being done about it, and who is responsible.
An AI risk register is the operational artefact of an AI risk management programme. Each entry typically includes: a risk identifier and description, the AI system and deployment context, potential causes and triggers, affected stakeholders, likelihood and impact scores, inherent and residual risk ratings, treatment actions with owners and deadlines, and current risk status. For high-risk AI systems under the EU AI Act, the risk management documentation required by Article 9 is substantively equivalent to a maintained risk register. Risk registers should be integrated with post-market monitoring so that new risks identified in operation are added promptly.
AI governance teams should maintain risk registers at the level of individual AI systems, not just programme level — enabling system-specific risk accountability and trend analysis across the portfolio.
Like a project risk register in project management — a structured, living document that tracks identified risks, treatment status, and ownership, reviewed regularly as the project progresses.
A living document that lists all the known risks of an AI system — what could go wrong, how serious it is, what is being done about it, and who is responsible.
An AI risk register is the operational artefact of an AI risk management programme. Each entry typically includes: a risk identifier and description, the AI system and deployment context, potential causes and triggers, affected stakeholders, likelihood and impact scores, inherent and residual risk ratings, treatment actions with owners and deadlines, and current risk status. For high-risk AI systems under the EU AI Act, the risk management documentation required by Article 9 is substantively equivalent to a maintained risk register. Risk registers should be integrated with post-market monitoring so that new risks identified in operation are added promptly.
AI governance teams should maintain risk registers at the level of individual AI systems, not just programme level — enabling system-specific risk accountability and trend analysis across the portfolio.