AI risk register template

How to create an AI risk register that shows use cases, owners, data categories, decision impact, controls, and residual risk.

Buyer

AI governance owners, IT, operations, risk, and management teams

Problem

Companies cannot prioritize AI risk when all tools and use cases are discussed informally and no risk record exists.

What to look for

Fields for use case, owner, system, users, data category, output use, decision impact, controls, and residual risk.
Clear risk signals for customer, employee, regulated, financial, legal, and automated-decision workflows.
Mitigation tracking that turns concerns into actions and owners.

Red flags

The register lists AI tools but not how outputs are used.
Sensitive-data use is not separated from low-risk productivity use.
No one reviews residual risk or updates controls.

Implementation steps

List active and planned AI use cases, not just vendor names.
Score data sensitivity, decision impact, external exposure, vendor dependency, and control strength.
Record mitigations such as human review, data restrictions, vendor opt-out, logging, and approval ownership.
Use residual risk to decide approve, restrict, escalate, or block.
Review changes when data categories, users, vendors, outputs, or customer commitments change.

Template preview

Use case: customer-support draft replies. Data: customer tickets. Output: customer-facing after human review. Residual risk: medium.

Use case: internal meeting summaries. Data: internal non-sensitive notes. Output: internal only. Residual risk: low.

Use case: employee performance summaries. Data: employee records. Output: employment-related. Residual risk: high until HR/legal review.

Use note

An AI risk register is a management tool, not a legal classification or regulatory determination. Use it to organize facts and escalate the right workflows.

FAQ

Is an AI risk register different from an AI inventory?

Yes. An inventory records what exists; a risk register evaluates exposure, impact, controls, and what needs action.

Can small companies use a simple register?

Yes. A simple register is often the best first step before formal governance tooling.