An AI risk register is a single list of every AI tool and use case in your organisation, with its risks, controls, owner and review date. It doubles as your AI inventory, which ISO/IEC 42001, NIST AI RMF and the EU AI Act all expect. Copy the columns below into a spreadsheet, or download this page as a Word document.
Columns
| Column | What to write |
|---|
| ID | AI-001, AI-002… |
| Tool and plan | e.g. Claude Team |
| Use case | What it is used for, in one sentence |
| Owner | The person accountable |
| Users | Teams or number of users |
| Data types | Public / internal / confidential / personal / special category |
| Risk category | Privacy, security, accuracy, bias, IP, legal, vendor |
| Risk description | What could go wrong |
| Likelihood (1–5) | |
| Impact (1–5) | |
| Inherent score | Likelihood × impact |
| Controls | Training off, DPA, SSO, human review… |
| Residual score | Score after controls |
| SafeScore | Score and date from KurateAI |
| EU AI Act category | Prohibited / high-risk / transparency / minimal |
| Decision | Approved / approved with conditions / rejected |
| Review date | Next check |
| Notes | Incidents, vendor changes |
Example rows
| ID | Tool | Use case | Data | Main risk | Score (L×I) | Controls | Residual | Decision |
|---|
| AI-001 | ChatGPT Business | Drafting client emails | Confidential | Wrong facts reach a client | 3×4 = 12 | Human review; training off | 4 | Approved |
| AI-002 | Meeting note-taker | Summarising internal meetings | Internal, personal | Recording without consent | 3×3 = 9 | Announce recording; delete after 30 days | 3 | Approved with conditions |
| AI-003 | Free image generator | Social media images | Public | Copyright in outputs | 2×3 = 6 | Use commercial-safe tool | 2 | Rejected |
How to keep it useful
- Add a row before any new tool is used, not after.
- Review the whole register every quarter and after every incident.
- Keep it where everyone can see the approved tools, but only the owner can edit.