AI Risk Register Template

Enterprise risk registers are designed around categories like financial risk, operational risk, compliance risk, and reputational risk. AI risks cut across all of these categories in ways that generic registers do not accommodate. Model drift is an operational risk with compliance implications. Training data bias is a technical risk with legal, reputational, and financial consequences. Prompt injection is a security risk that can manifest as a data privacy violation. When AI risks are forced into generic categories, they get split across multiple register entries, lose their AI-specific context, and become difficult to assess because the scoring rubric was not calibrated for probabilistic system failures.

The scoring rubric uses a five-point scale for both likelihood and impact, with descriptors calibrated to AI system behavior rather than generic business risk. The likelihood scale accounts for the probabilistic nature of AI failures (model degradation is not a question of if but when), and the impact scale considers both immediate effects and downstream consequences.

The following risk categories are pre-populated with the most common AI-specific risks. Use these as a starting point and add organization-specific risks based on your AI system portfolio, industry, and regulatory environment. Each risk entry should be assigned an owner and reviewed on a defined cadence.

Technical risks arise from the inherent characteristics of ML systems: models degrade over time as data distributions shift, training can introduce subtle biases that are difficult to detect, and system complexity makes failure modes hard to predict. The most important technical risk for most organizations is model drift -- the gradual degradation of model accuracy that occurs as the real world changes relative to the training data.

Data risks encompass training data quality issues, data poisoning attacks, privacy violations through model memorization, and data pipeline failures that corrupt features. Data risks are particularly dangerous because they can be invisible: a biased training dataset produces a biased model that generates biased outputs, and without proactive fairness testing, the bias may never be detected until it causes harm.

AI-specific security risks include prompt injection (manipulating model behavior through crafted inputs), model extraction (using API access to reconstruct proprietary models), adversarial attacks (inputs designed to cause misclassification), and training data extraction (recovering training data from model outputs). These risks require defenses beyond traditional application security.

Risk register entries are living documents. Each entry must be reviewed on a defined cadence based on its risk level: critical and high risks monthly, medium risks quarterly, and low risks annually. The review process assesses whether the likelihood or impact has changed, whether current controls remain effective, whether the mitigation plan is on track, and whether new information has emerged that affects the risk assessment.