How to build and maintain an AI risk register

This guide is for the governance or risk lead standing up an AI governance program who needs a working register, not a template to fill in by hand.

What an AI risk register holds

A register earns its place by being specific. A row that reads “AI risk: high” tells no one anything. A useful entry carries enough to act on.

• The risk itself, described in plain terms. What could go wrong, to whom, in what circumstances.
• The source system. Which AI system in your inventory this risk belongs to, so the register ties back to something real.
• A likelihood and a consequence rating that your reviewers set. These are judgments your people make about this system in its context, not a number the software hands down.
• The owner. A named person accountable for the risk, not a team or a function.
• The treatment. The control or controls in place or planned, and their status.
• The review date. When the entry was last looked at, and when it is due again.

The register is not the assessment. An assessment is the work of examining one system and its risks in context. The register is where the risks from every assessment sit together, so you can see the whole picture across the organisation and report on it.

Where the risks come from

The traditional way to populate a register is to gather people in a room, work through a spreadsheet and write down what everyone can think of. That produces a snapshot that is out of date the moment a new system is added, and standing one up this way is analyst or consultant work before you have a single row. The bigger problem is that a hand-built register is disconnected from the systems it describes. When a system changes, nothing tells the register.

The alternative is to source risks from assessments rather than from memory. You assess a system, the assessment surfaces the risks that system actually carries, and those risks flow into the register attached to their source. Do this for every system in your inventory and the register builds itself out of the assessment work you were going to do anyway.

This is how Aicura Essentials populates the register. Aicura is your AI Register, so the inventory of systems is already in one place. When you run a risk assessment against a system, Aicura generates the register entries from the risks that assessment surfaces, each one linked back to the system and the assessment it came from. You review and set the ratings, ownership and treatment. Aicura does not decide the risk level and does not sign anything off. It surfaces the risk picture so your people can.

Build the register in five steps

1. Catalogue your AI systems first

You cannot register risks for systems you have not found. Start from a complete inventory of the AI in use, including the tools bought as features inside other software and the models teams have adopted quietly. Aicura is your AI Register. It holds the AI systems in use as the record, versions each as systems change and prompts your people when something needs attention, so the inventory is a live record rather than a survey you re-run each quarter.

2. Run a risk assessment against each system

Assess one system at a time, in the context of how it is actually used. The risk of an AI tool depends on the job it does. The National AI Centre gives the example of a chatbot that answers simple questions during business hours under staff supervision, a low-risk use, against the same chatbot running around the clock without oversight and handling complex questions, where the risk expands. It is the same tool with a different risk because the context is different, and the assessment is where that context is captured.

3. Record the risks each assessment surfaces

As each assessment identifies risks, they become entries in the register. In Aicura this happens as you go. The risks the assessment surfaces are written into the Risk Register linked to their source, so you are not copying findings from one place to another and losing the connection in the process.

4. Set ownership, ratings and treatment

For each risk, assign a named owner, agree a likelihood and consequence rating and record how the risk is being treated. Treatment usually means a control. In Essentials the controls are derived from the assessment and drafted for you to review, so the link from risk to control to the system is kept intact. The guide to AI controls covers this in full. The ratings and the sign-off are decisions your reviewers make. The tool holds the record.

5. Review and re-assess as systems change

A register is only worth keeping if it reflects reality. Set a review cadence, and re-run the assessment when a system changes materially, when a new system is registered or when its use expands. Because each entry is tied to the assessment that produced it, re-assessing updates the register at its source rather than leaving you to reconcile a stale list by hand. The register stays connected to the assessments it came from, so it reflects the footprint as the footprint moves.

Keeping it current is the point

The reason to source a register from assessments rather than build it by hand is not the first version. It is the second, and the twentieth. A hand-built register decays. Each new system and each change in how a system is used is a chance for the spreadsheet and the reality to drift apart, and over time they do. A register generated from assessments and connected to its source does not carry that maintenance debt. You maintain the contents by keeping your assessments current. The register follows.

This is the practical case for a program buyer choosing a tool over the manual route. The work of assessing systems still belongs to you and your people. What you are not doing is rebuilding the register by hand each time the picture changes, or paying someone to.

The boundary

Governance surfaces the risk picture. The business owner decides. Aicura registers your systems, runs the assessments, generates the register and drafts the controls, and it does all of this so the people accountable can see clearly and act. It does not certify your AI as safe, audit your organisation or tell you a risk is acceptable. Those are decisions for your organisation and its people, and a register exists to inform them, not to replace them. Aicura is AI governance support, and this guidance is not legal advice.

Pairs with

• How to build and manage AI controls
• How to write and maintain AI governance policies
• Scenario: document and manage AI risk
• The Voluntary AI Safety Standard (Department of Industry, Science and Resources)
• Framework: the NSW AI Assessment Framework

Ready to build yours? Start with Aicura Essentials.

The primary source

The National AI Centre sets out risk management for AI under essential practice 3, “Measure and manage risks”, in its Guidance for AI adoption: foundations. It asks organisations to create a risk screening process to flag AI systems and specific uses that pose unacceptable risk or need extra governance attention, and as a next step to conduct risk assessments and create mitigation plans for each specific use and its identified impacts, applying risk controls based on the level of risk. Read it at ai.gov.au.

A note on this page. This guide explains how to build and maintain an AI risk register and how Aicura Essentials supports that work. It is general information, not legal advice, and it does not certify or audit your organisation. For how a specific obligation applies to you, read the source above in full and take your own advice.