What does the ai risk register produce?
Maintain an AI risk statement with affected groups, treatment, ownership, evidence and a customer-assessed residual rating.
Prepare and review the task-specific records in this browser. Inspect consistency findings and retain the complete backup before preparing the finalized pack. Accountable decisions require responsible review.
What do you need before you start?
- Define the named scope, accountable owner and your review basis.
- Retain the actual evidence separately. Recorded links and evidence references are declarations and are not fetched.
- Choose a valid review date. Resolve missing fields, contradictory declarations and date or status findings before relying on the review.
What information do you enter?
The browser workspace asks only for the structured fields listed below.
- AI system or use case (required). Use the name in the organization’s inventory.
- Risk statement (required). Describe the event, cause and potential consequence.
- Affected people or processes (required). Identify the groups, decisions or operations that could be affected.
- Customer-assessed likelihood (required). Use the organization’s own approved scale.
- Customer-assessed impact (required). Use the organization’s own approved scale.
- Treatment and safeguards (required). Record planned or operating controls and unresolved gaps.
- Risk owner (required). Name the person or role responsible for treatment and acceptance.
- Customer-assessed residual rating (required). This tool does not calculate or approve the rating.
- Evidence reference (optional). Use an internal evaluation, incident or control reference.
- Next internal review date (required). Choose the organization’s own review date.
- Treatment status (required). Record the current state of the treatment.
| Field | What to enter | Fictional example |
|---|---|---|
| AI system or use caseRequired | Use the name in the organization’s inventory. | Example document classifier, fictional |
| Risk statementRequired | Describe the event, cause and potential consequence. | Incorrect classification could route a document to the wrong review queue. |
| Affected people or processesRequired | Identify the groups, decisions or operations that could be affected. | Operations reviewers and customers awaiting a response. |
| Customer-assessed likelihoodRequired | Use the organization’s own approved scale.Choose from Low, Medium, High, Unknown. | Medium |
| Customer-assessed impactRequired | Use the organization’s own approved scale.Choose from Low, Medium, High, Unknown. | Medium |
| Treatment and safeguardsRequired | Record planned or operating controls and unresolved gaps. | Human review before action. Monthly error sampling. |
| Risk ownerRequired | Name the person or role responsible for treatment and acceptance. | Operations risk lead |
| Customer-assessed residual ratingRequired | This tool does not calculate or approve the rating.Choose from Low, Medium, High, Unknown. | Unknown |
| Evidence referenceOptional | Use an internal evaluation, incident or control reference. | EXAMPLE-EVAL-012 |
| Next internal review dateRequired | Choose the organization’s own review date. | 2026-11-15 |
| Treatment statusRequired | Record the current state of the treatment.Choose from Open, In progress, Accepted, Closed, Unknown. | In progress |
What you can download
Every result must identify its supplied facts, assumptions and unresolved items.
| Free result | Included downloads |
|---|---|
Enter your information, inspect the on-screen result and keep a browser backup. Editing and direct copies of your entered information stay free. |
These supported outputs are free. No checkout is required. |
How does the ai risk register work?
- 1Prepare the named records
Use the task-specific fields above. Retain original evidence separately and record exact references and versions.
- 2Review internal consistency
Choose the review date. Inspect each scope identity, contradictory declaration, missing decision support and date or status finding.
- 3Keep recoverable work
Download a free backup before replacing or clearing work. Restore earlier record backups or the complete current snapshot, including unfinished drafts.
- 4Prepare the finalized pack
Prepare all nine files, then download them free. Review excerpts in PDF and DOCX against the complete Excel, CSV and JSON. Optional private cloud saving requires sign-in and separate consent.
Method and sources
Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.
- Artificial Intelligence Risk Management Framework 1.0A voluntary US baseline for AI risk records, responsibilities, evaluation and lifecycle decisions. Govern, Map, Measure and Manage.National Institute of Standards and Technology. Published 2023-01-26. Reviewed 2026-10-08.
- AI Risk Management Framework PlaybookImplementation ideas and documentation practices for the AI RMF. Suggested actions for Govern, Map, Measure and Manage.National Institute of Standards and Technology. Published 2023-03-30. Reviewed 2026-10-08.
Common questions
What information does the ai risk register need?
Enter AI system or use case (required). Use the name in the organization’s inventory; risk statement (required). Describe the event, cause and potential consequence; affected people or processes (required). Identify the groups, decisions or operations that could be affected; customer-assessed likelihood (required). Use the organization’s own approved scale; customer-assessed impact (required). Use the organization’s own approved scale. Define the named scope, accountable owner and your review basis.
What does the ai risk register produce?
Complete all-field record review and task-specific scope rows. Every unresolved finding stays visible. Free restorable browser backup including the unfinished draft, editing reference and review date. Nine-file finalized pack. Formal PDF, editable DOCX, complete Excel register and review sheets, records CSV, findings CSV, scope review CSV, complete JSON, file hashes and instructions. Review unresolved findings and limitations before use.
Who makes the final decision?
A responsible person reviews the result. Checks review customer declarations, recorded dates and internal consistency. They do not authenticate evidence, approve an AI use, determine legal applicability or establish conformity, safety or risk acceptance.
Is this tool free?
Yes. The on-screen result and listed downloads are free. No checkout is required. Keep local backups and review the stated method and limits.
Can I use the ai risk register for this task?
Track risks, treatments, evidence and accepted limitations. Checks review customer declarations, recorded dates and internal consistency. They do not authenticate evidence, approve an AI use, determine legal applicability or establish conformity, safety or risk acceptance.
What still needs review?
Checks review customer declarations, recorded dates and internal consistency. They do not authenticate evidence, approve an AI use, determine legal applicability or establish conformity, safety or risk acceptance.
Each workspace supports 1000 records, 20000 characters per field and a 30 MB complete workspace. Invalid and foreign backups preserve current browser work.
PDF and DOCX show the first 20 records, field excerpts through 2000 characters and the first 40 findings. Excel, CSV and JSON retain complete values and derived rows. Referenced files are not fetched or included.