Executive briefing: AI risk
AI Risk Register: How Boards Assess and Manage AI Risk
An AI risk register is the board's record of every AI system in use, the risks each one carries, a named owner, the control in place, the evidence it works and a review date. It is fed by an AI risk assessment and anchored to an AI risk management framework such as the NIST AI RMF or ISO/IEC 42001.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- An AI risk register starts with an inventory. You cannot assess the risk of AI you do not know is in use.
- Most AI risk falls into four groups: data, decisions, suppliers and accountability.
- Every risk needs an owner, a control and a line in the board report. A risk with no owner is not managed.
- Anchor the register to a recognised framework. The NIST AI RMF and ISO/IEC 42001 are the two most boards will meet.
- The register is a living document. Review it when AI use changes, not only once a year.
Why the board should care
AI arrives without a project
Staff use AI tools nobody approved, and vendors add AI features to software you already pay for. Neither appears in a traditional risk register.
Enterprise AI still needs governance
An approved, enterprise-grade tool reduces some risks. It does not decide who may use it, for what, or who answers for its output.
Regulation expects a risk process
For high-risk AI, the EU AI Act requires a documented risk management system. A register is the simplest place to show one exists.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
Next step
Build your first AI risk register
The Executive AI Strategy Day (£1,499 + VAT) builds the AI inventory, a first risk register with named owners and a 90-day plan with your leadership team, in one day. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
What is an AI risk register?
An AI risk register is a single record of the AI an organisation uses and the risks it carries. For each system it names the risk, the owner, the control, the evidence that the control works and the next review date, so the board can see who answers for each risk.
Is there an AI risk register template?
A workable register needs five columns: risk, owner, control, evidence and review date, built on a complete inventory of the AI in use. The structure matters less than keeping it current, giving every risk a named owner and reporting it to the board.
What is an AI risk assessment?
An AI risk assessment identifies what could go wrong with a particular use of AI, how serious it would be and what control is needed. It covers data, decisions, suppliers and accountability, and its results feed the AI risk register.
What is the NIST AI risk management framework?
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework released in January 2023. It organises AI risk work into four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile in July 2024.
What is the difference between ISO 42001 and ISO 23894?
ISO/IEC 42001 is a management system standard: it sets requirements for how an organisation governs AI and can be certified against. ISO/IEC 23894 is guidance on AI risk management, built on ISO 31000. Many organisations use both together.
Does the EU AI Act require an AI risk register?
Not by name. Article 9 requires providers of high-risk AI systems to establish, document and maintain a risk management system. For Annex III systems this applies from 2 December 2027, as amended by Regulation (EU) 2026/1744. A register is the natural place to evidence it.
Who should own AI risk in an organisation?
The board sets appetite, an AI governance committee owns the register, an executive AI lead is accountable for the programme, and use-case owners answer for each system day to day. Every risk on the register needs one named owner.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing is general information on AI risk management, including the EU AI Act as amended by Regulation (EU) 2026/1744, correct at the date last reviewed. It is governance guidance, not legal advice. AIPEX is not a certification body and does not certify. For decisions about specific AI systems, take advice from qualified advisers.