AI risk register template: columns, examples and how to use it
An AI risk register lists what could go wrong with the AI tools your organisation uses, how likely and serious each risk is, what you do about it, and who is responsible. Here are the columns to use, real example risks, and how to fill one in.
The columns
Risk description
What could go wrong, in one sentence, naming the tool and the task. Give each risk a number so it can be referred to.
Context / relevance
Why it matters for you: how the tool is actually used, and what data goes into it.
Potential impact
What happens if it goes wrong: to customers, staff, money, records or your reputation.
Likelihood
Low, medium or high, judged from how often the task happens and how easy the mistake is to make.
Existing or recommended controls
The checks that reduce the risk, written so someone can do them: who checks what, how often.
Owner
One role responsible for the risk and its controls, not "everyone".
Example risks
Three of 15 risks, word for word, from a pack written for a fictional dental practice in Australia with 12 staff that uses ChatGPT, Microsoft Copilot and the AI scheduling assistant in its practice software.
| Risk description | Context / Relevance | Potential impact | Likelihood | Existing or recommended controls | Owner |
|---|---|---|---|---|---|
| R3: A ChatGPT or Microsoft Copilot summary of a supplier invoice misstates a unit price, leading to an incorrect payment. | Supplier emails are summarised to prepare payments. Only supplier correspondence with patient details removed may be entered into these tools. | Overpayment or underpayment; supplier dispute; loss of funds; unreliable payment records. | Medium | Practice Manager checks a sample of 5 summaries against source emails monthly. Amounts are verified against the original invoice before any payment is approved. | Practice Manager |
| R4: The AI scheduling assistant double-books a hygiene appointment after a late cancellation. | The assistant writes directly to the practice software diary. Late cancellations create pressure to rebook quickly, which raises the chance of conflicts in the diary. | Chair time lost; patient waiting; front desk conflict; patient complaint about the booking. | Medium | Reception Team Lead checks a sample of 10 bookings against the diary monthly. Reception staff confirm any rebooking made after a late cancellation against the diary at the time. | Reception Team Lead |
| R10: Oversight remains informal, so checks are not performed consistently and cannot be demonstrated. | Current oversight of drafts and supplier summaries has no written procedure, no sampling and no record of checks. | Errors go undetected; the practice cannot show that review occurred; weak basis for incident investigation. | High | Practice Manager writes a one-page review procedure and starts the monthly samples within 30 days. Sample results are recorded and reviewed at the annual risk register review. | Practice Manager |
How to fill it in
- List every AI tool in use, including AI features inside software you already have, and what each is used for.
- For each tool and task, ask what could go wrong: wrong output relied on, information entered that shouldn't be, a decision about a person made unfairly or without a human check, people not told AI was used, or the supplier changing how it handles your data.
- Write each risk as one sentence that names the tool and the task, then fill in the context, impact and likelihood.
- Add controls that are specific enough to check: a named role, a sample size and how often.
- Give each risk an owner and a review date, and keep the register next to your AI tool inventory so the two match.
Not sure which rules apply?
Some risks come from the rules where you operate, such as telling people about automated decisions. The free checkers tell you which apply.
Need more than a policy?
The AI Policy & Risk Pack is written from your answers about how your organisation uses AI, for Australia, the UK, the EU or the US. Preview every section free before you pay. It's a starting point to review and adopt, not legal advice.
- AI Acceptable Use Policy
- AI Risk Checklist
- AI Risk Register
- Transparency & Disclosure Notices
- Rollout Plan and Adoption Guide
- AI Tool Inventory
- Staff Acknowledgement Form
- Management Summary
Questions
What is an AI risk register?
A table of the things that could go wrong with the AI tools your organisation uses, how likely and serious each is, what you do to reduce it, and who is responsible.
How is it different from a general risk register?
It's the same idea, focused on AI: each risk is tied to a specific tool and task, and the controls are about checking output, the data that goes in and decisions about people.
How often should it be reviewed?
At least once a year, and whenever you add a new AI tool, change how one is used, or have an incident. A register that isn't reviewed quickly stops matching what people actually do.
Is there a free template?
The columns and examples on this page are free to copy. The full pack includes a risk register written from your own tools and answers, as an editable Excel file.
Related: AI acceptable use policy, free AI checklists and the AI policy template by region. General information, not legal advice.