Appendix C. AI Risk Register Template
| Risk / scenario | Who is affected | Likelihood | Impact | Control / owner | Review evidence |
|---|---|---|---|---|---|
| Unsupported factual output | Customers / staff | Medium | High | Source checks; process owner | Sample audit and correction rate |
| Sensitive data exposure | Clients / students | Low–Medium | High | Approved tools; redaction; IT lead | Access and retention review |
| Unequal performance | Affected groups | Unknown until tested | High | Group testing; appeal; risk owner | Evaluation and complaints |
| Impersonation / synthetic media | Individuals / public | Medium | High | Verification protocol; comms lead | Incident exercise |
| Agent takes unintended action | Organisation / users | Low–Medium | High | Least privilege; human approval | Tool-action logs and test results |
For each real system, record the risk owner, existing controls, residual risk, escalation threshold, due date, and evidence that the controls are effective. Ratings should use a documented scale rather than intuition alone.