Assess risk and impact
AI risk register
What could go wrong with each AI system, how likely it is and how much it would matter, how it is mitigated and who answers for it, in one register.
What it is for
When AI risks live in emails and loose spreadsheets, nobody knows which ones are being watched or who answers for them. The Alethexis risk register, section GOB-3 of the M2 Governance module, brings each risk together with its assessment, its mitigation plan, its owner and its next review.
Risks identified on a 5×5 heatmap, with their mitigation plan and follow-up. Each risk can be linked to a system in the inventory or recorded as an organisation-wide risk.
It is an Alethexis internal methodological control: managing risk in a documented way is a governance practice, not a form required by a specific rule. What you record here then appears, system by system, in the FRIA and DPIA impact assessments of the M3 module.
How it works
Identify the risk
Name, category (operational, legal, ethical, security or data), description and, where relevant, the AI system it affects. For systems classified P5 (Alethexis’s internal taxonomy, not the AI Act’s nomenclature), the platform suggests typical risks as a starting point: bias in automated decisions, insufficient explainability, leaks of personal data, model drift, dependence on the provider or insufficient human oversight.
Score the inherent risk
Likelihood and impact on a scale of 1 to 5. The inherent score is their product, from 1 to 25, and falls into one of four bands: low, moderate, significant or critical. The 5×5 heatmap places each risk so you can see at a glance which to deal with first.
Assign mitigation and an owner
Mitigation plan, owner and the residual likelihood and impact you expect once it is applied. If the residual comes out above the inherent score, the register flags it as inconsistent: mitigation reduces risk, it does not increase it.
Schedule the review
Each risk has a status — open, mitigating, accepted or closed — and the date of its next review, at most twelve months ahead. Accepting a risk is a legitimate decision; it is worth writing down why and, where relevant, taking it to the decision log.
Linked to the FRIA and to closing
If a risk with an inherent score of 15 or more affects a system that already has a FRIA with a recorded approval, the FRIA section is flagged for review. To close the register, the Owner or the AI Officer ticks a statement that is recorded with their name, their role, the date and the hash of the content.
FAQ
- Who can record and edit risks?
- The Owner, the AI Officer and the DPO can record and edit risks. Closing the section falls to the Owner or the AI Officer, and deleting a risk to the Owner alone.
- Which risks should I record as a minimum?
- The section’s progress asks for at least one documented risk for each system classified P5 (Alethexis’s internal taxonomy, not the AI Act’s nomenclature), with a mitigation plan and an owner. You can add as many organisation-wide risks as you need.
- Does a high score mean I am doing something wrong?
- No. It means that risk is a priority. The score is a management tool for ordering the work, not a legal judgement on your organisation.
- What happens if I do not review a risk on time?
- The table highlights the review date when it is less than 30 days away or has already passed, so the register shows which risks are due for a look.