What Is an AI Risk Register? In Plain English

A risk register sounds intimidating. It isn't. It's a list. That's all.

Each row answers four questions: What could go wrong? How likely is it? How bad would it be? What are we doing about it? If your team uses an AI tool to draft client emails, one row might read: "The tool invents a fact in a client email. Somewhat likely. Embarrassing and possibly costly. A human reviews every draft before sending."

That's it. That's a risk register.

The fancy frameworks dress this up, but the idea is old. In my federal grants compliance days, we tracked risks on paper: a late report here, a miscoded expense there, each with an owner and a fix. AI risk works the same way. The NIST AI Risk Management Framework, published in January 2023, gives you the full vocabulary for this — govern, map, measure, manage — but you can start with a spreadsheet and an honest hour.

Start small. List the AI tools your team actually uses. For each one, write down the three worst realistic outcomes. Assign each a likelihood, an impact, and one concrete safeguard. Review it every quarter, because tools change and so do risks.

You don't need a risk department. You need a list, a calendar reminder, and the honesty to write down the scary stuff.

I explain frameworks; I don't give legal counsel.