At audit, the AI risk register needs to show every AI system in use, what could go wrong with each one, what is being done about it and which Annex A controls it maps to. With those four things in one file, the assessment is quick.

Effective Excel Registers

Part of the alphaZ ER series of Excel registers, built for listings that grow and need to be sorted and filtered. Supplied in fully editable MS Excel format, with all text in Calibri font for improved readability.
The register is set up with:

• Instructions sheet included, so there is no guesswork about how to complete it
• Dropdown lists for likelihood, consequence, treatment and monitoring frequency
• Risk rating table with the acceptable / not acceptable criteria set out
• Separate worksheets so systems, risks, controls and monitoring stay apart but linked

alphaZ documents - tried and tested registers with no junk, jargon or unnecessary columns, developed over 25 years through practical use in the real world.

Further Reading

Further guidance on assessing and controlling AI risk:

• ISO 42001 Clause 6.1 - Actions to Address Risks and Opportunities
• ISO 42001 Annex A Controls
• ISO 42001 Clause 9 - Performance Evaluation
• ISO 42001 knowledge base

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in the ISO 42001 Toolkit, so if you need the wider set of documents for an AI management system the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like a hand keeping the register current as new AI tools come into use, running the monitoring plan, or with your wider AI management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

AI Risks and Controls Register Template

A single Excel workbook that records every AI system the organisation uses, the risks each one carries, the treatment applied and the ISO 42001 Annex A controls selected against them. It replaces the spreadsheet most organisations end up building themselves once AI tools spread beyond one team.

ISO 42001:2023 requires an AI risk assessment, an AI risk treatment process and a Statement of Applicability covering the Annex A controls. This register holds all three in one place, alongside the monitoring plan that keeps them current.

Built for ISO 42001

The workbook is structured around what the standard actually asks for:

• The AI risk assessment and risk treatment required by clause 6.1, with inherent and residual ratings recorded separately
• All 38 Annex A controls carried on their own sheet, so applicability and justification can be recorded for each
• Each risk mapped to the controls that address it, so the Statement of Applicability is driven by the risks rather than written after the fact
• The planned monitoring activity required by clause 9.1, with responsibility and frequency against each item

What's Included in this AI Risks and Controls Register

Seven worksheets, each doing one job:

• Instructions - how to complete the register, with the risk rating table, the rating criteria and the treatment options
• AI-Systems - every AI system in use with its provider, intended purpose and where it is used, the conditions of use or restrictions applied, which assessments have been completed and its approval status
• AI-Risks-Treatment - the risk, the AI systems it applies to, known threats and potential consequences, current controls, the relevant Annex A controls, the treatment selected, the risk owner and the residual rating
• Monitoring - the planned monitoring activity, who is responsible and how often, so ongoing checks are scheduled rather than remembered
• Human-Only Activities - the activities the organisation has decided will not be handed to an AI system, the reason and who approved it
• Risks-vs-Controls - the mapping between each risk and the Annex A controls that address it
• SoA-Controls - all 38 ISO 42001 Annex A controls for recording applicability and justification

Who Needs an AI Risk Register?

Any organisation where AI tools have spread across teams and nobody can say with confidence what is in use, on what conditions and with what data. It is a core record for anyone working towards ISO 42001 certification, and it answers the AI questions that are now appearing in customer due diligence and tender questionnaires.

Included in the ISO 42001 Toolkit

This register is part of the ISO 42001 Toolkit - the policies, procedures, forms, audit checklists, training material and guidance for running an AI management system in one download.

Pairs with the AI Forms

The register is fed by the F-AI1 to F-AI4 Artificial Intelligence Forms - the impact assessment records the consequences for the people affected, and the resulting risks and their scoring are recorded here. The P-120 Artificial Intelligence Policy is the public facing statement that sits above both.