The risk register is the first thing I ask for on an AI audit. It has to show every AI system in use, what could go wrong with each one, what is being done about it and which Annex A controls that maps to. If those four things sit in one file, the assessment is quick.

Effective Registers

This register is supplied in fully editable MS Excel format and can be easily customised and edited. The workbook is built to be used rather than admired:

• Instructions sheet included, so there is no guesswork about how to complete it
• Dropdown lists for likelihood, consequence, treatment and monitoring frequency
• Risk rating table with the acceptable / not acceptable criteria set out
• Separate worksheets so systems, risks, controls and monitoring stay apart but linked

alphaZ documents - beautifully designed, tried and tested registers. No junk, jargon or unnecessary columns. Simple and usable registers developed over 25 years through practical use in the real world. No AI generated nonsense here!

Further Reading

Further guidance on assessing and controlling AI risk:

• ISO 42001 Clause 6.1 - Actions to Address Risks and Opportunities
• ISO 42001 Annex A Controls
• ISO 42001 Clause 9 - Performance Evaluation

Logo Update Service *

Download this register with your company name and logo already added!
Document Preparation available with all document toolkits.

How to Download

To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This register is also included in the ISO 42001 Toolkit, so if you need the wider set of documents for an AI management system the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help identifying and scoring the risks in the AI systems you already use, or setting up your wider AI management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

AI Risks and Controls Register Template

A single Excel workbook that records every AI system the organisation uses, the risks each one carries, the treatment applied and the ISO 42001 Annex A controls selected against them. It replaces the spreadsheet most organisations end up building themselves once AI tools spread beyond one team.

ISO 42001:2023 requires an AI risk assessment, an AI risk treatment process and a Statement of Applicability covering the Annex A controls. This register holds all three in one place, alongside the monitoring plan that keeps them current.

Built for ISO 42001

The workbook is structured around what the standard actually asks for:

• The AI risk assessment and risk treatment required by clause 6.1, with inherent and residual ratings recorded separately
• All 38 Annex A controls carried on their own sheet, so applicability and justification can be recorded for each
• Each risk mapped to the controls that address it, so the Statement of Applicability is driven by the risks rather than written after the fact
• The planned monitoring activity required by clause 9.1, with responsibility and frequency against each item

What's Included in this AI Risks and Controls Register

Seven worksheets, each doing one job:

• Instructions - how to complete the register, with the risk rating table, the rating criteria and the treatment options
• AI-Systems - every AI system in use with its provider, intended purpose and where it is used, the conditions of use or restrictions applied, which assessments have been completed and its approval status
• AI-Risks-Treatment - the risk, the AI systems it applies to, known threats and potential consequences, current controls, the relevant Annex A controls, the treatment selected, the risk owner and the residual rating
• Monitoring - the planned monitoring activity, who is responsible and how often, so ongoing checks are scheduled rather than remembered
• Human-Only Activities - the activities the organisation has decided will not be handed to an AI system, the reason and who approved it
• Risks-vs-Controls - the mapping between each risk and the Annex A controls that address it
• SoA-Controls - all 38 ISO 42001 Annex A controls for recording applicability and justification

Who Needs an AI Risk Register?

Any organisation where AI tools have spread across teams and nobody can say with confidence what is in use, on what conditions and with what data. It is a core record for anyone working towards ISO 42001 certification, and it answers the AI questions that are now appearing in customer due diligence and tender questionnaires.

Included in the ISO 42001 Toolkit

This register is part of the ISO 42001 Toolkit - the policies, procedures, forms, audit checklists, training material and guidance for running an AI management system in one download.

Pairs with the AI Forms

The register is fed by the F-AI1 to F-AI4 Artificial Intelligence Forms - the impact assessment records the consequences for the people affected, and the resulting risks and their scoring are recorded here. The P-120 Artificial Intelligence Policy is the public facing statement that sits above both.