An AI risk register sounds like something for a tech company. It is not. It is a list of the tools your people use, what could go wrong with each one and what you have decided about it. When this reaches me that list exists, and so does a plain record of what AI is not allowed to do here.
Further guidance on AI policy and AI risk:
AI Policy and Risk Register
AI tools are now part of everyday work - drafting, summarising calls, sorting and scoring. Using them well means knowing which tools are in use, what they are used for, what they can reach, and who decides. Written down, that becomes your AI policy and AI risk register: a clear position your staff can follow and your clients, candidates and customers can rely on.
This service prepares it for you - your AI policy, a register of the tools you use with the risks against each and the controls you have in place, and a clear record of the work you have decided AI is not permitted to do. It is built to the structure of ISO 42001, the international standard for managing AI, so if you ever decide to certify the groundwork is already there. You do not need to be heading for certification to use it.
Why You Need One
- Your people know where they stand - which tools are approved, what they can be used for and what stays with a person, so AI gets used well and consistently
- Clients and candidates are asking - more tenders, supplier questionnaires and contracts ask how AI is used, and a written policy and register give you the answer
- It protects the people your decisions affect - where a tool helps screen, rank or assess people, the register records how it is used and who reviews the outcome
- It keeps AI and personal data in step - most AI use touches personal data, and the register ties each tool to the safeguards that apply
- It is the groundwork for ISO 42001 - the policy, the risk register and the Statement of Applicability are the core of an AI management system, ready if you decide to certify
What You Get
- The P-120 Artificial Intelligence Policy tailored - your position on AI in plain terms, branded and adjusted to how you actually use it
- The AI policy and procedure set up - responsibilities, how a new tool gets approved and how use is reviewed, written for your business rather than issued generically
- The ER42 AI Risks and Controls Register completed - every AI system in use with its status and owner, the risks against it scored, and the treatment decided and written down
- The work AI is not permitted to do recorded - the activities kept with a person, with the reason and the date decided, so everyone can see the decision
- Impact assessments where the risks call for them - the F-AI3 AI Impact Assessment for any tool that makes or shapes decisions about people, such as screening or ranking job applicants
- A supporting business risk assessment - the RA-BR12 Use of Artificial Intelligence assessment matched to your business
- Monitoring set up - what gets reviewed, how often and by whom, so the register stays live rather than becoming a snapshot
- The Statement of Applicability completed - a decision recorded against each of the 38 Annex A controls of ISO 42001, with the reason, drawn from the register rather than written to look complete
- Next steps identified - any tool still to be approved, or any control still to be put in place, is marked so you know where to start
How Much One Day Covers
The policy, the register and the Statement of Applicability, for most organisations. There is no cap on the number of tools. What moves the time is how AI is used rather than how much of it - a business whose staff use general assistants for drafting is a different job from one where a tool screens applicants or makes decisions about customers. The more context and information you give us, the better what we prepare will be. We work through as much as the time allows, in the order that matters most to you.
How the Work Gets Done
We use our own AI tooling to do the mechanical part of document preparation, and a consultant checks the output before it reaches you. On this chain the tooling does the joining up - carrying each tool from your list into the risks, the risks into the controls, and the controls into the Statement of Applicability, so the policy, the register and the Statement of Applicability cannot say different things.
Whether a use of AI is acceptable at all, and what should stay with a person, is a consultant's judgement made with you. So is the decision to accept a risk, which is never made by tooling.
The templates are ours, built on a library developed over 25 years of real audits, and they are not AI generated. Every risk comes from the tools you use and the way you use them, and every control marked as applied is one you operate, so the Statement of Applicability stands up.
Why a Day Goes This Far
Anyone can rent the same AI we use. What they cannot rent is what we point it at.
Behind this service is a document library built over 25 years - manuals, procedures, policies, registers, risk assessments, COSHH assessments, audit checklists and forms, covering every standard we work to and most situations a management system runs into. Each one has been through real audits, and corrected where an assessor pushed back. That is the part that took 25 years, and it is the part that cannot be generated.
Our tooling applies that library to your business. A general purpose AI, pointed at the same job, has nothing to apply, so it writes something that reads well and describes a company that does not exist.
What We Need From You
- Every AI tool in use, including the free ones people use without asking, and which accounts or subscriptions they sit under
- What each one is used for, and by whom
- Any tool that makes, scores or shapes decisions about people or customers
- What goes into them, particularly anything personal or client-confidential
- Any existing AI policy, acceptable use rules or guidance given to staff
- Any client or contract requirements on AI use you are held to
Alongside Your Personal Data Register
Most AI risk sits on personal data - candidates, customers, staff. The Personal Data Register and Privacy Notice Preparation service writes your AI tools into the register of what you do with that data and rewrites your privacy notices to match. The two share one list of tools, so what your AI register says you use and what your personal data register says you share cannot drift apart. The F-AI2 AI Data Matrix is the bridge between them.
Keeping It Current
AI tools develop quickly, so the register is set up to be reviewed whenever a tool is added, changed or retired, with the monitoring on it saying how often. Remote Support - Ongoing covers keeping it current alongside the rest of your system.
What This Does Not Cover
It is not legal advice. It records your position and your controls but does not test that a tool does what its provider says, and it does not verify that the controls are working - that is what internal audit and management review are for. It is not certification either: if you decide to certify to ISO 42001, that assessment is carried out by a certification body.
Other Things Remote Support Covers
A support day does not have to be spent on your AI policy and register. The same day can be pointed at any one of these instead, and it is the same purchase either way:
A day can also go on things that are not document preparation at all - training, internal audits, a gap analysis, or simply working through a problem on a call. Remote Support - Project is the same day bought without a job attached to it.