Update Details: New addition to the alphaZ document library. ER42 AI Risks and Controls Register is a Microsoft Excel workbook holding AI systems, risks, treatment and the ISO 42001:2023 Annex A controls in one place.
ER42 AI Risks and Controls Register
ISO 42001 requires an AI risk assessment, an AI risk treatment process and a Statement of Applicability covering the Annex A controls. This register holds all three, alongside the monitoring plan that keeps them current. It replaces the spreadsheet most organisations end up building themselves once AI tools spread beyond one team.
Seven worksheets, each doing one job:
- Instructions - how to complete the register, with the risk rating table, the rating criteria and the treatment options
- AI-Systems - every AI system in use with its provider, intended purpose and where it is used, the conditions of use or restrictions applied, which assessments have been completed and its approval status
- AI-Risks-Treatment - the risk, the AI systems it applies to, known threats and potential consequences, current controls, the relevant Annex A controls, the treatment selected, the risk owner and the residual rating
- Monitoring - the planned monitoring activity, who is responsible and how often
- Human-Only Activities - the activities the organisation has decided will not be handed to an AI system, the reason and who approved it
- Risks-vs-Controls - the mapping between each risk and the Annex A controls that address it
- SoA-Controls - all 38 ISO 42001 Annex A controls for recording applicability and justification
Built for ISO 42001
Dropdown lists drive likelihood, consequence, treatment and monitoring frequency, and inherent and residual ratings are recorded separately. Mapping each risk to the controls that address it means the Statement of Applicability is driven by the risks rather than written after the fact.
