Risk register for AI: the ten risks we discuss with every client
What could go wrong, how likely, how bad, and what you do about it. Ten AI risks that apply to nearly every small business, with a control each.
The short answer
A risk register is a table: what could go wrong, how likely it is, how bad it would be, what control is in place, and who owns it. For AI in a small business, ten risks cover most of what matters, and each has a known control. Writing them down next to each other, with an owner, is what turns “we thought about the risks” into something you can show and act on. It takes two hours to fill in with the people who own the systems, twenty minutes a quarter to review, and a few minutes after any incident, new system or vendor change.
The ten risks
| Risk | What it looks like | Control |
|---|---|---|
| 1. Wrong output acted on | A quoted price, a promised delivery, a decision based on a confident error | Grounding in sources, output validation, a person at the gate for anything with money or commitments |
| 2. Data leakage through tools | Customer data pasted into consumer AI tools | Approved tools on business plans, a company assistant, a never-enter list |
| 3. Privacy breach | Personal data processed without basis, agreements or regional compliance | Data map, processor agreements, minimisation, regional endpoints |
| 4. Prompt injection | Content the system reads instructs it to misbehave | Input checks, separation of instructions from data, limited actions, allow-lists |
| 5. Unauthorised commitments | The system promises refunds, discounts, delivery dates | Action allow-lists, forbidden-phrase validation, escalation for commitments |
| 6. Bias in decisions | Screening, scoring or prioritising that disadvantages groups | Rules first, tested on representative cases, human review of decisions about people, explainability |
| 7. Cost overrun | A loop, a bot or an input size that multiplies usage | Provider caps, rate limits, anomaly alerts, monthly cost per case |
| 8. Vendor dependence | Prompts, data and features tied to one provider | Adapter layer, own index, evaluation set, short contracts |
| 9. Silent degradation | Quality drifting after model updates or document staleness | Monthly sample scoring, retests after version changes, document refresh |
| 10. Loss of skills and oversight | Nobody can do the task by hand or judge the output any more | Rotation through review, retained expertise, the pause button tested |
Filling it in
- Take the ten rows and add any risk specific to your business: a regulated process, a sector rule, a contractual obligation.
- Per system in the inventory, mark which risks apply.
- Score likelihood and impact as low, medium or high, honestly and quickly; the point is attention, not precision.
- Write the control that exists today, precisely. If none exists, write “none” and a date by which one will.
- Assign an owner per row.
- Review quarterly, after incidents, and when systems or vendors change.
What it gives you
A quarterly conversation with structure. An answer for the client questionnaire, the insurer and the auditor. A list of controls to check when a new system arrives. And, when something goes wrong, the evidence that the risk was considered and the control was in place, or an honest record that it was not yet, which is still better than surprise.
What this means for you
Ten rows, five columns, two hours, a quarterly look. The risks are known and so are the controls; the register is where they meet an owner and a date. Fill it in honestly, with “none” where none exists, start with the two that matter most, and keep it where anyone who asks how you manage AI risk can be shown it.
Frequently asked questions
Is a risk register not overkill for a small company?
A table with ten rows and five columns, filled in over two hours, reviewed for twenty minutes a quarter. It is the least bureaucratic way to make sure the obvious failures were considered before they happened, and it is the document that answers a client or auditor asking how you manage AI risk. The overkill would be not having one and discovering the risks in production.
Which of the ten is the most serious for a typical small business?
Wrong output acted on, because it is the most likely and the most direct: a price quoted, a promise made, a decision taken on a confident error. Second is data leakage through everyday tool use, because it is already happening wherever staff have the tools. Both have cheap controls: grounding and review for the first, an approved-tools policy and a company assistant for the second.
Who fills it in?
The accountable person with each system's owner, using the ten risks as a starting list and adding anything specific to the business. A partner who builds your systems should contribute the technical controls. It is a conversation captured in a table, not a form to be completed alone.
Sources
- OWASP GenAI LLM Top 10 (2026) (accessed 2026-09-14)