Phase 5: AI Impact Assessment & Governance · 35 min · Python

AI Risk Register — Tracking and Managing AI Risks

If a risk isn't in the register, it doesn't exist. If it's in the register, someone owns it.

Hiring signal: Maintaining an AI risk register is a core governance deliverable. Being able to build one programmatically — with risk scoring, ownership assignment, and status tracking — demonstrates engineering discipline in governance roles.

What you will learn

Describe the components of an AI risk register entry
Score risks using likelihood × severity with mitigation factors
Build a risk register tool that tracks risks from identification to resolution
Map risk register entries to NIST AI RMF functions and EU AI Act articles

The Problem

You've identified risks through the AIA (Lesson 1) and classified the system under the EU AI Act (Lesson 2). Now you need a living document that tracks each risk from identification through mitigation to closure — with an owner, a status, and evidence. This is the AI risk register, and it's the operational backbone of AI governance.

Risk Register Components

Field	Description	Example
Risk ID	Unique identifier	RISK-001
Description	What could go wrong	"Model discriminates against Group_B in loan approvals"
Category	Type of risk	Bias, Privacy, Security, Performance, Compliance
Likelihood	Probability of occurrence	Low, Medium, High
Severity	Impact if it occurs	Low, Medium, High, Critical
Inherent Risk Score	Likelihood × Severity (before mitigation)	3×4 = 12
Mitigation	What's being done about it	"Fairlearn bias audit + exponentiated gradient mitigation"
Residual Risk Score	Likelihood × Severity (after mitigation)	1×2 = 2
Owner	Who is responsible	"RAI Engineering Team"
Status	Current state	Open, In Progress, Mitigated, Closed
Evidence	Artifact proving mitigation	"bias_audit_report.json, mitigation_comparison.json"
Framework Mapping	NIST/EU AI Act/ISO references	"NIST MEASURE 2.7, EU AI Act Art. 10(2)(f)"

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Building the Risk Register Tool, What's Next — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.