The columns that matter
Eight fields carry almost all of the value. Anything beyond them is refinement; anything short of them leaves a question you cannot answer when someone asks.
| Column | What it captures |
|---|---|
| System | The AI tool or model, named the way people actually refer to it. |
| Owner | The person accountable — a name, not a department. |
| Use case | What it does, and whether it touches personal or regulated data. |
| Risk | The specific failure, written as cause → consequence. |
| Likelihood | Low / Medium / High. Judgement is fine; precision is not the point. |
| Impact | How bad it is if it happens — to people first, then the organisation. |
| Mitigation | The control that reduces it, stated as something someone does. |
| Status | Open, mitigated, accepted — and the date it was last reviewed. |
A worked example
One filled-in row is worth three pages of methodology. Here is what a real entry looks like:
| Field | Entry |
|---|---|
| System | AI chatbot for customer support |
| Owner | Head of CX |
| Use case | Answers customer questions; handles personal data |
| Risk | Hallucinated answer given as fact → harm / liability |
| Likelihood | Medium |
| Impact | High |
| Mitigation | Disclose it is AI; limit to trained topics; human handoff; logging |
| Status | Open — reviewed monthly |
Note what the mitigation column does not say: “improve model accuracy”. Mitigations are actions with owners and evidence, not aspirations.
Five steps to stand one up
- Catalogue the tools. Every AI system in use, including the ones procurement never saw. A confidential, non-punitive survey will find more than an audit will.
- Assign ownership and document purpose. One named owner per system, and a plain sentence about what it is for.
- Estimate the risk. Likelihood and impact, agreed in a room, in an afternoon. Do not build a scoring model.
- Add controls for the high-risk rows. Start where the impact is highest; leave the low-risk rows documented and untouched.
- Review monthly. A short, recurring review — what changed, what is new, what can close.
The value is in the habit, not the tool
A spreadsheet reviewed every month beats a governance platform nobody opens. Start in whatever your organisation already uses, and only move when the spreadsheet genuinely stops working.
Three ways this goes wrong
- It is built once. A register with no review date is an artefact, not a control. It ages badly and is worse than nothing in front of a regulator.
- It only lists approved systems. If shadow AI is missing, the register describes the organisation you wish you had. Start there instead.
- It is owned by the tooling team. Risk sits with the business owner of the use case. Engineering can maintain the entry; it cannot accept the risk.
Next: AI Governance for Non-Technical Leaders — where the register fits in the wider picture.