What Is an AI Risk Register? A Practical Guide for Small Businesses

AI risk management can sound like something designed for government departments and global companies. In practice, its most useful question is simple: what could go wrong, who owns it and what are we doing about it?

The UK Department for Science, Innovation and Technology published an AI Risk Management Toolkit on 8 September 2026. It is aimed mainly at multidisciplinary teams designing, buying or operating AI-enabled products, and it comes with a detailed workbook.

Most Northern Ireland SMEs will not need to copy the full public-sector framework. But its underlying approach is valuable: identify risks early, record an owner and treatment, then review the register as the tool, data or way of working changes.

What is an AI risk register?

An AI risk register is a working list of the ways an AI tool or workflow could affect the outcome you want.

It is not a general list of frightening things about artificial intelligence. It should relate to one real use case: an assistant drafting customer emails, a tool scoring sales leads, an automated support service or a system summarising confidential documents.

For each risk, record:

what might happen;
who or what could be affected;
how likely it is;
how serious the impact could be;
what control reduces the risk;
who is responsible;
when it will be reviewed.

That is enough to turn “we should be careful with AI” into something a team can actually manage.

The nine risk areas behind the government toolkit

The DSIT toolkit groups potential AI risks into nine broad areas:

Financial: wasted spend, incorrect decisions or unexpected operating costs.
Legal and regulatory: data protection, equality, consumer law or sector-specific requirements.
Transparency and explainability: people not knowing AI is involved or being unable to understand an important outcome.
Fairness: biased or discriminatory treatment of customers, applicants or staff.
Accountability and governance: nobody clearly owning the system or its output.
Contestability and redress: no practical way for somebody to challenge or correct an AI-assisted decision.
Technical robustness: unreliable performance, poor data or failure in unfamiliar situations.
Security: data leakage, prompt injection, compromised suppliers or other attacks.
People and the environment: effects on wellbeing, physical safety, infrastructure or resources.

You do not need nine separate policies. Use the areas as prompts to uncover risks your team might otherwise miss.

A small-business example

Imagine a ten-person firm wants an AI assistant to draft replies to website enquiries.

Its first register might include:

Wrong information sent to a prospect. Control: replies remain drafts until checked by a named employee.
Confidential details entered into the tool. Control: approved business account, clear prohibited-data rules and staff training.
Biased or inappropriate language. Control: test representative enquiry types and sample live drafts regularly.
An urgent complaint treated as a sales lead. Control: route complaints and sensitive topics to a person before drafting.
Nobody notices the supplier changed the model. Control: assign an owner to monitor release notices and retest after major updates.
A customer cannot correct a misunderstanding. Control: include a direct human contact and record corrections in the source system.

That is a useful register. It is specific, owned and connected to everyday work.

“AI may make mistakes” is not useful on its own. It does not tell anyone which mistake matters or what to do next.

Score proportionately

The government toolkit scores likelihood and impact from one to five, then multiplies them to produce a risk score. A small business can use the same idea without pretending the numbers are scientific.

Ask two questions:

How plausible is this during normal use?
If it happened, how much harm or disruption could it cause?

A typo in an internal brainstorm and an incorrect decision about a job applicant should not receive the same attention. The greater the effect on money, rights, safety or trust, the stronger the controls and human oversight should be.

Record why you chose the rating. That explanation is usually more valuable than the number itself.

Name one accountable owner

The DSIT guidance recommends identifiable responsibility for AI governance. A small company probably does not need a new job title, but every live use case needs one person who can answer:

Why are we using this tool?
What data does it receive?
Who checks its work?
What happens when it fails?
When was it last reviewed?
Who can pause or switch it off?

Ownership cannot sit vaguely with “the team” or disappear into the software supplier. A vendor may run the platform, but your business still decides how it is used in your work.

Review it when something changes

AI systems are not fixed. Suppliers update models, staff find unexpected uses, input data changes and customers respond in ways you did not predict.

Review the register after:

a material model or product update;
a change in the data or workflow;
a complaint, error or near miss;
expansion to more users or customers;
a change in relevant guidance or law;
a regular review date appropriate to the risk.

The goal is not to produce a perfect document once. It is to notice when yesterday’s controls no longer fit today’s use.

Start with one page

If you already have a risk register, add the AI use case there. If not, a simple spreadsheet with eight columns is enough: use case, risk, affected party, likelihood, impact, control, owner and review date.

Begin with the most important live use case, not every experiment somebody has tried. Then connect the register to your approved-tools list, data rules and staff training. Our AI readiness guide helps you check those foundations, while an AI Marketing Audit can identify which workflows are worth assessing in the first place.

Good AI governance should make useful adoption easier, not bury it in paperwork. A short register that changes a decision is better than a polished framework nobody opens.

Want to identify useful AI opportunities and the controls they need? Start with an AI Marketing Audit →

Sources and further reading: Department for Science, Innovation and Technology: AI Risk Management Toolkit · AI Risk Management Toolkit guidance. Published by DSIT on 8 September 2026.