{"data":{"slug":"ai-risk-register","title":"AI Risk Register (MIT AI Risk Repository taxonomy)","type":"register","formats":["xlsx"],"topics":["risk","governance","evidence"],"frameworks":["nist-ai-rmf","iso-42001","eu-ai-act"],"short":"A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds.","covers":{"categories":["risk_management","safety_testing"]},"version":5,"dataset_version":"ef1018b7a6a2","generated_at":"2026-11-12T05:14:17+00:00","citations":38,"downloads":5,"files":[{"format":"xlsx","filename":"ai-risk-register-v5.xlsx","bytes":50472,"url":"https://aipolicytracker.org/templates/ai-risk-register#download"}],"url":"https://aipolicytracker.org/templates/ai-risk-register","inside":["Register sheet: domain and subdomain dropdowns from the MIT taxonomy, likelihood × impact scoring with formulas, residual scoring after controls","Conditional formatting: red at 15 and above, amber at 8, green below","Controls sheet: every recorded control, what it does and which duties it satisfies","Taxonomy sheet: all 7 domains and 24 subdomains with their definitions"],"legal_basis":["eu-ai-act","us-nist-ai-rmf","iso-42001"],"caveat":null,"covered_obligations":[{"slug":"us-california-sb-53-frontier-ai-framework","title":"Large frontier developers must publish a frontier AI framework","policy":"us-california-sb-53","source_reference":"Business and Professions Code, Chapter 25.1 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework"},{"slug":"us-california-sb-53-catastrophic-risk-assessment-summaries","title":"Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state","policy":"us-california-sb-53","source_reference":"Business and Professions Code Section 22757.12 (as added by SB 53)","url":"https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries"},{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","policy":"eu-ai-act","source_reference":"Article 9","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","policy":"eu-ai-act","source_reference":"Articles 51, 52 and 55","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"us-new-york-gbl-1701-self-harm-protocol","title":"Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services","policy":"us-new-york-ai-companion-safeguards","source_reference":"N.Y. Gen. Bus. Law § 1701","url":"https://aipolicytracker.org/obligations/us-new-york-gbl-1701-self-harm-protocol"},{"slug":"south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai","title":"Operators of AI above the compute threshold must run lifecycle risk management and report safety results","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 32","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 34(1)","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","policy":"uk-ai-regulation-white-paper","source_reference":"Principle 1, Part 3","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness"},{"slug":"us-nist-ai-rmf-measure","title":"Measure and test trustworthiness characteristics (Measure)","policy":"us-nist-ai-rmf","source_reference":"MEASURE function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","policy":"us-nist-ai-rmf","source_reference":"MANAGE function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"us-omb-m-25-21-high-impact-ai-practices","title":"Apply minimum risk-management practices to high-impact AI","policy":"us-omb-m-25-21","source_reference":"Section 4","url":"https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices"},{"slug":"us-washington-eshb-2225-self-harm-protocol","title":"Keep and run a protocol to detect suicidal ideation and self-harm and refer users to crisis resources","policy":"us-washington-eshb-2225-ai-companion-chatbots","source_reference":"ESHB 2225 (Chapter 168, Laws of 2026), sec. 5(1) and (2)","url":"https://aipolicytracker.org/obligations/us-washington-eshb-2225-self-harm-protocol"}],"versions":[{"version":5,"generated_at":"2026-11-12T05:14:17+00:00","dataset_version":"ef1018b7a6a2","changelog":"Dataset 1e8ea28a8a93 → ef1018b7a6a2. Sheet \"Risk duties\": 10 → 12 rows (+2). Record citations: 36 → 38.","stats":{"sheets":{"Register":0,"MIT taxonomy":24,"Controls":26,"Risk duties":12},"blocks":0,"headings":0,"citations":38}},{"version":4,"generated_at":"2026-10-09T05:30:00+00:00","dataset_version":"1e8ea28a8a93","changelog":"Dataset 52bd836b1d6b → 1e8ea28a8a93.","stats":{"sheets":{"Register":0,"MIT taxonomy":24,"Controls":26,"Risk duties":10},"blocks":0,"headings":0,"citations":36}},{"version":3,"generated_at":"2026-10-08T05:30:00+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 3335c39da4b7 → 52bd836b1d6b.","stats":{"sheets":{"Register":0,"MIT taxonomy":24,"Controls":26,"Risk duties":10},"blocks":0,"headings":0,"citations":36}},{"version":2,"generated_at":"2026-09-27T05:30:00+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 914895c3103e → 3335c39da4b7. Sheet \"Risk duties\": 13 → 10 rows (-3). Record citations: 39 → 36.","stats":{"sheets":{"Register":0,"MIT taxonomy":24,"Controls":26,"Risk duties":10},"blocks":0,"headings":0,"citations":36}},{"version":1,"generated_at":"2026-09-26T13:05:21+00:00","dataset_version":"914895c3103e","changelog":"First version, built from dataset 914895c3103e.","stats":{"sheets":{"Register":0,"MIT taxonomy":24,"Controls":26,"Risk duties":13},"blocks":0,"headings":0,"citations":39}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}