RegisterFree · no account · links emailed to your work addressNIST AI RMFISO/IEC 42001EU AI Act
AI Risk Register (MIT AI Risk Repository taxonomy)
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The AI Risk Register (MIT AI Risk Repository taxonomy) is a free XLSX register for NIST AI RMF, ISO/IEC 42001 and EU AI Act. A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds. It is licensed CC BY 4.0 and is not legal advice.
- Format
- XLSX · Register
- Version
- v5, built 12 Nov 2026
- Duties cited
- 12 from 8 instruments
- Rows from the records
- 62
- Frameworks
- NIST AI RMF, ISO/IEC 42001, EU AI Act
- Written for
- Provider / developer, Deployer / user organisation, General-purpose AI model provider
- Price and licence
- Free · CC BY 4.0
What's inside
- Register sheet: domain and subdomain dropdowns from the MIT taxonomy, likelihood × impact scoring with formulas, residual scoring after controls
- Conditional formatting: red at 15 and above, amber at 8, green below
- Controls sheet: every recorded control, what it does and which duties it satisfies
- Taxonomy sheet: all 7 domains and 24 subdomains with their definitions
Preview
The sheets and sections of version v5, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Register
| Risk ID | System | Risk domain (MIT) ▾ | Subdomain (MIT) ▾ | Risk description | Cause or trigger | Likelihood (1–5) ▾ | Impact (1–5) ▾ | Inherent score ƒ | Control applied ▾ | Residual likelihood ▾ | Residual impact ▾ | Residual score ƒ | Owner | Status ▾ | Review date |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||||||||
Red at 15 and above, amber from 8, green below. An all-green register is a warning sign for a reviewer.
Sheet: MIT taxonomy
| Domain | Subdomain | Definition | Use cases (site taxonomy) |
|---|---|---|---|
| 1. Discrimination & Toxicity | 1.1 Unfair discrimination and misrepresentation | Unequal treatment of individuals or groups by AI, often based on race, gender, or other sensitive characteristics, resulting in unfair outcomes and representati | hiring_and_hr, finance_and_credit, education |
| 1. Discrimination & Toxicity | 1.2 Exposure to toxic content | AI exposing users to harmful, abusive, unsafe or inappropriate content. May involve AI creating, describing, providing advice, or encouraging action. Examples o | hiring_and_hr, finance_and_credit, education |
| 1. Discrimination & Toxicity | 1.3 Unequal performance across groups | Accuracy and effectiveness of AI decisions and actions is dependent on group membership, where decisions in AI system design and biased training data lead to un | hiring_and_hr, finance_and_credit, education |
| 2. Privacy & Security | 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information | AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized shari | biometrics, health |
| 2. Privacy & Security | 2.2 AI system security vulnerabilities and attacks | Vulnerabilities in AI systems, software development toolchains, and hardware that can be exploited, resulting in unauthorized access, data and privacy breaches, | biometrics, health |
| 3. Misinformation | 3.1 False or misleading information | AI systems that inadvertently generate or spread incorrect or deceptive information, which can lead to inaccurate beliefs in users and undermine their autonomy. | generative_ai |
Sheet: Controls
| Control | Kind | Purpose | Typical owner | Frequency | Duties it satisfies | Duties it supports | Evidence it produces | ISO/IEC 42001 | NIST AI RMF | Record |
|---|---|---|---|---|---|---|---|---|---|---|
| AI governance policy and accountability structure | Policy | Gives the organisation a single approved statement of how it will develop, buy and use AI, and names the people who are answerable for it, so that every other A | Executive sponsor for AI | annual | 9 | 8 | AI policy; Board or executive approval of the AI policy; AI governance forum minutes; AI responsibility map | Clause 5.1, 5.2, 5.3, 9.3; Annex A.2, A.3 | GOVERN 1.1, 1.2, 1.3, 2.1, 3.1 | https://aipolicytracker.org/controls/ai-governance-policy-and-accountability |
| AI impact and fundamental-rights impact assessment | Process | Examines how a planned AI use will affect the people, groups and communities it touches, with particular attention to discrimination and rights, and records the | AI system owner | per_system | 5 | 7 | AI impact assessment; Impact assessment approval; Impact assessment procedure and template | Clause 6.1.4, 8.4; Annex A.5 | MAP 5.1, 5.2; MEASURE 2.11 | https://aipolicytracker.org/controls/ai-impact-assessment |
| AI incident management and regulatory reporting | Process | Ensures that harm or near-harm caused by an AI system is detected, contained, investigated and, where a rule requires it, reported to the right authority and af | Incident coordinator | continuous | 9 | 7 | AI incident response playbook; AI incident record; Incident report to an authority | Clause 10.2; Annex A.8.3, A.8.4 | MANAGE 4.1, 4.3; GOVERN 4.3, 6.2 | https://aipolicytracker.org/controls/ai-incident-management-and-reporting |
| AI interaction and use disclosure notices | Process | Tells people, in plain language and at the right moment, that they are interacting with an AI system, that AI is being used in a decision about them or that the | Product owner | on_material_change | 19 | 4 | AI interaction or use notice; Notice catalogue; Notice wording approval | Annex A.8.2, A.8.5 | MEASURE 2.8; GOVERN 5.1 | https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure |
| AI literacy and role-based training programme | Training | Gives everyone who builds, buys, operates or is overseen by AI systems the knowledge they need for their role, from general awareness to the specific skills of | Learning and development lead | annual | 1 | 3 | AI training completion records; Role-to-curriculum training matrix; AI training curriculum and materials | Clause 7.2, 7.3; Annex A.4.6 | GOVERN 2.2, 4.1 | https://aipolicytracker.org/controls/ai-literacy-and-role-based-training |
| AI risk assessment and lifecycle risk register | Process | Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from | AI system owner | per_system | 7 | 5 | AI system risk assessment; Per-system AI risk register; Residual-risk acceptance | Clause 6.1.2, 6.1.3, 8.2, 8.3 | MAP 3, MAP 4, MANAGE 1.2, 1.3, 2.1 | https://aipolicytracker.org/controls/ai-risk-assessment |
Sheet: Risk duties
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Large frontier developers must publish a frontier AI framework | Safety testing and evaluation | California SB 53 | California (United States) | General-purpose AI model provider | Legal requirement | Business and Professions Code, Chapter 25.1 (as added by SB 53) | 2026-01-01 | Large frontier developers must publish and maintain a framework describing how they incorporate national and international standards, assess catastrophic risk, | Published frontier AI framework | GOVERN 1.x; NIST AI 600-1 | Pending review · source-linked | https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework | |
| Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state | Safety testing and evaluation | California SB 53 | California (United States) | General-purpose AI model provider | Legal requirement | Business and Professions Code Section 22757.12 (as added by SB 53) | 2026-01-01 | A large frontier developer must transmit to the California Office of Emergency Services, on the periodic schedule the statute sets, a summary of any assessment | Internal-use catastrophic risk assessment summary sent to the Office of Emergency Services | Clause 9.1; Annex A.8.3 | MEASURE 2.6, MANAGE 1.2, GOVERN 4.3 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries |
| Establish a risk management system for high-risk AI | AI risk management | EU AI Act | European Union | Provider / developer | Legal requirement | Article 9 | 2027-12-02 | Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: | Risk register and treatment plan; Pre-market test reports | Clauses 6.1.2, 6.1.3, 8.2, 8.3 and Annex A controls on AI risk | MAP, MEASURE and MANAGE functions | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system |
| Manage systemic risk for high-impact general-purpose models | Safety testing and evaluation | EU AI Act | European Union | General-purpose AI model provider | Legal requirement | Articles 51, 52 and 55 | 2025-08-02 | A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Com | Model evaluation and red-teaming reports; Commission notification record | MEASURE 2.x; NIST AI 600-1 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk | |
| Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services | AI risk management | New York AI companion safeguards | New York (United States) | Deployer / user organisation, Provider / developer | Legal requirement | N.Y. Gen. Bus. Law § 1701 | It is unlawful for an operator to operate or provide an AI companion to a user unless the AI companion contains a protocol for taking reasonable efforts to dete | The written protocol, with its detection approach and the referral message shown to users; Test results showing detection triggers the 988 and crisis-line refer | Pending review · source-linked | https://aipolicytracker.org/obligations/us-new-york-gbl-1701-self-harm-protocol | |||
| Operators of AI above the compute threshold must run lifecycle risk management and report safety results | Safety testing and evaluation | AI Basic Act | South Korea | Provider / developer, General-purpose AI model provider | Legal requirement | Article 32 | 2026-01-22 | An AI business operator whose AI system's cumulative training computation exceeds the threshold set by Presidential Decree must identify, assess and mitigate ri | Lifecycle risk assessment and mitigation record; Safety measures report submitted to the ministry | Clause 6.1.2, 6.1.3, 9.1 | MAP 5.1, MEASURE 2.6, MANAGE 1.3, MANAGE 4.3 | Verified against the official source 26 Sep 2026 | https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai |
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v5), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "Register" sheet for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "MIT taxonomy", "Controls" and "Risk duties" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (12)
Each is cited in the file with its source reference and a link back to the record.
- Large frontier developers must publish a frontier AI framework
- Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state
- Establish a risk management system for high-risk AI
- Manage systemic risk for high-impact general-purpose models
- Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services
- Operators of AI above the compute threshold must run lifecycle risk management and report safety results
- Operators of high-impact AI must establish and operate a risk management plan
- Ensure AI systems are safe, secure and robust throughout their lifecycle
- Measure and test trustworthiness characteristics (Measure)
- Prioritise, respond to and monitor AI risks (Manage)
- Apply minimum risk-management practices to high-impact AI
- Keep and run a protocol to detect suicidal ideation and self-harm and refer users to crisis resources
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v5 | ef1018b7a6a2 | Dataset 1e8ea28a8a93 → ef1018b7a6a2. Sheet "Risk duties": 10 → 12 rows (+2). Record citations: 36 → 38. | |
| v4 | 1e8ea28a8a93 | Dataset 52bd836b1d6b → 1e8ea28a8a93. | |
| v3 | 52bd836b1d6b | Dataset 3335c39da4b7 → 52bd836b1d6b. | |
| v2 | 3335c39da4b7 | Dataset 914895c3103e → 3335c39da4b7. Sheet "Risk duties": 13 → 10 rows (-3). Record citations: 39 → 36. | |
| v1 | 914895c3103e | First version, built from dataset 914895c3103e. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the AI Risk Register (MIT AI Risk Repository taxonomy)?
Register sheet: domain and subdomain dropdowns from the MIT taxonomy, likelihood × impact scoring with formulas, residual scoring after controls. Conditional formatting: red at 15 and above, amber at 8, green below. Controls sheet: every recorded control, what it does and which duties it satisfies. Taxonomy sheet: all 7 domains and 24 subdomains with their definitions.
Which duties does it cite?
12 recorded duties from California SB 53, EU AI Act, New York AI companion safeguards and AI Basic Act, including Business and Professions Code, Chapter 25.1 (as added by SB 53), Business and Professions Code Section 22757.12 (as added by SB 53), Article 9, Articles 51, 52 and 55, N.Y. Gen. Bus. Law § 1701 and Article 32. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and general-purpose ai model provider. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v5 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Is there a self-assessment that goes with it?
Yes: the NIST AI Risk Management Framework Assessment (22 questions, about 6 minutes). It is free and runs on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.