# AI Risk Register (MIT AI Risk Repository taxonomy)

- **Type**: Template (Register)
- **Page**: https://aipolicytracker.org/templates/ai-risk-register
- **Formats**: XLSX
- **Current version**: v5, built 2026-11-12

A risk register whose domain and subdomain dropdowns are the MIT AI Risk Repository taxonomy, with inherent and residual scoring, control lookup and colour-coded thresholds.

## What is inside

- Register sheet: domain and subdomain dropdowns from the MIT taxonomy, likelihood × impact scoring with formulas, residual scoring after controls
- Conditional formatting: red at 15 and above, amber at 8, green below
- Controls sheet: every recorded control, what it does and which duties it satisfies
- Taxonomy sheet: all 7 domains and 24 subdomains with their definitions

## Laws and frameworks it is built from

- EU AI Act (European Union), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act
- NIST AI RMF (United States), Verified against the official source 26 Sep 2026: https://aipolicytracker.org/policies/us-nist-ai-rmf

## Recorded duties it covers

- Large frontier developers must publish a frontier AI framework (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-frontier-ai-framework
- Large frontier developers must send periodic summaries of catastrophic-risk assessments to the state (California SB 53): https://aipolicytracker.org/obligations/us-california-sb-53-catastrophic-risk-assessment-summaries
- Establish a risk management system for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system
- Manage systemic risk for high-impact general-purpose models (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk
- Offer an AI companion only if it contains a protocol to detect suicidal ideation or self-harm and refer users to crisis services (New York AI companion safeguards): https://aipolicytracker.org/obligations/us-new-york-gbl-1701-self-harm-protocol
- Operators of AI above the compute threshold must run lifecycle risk management and report safety results (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-32-safety-measures-for-high-performance-ai
- Operators of high-impact AI must establish and operate a risk management plan (AI Basic Act): https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan
- Ensure AI systems are safe, secure and robust throughout their lifecycle (UK AI regulation framework): https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness
- Measure and test trustworthiness characteristics (Measure) (NIST AI RMF): https://aipolicytracker.org/obligations/us-nist-ai-rmf-measure
- Prioritise, respond to and monitor AI risks (Manage) (NIST AI RMF): https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage
- Apply minimum risk-management practices to high-impact AI (OMB M-25-21): https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices
- Keep and run a protocol to detect suicidal ideation and self-harm and refer users to crisis resources (Washington AI companion chatbot law (ESHB 2225)): https://aipolicytracker.org/obligations/us-washington-eshb-2225-self-harm-protocol

## Latest changes

Dataset 1e8ea28a8a93 → ef1018b7a6a2. Sheet "Risk duties": 10 → 12 rows (+2). Record citations: 36 → 38.

- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.