An AI risk register exercise helps a team describe what could go wrong in one bounded use case and who is responsible for the next decision. The worksheet below is a learning aid, not a completed governance system.
How should teams begin with a specific fictional use case?
Use a fictional team drafting responses to customer enquiries from an approved policy document. State who prepares the response, who reviews it and whether anything is sent automatically. For this exercise, every response remains an internal draft until a person approves it.
Ask participants what information is involved and who could be affected by a wrong answer. This makes the discussion concrete. “AI might be inaccurate” is too broad to guide action; “the draft may invent a refund exception absent from the policy” gives the group something to test.
How should teams create a risk record that supports a decision?
Document the scenario, consequence, existing safeguard and evidence that would show whether the safeguard works. Include an owner and an unresolved question. Do not mark a risk controlled merely because a control has been proposed.
| Field | Fictional example |
|---|---|
| Task and boundary | Draft enquiry response; no automatic sending |
| Failure scenario | Invented refund exception |
| Possible consequence | Customer receives an unauthorized promise |
| Proposed safeguard | Reviewer compares every policy claim with source |
| Evidence to collect | Review catches seeded unsupported exceptions |
| Owner | Customer-service process owner |
| Open decision | Who resolves gaps in the policy? |
How should teams distinguish proposed controls from tested controls?
Ask the group to run the review against a draft containing a deliberate policy error. If the error passes unnoticed, the safeguard needs improvement even if everyone attended the policy briefing. Record the result and the change required.
Use statuses such as proposed, trialled and reviewed, with a date and evidence reference. Avoid labels that imply certification or full assurance. A workshop is a place to reveal gaps; it should not turn uncertainty into a green status for presentation purposes.
How should teams use a framework as a reference, not a badge?
NIST describes its AI Risk Management Framework as voluntary guidance for considering trustworthiness across AI design, use and evaluation. It can provide a common vocabulary for a discussion, but citing it does not establish certification or compliance.
The worksheet here is AISFY editorial guidance. Adapt it to the organization’s existing risk process and have the responsible specialists determine applicable requirements. Do not create a parallel register that nobody owns or reviews after the workshop.
How should teams end with decisions and evidence owners?
Choose whether to stop, change the scenario, gather evidence or proceed to a limited trial under existing approval rules. For the fictional response workflow, the next step might be clarifying a policy gap before any further drafting.
Record the residual uncertainty and the person who can make the next decision. Link the risk record to the relevant policy, training need and review evidence. The policy-workshop checklist in this category helps turn those unresolved questions into an agenda.
- Keep the use case and affected people explicit.
- Separate observed failures from hypothetical scenarios.
- Test a safeguard with a meaningful error.
- Record what the exercise cannot establish.
- Assign the next decision to an accountable owner.
What questions do readers frequently ask?
Does completing a register establish compliance?
No. It records a bounded assessment and next actions. Applicable legal, contractual and organizational requirements need appropriate specialist review.
Can we use this for a live high-risk decision?
This is an introductory learning exercise. A live high-consequence use requires the organization’s formal assessment, controls and approval process.
Which sources support this guide and further reading?
The exercises and worksheets are AISFY editorial guidance. They are not vendor certification or a claim of measured customer outcomes.
How can you put this guide into practice?
Use these questions to prepare a team brief, then explore ai governance and compliance workshop to discuss the appropriate scope. Continue through the ai governance & compliance learning category for the related checklists and exercises.
