AI Risk Assessment: Inventory, Impact Assessment, and a Sample Risk Register

An AI risk assessment identifies what could go wrong with the AI systems you build, provide, or use, scores how likely and how serious each risk is, and records how you will treat it. Under ISO/IEC 42001 it sits alongside a separate AI system impact assessment (clause 6.1.4), which looks at consequences for individuals, groups, and society. Both depend on an AI inventory, so build that first.

This guide covers the difference between the two assessments, the supporting standards, how to build the inventory, and a sample risk register with scoring and treatment options.

Risk assessment vs impact assessment

ISO 42001 treats these as related but distinct requirements.

	AI risk assessment	AI system impact assessment
ISO 42001 clause	6.1.2 (planning), 8.2 (operation); treatment in 6.1.3 and 8.3	6.1.4 (planning), 8.4 (operation); Annex A.5 controls
Question it answers	How could AI affect our ability to meet our objectives?	How could this AI system affect people and society?
Perspective	The organization	Individuals, groups, society
Typical topics	Errors, security, data leakage, vendor failure, legal and contractual exposure, reputation	Fairness, discrimination, safety, privacy, autonomy, access to services, societal effects
Output	Risk register, treatment plan, inputs to the Statement of Applicability	Documented impact assessment per system, fed back into risk treatment
Guidance standard	ISO/IEC 23894:2023	ISO/IEC 42005:2025

They overlap. A biased hiring screen is a harm to applicants (impact) and also a legal and reputational risk to you (risk). Run them together where it saves time, but keep the outputs distinguishable so an auditor can see both were done.

The supporting standards

• ISO/IEC 23894:2023 gives guidance on managing AI-specific risk. It builds on general risk management practice (ISO 31000) and adds AI-specific risk sources and considerations. It is guidance, not certifiable.
• ISO/IEC 42005:2025 gives guidance on AI system impact assessment: when in the life cycle to perform one, what to consider, and how to document it. It is also guidance, not certifiable.
• ISO 42001 Annex C lists potential AI-related organizational objectives and risk sources. It is a useful prompt list when you brainstorm risks.
• The NIST AI RMF MAP and MEASURE functions, and the Generative AI Profile (NIST AI 600-1), are a free source of risk categories, especially for generative AI.

Step 1: Build the AI inventory

Every assessment starts with a list. Most companies underestimate what they have, because AI arrives through product features, purchased software, and employees' own tools.

Where to look

• Product and engineering: architecture docs, model registries, calls to model APIs, ML pipelines.
• Procurement and finance: vendor lists, expense reports, and card spend on AI subscriptions.
• IT and security: SSO and identity provider app lists, browser extension inventories, network logs for known AI services.
• Team leads: a five-question survey asking what AI tools and features their team uses and for what.
• Existing SaaS: AI features that vendors have switched on inside CRM, support, HR, and productivity tools.

What to record

Field	Example
System ID and name	AI-007 Support reply drafting
Type	Built in-house / embedded in product / purchased tool / employee tool
Owner	Head of Customer Support
Purpose and intended use	Draft replies to customer tickets for agent review
Model or vendor	Third-party LLM via API
Data in	Ticket text, customer name, account metadata
Who is affected	Customers, support agents
Human oversight	Agent reviews every draft before sending
Life-cycle stage	In production
Risk tier	Medium
Last assessed	[date]

Tiering

Use a short triage to decide how deep each assessment goes. For example, rate a system high if it affects decisions about individuals (employment, credit, access to services), processes sensitive personal data, acts without human review, or is sold to customers as an AI capability. Rate it low if it is an internal productivity tool with no confidential data. Everything else is medium. High-tier systems get a full risk and impact assessment; low-tier systems can use a short form.

Step 2: Define the method before you score anything

ISO 42001 expects a risk assessment process that produces consistent, valid, and comparable results. Write down, in a short procedure:

• Risk criteria: what counts as acceptable, and who can accept what.
• Scales: definitions for each likelihood and impact level.
• Triggers: when assessments are performed and repeated.
• Roles: who assesses, who reviews, who approves.

A simple scoring method

Score likelihood and impact from 1 to 5. Risk score = likelihood x impact (1 to 25).

Score	Likelihood	Impact
1	Rare: not expected in the next 3 years	Negligible: no customer effect, trivial cost
2	Unlikely: could happen within 3 years	Minor: limited, quickly corrected, internal only
3	Possible: could happen within a year	Moderate: some customers affected, contractual issue, short-term harm to individuals
4	Likely: expected within a year	Major: many customers affected, regulatory inquiry, significant harm to individuals
5	Almost certain: expected within months	Severe: lasting harm to individuals, loss of key customers, enforcement action

Bands and default actions:

Score	Band	Default action
1–4	Low	Accept; owner monitors
5–9	Medium	Treat within planned work; owner can accept with AI governance lead sign-off
10–16	High	Treat before or shortly after release; committee approval to accept
20–25	Critical	Do not deploy or continue until treated; executive approval required to accept

Score the inherent risk (before controls), then the residual risk (after the controls you have or plan). Adjust the definitions to your size; a 30-person company and a 500-person company have different thresholds for "major."

Step 3: Sample AI risk register

These rows are illustrative examples for a B2B SaaS company. They are not drawn from any real client.

ID	System	Risk description	Category	L	I	Inherent	Existing / planned controls	Residual (L x I)	Treatment	Owner	Due
R-01	AI-007 Support reply drafting	Draft includes another customer's data due to retrieval error, sent to wrong customer	Privacy / confidentiality	3	4	12 High	Tenant-scoped retrieval, agent review before send, output filtering for identifiers	1 x 4 = 4 Low	Mitigate	Eng lead, Support	[date]
R-02	AI-003 Product search assistant	Prompt injection in user-supplied content causes the assistant to reveal system instructions or take unintended actions	Security	4	3	12 High	Input isolation, least-privilege tool access, red-team test before release	2 x 3 = 6 Medium	Mitigate	Security lead	[date]
R-03	AI-011 Lead scoring (vendor feature in CRM)	Scoring model disadvantages leads from certain regions; vendor will not disclose training data	Fairness / vendor	3	2	6 Medium	Quarterly outcome review by region, contract clause requiring notice of model changes	2 x 2 = 4 Low	Mitigate and accept	Head of Sales Ops	[date]
R-04	Employee chat assistants	Staff paste confidential source code into a personal AI account that trains on inputs	Data leakage	4	4	16 High	Approved enterprise tool with no-training terms, acceptable use policy, block known consumer endpoints	2 x 4 = 8 Medium	Mitigate	IT lead	[date]
R-05	AI-009 Resume screening pilot	Automated ranking of applicants affects employment decisions and may fall under high-risk rules in some jurisdictions	Legal / impact on individuals	3	5	15 High	Impact assessment, legal review, human decision on every candidate	n/a	Avoid: pilot stopped pending legal review	Head of People	[date]
R-06	AI-003 Product search assistant	Model provider changes or deprecates the model version, degrading answer quality	Vendor / reliability	3	3	9 Medium	Pinned model versions, regression evaluation suite, fallback provider	2 x 2 = 4 Low	Mitigate and share (contract terms)	Eng lead	[date]

Notice what makes the register useful: specific descriptions (not "AI bias"), a named owner, residual scores that follow from named controls, and a decision for every row.

Step 4: Choose a treatment

Four standard options, in ISO-consistent language:

• Mitigate (modify): add or strengthen controls to reduce likelihood or impact. Most rows end here. Map each control to the relevant Annex A control so it flows into your Statement of Applicability.
• Avoid: stop the activity or do not deploy. Right for critical risks you cannot reduce, such as R-05 above.
• Share (transfer): move part of the risk through contracts, vendor commitments, or insurance. Responsibility for the outcome usually stays with you.
• Accept (retain): keep the risk, consciously, with a named approver at the right authority level, recorded with a date and a review trigger.

Under ISO 42001, the treatment plan is also where you check that no needed Annex A control has been missed and justify the controls you include or exclude in the Statement of Applicability.

Step 5: Run the impact assessment for high-tier systems

For each high-tier system, document:

1. Intended purpose, users, and the people affected, including people who never use the system directly.
2. Foreseeable misuse.
3. Potential benefits and harms to individuals and groups: fairness, safety, privacy, autonomy, access to services.
4. Potential societal effects, where relevant.
5. Existing safeguards: human oversight, contestability, transparency to affected people.
6. Conclusions and actions, which feed back into the risk register.

Keep impact assessments with the system's documentation and revisit them when the system or its use changes.

Auditor's note: In audits, the most common gap we look for is a register that cannot be traced. An auditor picks a production AI system and asks: is it in the inventory, where is its risk assessment, where is its impact assessment, which controls treat the risks, and who accepted what is left? If any link is missing, it becomes a finding. Before an audit, walk two or three of your own systems through that chain end to end.

Where to go next

The risk assessment is the center of an AI governance framework; your AI policy sets the rules it applies. To see how ready your current process is, take the free ISO 42001 readiness assessment.

TrustAIMS, founded by former Big Four auditors, reviews your inventory and risk method against clauses 4–10 and all 38 Annex A controls in a fixed-fee ISO 42001 gap assessment, from $12,500 in about two weeks, or builds the full risk and impact assessment process with you during certification readiness. We are not a certification body, so we can advise you without conflicting with your certification audit.