AI governance: risk registers, evidence and human accountability

Learn in your browser · Chapter 01 of 06

First agree what a register is for, and what it cannot do.

This is general education, not legal advice. It draws on primary sources read on 26 September 2026, and following it makes no one compliant or certified. Involve legal colleagues on what the law requires, your data protection officer (DPO) whenever personal data is involved, and security colleagues on systems, suppliers and attacks.

The Department for Science, Innovation and Technology (DSIT) describes AI governance as mechanisms such as laws, regulations, policies, institutions and norms that outline how decisions about AI are made, and assurance as measuring, evaluating and communicating whether AI is trustworthy. A risk register applies both to one system: its risks, scores, controls, evidence, owners and decisions.

Scroll sideways to see every column.

HM Treasury's Orange Book says risk management should be embedded in, not separate from, an organisation's activities; NIST's AI Risk Management Framework (AI RMF) says AI risk belongs in enterprise risk management. So report AI risks through your usual route. A data protection impact assessment (DPIA) is separate; link the two.

Learn in your browser · Chapter 02 of 06

A hazard is something that could cause harm. Look at every stage, not only the model.

NIST's AI RMF has four functions. GOVERN is cross-cutting: culture, policies, roles and accountability. MAP sets the context and identifies risks. MEASURE analyses and tracks them. MANAGE treats them. The framework is voluntary, and on 26 September 2026 NIST's web page said AI RMF 1.0 is being revised.

Mapping starts from context: purpose, users, people affected, and what the system must never do. NIST warns that a deployer's use can carry risks the developer never considered.

Scroll sideways to see every column.

Instructions embedded in material the model reads can attempt indirect prompt injection. The National Cyber Security Centre (NCSC) wrote in December 2025 that current large language models do not enforce a security boundary between instructions and data, so prompt injection may well never be totally mitigated. Those owning the risk should be aware it will remain a residual risk, it says, and design should focus more on deterministic (non-model) safeguards that constrain what the system can do. Hence Sampleford's assistant cannot send.

The NCSC's machine learning principles (version 2.0, May 2024) cover the lifecycle from design to decommissioning; the NCSC says they are not a checklist.

Learn in your browser · Chapter 03 of 06

Scores rank risks, but only with a written scale and proved controls.

NIST describes risk as combining the probability of an event with the size of its consequences; the Orange Book asks for common criteria based on likelihood and consequences. One simple convention scores each from 1 to 5 and multiplies. This scale is invented; use your organisation's own.

Scroll sideways to see every column.

Inherent risk is the score before controls. A control reduces likelihood or impact: a check, a setting, a contract clause. Residual risk, NIST says (after ISO), is risk remaining after treatment: the score with controls working. Many controls cut likelihood rather than impact.

Risk appetite, in the Orange Book's words, is the nature and extent of the risks an organisation is willing to take to achieve its objectives. NIST does not prescribe a risk tolerance; the ICO (Information Commissioner's Office) calls zero tolerance of risks to people's rights unrealistic. Sampleford's invented rule: a residual score above 8 needs a named approver who is not the owner. Where risk is unacceptable, NIST says deployment should cease safely.

No evidence, no control. Record where each control's proof lives: a dated test, a sample log, an access review. A control you cannot show working is a hope.

Learn in your browser · Chapter 04 of 06

Registers fail when nobody may clearly decide, or when human review exists only on paper.

Every risk needs an owner: a named post that manages it. NIST asks for documented roles, with executive leadership responsible for AI risk decisions; the ICO says these issues cannot be delegated to data scientists or engineering teams. The government's AI Playbook asks teams to set who may change the model, and escalation routes.

Scroll sideways to see every column.

Make the right to stop wide and fast, and the right to restart narrow. NIST asks for assigned responsibilities and mechanisms to deactivate a system that departs from its intended use; the ICO says be ready to halt a deployment that cannot comply. Write down which switch, who is told and what staff do instead.

Real oversight. The ICO describes automation bias as routinely relying on a system's output and no longer using your own judgement or questioning it. Its guidance concerns decisions about people, not drafting, so use its tests as a yardstick, not a requirement: a 'rubber stamp' does not count; reviewers need authority and competence to go against the output, and confidence they will not be penalised. The EU AI Act names automation bias too, in its human oversight rules for high-risk systems.

Scroll sideways to see every column.

The ICO says to analyse why, and how often, reviewers accept or reject outputs; if they routinely agree without genuine assessment, act, for example with more human scrutiny.

Learn in your browser · Chapter 05 of 06

Registers decay quietly. A small script can check their form, never their truth.

Save this as register.csv in a new folder (plain UTF-8 text): Sampleford's register, with mistakes planted. The PDF wraps long rows; your file needs exactly eight lines, so rejoin any row that copies in pieces. Use a text editor: a spreadsheet can alter dates and separators. In controls and evidence, semicolons separate items; the first evidence item supports the first control. Owners are posts; a real register also names the holder.

id,hazard,stage,likelihood,impact,controls,evidence,owner,residual,review,status,approver
R01,Draft promises a wrong repair date,model,5,3,Officer checks each draft;Dates from policy table,QA sample Sep;Test TP-2,Repairs Manager,6,2026-12-01,open,
R02,Hidden instructions in a tenant message,prompts,3,3,No send or edit rights;Officer checks each draft,Access review AR-7;QA sample Sep,Digital Services Manager,6,2026-11-15,open,
R03,Dangerous defect not flagged urgent,use,3,5,Keyword triage first;Officer checks each draft,Test TT-3;QA sample Sep,Repairs Manager,10,2026-10-15,open,Director of Housing
R04,Drafts sent unchanged without reading,use,4,4,Monthly sample;Unchanged rate to board,TBC,Customer Services Manager,9,2026-10-01,open,
R05,Supplier changes model without notice,supplier,3,3,Notice clause;Regression test,Contract s4;Test TP-2,,6,2026-08-31,open,
R02,Policy knowledge out of date,drift,3,6,Owner signs off updates,Change log CL-12,Repairs Manager,6,2026-10-30,open,
R06,Supplier outage,supplier,3,2,Manual templates,Test BC-2,Digital Services Manager,4,2026-06-30,closed,

The checker uses only Python's standard library and changes nothing. Save it as check_register.py beside the register.

"""check_register.py: check the form of an AI risk register. It only reads."""
import csv
import sys
from datetime import date

APPETITE = 8  # invented: a residual score above 8 needs a named approver
TODAY = date(2026, 9, 26)  # fixed so the output repeats; use date.today() for real
COLUMNS = ["id", "hazard", "stage", "likelihood", "impact", "controls", "evidence",
           "owner", "residual", "review", "status", "approver"]


def items(cell):
    """Preserve semicolon positions; blank, TBC and none become empty slots."""
    parts = [p.strip() for p in cell.split(";")]
    return ["" if p.lower() in ("", "tbc", "none") else p for p in parts]


def check(rows):
    problems, seen = [], set()
    for row in rows:
        rid = row["id"]
        if None in row or None in row.values():  # extra or missing values
            problems.append((rid, "wrong number of values"))
            continue
        if rid in seen:
            problems.append((rid, "duplicate id"))
        seen.add(rid)
        try:
            lik, imp = int(row["likelihood"]), int(row["impact"])
            res, due = int(row["residual"]), date.fromisoformat(row["review"])
        except ValueError:
            problems.append((rid, "unreadable score or date"))
            continue
        # scores 1 to 5; residual cannot exceed inherent (likelihood x impact)
        if not (1 <= lik <= 5 and 1 <= imp <= 5 and 1 <= res <= lik * imp):
            problems.append((rid, "score out of range"))
        if not row["owner"].strip():
            problems.append((rid, "no owner"))
        controls, evidence = items(row["controls"]), items(row["evidence"])
        if any(control and (i >= len(evidence) or not evidence[i])
               for i, control in enumerate(controls)):
            problems.append((rid, "a control has no evidence"))
        if res > APPETITE and not row["approver"].strip():
            problems.append((rid, f"residual {res} above appetite, no approver"))
        if row["status"] == "open" and due < TODAY:
            problems.append((rid, f"review overdue since {due}"))
    return problems


if __name__ == "__main__":
    with open(sys.argv[1], newline="", encoding="utf-8-sig") as f:
        reader = csv.DictReader(f)
        if reader.fieldnames != COLUMNS:
            sys.exit("First line must be: " + ",".join(COLUMNS))
        rows = list(reader)
    problems = check(rows)
    for rid, message in problems:
        print(f"{rid}: {message}")
    print(f"{len(rows)} risks checked, {len(problems)} problem(s)")
    sys.exit(1 if problems else 0)

Run it from that folder (python3 on macOS and Linux). TODAY is fixed, so your output should match.

python check_register.py register.csv
R04: a control has no evidence
R04: residual 9 above appetite, no approver
R05: no owner
R05: review overdue since 2026-08-31
R02: duplicate id
R02: score out of range
7 risks checked, 6 problem(s)

R03 is above appetite but names an approver; R06 is overdue but closed. The script exits with code 1 when it finds problems, so a scheduled job could flag them. A wrong header stops it; a split row or stray comma shows as a wrong number of values.

Now test the checker: each mistake, planted in a clean row, must give exactly one problem. Save this as test_check_register.py and run python -m unittest.

"""test_check_register.py: a clean row passes; each planted mistake is caught."""
import unittest

from check_register import check

CLEAN = {"id": "T1", "likelihood": "3", "impact": "3", "residual": "6",
         "owner": "Owner", "controls": "Check", "evidence": "Log", "approver": "",
         "review": "2026-12-01", "status": "open"}
MISTAKES = {"impact": "7", "owner": "", "evidence": "TBC", "residual": "9",
            "review": "2026-09-01", "status": None}  # None: missing value


class CheckTests(unittest.TestCase):
    def test_clean_row_passes(self):
        self.assertEqual(check([CLEAN]), [])

    def test_each_mistake_is_caught(self):
        for field, bad in MISTAKES.items():
            with self.subTest(field=field):
                self.assertEqual(len(check([dict(CLEAN, **{field: bad})])), 1)
        self.assertEqual(check([CLEAN, CLEAN]), [("T1", "duplicate id")])


if __name__ == "__main__":
    unittest.main()

python -m unittest
..
----------------------------------------------------------------------
Ran 2 tests in 0.000s

OK

Two dots, two passes; your time will differ.

Learn in your browser · Chapter 06 of 06

A register earns its keep when something breaks, changes or needs a decision.

Scroll sideways to see every column.

NIST asks for monitoring covering override, incident response, recovery, change management and decommissioning, at a set review frequency. The AI Playbook asks for revertible releases and drift monitoring; the ICO calls a DPIA a live document.

An audit trail of decisions. Record each decision to go live, accept a risk above appetite, pause or restart, on one page, so anyone later can see who decided what, on what evidence and advice.

Scroll sideways to see every column.

How the sources fit. NIST gives the structure; DSIT and the Government Digital Service's AI Playbook give UK public sector context; the NCSC covers security; the ICO covers personal data, with its AI guidance under review after the Data (Use and Access) Act. ISO/IEC 42001:2023 is paid, so we use only ISO's public description: requirements for establishing, implementing, maintaining and continually improving an AI management system.

If you need this framework built into a real workflow, Mickai advertises bespoke systems with an offline core running on customer hardware. Establish the actual data flows, permitted connections, logs, support routes and contractual limits for your proposed engagement. This workbook has not verified a deployment or a universal zero-egress property. See mickai.co.uk/bespoke for the published service description.