Free PDF · No signup · UK
Download the PDF. Print it. Bring it to your next leadership-team meeting.
What's inside
- Twelve pre-populated risks. From data leakage to public AI tools (the most common), through UK GDPR exposure, sector-regulatory exposure, output quality drift, vendor lock-in, bias, prompt injection, third-party AI exposure, skill gaps, cost overrun, inaction risk, and audit-failure risk.
- Likelihood × impact scoring. Standard 1–5 × 1–5 framework producing a 1–25 residual risk score. Anything ≥12 is board awareness territory; anything ≥16 is board action.
- Mitigation patterns per risk. Each risk includes the typical mitigation pattern — not detailed implementation, but enough to anchor the next decision.
- Methodology and review cadence. Six-monthly full review, 90-day light-touch refresh, trigger-based review on vendor or regulatory change.
Who this is for
UK businesses where AI risk needs to be presented to leadership, the board, a risk committee, or a client doing procurement due diligence. Particularly useful in regulated sectors (FCA, SRA, ICAEW, NHS supplier) where the risk register is an expected artefact.
How to use this
Adopt the pre-populated 12 risks as a starting point. Add your business-specific risks. Score honestly — both likelihood and impact. Decide treatment for each (accept, reduce, transfer, avoid). Name an owner and a review date for everything you intend to reduce.
Frequently asked
Is this a regulated risk assessment?
No. Where formal AI risk documentation is required (FCA SS1/23, sector-specific frameworks), use this as the working draft and convert to the regulator-expected format. For unregulated UK businesses, this is sufficient as the formal artefact.
How is this different from a DPIA?
A DPIA (Data Protection Impact Assessment) is UK GDPR-anchored and specifically about personal data risks. This is broader — covering data, regulatory, operational, security, vendor, and inaction risks. Run both; they're complementary.
Why include 'inaction' as a risk?
Boards consistently underweight the risk of not doing things — and overweight the risk of doing them. Inaction is a real risk: competitive disadvantage, talent flight, opportunity cost. Including it in the register forces a balanced conversation.
What if our residual risk scores look high?
It's normal on first run. The point isn't to score low — it's to know which risks need treatment. A high residual risk that's been acknowledged, accepted, and named-owned at appropriate seniority is defensible. An invisible risk is the problem.
How often should we update this?
Full review every 6 months. Light-touch refresh every 90 days. Trigger-based review on any vendor change, regulatory change, or material incident. Quarterly for businesses scaling AI use rapidly.
Related Arx Certa services
If the gaps this resource surfaces for your business need outside help to close:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — security overlay for AI use, UK GDPR / NCSC alignment, vendor risk assessment.
- Database — data foundations work AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Score your AI readiness in 4 minutes
The Arx Certa AI Readiness Scorecard quantifies the foundations this resource describes — across governance, data, infrastructure, security and use case. Free, 12 questions, personalised report.
Get your AI readiness score →