The AI risk register that survives an audit
ISO 42001 is a risk-based standard, which means the risk register isn't paperwork — it's the evidence that you understood your exposure and did something measurable about it. Most registers fail an auditor for the same three reasons. Here's how to build one that doesn't.
Inherent vs residual — the distinction that gets missed
The most common failure is a register that lists risks and controls but never distinguishes inherent risk (before controls) from residual risk (after). Auditors want to see the arithmetic of governance: here was the raw exposure, here's what we did, here's what's left. Without that before-and-after, you've described risks but not shown that your controls actually move the needle — which is the whole point of a management system.
Score it, don't just describe it
For each AI system, rate likelihood and impact on a simple, consistent scale and multiply for a priority. The scale matters less than using the same one every time — consistency is what lets you compare risks and defend why you treated some and accepted others. Purely narrative registers ("this could be biased") give an auditor nothing to test. A scored register says you thought in terms of exposure, not vibes.
Every risk needs an owner and a date
A risk with no named owner and no target date is a wish. The treatment column should say what you'll do (mitigate, transfer, accept, avoid), who owns it, and by when. This is also where the register connects to the rest of the system: owners come from your RACI, treatments feed your procedures, and accepted risks should trace to a conscious decision, not an omission.
Keep it alive
A register dated once, a year ago, tells an auditor the loop isn't running. Update it when you add an AI system, when an incident reveals a new risk, and at each management review. ISO 42001 is about a system that keeps working — a living register is the clearest single piece of evidence that yours does.
Educational orientation, not legal advice. ISO/IEC 42001 references current as of September 2026. Certification is performed by accredited bodies.