---
title: "Risk register and operating readiness for an AI initiative"
slug: registro-riesgos-y-readiness
lang: en
situation: gobernar
format: plantilla
minutes: 20
updated: 2026-10-19
---

# Risk register and operating readiness for an AI initiative

> For whoever owns an AI initiative and has to answer "what could go wrong?" before the committee asks.

## When to use it

- The initiative already has a budget and nobody has written down what could fail or who would see it first.
- The vendor says it is "ready" and nobody knows whether your data, process or people are.
- You are going to the committee and the one question you dread is "and if it does not work?".

## The sheet

**Part 1 · Risk register.** One risk per row. The early signal is what someone would see before the risk materialises. Scale: H (high), M (medium), L (low). Response: avoid, reduce, transfer or accept.

| # | Risk | Early signal | Likelihood | Impact | Owner | Response | Review date |
|---|---|---|---|---|---|---|---|
| 1 | AI answers with outdated or incomplete data. [Illustrative.] | Two client complaints about the same answer in one week. | M | H | Head of operations | Reduce: weekly sample review; documented data cut-off. | __/__ |
| 2 | The team stops reviewing what AI produces. [Illustrative.] | Review time per item drops to zero in the log. | H | M | Area lead | Reduce: mandatory sample; whoever sends, signs. | __/__ |
| 3 | The vendor changes price or terms mid-contract. [Illustrative.] | Notice of change of terms; a "new plan" email. | L | H | Procurement or legal | Transfer: exit clause and data export. | __/__ |
| 4 | ______________________________ | ______________________ | | | | | |
| 5 | ______________________________ | ______________________ | | | | | |

**Part 2 · Six operating readiness questions.** Answer yes, no or partial. Every "no" is a new row in the register.

1. Data: is the information AI will use clean, permitted and owned by someone?
2. Process: is it written down at which step AI enters and at which it leaves?
3. People: has whoever will use it practised on real tasks and do they know what not to paste?
4. Supervision: who reviews a sample, by name, and how often?
5. Vendor dependency: what stops working if the vendor is down for a week?
6. Exit: can you switch it off, recover your data and return to the previous process without a large cost?

Readiness: ___ of 6 "yes" · Owner's signature: ____________ · Next review: ____________

## How to fill it in 20 minutes

1. Bring together the owner, someone who will use it and whoever signs the contract. Twenty minutes.
2. Answer the six questions first. Every "no" or "partial" becomes a row in the table.
3. Write the early signal before the response. If nobody can describe what they would see, the risk is badly written.
4. Set likelihood and impact on H/M/L without arguing decimals. What matters is which rows end up on top.
5. Write a name under "owner" and a date under "review". Without a date, the register gets filled once and never opened again.
6. The most common mistake: filling the table only with technical risks. The ones that cost most sit in people, process and exit.

## The line that is almost always missing

The early signal. Registers list risks and responses, and nobody writes what would be seen beforehand. Without a signal, the owner finds out once the problem has already happened and the "response" turns into an explanation.

## If this becomes a big decision

If the register shows high risks on a decision that is hard to reverse and carries your name, the free tools at vicsol.org/decision-clarity/ help you structure it. They do not replace a formal review.

---

Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution.
This sheet structures a conversation; it is not legal, financial or audit advice.