---
title: "Prompt: build the risk register for your AI initiative"
slug: prompt-registro-riesgos
lang: en
updated: 2026-10-19
---

# Prompt: build the risk register for your AI initiative

How to use it: copy the block, paste it into ChatGPT, Claude or Gemini and replace the fields in brackets. Paste the proposal or the pilot scope. A good register is short: every risk has a signal that warns early and an owner who watches it. Complete it with the [Risk register and readiness](/resources/registro-riesgos-y-readiness/) and [AI operating risk checklist](/resources/checklist-riesgos-ia-operacion/) sheets. Do not paste confidential data unless your company has approved it.

```text
Act as an operational risk manager in mid-sized companies. You look for concrete risks of this initiative, not generic categories, and for each one you require an early signal and a workable control.

Context I am giving you:
- Company and function: [e.g. private healthcare, 1,500 people, patient services]
- AI initiative: [what it does, with which tool, on which data]
- Who uses it and who receives the output: [ ]
- Stage: [idea / pilot / in operation]
- Controls already in place: [ ]
- Full proposal or description: [paste]

What I need: a risk register with exactly this structure:
1. A table of 6 to 10 risks with columns: Risk | Cause | Impact (what breaks and for whom) | Likelihood 1–5 | Early signal | Control | Owner (role) | Review date.
2. The top 3 risks by impact and likelihood, with one line on why.
3. Risks I cannot assess yet, with the missing data point.

Cover at least: output quality, data and privacy, vendor dependency, use beyond what was approved, cost and adoption.

Output format: one table plus two short blocks, maximum 450 words. No introduction.

Rules:
- Do not invent figures, regulations or incidents. If data is missing, write [DATA PENDING] and tell me how to get it.
- Likelihood is an assumption: say what it rests on.
- An early signal must be visible before the damage. "Customer complaints" arrives too late.
- Do not give legal advice; if a risk needs legal or compliance review, say so and move on.
- If critical information is missing, ask me at most 3 questions before answering.
- Answer in plain, direct business English, with no sales adjectives and no alarmist language.
```

What to check in the answer:

- Is each risk specific to this initiative or generic? "AI can hallucinate" is generic; "the summary drops allergies from the patient history" is concrete.
- Can the early signals be seen before the damage, and does someone review them on a date?
- Does every control have an owner who exists in your org chart today?

This register organises a risk conversation; it is not legal or compliance advice. If the initiative is hard to reverse and carries your name, the free tools at vicsol.org/decision-clarity/ help you structure it. They do not replace a formal review.

---

Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution.
This sheet structures a conversation; it is not legal, financial or audit advice.