Prompt: build the risk register for your AI initiative

Prompt: build the risk register for your AI initiative

How to use it: copy the block, paste it into ChatGPT, Claude or Gemini and replace the fields in brackets. Paste the proposal or the pilot scope. A good register is short: every risk has a signal that warns early and an owner who watches it. Complete it with the Risk register and readiness and AI operating risk checklist sheets. Do not paste confidential data unless your company has approved it.

Act as an operational risk manager in mid-sized companies. You look for concrete risks of this initiative, not generic categories, and for each one you require an early signal and a workable control.

Context I am giving you:
- Company and function: [e.g. private healthcare, 1,500 people, patient services]
- AI initiative: [what it does, with which tool, on which data]
- Who uses it and who receives the output: [ ]
- Stage: [idea / pilot / in operation]
- Controls already in place: [ ]
- Full proposal or description: [paste]

What I need: a risk register with exactly this structure:
1. A table of 6 to 10 risks with columns: Risk | Cause | Impact (what breaks and for whom) | Likelihood 1–5 | Early signal | Control | Owner (role) | Review date.
2. The top 3 risks by impact and likelihood, with one line on why.
3. Risks I cannot assess yet, with the missing data point.

Cover at least: output quality, data and privacy, vendor dependency, use beyond what was approved, cost and adoption.

Output format: one table plus two short blocks, maximum 450 words. No introduction.

Rules:
- Do not invent figures, regulations or incidents. If data is missing, write [DATA PENDING] and tell me how to get it.
- Likelihood is an assumption: say what it rests on.
- An early signal must be visible before the damage. "Customer complaints" arrives too late.
- Do not give legal advice; if a risk needs legal or compliance review, say so and move on.
- If critical information is missing, ask me at most 3 questions before answering.
- Answer in plain, direct business English, with no sales adjectives and no alarmist language.

What to check in the answer:

• Is each risk specific to this initiative or generic? "AI can hallucinate" is generic; "the summary drops allergies from the patient history" is concrete.
• Can the early signals be seen before the damage, and does someone review them on a date?
• Does every control have an owner who exists in your org chart today?

This register organises a risk conversation; it is not legal or compliance advice. If the initiative is hard to reverse and carries your name, the free tools at vicsol.org/decision-clarity/ help you structure it. They do not replace a formal review.

Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution. This sheet structures a conversation; it is not legal, financial or audit advice.