Vic Sol · Decision DeskEditable template · 20 min to use
Risk register and operating readiness for an AI initiative
For whoever owns an AI initiative and has to answer "what could go wrong?" before the committee asks.
When to use it
The initiative already has a budget and nobody has written down what could fail or who would see it first.
The vendor says it is "ready" and nobody knows whether your data, process or people are.
You are going to the committee and the one question you dread is "and if it does not work?".
The sheet
Part 1 · Risk register. One risk per row. The early signal is what someone would see before the risk materialises. Scale: H (high), M (medium), L (low). Response: avoid, reduce, transfer or accept.
#
Risk
Early signal
Likelihood
Impact
Owner
Response
Review date
1
AI answers with outdated or incomplete data. [Illustrative.]
Two client complaints about the same answer in one week.
M
H
Head of operations
Reduce: weekly sample review; documented data cut-off.
__/__
2
The team stops reviewing what AI produces. [Illustrative.]
Review time per item drops to zero in the log.
H
M
Area lead
Reduce: mandatory sample; whoever sends, signs.
__/__
3
The vendor changes price or terms mid-contract. [Illustrative.]
Notice of change of terms; a "new plan" email.
L
H
Procurement or legal
Transfer: exit clause and data export.
__/__
4
______________________________
______________________
5
______________________________
______________________
Part 2 · Six operating readiness questions. Answer yes, no or partial. Every "no" is a new row in the register.
Data: is the information AI will use clean, permitted and owned by someone?
Process: is it written down at which step AI enters and at which it leaves?
People: has whoever will use it practised on real tasks and do they know what not to paste?
Supervision: who reviews a sample, by name, and how often?
Vendor dependency: what stops working if the vendor is down for a week?
Exit: can you switch it off, recover your data and return to the previous process without a large cost?
Readiness: ___ of 6 "yes" · Owner's signature: ____________ · Next review: ____________
How to fill it in 20 minutes
Bring together the owner, someone who will use it and whoever signs the contract. Twenty minutes.
Answer the six questions first. Every "no" or "partial" becomes a row in the table.
Write the early signal before the response. If nobody can describe what they would see, the risk is badly written.
Set likelihood and impact on H/M/L without arguing decimals. What matters is which rows end up on top.
Write a name under "owner" and a date under "review". Without a date, the register gets filled once and never opened again.
The most common mistake: filling the table only with technical risks. The ones that cost most sit in people, process and exit.
The line that is almost always missing
The early signal. Registers list risks and responses, and nobody writes what would be seen beforehand. Without a signal, the owner finds out once the problem has already happened and the "response" turns into an explanation.
Vic Sol · Decision Desk · vicsol.org/resources/ · Free to use with attribution. This sheet structures a conversation; it is not legal, financial or audit advice.
Open the .docx in Word (or the .xlsx in Excel) or print it before the meeting.
Fill the fields with the team; leave the blanks visible, they are the discussion.
Close with one owner, one date and one next action. Nothing else.
Prompt
Generate this sheet for your case
Paste this prompt into ChatGPT, Claude or Gemini together with your proposal, process or policy. It reproduces the sheet with your data and flags what is missing.
Act as a chief operating officer with 15 years of experience who has watched AI initiatives fail because of the data, the people or the contract, almost never the technology.
Context I am giving you:
- Initiative and area: [ ]
- Process where AI comes in, step by step, as it works today: [ ]
- Data it will use and who owns it: [ ]
- People who will use it and what practice they have had: [ ]
- Vendor, contract length and exit terms: [paste or "not sure"]
- My answers (yes / no / partial) to the six readiness questions: data [ ], process [ ], people [ ], supervision [ ], vendor dependency [ ], exit [ ]
What I need: a risk register with exactly these columns: # · Risk · Early signal · Likelihood (H/M/L) · Impact (H/M/L) · Owner (role) · Response (avoid, reduce, transfer or accept) · Review date.
1. Turn every "no" or "partial" from the six questions into at least one row.
2. Add at most three more risks you can see in the process I gave you.
3. Order the rows from highest to lowest by combining likelihood and impact.
After the table, tell me in one line which row has the hardest early signal to observe and what to measure instead.
Output format: a table of at most eight rows and one closing line, maximum 350 words. No introduction.
Rules:
- Every row needs an early signal observable before the risk happens; if you cannot find one, say so in the cell instead of inventing it.
- Do not invent figures or names; where data is missing, write [DATA PENDING] and tell me how to get it.
- Include people, process and exit risks, not only technical ones.
- Flag every assumption as an assumption.
- If critical information is missing, ask me at most 3 questions before answering.
- Answer in plain, direct business English, with no sales adjectives.
What to check in the answer:
Does every row have an early signal someone would see before the problem, or did it put the problem itself as the signal?
Are there people, process and exit rows, or only technology?
Is the owner a concrete role in every row, or did it spread it between "the team" and "the vendor"?
Vic Sol