AI risk register
Register of AI-specific and delivery risks with likelihood, impact, owner and mitigation.
AI Risk Register
| ID | Risk | Likelihood (1-5) | Impact (1-5) | Score | Owner | Mitigation | Status |
|---|---|---|---|---|---|---|---|
| R1 | Model gives wrong or fabricated answer (hallucination) | 3 | 4 | 12 | AI engineer | Ground answers in approved sources; cite sources; human review for financial postings | Open |
| R2 | Sensitive data exposed to external model | 2 | 5 | 10 | InfoSec | Use in-tenancy models (OCI GenAI); mask PII; data processing agreement | Open |
| R3 | Poor data quality lowers accuracy | 4 | 3 | 12 | Data owner | Profile and cleanse early; set accuracy gates | Open |
| R4 | Users do not trust or adopt the tool | 3 | 3 | 9 | Business owner | Co-design, training, show sources, phased rollout | Open |
| R5 | Quarterly Oracle update breaks integration | 3 | 3 | 9 | Solution architect | Regression suite before each update | Open |
| R6 | Model drift after go-live | 3 | 3 | 9 | AI engineer | Monitoring and monthly evaluation | Open |
| R7 | Regulatory non-compliance (audit trail, explainability) | 2 | 5 | 10 | Compliance | Log inputs/outputs; maker-checker approvals | Open |