Skip to main content
The Risk Register is the central living record of every identified risk for a project. Each entry represents one specific risk that could affect health, safety, or fundamental rights — exactly what EU AI Act Article 9 requires you to identify and analyze. You can add risks manually, or let Alethia suggest them automatically from your test results.

​
What’s in a risk entry?

​
Risk scoring

Every risk gets two scores: inherent (before mitigations) and residual (after mitigations). Both are calculated on a 5×5 matrix: Likelihood × Impact.
When you create a risk, you set the inherent score. The residual score starts equal to the inherent score and decreases as mitigations are verified as effective.

​
Adding a risk manually

1

Open Risk → Register

Inside your project.
2

Click 'New Risk'

The form opens.
3

Fill in title and description

Be specific and concrete. “Model recommends declined applications more often for non-Western names” is better than “Bias.”
4

Pick the EU AI Act risk domain

The dropdown lists the standard domains: health_safety, fundamental_rights, discrimination, privacy, transparency, child_safety, environmental, cybersecurity.
5

Link prompt categories

Select the prompt categories that test for this risk. This makes assessments much faster later.
6

Set likelihood and impact

Pick from the dropdowns. The inherent risk score is calculated and shown live.
7

Set priority and assign an owner

Owner = the person responsible for tracking this risk and its mitigations. Defaults to you.
8

Save

The risk gets a code (RISK-001, etc.) and appears in the register.

​
Auto-suggested risks

Alethia can read your test results and suggest risks based on patterns of failure:
1

Run some tests first

The system needs at least a few test results to suggest from.
2

Click 'Suggest Risks' on the Register page

Alethia analyzes recent test runs and looks for categories with high failure rates.
3

Review the suggestions

Each suggestion includes:
  • A proposed title
  • The data behind it (“12 of 15 tests in bias_and_fairness returned unsafe”)
  • A pre-filled risk domain (mapped from the prompt category)
  • A suggested likelihood and impact based on the failure rate and prompt severity
4

Accept, edit, or reject

You can edit any field before accepting. Rejected suggestions are logged but not added.
The mapping from prompt categories to EU AI Act risk domains is built in. For example: The full mapping table is visible at the bottom of the suggestions page.

​
Risk lifecycle

A risk’s status field tracks where it is in its life:
  • identified — risk has been added but not yet formally assessed
  • assessed — at least one assessment has been completed
  • mitigating — at least one mitigation is in_progress or implemented
  • accepted — the residual risk is acceptable; no further action planned
  • closed — the risk no longer applies (e.g., the feature was removed)
  • transferred — the risk is owned by another party (e.g., a vendor)

​
Filtering and prioritizing

The register is sortable and filterable:
  • Sort by inherent risk to see what to prioritize first
  • Sort by residual risk to see what’s still concerning after mitigations
  • Filter by status to see active vs closed risks
  • Filter by priority to see what your owners should focus on
  • Filter by owner to see your own assigned risks

​
The risk heatmap

On the Dashboard, you’ll see your risks plotted on the same 5×5 likelihood × impact matrix. Each cell shows how many risks land in that bucket. This is a quick way to see whether your portfolio of risks is concentrated in the dangerous corner (high likelihood, high impact) or spread out. See Risk Dashboard.

​
Audit trail

Every action on the risk register is logged: creating, editing, status changes, owner changes, deletion attempts. The audit log shows who, when, and what changed (with full before/after snapshots).