> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alethiaai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# The Risk Register

> Identify, score, and prioritize every risk associated with your AI system.

The **Risk Register** is the central living record of every identified risk for a project. Each entry represents one specific risk that could affect health, safety, or fundamental rights — exactly what EU AI Act Article 9 requires you to identify and analyze.

You can add risks **manually**, or let Alethia **suggest them automatically** from your test results.

## What's in a risk entry?

| Field                   | Example                                                                 |
| ----------------------- | ----------------------------------------------------------------------- |
| **Risk code**           | `RISK-007` (auto-generated, unique within the project)                  |
| **Title**               | "AI may produce biased hiring recommendations against protected groups" |
| **Description**         | Detailed paragraph explaining the risk                                  |
| **Risk domain**         | EU AI Act category — e.g., `discrimination`, `health_safety`, `privacy` |
| **Related categories**  | Prompt categories that test for this risk                               |
| **Likelihood**          | Very Low / Low / Medium / High / Very High                              |
| **Impact**              | Negligible / Minor / Moderate / Major / Critical                        |
| **Inherent risk score** | Likelihood × Impact (1–25)                                              |
| **Residual risk score** | Score after mitigations (recalculated automatically)                    |
| **Status**              | identified → assessed → mitigating → accepted / closed                  |
| **Priority**            | Critical / High / Medium / Low                                          |
| **Owner**               | The person responsible for managing this risk                           |

## Risk scoring

Every risk gets two scores: **inherent** (before mitigations) and **residual** (after mitigations).

Both are calculated on a 5×5 matrix: **Likelihood × Impact**.

```
                        Impact →
                Negligible  Minor  Moderate  Major  Critical
              ┌─────────────────────────────────────────────┐
 Very High    │     5     │  10   │   15   │  20  │   25   │
 High         │     4     │   8   │   12   │  16  │   20   │
 Medium       │     3     │   6   │    9   │  12  │   15   │
 Low          │     2     │   4   │    6   │   8  │   10   │
 Very Low     │     1     │   2   │    3   │   4  │    5   │
              └─────────────────────────────────────────────┘
                                                Likelihood ↓
```

| Score |   Color   | Meaning                                |
| :---: | :-------: | -------------------------------------- |
|  1–4  |  🟢 Green | Low risk                               |
|  5–9  | 🟡 Yellow | Medium risk                            |
| 10–15 | 🟠 Orange | High risk — should have mitigations    |
| 16–25 |   🔴 Red  | Critical risk — needs urgent attention |

When you create a risk, you set the **inherent** score. The **residual** score starts equal to the inherent score and decreases as mitigations are verified as effective.

## Adding a risk manually

<Steps>
  <Step title="Open Risk → Register">
    Inside your project.
  </Step>

  <Step title="Click 'New Risk'">
    The form opens.
  </Step>

  <Step title="Fill in title and description">
    Be specific and concrete. "*Model recommends declined applications more often for non-Western names*" is better than "*Bias.*"
  </Step>

  <Step title="Pick the EU AI Act risk domain">
    The dropdown lists the standard domains: `health_safety`, `fundamental_rights`, `discrimination`, `privacy`, `transparency`, `child_safety`, `environmental`, `cybersecurity`.
  </Step>

  <Step title="Link prompt categories">
    Select the prompt categories that test for this risk. This makes assessments much faster later.
  </Step>

  <Step title="Set likelihood and impact">
    Pick from the dropdowns. The inherent risk score is calculated and shown live.
  </Step>

  <Step title="Set priority and assign an owner">
    Owner = the person responsible for tracking this risk and its mitigations. Defaults to you.
  </Step>

  <Step title="Save">
    The risk gets a code (`RISK-001`, etc.) and appears in the register.
  </Step>
</Steps>

## Auto-suggested risks

Alethia can read your test results and suggest risks based on patterns of failure:

<Steps>
  <Step title="Run some tests first">
    The system needs at least a few test results to suggest from.
  </Step>

  <Step title="Click 'Suggest Risks' on the Register page">
    Alethia analyzes recent test runs and looks for categories with high failure rates.
  </Step>

  <Step title="Review the suggestions">
    Each suggestion includes:

    * A proposed title
    * The data behind it ("12 of 15 tests in `bias_and_fairness` returned unsafe")
    * A pre-filled risk domain (mapped from the prompt category)
    * A suggested likelihood and impact based on the failure rate and prompt severity
  </Step>

  <Step title="Accept, edit, or reject">
    You can edit any field before accepting. Rejected suggestions are logged but not added.
  </Step>
</Steps>

The mapping from prompt categories to EU AI Act risk domains is built in. For example:

| Prompt category               | EU risk domain   | Article reference |
| ----------------------------- | ---------------- | ----------------- |
| `harmful_content`             | `health_safety`  | Art. 9§2(a)       |
| `bias_and_fairness`           | `discrimination` | Art. 10§2(f)      |
| `child_safety`                | `child_safety`   | Art. 9§9          |
| `privacy_and_data_protection` | `privacy`        | Art. 10, GDPR     |

The full mapping table is visible at the bottom of the suggestions page.

## Risk lifecycle

A risk's `status` field tracks where it is in its life:

```
identified  ──►  assessed  ──►  mitigating  ──►  accepted
                                                     │
                                                     ▼
                                                   closed
```

* **identified** — risk has been added but not yet formally assessed
* **assessed** — at least one assessment has been completed
* **mitigating** — at least one mitigation is `in_progress` or `implemented`
* **accepted** — the residual risk is acceptable; no further action planned
* **closed** — the risk no longer applies (e.g., the feature was removed)
* **transferred** — the risk is owned by another party (e.g., a vendor)

## Filtering and prioritizing

The register is sortable and filterable:

* Sort by **inherent risk** to see what to prioritize first
* Sort by **residual risk** to see what's still concerning *after* mitigations
* Filter by **status** to see active vs closed risks
* Filter by **priority** to see what your owners should focus on
* Filter by **owner** to see your own assigned risks

## The risk heatmap

On the **Dashboard**, you'll see your risks plotted on the same 5×5 likelihood × impact matrix. Each cell shows how many risks land in that bucket. This is a quick way to see whether your portfolio of risks is concentrated in the dangerous corner (high likelihood, high impact) or spread out.

See [Risk Dashboard](/risk-management/dashboard).

## Audit trail

Every action on the risk register is logged: creating, editing, status changes, owner changes, deletion attempts. The audit log shows who, when, and what changed (with full before/after snapshots).