Building an AI Risk Register that Survives Internal Audit
What fields, classifications, and review cadences regulators expect. A practical template for AI inventories that stand up to MAS, RBI, and EU AI Act scrutiny.
A regulator-grade AI risk register has a minimum field set: model ID, model owner, use case, decision context (customer-facing, internal, hybrid), risk tier (low, medium, high), data sources, model type (rule-based, ML, LLM, agentic), training data lineage, evaluation methodology, deployment date, last review date, monitoring status, and incident history.
Classification matters more than most teams realise. Risk tiering should be done at intake, not retrofit, with clear criteria for each tier. EU AI Act Annex III applies to high-risk AI in eight specified categories; MAS Veritas applies the FEAT lens; RBI applies model risk principles closely aligned to SR 11-7. The right register supports all three with a single classification taxonomy.
Review cadence is the other regulator hotspot. High-risk models need quarterly review at minimum, with annual board-level reporting. Medium-risk models can run on semi-annual review. Low-risk models on annual review with event-triggered exceptions (drift detection, data source change, regulator update). The Magnis AI risk register template is downloadable from the Resources hub when templates ship in the next release.