Book demo Start free

AI Agent Risk Register

Estimated reading time: 4 minutes

The risk register is a maintained, organization-scoped record of specific risks tied to the specific AI systems, assets and agents they belong to. Each entry names a risk category, describes the exposure, lists mitigation measures, rates the residual risk after those mitigations, can be rated on eight risk dimensions, can point to the incident that raised it, and records who assessed it and when it is due for review — the structure Article 9 of the EU AI Act expects a risk-management record to have. For the product overview, see risk management.

In the product

Open Trust & Safety → Risk Register. The register lists every risk with these columns:

  • Risk — the risk category and a description of the exposure.
  • AI System / asset — what the risk belongs to.
  • Residual risk — low, medium or high, what remains once the mitigations are in place.
  • Dimensions — how many of the eight risk dimensions have been assessed.
  • Review — the next review date and a status: review scheduled, review overdue, or no review scheduled.
  • Incident — the incident the risk was raised from, where there is one.

Filter the list by AI System, asset, residual risk level, or review status. With compliance.manage you can add a risk or edit an existing one — category, description, mitigations, residual risk, next review date, the AI System, asset and incident it belongs to, and each of the eight dimensions. The API below does the same from your own tooling, and also links entries to agents, guardrails and alert configurations.

Before you start

  • Reading entries requires compliance.view; creating, updating, or deleting entries requires compliance.manage. Unlike most feature-gated endpoints, risk register routes are not behind a feature flag — compliance tooling is available to every organization.
  • Decide your risk categories up front. The register uses six fixed categories: data-privacy, discrimination, safety, security, transparency, autonomy. Every entry is classified under exactly one.
  • An entry can reference the AI System (aiSystemId), asset (assetId) or agent (agentId) it belongs to, and the incident (incidentId) that raised it; a referenced AI System, asset or incident must belong to your organization. Attach entries to the real system, asset or agent wherever the risk is specific to one — an entry with none of these is only appropriate for an org-level process risk.

1. Create an entry

POST /organizations/{orgId}/compliance/risk-register
{
  "aiSystemId": "...",
  "assetId": "...",
  "agentId": "...",
  "incidentId": "...",
  "riskCategory": "security",
  "description": "Agent has write access to the customer database and no output-content guardrail.",
  "mitigationMeasures": ["Guardrail GR-114 blocks write-scope tool calls outside business hours"],
  "residualRiskLevel": "medium",
  "assessedAt": "2026-09-01T00:00:00.000Z",
  "reviewDueAt": "2027-01-01T00:00:00.000Z",
  "linkedGuardrailIds": ["..."],
  "linkedSloIds": ["..."],
  "impact": "high",
  "likelihood": "medium",
  "autonomy": "medium",
  "dataSensitivity": "high",
  "privilege": "high",
  "externalExposure": "low",
  "regulatoryImpact": "medium",
  "businessCriticality": "high"
}

residualRiskLevel is low, medium, or high — a qualitative rating with the mitigation description as its rationale, not an invented numeric score. linkedGuardrailIds and linkedSloIds tie the entry to the actual guardrail or alert configuration that mitigates or monitors it, so a reviewer can follow the reference rather than take the entry's word for it. incidentId records the incident a risk was raised from.

The eight risk dimensions — impact, likelihood, autonomy, dataSensitivity, privilege, externalExposure, regulatoryImpact, businessCriticality — are each optional and rated low, medium, or high. A dimension you leave out is recorded as not assessed, never counted as low, so rate only what you have actually assessed.

2. List and filter entries

GET /organizations/{orgId}/compliance/risk-register?aiSystemId=...

Results are paginated. Filter by aiSystemId, assetId, agentId or incidentId to see every entry for one AI System, asset, agent or incident, or omit the filters to see the organization's full register.

3. Update or close an entry

PUT /organizations/{orgId}/compliance/risk-register/{id} accepts the same fields as creation (all optional on update) and is used to update the residual risk level, add a mitigation, or push out the review date after a reassessment. DELETE removes an entry (soft delete).

Building the register from real agents

Walk your actual agent inventory rather than writing generic entries. An agent connected through the entity and connection model with a specific, broad grant is a concrete entry — "agent X has write access to Y and no guardrail Z" — not a restatement of "AI introduces risk." See how to build an AI agent risk register for the full procedure this API implements: defining categories, walking the inventory, rating consistently, linking controls, assigning owners, and setting a review cadence.

The OWASP Agentic — Security Starter governance pack, where available in your deployment, creates ten unassessed starter risk-register entries you configure and assess rather than writing from a blank register — see the action-to-evidence quickstart for where that pack fits into a broader control setup.

Continue with classifying an agent's EU AI Act risk tier, which determines the broader obligation tier this register's Article 9 entries sit inside.