You take on a new client, a professional services firm with some sensitive data. A month later, you realise that three people in your team have been using ChatGPT to draft their client emails. None of them used client names. Probably. You think.
That moment of “probably” is what an AI risk register is designed to close. A simple record of what AI tools you are using, what risks they carry, and what you have done about each one. For a 5 to 50 person services firm, building one takes a few hours. Ignoring it is increasingly hard to justify as AI use spreads through your business and your clients start asking questions.
What is an AI risk register?
An AI risk register is a structured log, usually a spreadsheet or Notion table, that lists every AI tool in your business alongside the risks it creates, a likelihood and impact score, the controls you have in place, a named owner, and a review date. The ICO describes risk-based documentation as central to compliant AI; LexisNexis’s legal precedent template uses exactly these fields as its starting point.
For a small firm, you are typically looking at 10 to 30 rows across the whole business. A single row might read: use of ChatGPT to draft client emails; risk of personal data export and confidential information loss; likelihood 2; impact 3; risk rating 6; control is a policy banning client-identifiable information in public tools plus an enterprise version with a data processing agreement; owner is the operations manager; quarterly review. That is the whole format.
HighTable’s risk register guidance for SMEs illustrates a 1 to 9 scoring model where likelihood runs from 1 (low) to 3 (high) and impact does the same, so the product reaches a maximum of 9 for the most severe risks. A score of 6 or above flags a risk that warrants action. A shared spreadsheet with those columns works for a firm at this scale.
Why does it matter for a small services firm?
UK GDPR Article 25 requires data protection by design and by default whenever you process personal data. The ICO is explicit that sending personal data to a third-party AI API for summarisation or drafting counts as data processing. That means you need a lawful basis, appropriate contracts, and demonstrable risk management. A risk register is the clearest evidence that you have done that work.
The ICO can request evidence of your risk management approach, and so can an enterprise client’s procurement team. Having a register ready cuts that conversation short. Law firm Osborne Clarke notes that employees pasting sensitive information into public AI tools creates confidentiality and trade secret risks, and that businesses need to document how they are managing these exposures.
The Cabinet Office’s 2024 Mitigating Hidden AI Risks Toolkit found that poorly managed AI introductions can lead to over-reliance on AI outputs, staff deskilling, and erosion of trust, even when the technology itself performs well. A risk register that captures all four categories of AI risk, technical and organisational alike, is what helps you catch these problems before they become habits.
Where do AI risks actually show up in a small firm?
The practical risk categories for a small UK services firm break into four areas. Data and confidentiality is the most immediate. Bias and decision-making is less obvious but relevant if AI influences hiring, credit, or customer triage. Cyber and fraud risks are rising fast. Hidden behavioural risks, over-reliance, shadow AI, and inadequate training, round out the picture and are often the last to get documented.
Starting with data and confidentiality: the ICO’s AI guidance is clear that personal data sent to any third-party AI API is still data processing under UK GDPR. Controls here include acceptable-use policies, banning the entry of client-identifiable information into public tools, and using enterprise API versions that come with data processing agreements.
Bias and decision-making applies wherever AI plays any role in screening, scoring, or sorting individuals. If your firm uses an AI tool to filter job applications, assess credit risk, or triage customer queries, the ICO expects you to assess and document any bias or discrimination risks. KPMG’s AI Risk and Controls Matrix identifies unintended bias as a key category with potential for reputational damage and regulatory action.
Cyber and fraud risk is both external and internal. The National Cyber Security Centre reports that AI significantly increases the scale and sophistication of phishing, including AI-generated messages that closely mimic genuine communication patterns. Your brand could also be imitated. Both belong in the register with ownership shared between IT and operations.
Hidden risks cover staff over-relying on AI outputs, bypassing normal checks, and using tools that have not been approved. The Cabinet Office toolkit specifically flags these as the risks that undermine quality and trust from the inside, often long before anyone notices.
When should you build one, and when can you hold off?
A dedicated AI risk register is worth building once AI is touching client data, influencing decisions about individuals, or embedded in a core operational process. If your only AI use is a corporate-configured tool generating generic marketing copy with no personal data involved, a few rows in your existing risk log may be sufficient. The test is whether AI is creating risks for anyone other than your own team.
The ICO’s test, built into UK GDPR, is whether your AI use creates risks to individuals’ rights and freedoms. If it does, proportionate documentation is expected. The ICO does not specify a register format; it cares that you have a clear record of risks and controls and that someone owns them.
HighTable’s guidance for SMEs explicitly suggests integrating AI risks into an existing ISO 27001 style register rather than creating a separate document when the volume of AI use is low. That is a reasonable approach for a firm of fewer than ten people with limited AI exposure.
The practical check is this: if a regulator or an enterprise client asked to see evidence that you understand your AI risks and have controls in place, could you show them something credible in five minutes? If yes, you are covered. If the answer involves pulling something together, you need a register. The document you would need to create under pressure is exactly the document you should already have.
What connects to an AI risk register?
Several obligations and documents link directly to a small business AI risk register. A Data Protection Impact Assessment is required for higher-risk AI uses, including large-scale profiling and automated decisions with significant effects on individuals. Your risk register should link each high-risk AI use to its DPIA, or flag that one is needed before the use case goes live.
Shadow AI is a close neighbour. Both HighTable and the Cabinet Office toolkit recommend starting any AI governance exercise by surveying staff on the tools they actually use, not just the ones you have signed off. That survey becomes the first draft of your inventory, and uncovering shadow AI is often the most useful output of the exercise.
The EU AI Act is relevant if you deal with EU residents. It classifies AI systems by risk level, with high-risk categories including employment screening and credit scoring carrying stricter documentation obligations regardless of where your firm is based. For UK-only operations, ICO guidance is the primary reference point.
Supplier risk sits alongside these obligations. The Competition and Markets Authority’s ongoing oversight of foundation model providers means the contractual terms and pricing of key AI vendors may shift. Periodic reassessment of supplier risk belongs in the register as a standing review item.
Free starting points include the GOV.UK Hidden Risk Register Excel template, the ICO’s AI and data protection risk toolkit with downloadable worksheets, and the LexisNexis AI risk register precedent, which shows what professional-grade documentation looks like.
The aim is a document you can hand to a client, an insurer, or an ICO officer and have it read as evidence that someone in your business thought carefully about this. For a firm of 10 to 50 people, that document is rarely more than one page of a spreadsheet. The effort to build it is an afternoon. The cost of not having it tends to surface at the worst possible moment.
