What is a risk register in AI governance?

• A. A documented list of AI-related risks, with likelihood, impact, controls, owners, and status.
• B. A list of project milestones and deadlines.
• C. A register of data sources and licenses.
• D. A log of user feedback.

Answer: (A)

In AI governance, a risk register is a structured, documented list that captures AI-related risks and tracks how they are being addressed. It records each risk along with its likelihood and potential impact, the controls or mitigations in place, who is responsible, and the current status. This format supports ongoing monitoring, prioritization, and accountability, helping governance bodies understand residual risk and whether additional actions are needed as AI systems evolve.

The other options don’t fit the purpose of risk management: a list of project milestones and deadlines focuses on scheduling rather than risk; a register of data sources and licenses concerns data provenance and compliance, not the assessment and mitigation of risks; and a log of user feedback collects stakeholder input without systematically tracking risk, controls, or ownership.