Ernesto Custodio, PhD, Editor

Use a structured risk evaluation framework covering vendor stability, data handling, integration risk, compliance, user access, and exit options. Score each dimension to get a composite risk rating.

An AI risk register extends your standard risk register with AI-specific categories: vendor dependency, model drift, data privacy violations, bias in outputs, and regulatory non-compliance. Assign likelihood and impact scores, and define mitigations.

Project managers preparing for EU AI Act compliance should: inventory all AI tools in use, classify each by risk tier, document human oversight mechanisms for high-risk systems, verify vendor compliance status, and create an AI change management record. Deadline: August 2026 for most provisions.