Can we place each AI risk by likelihood and impact without giving it a score?

Beside the risk register

• The levels, the reasons in words, owners and status are described on the AI risk register page.
• This page covers what the map adds to the same risks: likelihood and impact before and after the action, two maps and a file for ISO/IEC 42001.

What it does

• A risk gets a kind from a list: bias, wrong answers, data leakage, prompt injection, drift, vendor dependency, copyright or other. Each kind but the last comes with a usual first action.
• Likelihood is rare, possible or likely and impact is minor, serious or severe, each with a plain line; possible, for one, is something that could happen in a year of use. You pick one pair before the action and one after it.
• Two maps stand side by side, before the action and after it, with impact down and likelihood across. Each cell counts the risks that are not closed; a risk without both words is counted apart as not placed.
• Where the two words meet, the form says what level the map suggests, and that the level is yours to choose. You still pick low, medium or high and write why.
• Each risk also keeps an owner, an action, evidence files from the workspace and a date for the next review.

Where the two words meet

The export for ISO/IEC 42001

• One CSV with a row per risk: ID, AI system, risk source, description, likelihood, impact, risk level, treatment, owner, residual likelihood, residual impact, residual level, status, evidence, next review and last updated.
• It is laid out as a risk assessment and treatment record for an ISO/IEC 42001 management system for your AI systems. It certifies nothing and does not check your management system against the standard.
• The risk level is the one a person chose. The residual level is not chosen: it is the map's cell for the words given after the action.
• A missing value is written out in words, such as Not placed, None recorded, None linked or Not set, and a risk tied to no system reads Whole company.
• Closed risks are in the file with their status. You can export every risk or those of one system, and each download leaves a row in the activity log.

What it does not do

• It adds nothing up. There is no total and no score, and neither the page, the form nor the file's column names carry the word score or a percentage.
• The map suggests a level and does not set one. The level in the register and in the file is the one a person picked, and it can differ from the cell.
• A risk leaves the maps when it is closed, and a risk with only one of the two words is not placed on that map.
• Nothing reminds anyone of a risk's date for the next review.
• It is not by itself the risk management system that Article 9 asks for a high-risk AI system: it holds the records, and the process and the testing stay with you.

Which plan

Starter and up. In the app it is a Growth feature, included in Starter until Growth launches. The trial and every paid plan open it; on Free it is locked, with a link to the plans.

Where it sits in the law

• It is not an EU AI Act duty, and ISO/IEC 42001 is a standard, not a law. The maps and the file are Complipath's own way of keeping risk records.
• For a high-risk AI system, Article 9 asks for a risk management system, “a continuous iterative process planned and run throughout the entire lifecycle of a high-risk AI system” (Article 9(2)). The map and the file hold records for it.
• Article 9(5) adds that the residual risk of each hazard and the overall residual risk are to be “judged to be acceptable”. The file holds the words given after the action as residual likelihood, residual impact and residual level; whether a risk is acceptable, the map does not decide.
• Article 9 sits in Chapter III, Section 2. That section applies from 2 December 2027 to AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to those under Article 6(1) and Annex I (Article 113, third paragraph, point (c)(i) and (ii), as replaced by Regulation (EU) 2026/1744 (the Digital Omnibus on AI)).