Feature · Govern · Written by Yobel Tzegai · Last checked 9 October 2026
How do you keep a register of the risks your AI systems carry?
In Complipath (complipath.io), Risks holds each risk your AI systems carry: a level a person chooses, low, medium or high; the reason in words, which the app refuses to store empty; an owner, an action and a status. The page counts open risks per level and never adds them up into a score.
Each risk your AI systems carry, with the level a person gives it — low, medium or high — the reason in words, an owner, an action and a status; never a score.
Illustration · not your dataRisk Outcomes differ unfairly between groups of people · one AI systemLevel and reason High · the reason, written by a personOwner · action · status A named owner · a monthly review · Open
What it does
Each risk is a line of text, a level of low, medium or high and the reason for that level in words. A level without a reason is refused, by the form and by the database.
A risk can belong to one AI system in your register, or to none.
Owner and action are optional free text. A risk that is not closed and lacks either says No owner yet or No action yet on its row.
Status is Open, In progress or Closed. Nothing on the page deletes a risk: it is closed, and closed risks sort to the bottom.
One line above the list counts the risks that are not closed: so many high, medium and low. No likelihood times impact, no total, no percentage.
Every risk recorded or changed is written to the workspace's activity log.
A system's open risks become sentences in its DPIA and FRIA drafts, each sourced to the risk register, and each action becomes a measure.
The Leadership dashboard counts open risks per level and names high risks with no action recorded.
Who it is for
The person who answers for AI risk in a company that builds or uses AI: a compliance lead, a CTO or counsel who needs one list that leadership and an auditor can read.
The form asks for no role, so it serves a system you build and one you buy alike.
How you use it, step by step
Open Risks in the sidebar, under Govern.
Under Add a risk, write the risk in a line and choose the AI system it belongs to, or none.
Pick the level, each with a line on what it means, and write why you chose it.
Add who owns it and what is being done about it, now or later.
Use Change on a row to update any field, the status included.
Or run Prepare everything: for each system whose classification is confirmed and that has no risk yet, rules suggest risks that fit its class, each with a level and a reason. Nothing is added until a person adds it in Review.
Which plan
Growth feature · included in Starter until Growth launches. The trial and every paid plan open it. On Free, Risks shows what it does, locked, with a link to the plans.
Where it sits in the law
Low, medium and high are a scale of the app's own, printed on the form with what each means. They are not risk classes from Regulation (EU) 2024/1689.
For a high-risk AI system, Article 9 requires a risk management system: a continuous iterative process across the system's lifecycle, with regular systematic review and updating, risk management measures and testing.
For the deployers Article 27(1) binds, the fundamental rights impact assessment must cover the specific risks of harm and the measures if they materialise: Article 27(1), points (d) and (f). The FRIA draft takes sentences for those parts from this register.
What it does not do
It does not score or total risks. No model is involved: a person chooses the level, or accepts one a rule suggested.
It is not by itself the risk management system Article 9 requires for a high-risk AI system. It records risks, reasons, owners and actions; the lifecycle process and the testing in Article 9(6) stay with you.
Owner is free text, not a member of the workspace, and nothing reminds anyone about a risk.
A risk added from Review carries the rule's level and reason, with no owner and no action, until someone changes it on Risks.
There is no export of the register on its own.
Where it is in the app
In the sidebar, under Govern, as Risks. Each row shows the level, the risk, its system, the status, the reason, the owner and action and the day it was last changed; Change opens the same form.
Because a count is a fact and a score is a claim. Each risk carries a level a person chose and the reason written out. The page counts the risks that are not closed at each level (high, medium and low) and nothing else: no likelihood times impact, no total and no percentage anywhere.
Can Complipath suggest risks for me?
Yes, by rules, for systems whose classification a person has confirmed and that have no risk yet. Prepare everything proposes risks that fit the confirmed class, such as unfair outcomes and unchecked reliance for a high-risk system, each with a level and a reason. Nothing is added until a person adds it in Review.
Is this AI risk management software the risk management system Article 9 asks for?
Not by itself. Article 9 requires, for a high-risk AI system, a continuous iterative risk management system run across the system's lifecycle, with regular systematic review, risk management measures and testing. The register records the risks you identify, why, who owns each and what is being done. The process and the testing stay with you.
Which plan includes it?
Starter, at €499 a month for up to 20 AI systems, and the trial. Prices exclude VAT. In the app it is a Growth feature, included in Starter until Growth launches: Growth is not available yet, so Starter is the plan to buy. On Free, Risks shows what it does, locked.