AI risk assessment template for UK small businesses

Use this free AI risk assessment template to build a starting AI risk register for your business. Tell us which AI tools your staff use, what they use them for and what data goes into them, and the register appears on this page with a suggested score and controls for each risk. You don't need an account to see it.

Each risk gets a likelihood and an impact from 1 to 5, and the score is the two multiplied together, which is the method the GOV.UK AI risk management toolkit uses. Where a risk involves personal data, the register links to the ICO's guidance rather than restating the law. It's a starting point for you to edit, not legal advice.

A few quick questions

The register stays on this page. We only ask for an email if you want the Word or CSV file.

Staff size
Which AI tools do staff use?
Are those business accounts or free ones?
What do staff use AI for?
What data goes into AI tools?
Does a person check AI output before a customer sees it?
Do you have a written AI policy?

Questions about this AI risk assessment template

What is an AI risk assessment?
It's a short record of what could go wrong when your business uses AI tools, how likely each problem is, how much harm it would do, and what you'll do about it. Most small firms keep it as a risk register, with one row per risk, an owner and a date to look at it again.
Do small businesses need an AI risk assessment?
There's no UK law that asks every small business for a document with this name. If staff put personal data into AI tools, though, UK GDPR expects you to think about the risks to the people involved, and the ICO's guidance on AI and data protection explains what that means in practice. A short register is a simple way to show you've done that, and it helps you decide which tools and uses to allow.
How is this different from a DPIA?
A data protection impact assessment (DPIA) is a specific UK GDPR process for processing that's likely to result in a high risk to people, and the law sets out what it must contain. This register is lighter and broader, because it also covers accuracy, suppliers, security and staff skills. If you tick special category data or decisions about people, the register links to the ICO's DPIA guidance, since you may need one.
How often should we review our AI risk register?
The form sets a review date 3, 6 or 12 months ahead, and it's worth sticking to it. Look again sooner if you approve a new tool, start using AI for a new kind of work, or start putting a new kind of data into it.
Is this template legal advice?
No. It's a starting template with suggested scores that you should change to fit your business. Check it against your own contracts, data protection duties and any rules for your sector, and use the ICO and GOV.UK pages it links to when you need more depth.