AI risk management
AI risk management that fits inside your existing programme
Register your AI systems, classify their risk, and connect them to the controls and frameworks that apply — all in the same workspace as the rest of your compliance programme.
Why AI risk management is different
Traditional risk registers were not built for AI. AI systems change after deployment, their risk profile shifts with new data, and regulators are writing rules faster than most teams can read them. Certifyi gives you a structured way to register, classify and govern AI systems inside the compliance programme you already run.
How AI risk management works in Certifyi
AI governance in Certifyi is a module, not a separate product. It shares the same controls, evidence and audit trail as the rest of the platform.
- AI system register
- Catalogue each AI system with its purpose, data sources, model type, deployment status and risk tier. The register is the single source of truth for your AI inventory.
- Risk classification
- Classify AI systems against ISO 42001, the EU AI Act risk categories and the NIST AI RMF. The classification links to the controls that apply at each tier.
- ISO 42001 mapping
- Map your AI management system controls to ISO 42001. Evidence sits on the control, and the mapping carries across to your other frameworks.
- EU AI Act compliance
- High-risk AI systems require conformity assessments, technical documentation and human oversight. Certifyi tracks these requirements as controls.
- NIST AI RMF
- The NIST AI Risk Management Framework organises AI governance into Map, Measure, Manage and Govern. Certifyi maps your controls to each function.
- AI agent assessments
- Assess AI agents against security, reliability and governance criteria before they are deployed into production.
AI inventory
Start with knowing what you have
Most organisations cannot list their AI systems, let alone classify them. The AI system register in Certifyi captures each system with structured fields: purpose, data sources, model provider, deployment status, risk tier and the team responsible.
When a regulator or auditor asks what AI you run and how you govern it, the register is the answer.
- Structured fields for every AI system: purpose, data, model, deployment, risk
- Risk tier classification against ISO 42001 and the EU AI Act
- Owner and responsible team for each system
- Change tracking: when a system is updated, its classification is flagged for review
- Export for regulatory reporting and board presentations
AI frameworks
Three frameworks, one control set
ISO 42001, the EU AI Act and the NIST AI RMF overlap significantly. All three require an inventory, risk assessment, human oversight and documentation. In Certifyi you map each control once and it applies wherever the requirement appears.
- ISO 42001: the AI management system standard, with Annex A and B controls.
- EU AI Act: risk categories, conformity assessments and prohibited practices.
- NIST AI RMF: Map, Measure, Manage and Govern functions.
- AI governance module: the module that ties them together.
Inside your programme
AI risk inside your broader risk programme
AI risk does not sit in isolation. A model failure is an operational risk. A data leak from an AI system is a privacy risk. In Certifyi, AI risks live in the same risk register as the rest of your programme, linked to the controls that treat them.
- Risk management: AI risks in the same register as operational and compliance risks.
- Compliance software: AI controls beside your SOC 2, ISO 27001 and HIPAA controls.
- GRC platform: governance, risk and compliance in one workspace.
- Vendor risk: assess AI vendors through the vendor portal.
Questions
AI risk management, answered
What is the difference between AI risk management and traditional risk management?
Traditional risk management focuses on harm to the organisation: financial loss, reputational damage, regulatory penalty. AI risk management adds harm to individuals and groups: algorithmic bias, loss of autonomy, safety failures and privacy violations. The risk criteria, the stakeholders and the review cadence all expand.
Do we need a separate risk register for AI?
No. AI risks should sit in the same register as your other risks, scored with the same methodology. What changes is the criteria: you need fields for the AI system, its risk tier under the EU AI Act, and the type of harm (individual, group, organisational). Keeping one register gives leadership a single view of risk posture.
How does the EU AI Act classify AI risk?
The EU AI Act defines four categories: unacceptable risk (banned uses such as social scoring), high risk (systems listed in Annex III, including hiring, credit and law enforcement), limited risk (transparency obligations, such as chatbots disclosing they are AI), and minimal risk (no specific obligations). Classification determines what you must do.
How often should we re-assess AI risk?
At planned intervals and whenever a system changes materially: a new model version, a new data source, a change in use case, or a move from development to production. ISO 42001 requires periodic review. The EU AI Act requires ongoing monitoring for high-risk systems.
See how Certifyi governs AI systems inside your compliance programme
Book a demo and we will walk through the AI register, risk classification and framework mapping.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them