Home / The book

Cover of AI Risk Identification: The Complete Methodology by Rory Roberts

AI Risk Identification: The Complete Methodology

How to find the risks in AI systems before they find you. A practitioner's method built on ISO/IEC 42001 and the EU AI Act.

By Rory Roberts, FRM. November 2026 edition, 154 pages. Free.

You get three files:

  • The book as a PDF.
  • The AI risk register as an Excel workbook: all 91 lines with every field the method uses, scoring formulas, heat maps, the scales, the taxonomy, the templates and the interaction matrix.
  • The register as a PDF, with example scores and heat maps.

Get the files

You get the links on this page straight away, and a copy by email. See how your email address is used.

Your files are ready. The links are personal to your email address and work for 7 days. A copy is on its way to your inbox.

    Start with Chapter 1, then Appendix A for the register. Questions about the method are welcome at rory@eonriskservices.com.

    Who it is for

    Anyone who has to find the AI risks in an organisation and defend the result: risk managers and CROs, compliance and AI governance leads, data protection officers, model validators and internal auditors. The examples lean towards banks, lenders and insurers, where the AI Act's high-risk uses include credit scoring and life and health insurance pricing, but the method works for any organisation that builds, buys or uses AI.

    What it is not

    It is not legal advice, and the register's scores are examples, not your assessment. Where a standard's text could not be read in full, the book says so.

    Contents

    • Chapter 1: Why Organisations Fail at AI Risk Identification
    • Chapter 2: The Foundations: ISO/IEC 42001, ISO/IEC 23894, NIST AI RMF and the EU AI Act
    • Chapter 3: Governance: Who Owns What
    • Chapter 4: The AI Risk Taxonomy
    • Chapter 5: Setting the Context: Inventory, Roles, Classification and the Starting Universe
    • Chapter 6: Top-Down Identification: Workshops, SWIFT, Scenarios, Delphi and Red Teams
    • Chapter 7: Bottom-Up Identification: The AI Use-Case Template and the Specialist Sub-Processes
    • Chapter 8: Reconciliation and the Enterprise AI Portfolio View
    • Chapter 9: Assessment: Four-Dimensional Scoring, Harm to Individuals and Data Quality
    • Chapter 10: Risk Interaction: Bow-Ties, Cascades and Concentration
    • Chapter 11: Documentation: The Living AI Risk Inventory
    • Chapter 12: Integration: Impact Assessments, the Statement of Applicability, Monitoring and the Board
    • Chapter 13: The Ongoing Cycle: Re-Identification, Triggers, Indicators and Audit
    • Chapter 14: Technology: Monitoring, Evaluation Harnesses, Red Teams and Using AI to Find AI Risk
    • Chapter 15: The Regulatory Landscape: One Method, Many Rules
    • Chapter 16: Lessons from AI Failures: What the Method Catches
    • Appendix A: The AI Risk Register
    • Appendix B: Templates
    • Appendix C: Crosswalk