- A Spreadsheet, Not a Framework
Building an AI Risk Register for a Small Business
Enterprise AI governance frameworks assume a compliance department. Here is the version that works when governance is one person doing it alongside their real job.
RIGHT-SIZING IT
One Row per AI Use, Six Columns
A risk register sounds like something that needs a consultant and a framework. In a business of thirty people it is a spreadsheet with one row for each way AI is used, and it takes an afternoon to build and twenty minutes a quarter to maintain.
The value is not the document. It is that filling it in forces someone to answer, for each use, who owns it and what would happen if it were wrong, two questions that otherwise never get asked out loud. Most of the benefit arrives during the first afternoon, before anyone reads the finished thing.
It also happens to be the artifact an insurer, auditor, or grant funder asks for when the subject comes up, and having one that is a year old is considerably better than producing one in a hurry. What AI regulation actually asks of a Texas business explains why the request is becoming routine.
The six rows in this register are the ones that keep showing up in Dallas-area businesses, ranked by what actually happens rather than by what sounds alarming. A register longer than one page tends to sit unopened, which defeats the point of keeping one.
THE COLUMNS
What Each Row Records
The use
What it does, in a sentence a non-technical board member would follow. “Drafts first replies to referral emails,” not “NLP- assisted triage.”
The data it touches
Which classes, and whether any are regulated. This column is what makes the register useful in a compliance conversation.
What could go wrong
The realistic failure, not the catastrophic one. “Misclassifies an urgent referral as routine” is more useful than “data breach.”
What catches it
The specific control, a human review step, a confidence threshold, a daily report. If this cell is empty, that is your finding.
Who owns it
A named person. Not a department, not IT by default. The one who would be asked what happened.
Last reviewed
A date. Rows nobody has looked at in a year are either dead uses to remove or live risks nobody is watching.
Include the unsanctioned uses too
A register listing only what you approved describes a business that does not exist. Whatever an audit turned up goes in as well, marked as unsanctioned with a decision attached: approve it, replace it, or stop it. Rows you would rather not write down are the ones the register exists for.
We are twenty people. Is this overkill?
At six rows and an afternoon, no. What would be overkill is adopting an enterprise AI governance framework with maturity levels and committees. The register is deliberately the smallest thing that answers the questions that matter.
Who should own the register itself?
Someone on the business side, a practice manager, operations lead, or owner. If IT owns it, it becomes a technical document and the “what could go wrong” column fills up with technical failures rather than business ones. We help maintain it; we should not be the ones who care about it most.
Does anyone actually ask to see this?
Increasingly, yes, cyber insurers at renewal, grant funders in applications, and enterprise clients in vendor questionnaires. The pattern we expect to continue is that being asked stops being unusual, and the businesses with an existing answer will not have to scramble.
BK
Written and reviewed by Bob Kehr, President & Founder of Kehr Technologies, Plano City Council member, and Plano Chamber Small Business Person of the Year 2022. He maintains these registers with clients, and has produced them for insurers and grant funders on request.
Last reviewed August 2026 · Questions we have not answered here? Call 214-444-3583. Kehr Technologies is based in Plano, Texas, and works with businesses throughout the Dallas area.