Sarghaby Araghatta
Request a free assessment →
Home / Risk assessment

An AI risk register your auditors will accept.

Every AI risk is scored, reduced by the controls you record, owned and mapped to the standards you report against, and drafted from what Sargha actually found.

One risk on the Sargha register: title, score and status, the status workflow, owner, treatment, likelihood and impact, the inherent to residual score, recorded controls and the framework clauses it answers
One risk on the register: likelihood and impact, recorded controls, the residual score and the clauses it answers. No language model sets the number. Sample data from the Sargha sandbox.

Every risk assessed and owned

Each entry carries a category, a likelihood and an impact, recorded controls, an owner, a treatment, a due date and the clauses it answers.

Scoring you can defend

The same scale everywhere, applied the same way, so two people get the same number and last quarter's score can be reproduced. A heat map of likelihood against impact shows where the risk sits.

Controls count only when recorded

A control lowers the score once its effectiveness is on record. What remains is the residual risk, and it drives your queue and your board report.

Mapped to your frameworks

EU AI Act, NIST AI RMF, ISO/IEC 42001, ISO/IEC 27001:2022 Annex A and SOC 2 references, so the register doubles as evidence. No spreadsheet per standard.

The register maintains itself

Material findings become draft entries with a suggested rating. You review, assign and treat; the residual updates the same way every time.

Export for your auditor

Export the assessed register to CSV, or import an existing one. Owners, treatments and due dates travel with each entry. Where a risk names one asset, its likelihood and impact come from the eleven-fact asset model, with the proof shown.

How it works

Step by step.

  1. Findings become draft entries

    Material findings are drafted into the register with a category and a suggested rating.

  2. You score, record controls and assign an owner

    The residual updates the same way every time.

  3. Export for your auditor

    Export the assessed register to CSV with its framework references.

Questions

Common questions.

Does an AI model set the score?
No. Scores are deterministic and reproducible. No language model sets the number.
Which frameworks does it map to?
EU AI Act, NIST AI RMF, ISO/IEC 42001, ISO/IEC 27001:2022 Annex A and SOC 2 references.
Is this a certification?
No. It is reviewer guidance and control mapping with evidence, not a certification of your organization.
What you need
  • The findings from your sensors and connectors.
  • Someone to record controls and own treatments.
For your technical team

A sample register with its heat-map, one fully assessed entry and the framework counts are in the technical pack, shared with your team under NDA.

Request the demo and technical pack
Get started

See the AI on your fleet in about a week.

Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.

Request a free assessment → Book a 30-minute call