Risk Register — Living Document Requirements The risk register is maintained as a living document throughout the system lifecycle. It evolves with operational experience: PMM findings create new entries, serious incidents reveal unanticipated risks, regulatory developments change the risk landscape, and system modifications alter the risk profile. Each entry records risk ID, description, likelihood, severity across four dimensions, current mitigations, residual risk level, and assigned owner. The AI Governance Lead reviews and accepts residual risks. Key outputs

• Living document updated throughout lifecycle
• Four-dimension severity scoring
• AI Governance Lead residual risk acceptance