AI risk identification template: the risk canvas
A template for identifying your AI system’s risks with your team: each output failure, its causes, its consequences and the controls already in place.
Resources
Open material for working through the AI Act
Guides to understand it, templates to work on it with your team and a blog to keep up with it. No sign-up.
All
EU AI Act guides
High-risk AI.
Health, safety and fundamental rights are the starting point. Understand what to check in your company and what you need to organise.
Reviewed on September 25, 2026
Read the guide →You use or develop AI.
Before adopting AI or extending its use, leadership, quality and product need to establish who is responsible for the system, who manages its use and when those responsibilities change.
Reviewed on September 12, 2026
Read the guide →By sector
AI by sector: decisions, responsibilities and evidence
- RRHH y talento
in Spanish
See the sectors →Templates
AI risk canvas
A risk identification session with your team, in two versions: risks to affected people, with prEN 18228, and risks to your organisation’s objectives, with ISO/IEC 23894.
PDF · Double-sided A4 · CC BY-NC-SA licence
How to use it, with two worked sessionsThe risk management series
After identifying risks, the series follows these steps for affected people (prEN 18228) and your organisation’s objectives (ISO/IEC 23894).
Set the criteria
Agree which risks are acceptable and what evidence is needed.
In preparation
Analyse
Examine likelihood, severity, consequences and the effectiveness of controls.
In preparation
Evaluate
Compare risks with the criteria and assess the remaining risk.
In preparation
Treat
Prepare tests and controls, and agree a treatment plan.
In preparation
Blog
ISO 42001 vs EN 18286: the differences, and when both are needed
What ISO/IEC 42001 is for and what EN 18286 is for: processes versus product, deployers versus producers, what they share and how they fit together. With the case of an HR company that builds its own AI to run job offers.
What Is AI Assurance? The Three Engineering Disciplines That Make AI Compliance Executable
AI Assurance is not a consulting service. It's an architecture built on three engineering disciplines: GovOps, Compliance-as-Code, and Evidence Engineering. Together, they turn 'comply with the EU AI Act' from a legal project into a technical pipeline.
Want to work through these topics with your team?
Let's talkWriting commits you to nothing: not to a trial, not to a purchase.