Ethics & Governance Risk Register
Instruction and application
In ProgressEthics & Governance Risk Register — Phase 1 Module 3 deliverable
This template consolidates the ethical, privacy, transparency, security and compliance risks you have surfaced across the three Module 3 skills applications (TalentFind Solutions, Insight Innovations Ltd, and Health Insights AI) into a single, structured register you can attach to your Phase 1 project submission.
Why this register matters
The AIMLF Phase 1 project explicitly lists an ethics & governance risk register among the artefacts that advance to Phase 2. Milestone 3 asks you to "embed ethical considerations and governance practices into the solution's design" and to "assess key risks — bias, privacy, transparency — and ensure alignment with org standards and regulatory policies."
The register is your single source of truth for:
- Bias, privacy, transparency, security and compliance risks in your scoped ML/AI challenge.
- Regulatory mapping — UK GDPR, EU AI Act, ISO/IEC 42001 (AI management systems), PECR, sector-specific duties.
- Mitigations, owners and status — so risks are trackable rather than one-off reflections.
Template
Copy the table below into your project workspace (Notion, Confluence, Excel, Google Sheets) and populate it with the risks from your own Phase 1 project. Every row should be traceable to an evidence source (dataset audit, DPIA, stakeholder interview, model card, or a Module 3 skills application).
| Risk ID | Risk Description | Category | Likelihood (H/M/L) | Impact (H/M/L) | Regulation Mapped | Mitigation | Owner | Status |
|---|---|---|---|---|---|---|---|---|
| R-001 | e.g. Training data underrepresents a protected group. | Bias | M | H | UK GDPR Art. 22; EU AI Act Art. 10; Equality Act 2010 | Rebalance dataset; slice-aware evaluation; publish fairness metrics in model card. | ML Lead | Open |
| R-002 | e.g. Free-text symptom fields contain identifiable content. | Privacy | H | H | UK GDPR Arts. 5, 9; DPA 2018 | Pseudonymise at ingest; NER-based redaction; access tiering with audit log. | Data Governance Lead | In progress |
| R-003 | e.g. Model scoring rationale not explainable to end users. | Transparency | M | M | EU AI Act Art. 13; ISO/IEC 42001 | Add SHAP/feature-importance layer; user-facing "why this decision" explainer; document limitations. | Product Owner | Open |
Worked examples (from the Module 3 skills applications)
Use these as calibration — they show how a risk surfaced in a scenario reflection becomes a formally tracked register entry.
Example row 1 — TalentFind Solutions (Unit 1)
Risk ID:
R-TF-01
Risk Description:
Historical hiring records used for training reflect past under-hiring of women in technical roles; the résumé screener may learn to down-rank equivalently qualified female candidates.
Category:
Bias
Likelihood / Impact:
H / H
Regulation Mapped:
UK GDPR Art. 22 (automated decision-making); Equality Act 2010; EU AI Act Annex III (employment as high-risk).
Mitigation:
Strip proxy features (name, university, career gap); reweight training set; disparate-impact testing before release; human-in-the-loop review for borderline scores; publish a model card.
Owner / Status:
Head of Talent Tech / Open
Example row 2 — Insight Innovations Ltd (Unit 2)
Risk ID:
R-II-04
Risk Description:
Website log aggregation drops granular cart actions after three months, so the churn model's features silently shift; retraining data no longer matches production inputs.
Category:
Transparency / Compliance
Likelihood / Impact:
H / M
Regulation Mapped:
UK GDPR Art. 5(1)(d) (accuracy); PECR (cookies and traffic data); ISO/IEC 42001 (data lineage controls).
Mitigation:
Central metadata catalogue with schema versioning; store raw logs for the model retention window; document transform rationale; monitor feature drift in production.
Owner / Status:
Data Platform Lead / In progress
Example row 3 — Health Insights AI (Unit 3)
Risk ID:
R-HI-02
Risk Description:
Genetics dataset has uneven ethnic representation from historical study recruitment; cardiovascular risk scores may be less accurate for under-represented groups, causing clinical harm.
Category:
Bias / Compliance
Likelihood / Impact:
H / H
Regulation Mapped:
UK GDPR Arts. 9 & 22 (special-category data, automated decisions); EU AI Act Annex III (health as high-risk); MHRA software-as-a-medical-device guidance.
Mitigation:
Recruit additional cohorts; report slice-level performance in the model card; federated learning to widen contributor base; contraindicate use for populations below evidence threshold.
Owner / Status:
Chief Medical Officer / Open
Action item: Build your own register
Consolidate the risks you identified across the three Module 3 skills applications into a single register for your own Phase 1 project. Aim for at least six rows, covering each of the five categories (Bias, Privacy, Transparency, Security, Compliance) at least once. Map every row to a specific regulation clause — not just "GDPR" but the article or Annex that applies.