Strategy & governance

Risk register

Twelve agentic AI and automation risks on a likelihood × impact heatmap, with owner, mitigation and status.

Risks

R-01 Hallucinated output leads to an incorrect procurement or payment decision
R-02 Data leakage to public LLM endpoints
R-03 Adoption friction and low CSAT
R-04 Prompt injection through documents or emails triggers an unintended tool call
R-05 Over-automation: autonomy level raised without evidence
R-06 Model or vendor change silently degrades quality
R-07 Run cost overruns (tokens, GPU)
R-08 HITL reviewer fatigue and rubber-stamping
R-09 Regulatory non-conformity (EU AI Act, GDPR, DORA)
R-10 Orphan bots and unmanaged credentials
R-11 Air-gapped models fall behind (no updates)
R-12 Benefits overstated (no baseline)