Templates / LLM & generative-AI risk register template
LLM & generative-AI risk register template
A register for the risks of large language models in production — prompt injection, hallucinated output relied upon, training-data leakage, insufficient oversight. The worked example below reflects OWASP LLM and NIST AI RMF concerns and is free to download or open live.
No sign-up needed to download. Opening it live lets you edit, score your own risks, and get a suggested remediation for each.
Worked example: llm & generative-ai risk register template
| Risk | Category | Likelihood | Impact | Rating | Suggested remediation |
|---|---|---|---|---|---|
| Prompt injection / jailbreakingMalicious instructions in user input or retrieved content override the system's intended behaviour or bypass safety constraints. | security | high | high | Red-team for prompt injection and jailbreaking before and during deployment. | |
| Hallucinated / incorrect output relied uponThe model produces plausible but false output that a user or downstream process acts on. | robustness | high | medium | Ground responses in verified sources and surface uncertainty / citations. | |
| Training-data privacy / PII leakagePersonal data in training or context is memorised and surfaced in outputs, or processed without a lawful basis. | privacy | medium | high | Minimise and document training data; apply a lawful basis and data-protection controls. | |
| Insufficient human oversightConsequential decisions are automated without a human able to review, override or intervene in real time. | accountability | medium | high | Define human-in-the-loop controls at each consequential step, with the authority and information to intervene. | |
| Insufficient transparency / missing AI disclosureUsers are not told they are interacting with AI or how outputs are produced, breaching transparency duties (EU AI Act Art. 50). | transparency | medium | medium | Disclose AI use to users and label AI-generated content. | |
| Compromised / poisoned model or dependencyAn externally sourced model or dependency carries a backdoor, or training data is poisoned so the model fails on attacker-chosen inputs. | security | medium | high | Obtain models only from trusted origins; verify integrity and provenance (signing) where available. | |
| Unsafe autonomous-agent actionsAn agent with tool or write access takes unintended or irreversible actions beyond its intended scope. | safety | medium | high | Scope agent permissions tightly; require approval for consequential or irreversible actions. |
Ratings are derived from likelihood, impact and vulnerability. This is a starting point to adapt — read each row and keep what applies.
Questions
What are the main LLM risks?
Prompt injection and jailbreaking, hallucinated output being relied upon, leakage of training or prompt data, weak human oversight, and compromised model dependencies. Each appears below with a suggested control.
What is prompt injection?
Prompt injection is when crafted input makes an LLM ignore its instructions or take unintended actions — the top item on the OWASP Top 10 for LLM applications. The register below includes controls for it.
Free to use?
Yes — CSV download, no sign-up, or open it live in Urna. No card.
Build your own in Urna — free
Urna is a free risk register: start from curated libraries instead of a blank page, score against recognised frameworks, and get a suggested remediation for every risk you log. Export any time. No card.