AI TRAINING
AI Risk for SMEs: A Practical Register
Build a working AI risk register your team will actually use and maintain.
See if this training is the right one for your team, free diagnostic
Run the diagnosticWhat it covers
This one-day workshop guides founders and operations leads through the top 15 AI-specific risks facing small and mid-sized businesses, from data leakage and hallucination to shadow AI and vendor lock-in. Participants map each risk to an owner, select proportionate mitigations, and define a lightweight review cadence. The session is highly practical: every team leaves with a populated, ready-to-use risk register rather than a theoretical framework.
What you'll be able to do
- Identify and rank the top 15 AI risks most likely to affect your specific SME context
- Assign a named owner and at least one concrete mitigation to each risk in your register
- Define a realistic review schedule (quarterly cadence or trigger-based) for your risk register
- Apply a vendor due diligence checklist before onboarding a new AI tool or SaaS provider
- Detect and document shadow AI usage within your team using a structured discovery process
Topics covered
- Top 15 SME-specific AI risks (data leakage, hallucination, vendor lock-in, shadow AI, bias, IP exposure, third-party dependency, model drift, consent failures, over-reliance, cost overruns, auditability, staff misuse, regulatory exposure, reputational risk)
- Risk ownership assignment and RACI mapping for small teams
- Proportionate mitigations: controls that fit SME budgets and headcount
- Shadow AI identification: spotting unsanctioned tool usage
- Vendor due diligence checklist for AI SaaS procurement
- Review cadence design: quarterly vs. event-triggered reassessment
- GDPR and data-handling obligations relevant to AI use in SMEs
- Populating and maintaining a living risk register
Delivery
Delivered in-person or live-online (half-day sessions can be split into two 3-hour blocks for remote cohorts). Participants receive a pre-filled risk register template (Google Sheets / Excel), a vendor checklist, and a one-page shadow AI audit guide. Approximately 60% of the session is hands-on working time on participants' own context; 40% is facilitated instruction and group discussion. A 30-day async follow-up check-in via email or Slack is recommended to review completed registers.
What makes it work
- Nominating a single named 'risk register keeper' before the workshop ends, with a calendar invite for the first review
- Starting from the pre-filled template rather than a blank sheet, momentum from partial completion drives follow-through
- Linking each risk to a real recent incident or near-miss from the team's own experience to make ownership feel concrete
- Integrating the vendor checklist into the procurement sign-off process so it becomes a default gate, not an optional step
Common mistakes
- Treating AI risk as an IT-only concern rather than a whole-business responsibility, leaving founders disengaged from the register
- Copying enterprise risk frameworks verbatim, the controls are disproportionate and the register is abandoned within weeks
- Ignoring shadow AI: employees using personal ChatGPT or other tools with company data is often the highest actual risk and the least visible
- Setting a review cadence without nominating a specific owner, so the register is never updated after the first session
When NOT to take this
This workshop is not the right fit if your organisation already has a functioning enterprise risk management team and a mature GRC platform, in that case, a dedicated AI governance programme with policy-writing and model audit components would be more appropriate.
Providers to consider
Sources
Other trainings at this level
This training is part of a Data & AI catalog built for leaders serious about execution. Take the free diagnostic to see which trainings your team needs.