NIST

Most organizations that have started tracking AI risk are using their existing risk register format with a few AI-specific line items added. That's a start — but the entries that matter most are the ones that don't map cleanly to traditional IT risk categories.