What should an AI risk register include?
Answer
An AI risk register should list every AI system in use and, for each, its purpose and decision scope, risk classification, the data it consumes, applicable regulations, the human owner accountable for it, the date it was last assessed, and its current insurance coverage status. Maintained this way, the register doubles as both a compliance artifact and the evidence an insurer or claims adjuster will ask for.
An AI risk register should catalog each AI system, its risk classification, applicable regulations, data inputs, decision scope, last assessment date, responsible owner, and insurance coverage status — critical for both compliance and claims documentation.
Sources checked
- Colorado SB 26-189 (Colorado AI Act) — bill text
- Hamilton — Artificial Intelligence Sublimit Endorsement (ties coverage to governance documentation)
Scope
General governance and insurance-readiness guidance, not legal advice. Required fields vary with your jurisdictions, industries, the consequential decisions AI touches, tool autonomy, and the wording of any policy that conditions coverage on documentation — such as Hamilton's sublimit. Confirm regulatory and underwriting expectations with counsel and your broker.
Operational implication
A register only protects you if it stays current as AI use changes. Gridex maintains the inventory as a live operational artifact — owners, review points, last-assessed dates, and coverage status kept up to date through governed workflows with audit trails — so it is insurance-ready the day a regulator or carrier asks.
Applicable Regulations
Colorado AI Act — Automated Decision-Making Technology (SB 26-189, repeal & reenactment of SB 24-205)
On 2026-05-14 Governor Polis signed SB 26-189, which repeals and reenacts the Colorado AI Act (originally SB 24-205). The new law abandons the risk-management / annual-impact-assessment model and replaces it with a disclosure-and-notice framework governing "automated decision-making technology" (ADMT) that makes or substantially influences "consequential decisions" (education, employment, housing, financial services, insurance, healthcare, government services). The statute formally takes effect 2026-08-12 (no safety clause), but all substantive compliance obligations — for both deployers and developers — begin 2027-01-01, which is the operative date for regulated businesses; the Attorney General's implementing rules are also due by 2027-01-01. The AG has stated he will not enforce until the mandatory rulemaking process concludes.
Key Requirements
Carrier Endorsement Details
Hamilton — Hamilton AI Sublimit
Rather than excluding AI claims, applies a sublimit to AI-related professional liability claims, typically 25-50% of the policy limit.
Key Provisions
Full State Analysis
Where this lands operationally
Gridex turns the compliance or coverage question into operated workflow controls: intake, review points, audit trails, and the places a person stays in the decision.
Build Your AI Governance Framework
Stand up the register as a living inventory rather than a spreadsheet snapshot — Gridex can build and operate it with owners, review points, and coverage status wired into your workflows. Start with a governance review.
Build Your AI Governance Framework →Related Questions
- What should an AI governance framework include? An AI governance framework should include an AI use policy, an inventory of where AI makes or substantially influences consequential decisions, documentation requirements, incident response procedures, and regular audit mechanisms. Note that Colorado's AI Act (SB 26-189, which repealed and reenacted SB 24-205) dropped the old impact-assessment and high-risk-classification model in favor of disclosure, consumer-notice, and human-review duties — so a framework should map to those obligations rather than the repealed assessment regime.
- What AI documentation do insurers require? Insurers increasingly want documented AI governance programs, risk assessments, and usage inventories when underwriting technology-related policies. Hamilton's sublimit endorsement explicitly rewards governance documentation with higher coverage limits.
- Who is liable when an AI agent causes harm? When an AI agent causes harm, legal responsibility almost always traces back to a person or organization — not to the AI itself, which has no legal personhood. As a default, liability flows to the deploying organization: under established agency, vicarious-liability, and negligence principles, the business that puts an agent into operation generally answers to the third party it harms, much as it would for an employee or a tool it chose to use. Responsibility can extend upstream to the developer or vendor through product-liability, professional-liability (E&O), or contractual-indemnity theories — particularly where the harm stems from a defect, a misrepresented capability, or the agent's autonomous decision-making rather than the deployer's own configuration. Outcomes vary by jurisdiction, the agent's degree of autonomy, and whether it faces customers, handles transactions, or runs internal workflows. Two practical wrinkles matter: emerging laws such as Colorado's AI Act (SB 26-189, obligations from January 1, 2027) impose deployer and developer duties — interaction notice, adverse-outcome disclosure, and meaningful human review — whose breach can support a claim; and AI-specific insurance exclusions such as Verisk's CG 40 47 can strip coverage a deployer assumed it had, so who ultimately pays may differ from who is liable. In practice, liability is shaped before any incident — by where human review sits, what the audit trail can prove, and how vendor contracts allocate risk.
- What is the Hamilton AI sublimit endorsement? Hamilton's AI endorsement takes a sublimit approach rather than full exclusion, providing capped coverage for AI-related claims with governance incentives that can increase the sublimit for organizations with documented AI risk management programs.