# GOV-03 Agent Risk Register

Domain: GOV Governance & Accountability · HI-AAF v1.3 · Public review · https://humanintel.net/standard/gov/gov-03

An Agent Risk Register is maintained, scoring each agent on impact and likelihood, reviewed at least quarterly by accountable leadership.

The risk register captures, for each agent, the categories of harm the agent could cause, the likelihood and severity of those harms, the controls applied to reduce them, and the residual risk accepted by the risk owner. It is reviewed at a documented cadence, at least quarterly, by leadership with authority to accept, escalate, or remediate risks.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for GOV-03: Risk register is current within the documented cadence; entries include impact scores, likelihood ratings, and residual risk acceptance; review evidence is retained with sign-off records.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Risk register is current within the documented cadence.
- Entries include impact scores, likelihood ratings, and residual risk acceptance.
- Review evidence is retained with sign-off records.

## Framework mappings

- NIST AI RMF: GOVERN 1.1
- ISO/IEC 42001: 5.2, A.2.1
- SOC 2 (TSC): CC1.1, CC1.2
- EU AI Act: Art. 9(2)
- Singapore: MAIGF Internal Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by GOV-12 Jurisdictional dependency register: https://humanintel.net/standard/gov/gov-12
- Cited by OUT-15 Model availability & continuity: https://humanintel.net/standard/out/out-15

## Cite this control

Human Intelligence. HI-AAF v1.3, GOV-03 Agent Risk Register. Public review edition, July 2026. https://humanintel.net/standard/gov/gov-03