As of 13 August 2026, AI can only partly create a risk register for your UK small business.

What to actually do

1. Use a tool built for this

   The route this page recommends

2. Do it yourself

   Second choice

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open a spreadsheet and create columns for risk ID, description, cause, consequence, affected activity or asset, existing controls, likelihood, impact, rating, further action, owner, target date, warning indicator and review frequency.
   2. Gather your business plan, list of services, staff and contractors, premises information, key suppliers, important systems, data handling details, insurance documents, policies, incident records and business continuity arrangements.
   3. Paste the gathered facts into the prompt under the matching business details sections, removing passwords, customer identities and other unnecessary personal or confidential data.
   4. Run the prompt and ask the chatbot to return the register as a table that can be copied into your spreadsheet, with missing information and assumptions marked separately.
   5. Compare each drafted risk against your incident records, supplier list, insurance documents, policies, system inventory and day-to-day operations, then delete unsupported claims and add risks the chatbot missed.
   6. Ask a manager or relevant colleague to challenge the likelihood, impact, owners and actions, and send legal, regulatory, employment, health and safety or insurance uncertainties to the appropriate UK adviser before relying on them.
   7. Copy the agreed register into the spreadsheet, assign realistic owners and dates, and set a recurring review using the warning indicators and review frequency.

   Prompt

   Create a practical risk register for my UK small business using only the information I provide. Do not invent risks that depend on facts I have not supplied, and mark assumptions clearly. Use these columns: risk ID, risk description, cause, possible consequence, affected activity or asset, existing controls, likelihood, impact, overall rating, further action, action owner, target date, early warning indicator and review frequency. Use a simple likelihood and impact scale of low, medium or high, explain each rating in one sentence, and separate inherent risk from residual risk where the information supports it. Consider operational, financial, legal and regulatory, employment, health and safety, cyber and data, supplier, premises, reputational and business continuity risks, but exclude categories that do not fit the business. Highlight missing information and risks that need checking with an appropriately qualified UK adviser. Do not give legal, tax, insurance or health and safety advice. After the table, provide a short list of the five risks that need attention first, with the reason for each ranking. Business details: [describe what the business does, where it operates, its size, staff, customers, premises, suppliers, systems, sensitive data, key dependencies and current controls]. Existing incidents or concerns: [paste details]. Current policies, insurance and compliance arrangements: [paste details]. Risk owners and target dates available: [paste details].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.

3. Hand it to a person

   The distant third

   A person who owns the outcome does this end to end, worth it when the failure is dear.