{
  "handle": "ai-risk-card",
  "name": "THE AI RISK REGISTER CARD",
  "number": "PROPOSED",
  "edition": 1,
  "house": "THE INSTRUMENTS",
  "sigil": "airisk",
  "hue": "#5A1EC8",
  "role": "the risk register · known before launch, watched after",
  "tagline": "WRITTEN DOWN · TESTED · OWNED · NOT LEGAL ADVICE",
  "honest_line": "It writes down, scores and tracks the risks of an AI system a business runs, maps which rules may apply with each citation and date (checked on 2026-10-10), writes a benign pre-launch test plan, keeps an incident log and a one-page system card. Every score is the team's judgement and every rule a map, not legal advice. It never helps hide an incident, get around a law, disguise a high-risk use as low-risk, write jailbreaks or attack prompts, or build surveillance of people.",
  "wakes": [
    "an AI system about to launch: a support chatbot, a hiring screen, a writing assistant, an internal agent",
    "a risk register to start, score or review",
    "which rules may apply: the EU AI Act, Colorado's ADMT and chatbot laws, US and UK law",
    "a pre-launch test plan with pass/fail lines",
    "an incident to log, or a system card to write"
  ],
  "loop": [
    "NAME",
    "USE",
    "STARTER",
    "SCORE",
    "RULES",
    "TEST",
    "WATCH",
    "CARD",
    "HAND OFF",
    "LEDGER"
  ],
  "never": [
    "hiding an incident or softening the log",
    "getting around a law, or making a high-risk use look low-risk",
    "jailbreaks or attack prompts",
    "surveillance of people",
    "a legal determination or compliance sign-off (a lawyer gives it)",
    "a rule or a deadline without its citation and date"
  ],
  "laws": [
    "Every risk has an owner, a control and a review date. Scores are the team's judgement, written down with why, scored before and after the control, and scored again after every incident or change.",
    "All twelve risks are walked. A risk marked low keeps its row and a written reason: a gap is a decision, never a silence.",
    "Every rule is cited and dated, marked in force, ahead, repealed or only proposed, and called a map, not legal advice. As checked on 2026-10-10: the EU moved its high-risk dates by Regulation (EU) 2026/1744 (in force 27 July 2026); Colorado repealed SB 24-205 and re-enacted it as SB 26-189 (from 1 January 2027).",
    "Tests are benign and on the team's own system: accuracy, made-up answers, off-limits outputs, bias, privacy, oversight. No jailbreaks or attack prompts; security testing goes to the security lead.",
    "The incident log is honest and only ever appended. When to tell people or a regulator is named with its source, and every entry says: check your own legal duty.",
    "Every number shows its formula, its source and its limit; every fact that moves (a date, a law) carries the day it was checked.",
    "No hidden incidents, no dodged laws, no high-risk use dressed as low-risk, no surveillance of people."
  ],
  "box": [
    "SKILL.md · CARD.md",
    "the machine · airisk.py · 50/50",
    "references · THE-METHOD by hand",
    "START-HERE · TIN · MY-LEDGER",
    "THE-CLAUSES · LICENSE-NOTE",
    "the doors · HOSTS · system prompts",
    "ten tests · faces · audit · witness"
  ],
  "score": null,
  "tier": null,
  "layer": null,
  "score_line": "NOT SCORED HERE · THE SEATING GIVES THE SCORE",
  "proof": "MACHINE ABOARD · SELFTEST 50/50 · 10 TESTS · WITNESSED ON REAL WORK",
  "cut": "2026-10-10",
  "from": "his word on Oct 10 2026 — for a small business or team putting AI to work: know the risks before launch, write them down, test for them, watch for incidents, and know which rules may apply, every rule cited and dated, with plain words that it is not legal advice",
  "room": {
    "what_it_is": [
      "A seat at the risk register for a small business or team putting AI to work: the risks of a support chatbot, a hiring screen, a writing assistant or an internal agent known before launch, written down, tested, owned and watched after, with every rule it may meet cited and dated, and plain words that this is not legal advice.",
      "Writes a starter risk register for a described use from the twelve risks of NIST AI 600-1, each with what it looks like in that use, a first control and an owner slot; scores a register (likelihood × impact, 1 to 5 each), sorts it, draws text heat maps before and after controls, and flags risks with no owner, no control, no score or an overdue review; turns the NIST AI RMF 1.0 into a 19-line checklist for a small team and ticks what your files show; walks eight questions to say which rules may apply in the EU, Colorado, the US and the UK, each with its citation, its date and whether it is in force, repealed or only proposed; writes a pre-launch test plan (accuracy, made-up answers, harmful outputs, bias across groups, privacy leaks, human oversight and an off switch) with pass/fail lines and sample sizes; keeps an append-only incident log with a severity scale and when to tell people or a regulator; writes a one-page system card."
    ]
  },
  "lsc": "LSC-1",
  "punch": "8DC3AD9C97793A7FD8B144CA",
  "punch_of": "sha256(SKILL.md)[:96 bits]",
  "skill_sha256": "8dc3ad9c97793a7fd8b144caec2dff0c9d8cf8f391d7148f488ff9cd809e32dc",
  "faces": [
    "card.svg",
    "card-machine.svg",
    "card.html"
  ]
}