Update
AI Risk and Control Matrix Version 2.1 Released
Version 2.1 of our free AI risk and control matrix covers 92 risks across 14 domains, including AI agents, with test procedures for every risk.
Published:
Bloch AI has released version 2.1 of its AI Risk and Control Matrix, a free Excel workbook for internal audit, risk and compliance teams.
The matrix lists what can go wrong with AI, the control that should stop it, and how to test whether that control works. Version 2.1 covers 92 risks across 14 domains, up from 84 across 12 in version 1.0, published in November 2024.
The main changes:
A new Agentic AI domain, covering agents with too much authority, tool-call errors, agent identity and access, prompt injection through content an agent reads, runaway multi-agent loops and agent actions that cannot be traced.
A new Risk and impact assessment domain, covering whether AI risks are assessed consistently, reassessed after change and accepted by someone with the authority to do so.
Test procedures for every risk: the evidence to request, a design test and an operating test.
A working assessment, with scope sheet, assessment sheet and action log, so a review can be run in the workbook.
A sources register linking to the laws, regulations, standards and guidance behind the risks.
Version 1.0's Y/P/N deployment flags have been replaced by a "When it applies" note on each risk, and its per-risk citations by the sources register.
The matrix is released under the Apache 2.0 licence. Download it free from the AI Risk and Control Matrix page.