UK government publishes AI Risk Management Toolkit for public sector

According to the Neural Network newsletter for September and October 2026, the UK Department for Science, Innovation and Technology released an AI Risk Management Toolkit and an accompanying workbook on 8 September 2026. The newsletter describes the Toolkit as guidance for designing, running and delivering AI-enabled products, with a particular focus on the public sector.

Public bodies are encouraged to record the AI risks they identify and pass that log to the central Toolkit team within government. The Toolkit is built to operate with the Cyber Assessment Framework, which the National Cyber Security Centre produced as a general method for assessing the cyber resilience of organisations that run essential services. Although it is aimed mainly at AI adoption in government and the wider public sector, the newsletter notes that it can also help other organisations assess and manage risk, including regulatory compliance. Appendix 1 contains risk identification questions that can reveal where an organisation's processes diverge from relevant laws.

The Toolkit combines guidance, risk identification measures and frameworks with a monitoring dashboard, and it sorts risks into nine categories: legal, regulatory and compliance; accountability and governance; contestability and redress; appropriate transparency and explainability; fairness; financial; security; technical robustness; and environment and people. Each category prompts questions, for example on liability for outcomes, users' ability to appeal AI decisions, bias and discrimination, unexpected costs, cyberattacks, system failures, and effects such as job displacement.

The Toolkit also assigns each type of risk an Impact Level running from negligible to catastrophic, judged against the organisation's own risk appetite. It considers business, staff, service or user, and reputational impacts, and helps organisations put numbers on risks that can be quantified for different use cases.