Assess

Describe your use case, get its risk register

Tick the elements your solution contains — components, design choices and capabilities, following the ARC framework's element lens. The tool derives the activated risks from the 44-risk enterprise taxonomy, the relevant control categories, and one-line control statements with Cardinal / Standard / Best-practice levels — then lets you download the complete register and its mapping tables, with stable IDs on every element, risk, category and statement. Cardinal control statements are readiness-aware: declare your enterprise infra and statements whose prerequisites are missing are flagged as gated, not day-one mandates. Specific guardrail implementations are designed downstream by system teams; this tool stays at the control-statement level.

Elements you can declare (19)

Components: EL-01 LLM / foundation model · EL-02 Tools / function calling · EL-03 Instructions / system prompt · EL-04 Memory / knowledge store

Design: EL-05 Agentic architecture (multi-agent)

Capabilities: EL-06 Planning & goal management · EL-07 Agent delegation · EL-08 Tool selection & use · EL-09 Natural language communication · EL-10 Multimodal understanding & generation · EL-11 Official communication · EL-12 Business transactions · EL-13 Internet & search access · EL-14 Computer use · EL-15 Other programmatic interfaces · EL-16 Code execution · EL-17 File & data management · EL-18 System management · EL-19 Privileged system access

Retained control categories (13)

CC-01 · Enterprise Governance & Training CC-02 · Customised Model Design CC-03 · Filtering & Control CC-04 · Red Teaming CC-05 · Human Oversight CC-06 · Iterative Improvement CC-07 · Monitoring & Review CC-08 · User Transparency & Consent CC-09 · Prompt Design CC-10 · Kill-Switch CC-11 · Fallback CC-12 · Agent Access & Tool Control CC-13 · Agent Runtime Safety & Containment

Each links into the full Control Library. “Human Oversight” and “Monitoring & Review” are display names for the library's “Human-in-the-Loop (HITL) Moderation” and “Monitoring & Validation”.

Worked example: a RAG chat assistant with web search

Declaring 5 elements (LLM, instructions, memory, natural-language chat, internet & search access) activates 36 of the 44 enterprise risks and recommends 107 control statements across 12 control categories:

RISK-01 Unrepresentative or biased data inputs RISK-02 Adverse or inappropriate impact to individuals and groups RISK-03 Value misalignment RISK-04 Environmental sustainability impact RISK-05 Dark patterns RISK-06 Toxic and offensive outputs RISK-07 Lack of AI risk awareness RISK-08 Lack of third-party accountability RISK-09 Lack of use case, data and model governance RISK-11 Inadequate feedback and recourse mechanisms RISK-12 Unclear output accuracy RISK-13 Unclear provenance for training/test data RISK-14 Lack of explainability RISK-15 Anthropomorphism+22 more