Risk Register and Mitigations
This register documents known risks, managed dependencies, and active mitigations. The register is maintained as part of the ongoing engineering and governance cadence and reviewed at each delivery phase gate.
Last updated: 30 June 2026
Risk governance approach
Risks are managed through a combination of architectural design decisions, delivery phase planning, and active dependency tracking. The risk posture prioritises transparency: all known risks are declared, mitigations are specified, and residual risk is acknowledged where it exists.
This register covers technical, delivery, regulatory, and capacity risks. Each entry includes a likelihood and impact assessment to support prioritisation. The register is a living document — updated as dependency status changes or new risks are identified.
Risk register
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| GPU quota unavailability Delivery / Infrastructure |
Medium | High | Phase 1 designed to proceed without GPU. Alternative provider options evaluated. Procurement pathway documented. Phase 2 gate requires confirmed quota before commencement. |
| Benchmark under-performance vs frontier models Technical |
Medium | Medium | Scope positioned as sovereign-first, not frontier-replacement. Use cases selected for domain fit. Comparative reporting against declared baseline, not frontier model benchmarks. |
| Regulatory framework evolution Regulatory |
Low | Medium | Governance architecture designed for auditability and accountability. Aligned with current DSIT and AI Safety Institute guidance. Framework designed to be adaptable. |
| Talent and capacity constraints Operational |
Low | Medium | Core team focused on sovereign delivery priorities. Hiring roadmap aligned to Phase 2+ demands. Critical path tasks documented for onboarding new contributors. |
| UK procurement timeline delays Commercial |
Medium | Medium | Submission documentation prepared to accelerate review. Technical briefing available on request. Evidence pack maintained in reviewer-ready state at all times. |
| Third-party API dependency in platform layer Technical |
Low | Low | API surface is operator-controlled. No mandatory hosted model dependency in model core. Alternative provider options documented. |
| Data residency compliance verification Regulatory / Data |
Low | Medium | UK-hosted infrastructure target declared. Data boundary controls designed by intent. Operator-managed dataset curation with explicit provenance. Verification pathway documented for assessor review. |
Managed dependencies
The following dependencies are actively tracked with mitigation pathways in place:
GPU compute quota
GPU quota and provisioning are an actively managed dependency. Multiple UK and European provider options have been evaluated. Procurement pathway is documented. Current baseline does not require GPU — dependency becomes active at Phase 2 commencement.
UK sovereign infrastructure providers
UK data-centre and private cloud infrastructure options have been evaluated for model weight storage and inference. Deployment pathway is documented. Selection deferred to funded phase.
Assessor and reviewer engagement
Technical briefing and structured review is available on request. Evidence pack is maintained in reviewer-ready state. Dependency: assessor availability and engagement timeline.
Funding confirmation
Phase 2 and Phase 3 deliverables are contingent on confirmed funding. Phase 1 proceeds on current baseline.
Governance controls
The following governance controls are implemented to manage risk at the system level:
- Deployment promotion gates: Models and system changes must pass explicit promotion criteria before progression to externally consumed environments.
- Configuration-driven reproducibility: All training and evaluation runs are defined through versioned configurations, enabling independent verification and rollback.
- Audit trail by design: Usage signals and deployment lifecycle events are captured in structured format from inception, not retrofitted.
- Dependency register: Active technical, operational, and supply-chain dependencies are tracked with documented mitigation pathways and escalation criteria.
- Phase gate reviews: Each 30-day delivery phase has defined gate criteria that must be met before progression, enabling structured risk reassessment.
- Transparency posture: Capability claims are bounded by evidenced baseline, not aspirational extrapolation. Known limitations are declared in documentation.
Discuss risk and governance
Request a briefing to walk through the risk register, mitigations, and governance controls in detail.