About RiskNote

Risk management should be a living part of how an organisation makes decisions. Not an Excel file updated once a year because someone asked for it before the audit.

That insight grew out of 25 years on the other side of the desk: developer, Scrum Master, IT director in local government, Group CIO in the private sector. Every role produced the same kind of frustration. Most small and mid-sized companies know they have to do risk assessments. Most don't know how. The ones who do, don't have a tool that costs less than a monthly salary to introduce.

During the IT director years in local government, an information-security management system was started. Training in ISMS was done in parallel at Högskolan i Skövde. The theory was solid. The tools were not.

The search for a platform that tied risk, documentation, and follow-up together ended in spreadsheets, scattered Word documents, and systems built for auditors rather than the business. The real problem ran deeper than missing tools.

The same pattern came up in every organisation. The consultant who built a risk assessment for a client in Excel and never got around to updating it. The municipal head who wouldn't spend half a year's salary on a GRC system. The fintech startup that needed to be DORA-compliant but had no one to ask.

None of it was because the standards were too complex. ISO 31000 is shorter than an average terms of service. The problem was that the tools were either free and broken (Excel) or enterprise-priced (Archer, ServiceNow, SAP GRC). Nothing existed in between.

In the last two years, AI has moved from promise to practice. It can do what used to require a senior risk consultant billing by the hour: suggest industry-relevant risks, adapt to the organisation's context, produce board-ready reports in minutes instead of days.

But a product that needs AI to work isn't a product. It's a dependency.

RiskNote is built so everything works without AI. The risk register, the 5x5 matrix, the PDF export, and sharing with a client or a board all stand on their own. AI is a force multiplier for risk identification, but the decision is always the human's. That's GDPR Art. 22 and EU AI Act Art. 50 baked in from day one, not bolted on as a disclaimer afterwards.