Method · Library
How the library is built
How risks and controls are admitted to the library, defined, rated for severity and mapped to each other and to regulation and standards.
- Risk categories
- 16
- Control families
- 12 Responsible AI domains
- Reviewed
- 2026-11-11
The library is a register of the risks an organisation takes on by building, buying or using AI, and the controls that manage them. Each entry is defined in the lab’s own words and mapped to the others and to the clauses of public regulation and standards. It is sized by coverage of a stated body of sources, not copied from any catalogue it draws on.
The standpoint is a regulated organisation that deploys AI and sometimes builds it. Risks that only a frontier model developer can act on are included only where a deployer carries exposure.
Admission
A risk is admitted when all five of these hold:
- It can be stated as cause, event and consequence in one sentence.
- It is specific to AI, or materially changed by AI.
- One owner could be accountable for it.
- Its controls differ from its neighbours’. Two candidates answered by the same controls are one risk.
- A public source supports it: a regulation, a standard, a published catalogue or a documented incident.
A control is admitted when it is an activity done at a frequency or on a trigger, has an owner, leaves evidence an auditor could inspect, and can fail a test. A principle is not a control. A document is not a control; approving, maintaining and enforcing it is.
A published entry is never retired. It is rewritten, narrowed or recategorised in place, so its address and ID stay stable.
Risk categories
A risk has exactly one category, chosen by where its primary control owner sits. Two cross-cutting views apply to every entry: the twelve Responsible AI domains and the eight lifecycle stages.
- Governance & Accountability
- Who owns an AI system, who signs off on it, and whether that accountability is documented or assumed.
- Model Performance & Reliability
- The system does not work well enough, or stops doing so, with no attacker involved.
- Data Protection & Privacy
- Lawful basis, minimisation, and the automated-decision safeguards that keep an AI system inside UK GDPR, not just inside what the model technically allows.
- Fairness, Bias & Impact
- Disparate outcomes across groups, and the impact-assessment discipline that catches them before deployment, not after a complaint.
- Conduct & Customer Outcomes
- Harm to customers and markets from how AI is used with them.
- Transparency & Explainability
- Whether an AI system’s outputs and decisions can actually be explained to the person affected by them, not just logged.
- Human Factors & Workforce
- How people rely on, oversee and are managed by AI.
- Model & Application Security
- Attacks against the model or the application wrapped around it: prompt injection, insecure output handling, excessive agency.
- Adversarial ML & Model Integrity
- Attacks against the model artefact itself, and the operational discipline that catches them: evasion, extraction, backdoors, and the testing coverage that finds them before an adversary does.
- Agentic & Autonomous Systems
- Risks that arise because a system plans and acts with tools and delegated authority.
- Generative Content & Information Integrity
- What generated content says and how it is used.
- Intellectual Property & Legal Liability
- Rights in data, models and outputs, and who bears the loss.
- Third-Party & Supply Chain
- Vendor and model provenance risk: carries the third-party lens and is the category most closely tied to SS2/21.
- Operational Resilience
- Whether AI is mapped into your important-business-service inventory, has an impact tolerance, and has been tested to fail: the SS1/21 lens applied to AI specifically.
- Prohibited & High-Risk Practices
- The EU AI Act's Article 5 bans: social scoring, real-time public biometric identification, manipulative systems. Deliberately thin on mapped controls: the correct response to a legal prohibition is not building the system.
- Systemic & Societal
- Exposures an organisation shares with its sector and society, kept deliberately thin.
Control families and types
A control belongs to exactly one family: the Responsible AI domain whose owner would operate it. Each control also has one type: directive (sets what must happen), preventive (stops the risk event), detective (finds that it has occurred or is about to) or corrective (limits the harm and restores the position). Every risk category should have at least one detective and one corrective control mapped into it.
| Code | Family | Band |
|---|---|---|
| 01 | Strategy & Risk Appetite | Mandate |
| 02 | Governance & Accountability | Mandate |
| 03 | Regulatory & Legal Compliance | Mandate |
| 04 | Data & Data Governance | Foundation |
| 05 | Model & System Lifecycle | Foundation |
| 06 | Third Party & Supply Chain | Foundation |
| 07 | Fairness & Customer Outcomes | Conduct |
| 08 | Transparency & Explainability | Conduct |
| 09 | Human Oversight & Contestability | Conduct |
| 10 | Security & Resilience | Assurance |
| 11 | Monitoring, Assurance & Incidents | Assurance |
| 12 | Skills, Capability & Culture | Assurance |
How an entry is written
Every risk states its cause, event and consequence in one sentence, then says what it is (and which neighbouring risks it is not), how it happens, why it matters and its warning signs. Risks rated critical or high also say who owns it and how it looks in practice.
Every control states who does what, when and to what end, then what it does, how to implement it, the evidence that it operates, where it fits and its limits. The evidence block names one test of design and one test of operating effectiveness: what an auditor would ask to see.
Severity
Severity is inherent: the credible worst case for a regulated organisation with the risk unmitigated, before any control. It is not likelihood and not residual risk; an organisation’s own assessment supplies those. The rating is the highest level reached on any one of four criteria: harm to individuals, legal and regulatory exposure, reversibility, and scale.
- Critical: serious harm to safety, liberty or fundamental rights; a prohibited practice; cannot be undone; many people at once.
- High: material financial, psychological or discriminatory harm; breach of a binding obligation; undone only with significant effort; a customer segment or key process.
- Medium: limited or indirect harm; departure from guidance or a standard; readily corrected; contained to a team or use case.
- Low: inconvenience; no legal exposure expected; self-correcting; isolated.
Mapping
Each risk to control mapping is graded:
- Primary: the control acts directly on the risk event, preventing or detecting it, and would be relied on by itself.
- Supporting: it reduces likelihood or impact but would not be relied on alone.
- Compensating: it stands in where the primary control is impractical.
Every mapping carries one sentence saying how the control acts on that risk. Every risk has at least one primary control. For the prohibited practices that control is the screening of proposed uses, because the response to a prohibition is not to build the system. A control that is primary for more than ten risks is reviewed for being defined too broadly.
A framework reference is made only where the clause addresses the entry specifically, at the finest grain the source supports. A reference says the clause is relevant; it never claims that a control satisfies it.
Change control
Each entry shows its public ID and the date it was last reviewed. A source that issues a new edition triggers review of the entries that cite it. To report an error in any entry, use the corrections route.
Browse the risks and the controls, or return to the library overview.
Found an error or a better source? Report a correction.