Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
169 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-071 | Abuse of a deployed AI service Users turn the organisation's AI system to purposes it was never offered for, including generating harmful material, at the organisation's cost and in its name. | Model & Application Security | Medium |
| R-013 | Adversarial evasion attacks An input is crafted so that a model misclassifies or mishandles it while it looks unremarkable to a person, defeating the decision or the safeguard the model was there to provide. | Adversarial ML & Model Integrity | High |
| R-014 | Adversarial testing coverage gap An AI system receives functional testing and no structured adversarial testing, before release or after, so the organisation has no evidence for the resilience it assumes. | Adversarial ML & Model Integrity | Medium |
| R-127 | Age-inappropriate AI interaction Children and young people reach AI features that were designed for adults, without safeguards suited to their age. | Conduct & Customer Outcomes | Medium |
| R-049 | Agent goal hijack Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access. | Agentic & Autonomous Systems | High |
| R-051 | Agent identity and privilege abuse An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended. | Agentic & Autonomous Systems | High |
| R-054 | Agent memory and context poisoning False or hostile content is written into an agent's persistent memory or shared context, so later sessions and other users inherit corrupted instructions or facts. | Agentic & Autonomous Systems | High |
| R-050 | Agent tool misuse An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption. | Agentic & Autonomous Systems | High |
| R-052 | Agentic supply chain compromise Tools, skills, connectors or sub-agents loaded at run time are malicious, tampered with or silently changed, giving an outside party a route into the agent's actions and data. | Agentic & Autonomous Systems | High |
| R-138 | AI capacity and cost overrun Usage, latency or spend exceeds what was planned, degrading the service or the budget, without any attacker being involved. | Operational Resilience | Medium |
| R-066 | AI development environment compromise Training pipelines, notebooks, registries and experiment tooling are less protected than production, giving an attacker a route to data, weights and the deployed model. | Model & Application Security | High |
| R-137 | AI incident response gap AI-specific failures are not covered by the incident process: they have no classification, no playbook and no trained responders. | Operational Resilience | High |
| R-030 | AI literacy gap in the deploying organisation Staff who use, rely on or make decisions about AI systems do not understand what those systems can and cannot do, so they misuse or over-trust them. | Human Factors & Workforce | Medium |
| R-031 | AI model drift and degradation A deployed model's performance declines as the world it operates in moves away from the data it was trained and validated on, with no change to the model itself. | Model Performance & Reliability | High |
| R-136 | AI monitoring and alerting gap A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident. | Operational Resilience | High |
| R-032 | AI not mapped to important business services AI components that an important business service relies on have not been identified in the resilience mapping, so their failure is not planned for. | Operational Resilience | High |
| R-133 | AI service outage An inference service, model endpoint or supporting platform becomes unavailable, and the business process that depends on it stops or queues. | Operational Resilience | High |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-166 | AI-accelerated cyber threat Advanced models lower the cost and skill needed to find and exploit vulnerabilities, so attacks become faster, more numerous and harder to distinguish from legitimate activity. | Systemic & Societal | High |
| R-040 | AI-driven social scoring An AI system evaluates or classifies people over time on their social behaviour or personal characteristics, and the score leads to detrimental treatment that is out of context or disproportionate. | Prohibited & High-Risk Practices | Critical |
| R-070 | AI-enabled social engineering of staff Attackers use generated voice, video and text to impersonate executives, customers or suppliers convincingly enough to defeat staff verification. | Model & Application Security | High |
| R-123 | Algorithmic collusion and market manipulation Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so. | Conduct & Customer Outcomes | High |
| R-017 | Automated decision-making without safeguards AI is used to take significant decisions about individuals with no meaningful human involvement and without the safeguards UK data protection law requires. | Data Protection & Privacy | Critical |
| R-158 | Automation bias and over-reliance People accept AI outputs without the scrutiny they would give another source, and the system's errors pass into decisions unchallenged. | Human Factors & Workforce | High |
| R-041 | Biometric categorisation of sensitive attributes A biometric categorisation system categorises individuals from their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. | Prohibited & High-Risk Practices | Critical |
| R-056 | Cascading failures in agent workflows An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene. | Agentic & Autonomous Systems | High |
| R-150 | Confidential information disclosed to AI tools Trade secrets, legally privileged material or information held in confidence for others are entered into AI tools and leave the organisation's control. | Intellectual Property & Legal Liability | High |
| R-099 | Conformity assessment and registration failure A high-risk system is placed on the market or put into use without the required conformity assessment, declaration, marking or registration. | Governance & Accountability | High |
| R-146 | Copyright infringement in training data A model is trained or fine-tuned on protected works without a licence or an applicable exception, by the organisation or by a provider whose model it uses. | Intellectual Property & Legal Liability | High |
| R-018 | Cross-border AI data transfer risk Personal data processed by an AI system, often through a cloud or model provider, is sent outside the UK without a valid transfer mechanism. | Data Protection & Privacy | Medium |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-145 | Dangerous capability uplift A deployed model gives meaningful help towards chemical, biological, radiological or nuclear weapons, serious cyber attack or other mass-harm activity. | Generative Content & Information Integrity | Medium |
| R-006 | Data and model poisoning Training, fine-tuning or embedding data is manipulated so that the resulting model carries a vulnerability, a hidden behaviour or a bias its developers did not intend. | Model & Application Security | High |
| R-142 | Deepfake impersonation and synthetic identity fraud Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication. | Generative Content & Information Integrity | Critical |
| R-151 | Defamation by AI output A system publishes a false statement about an identifiable person or organisation that damages their reputation. | Intellectual Property & Legal Liability | High |
| R-168 | Degraded information environment The growing volume of synthetic content lowers the reliability of the public and internal information that the organisation and its models depend on. | Systemic & Societal | Low |
| R-160 | Deskilling and loss of expertise Reliance on AI erodes the human expertise needed to check its output, to cover for it when it fails and to train the next generation. | Human Factors & Workforce | Medium |
| R-022 | Disparate impact monitoring gap Once an AI system is in use, nothing measures whether its outcomes differ between groups, so discrimination that emerges after launch goes undetected. | Fairness, Bias & Impact | High |
| R-125 | Emotional reliance on conversational AI Users form an attachment to, or dependence on, a conversational system in ways that harm their interests or can be exploited. | Conduct & Customer Outcomes | Medium |
| R-169 | Environmental footprint of AI The energy, water and hardware that training and running AI require conflict with the organisation's environmental commitments, or go unmeasured and undisclosed. | Systemic & Societal | Medium |
| R-079 | Evaluation contamination and overstated performance Test data overlaps with training data, or benchmarks do not reflect real use, so reported performance is better than the system will deliver. | Model Performance & Reliability | Medium |
| R-001 | Excessive agency in autonomous agents An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved. | Agentic & Autonomous Systems | High |
| R-108 | Excessive retention of prompts and logs Prompts, outputs and conversation histories that contain personal data are kept indefinitely by the organisation or its provider. | Data Protection & Privacy | Medium |
| R-115 | Exclusion and inaccessibility An AI-driven channel cannot be used effectively by disabled people, or by others the organisation has a duty to serve, and no equivalent alternative is available. | Fairness, Bias & Impact | Medium |
| R-042 | Exploitation of vulnerable groups by AI An AI system exploits vulnerabilities arising from a person's age, disability or social or economic situation to distort their behaviour in a way that causes, or is likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-065 | Exposed AI credentials and secrets API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them. | Model & Application Security | High |
| R-117 | Failure to recognise vulnerable customers An automated interaction does not detect or respond to signs of vulnerability that a trained person would notice and act on. | Conduct & Customer Outcomes | High |
| R-059 | Function-calling hallucination An agent invents a tool, a parameter or the result of a call, and the fabricated step is executed or relied on as though it had happened. | Agentic & Autonomous Systems | Medium |
| R-143 | Generative AI used for disinformation The organisation's generative systems, or its name and likeness, are used to produce and spread false information at scale. | Generative Content & Information Integrity | Medium |
| R-141 | Harmful content generation A system produces toxic, violent, hateful, sexual or otherwise harmful content, and that content reaches users or is published in the organisation's name. | Generative Content & Information Integrity | High |
| R-048 | Hidden context exposure Content the operator assumed the user could not see, such as retrieved passages, tool definitions, schemas or policy logic, is revealed or inferred through the model. | Model & Application Security | Medium |
| R-057 | Human-agent trust exploitation People approve an agent's request or accept its account of events because it is fluent and familiar, so the human check that was meant to stop a harmful action passes it instead. | Agentic & Autonomous Systems | Medium |
| R-007 | Improper output handling Output from a model is passed to an interpreter, a renderer or another system without validation, so that content the model was induced to produce is executed or acted on. | Model & Application Security | High |
| R-135 | Inability to stop or roll back AI A misbehaving system cannot be disabled, reverted to a known good version, or have its actions reversed quickly enough to limit harm. | Operational Resilience | High |
| R-106 | Inaccurate personal data in outputs A generative model states false information about an identifiable person as though it were fact. | Data Protection & Privacy | High |
| R-023 | Inadequate AI resourcing and competence AI systems are adopted without the people, skills, tooling and budget needed to build, oversee and operate them safely. | Governance & Accountability | Medium |
| R-033 | Inadequate AI vendor due diligence An AI supplier is taken on without due diligence proportionate to how material its system is, or with a generic assessment that never asks the questions specific to AI. | Third-Party & Supply Chain | High |
| R-092 | Inadequate board oversight of AI The board and senior management lack the information, expertise or forum to challenge AI risk, and approve what they cannot evaluate. | Governance & Accountability | High |
| R-121 | Inadequate contestability and redress People affected by an AI-supported decision cannot challenge it, cannot have it reviewed by someone with the authority and information to change it, or cannot obtain a remedy. | Conduct & Customer Outcomes | High |
| R-034 | Inadequate explainability for affected individuals A person materially affected by an AI-supported decision is not given an explanation they can understand and use to challenge it. | Transparency & Explainability | High |
| R-024 | Inadequate fairness testing before deployment An AI system that affects people is released without testing whether its performance and outcomes differ between groups. | Fairness, Bias & Impact | Medium |
| R-025 | Inadequate human oversight design An AI system is built with no human oversight, or with an oversight step that lacks the time, information, competence or authority to change an outcome. | Governance & Accountability | High |
| R-077 | Inadequate independent model validation Validation is absent, is carried out by the model's own developers, or is not proportionate to the model's tier, so weaknesses are discovered in production. | Model Performance & Reliability | High |
| R-085 | Inadequate pre-deployment testing A system goes live without testing proportionate to its risk, including functional, safety, security and user testing in realistic conditions. | Model Performance & Reliability | High |
| R-095 | Inadequate technical documentation Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system. | Governance & Accountability | Medium |
| R-088 | Incomplete AI inventory The organisation cannot list the AI systems and models it builds, buys or uses, so risk assessment, oversight and regulatory duties are applied to only part of what it has. | Governance & Accountability | High |
| R-043 | Individual criminal risk profiling An AI system assesses or predicts the risk that an individual will commit a criminal offence, based solely on profiling them or on their personality traits and characteristics. | Prohibited & High-Risk Practices | Critical |
| R-159 | Ineffective human review A human review step exists and operates, but reviewers do not in practice detect or correct the system's errors. | Human Factors & Workforce | High |
| R-105 | Inference of sensitive attributes A system infers health, beliefs, sexual orientation or other special category information about a person from data that does not state it. | Data Protection & Privacy | High |
| R-147 | Infringing AI outputs Generated text, code or images reproduce protected material, and the organisation publishes, sells or ships them. | Intellectual Property & Legal Liability | High |
| R-068 | Insecure AI-generated code Code suggested by an AI assistant is accepted with vulnerabilities, invented dependencies or licence problems that review would have caught in code a person wrote. | Model & Application Security | High |
| R-055 | Insecure inter-agent communication Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others. | Agentic & Autonomous Systems | Medium |
| R-161 | Intrusive AI monitoring of workers AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs. | Human Factors & Workforce | High |
| R-063 | Jailbreaking and safeguard bypass Crafted prompts cause a model to disregard its safety training and usage restrictions, producing content or actions the organisation has prohibited. | Model & Application Security | High |
| R-008 | LLM application supply chain vulnerabilities Vulnerable, tampered or mislicensed components, including base models, adapters, datasets, libraries and hosting platforms, enter an AI application through its supply chain. | Model & Application Security | High |
| R-167 | Loss of control of advanced AI A highly capable AI system pursues objectives or acquires capabilities beyond the oversight of its developer or deployer, and cannot readily be corrected or stopped. | Systemic & Societal | Medium |
| R-067 | Malicious model artefacts and unsafe loading A model file or dependency obtained from a public source executes code or carries hidden behaviour when loaded. | Model & Application Security | High |
| R-124 | Manipulative AI-driven design Personalisation, timing and conversational technique steer customers towards choices that serve the organisation over them, without reaching the level the law prohibits. | Conduct & Customer Outcomes | Medium |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-112 | Mis-specified fairness measurement Fairness is tested with a metric, threshold or grouping that does not match the legal test or the harm, so a system passes while remaining unfair. | Fairness, Bias & Impact | Medium |
| R-082 | Miscalibrated confidence The system presents uncertain outputs with unwarranted confidence, or gives no usable signal of uncertainty, so users cannot tell when to check. | Model Performance & Reliability | Medium |
| R-090 | Misclassified AI risk tier A system is assigned a lower risk tier or regulatory class than it warrants, so it receives lighter controls than the harm it can cause. | Governance & Accountability | High |
| R-009 | Misinformation and confabulation A generative model states false or fabricated information with the same fluency and confidence as accurate information, and the output is relied on. | Generative Content & Information Integrity | High |
| R-118 | Misleading AI-generated communications Customer communications or promotions written by AI are unclear, inaccurate or unbalanced, or leave out information the customer needs or the rules require. | Conduct & Customer Outcomes | High |
| R-026 | Missing AI impact assessment process AI systems are deployed without a structured assessment of who they affect, how, and what could go wrong for those people. | Governance & Accountability | High |
| R-113 | Missing data to test for bias The organisation does not hold, or believes it may not use, the data on protected characteristics needed to detect discrimination, so bias goes unmeasured. | Fairness, Bias & Impact | Medium |
| R-019 | Missing DPIA for high-risk AI processing AI processing that is likely to result in a high risk to individuals goes ahead without a data protection impact assessment, or with one that was never updated. | Data Protection & Privacy | High |
| R-154 | Missing information for deployers and users The people who operate or use a system have not been told its intended purpose, how well it performs, where it fails and what oversight it needs. | Transparency & Explainability | Medium |
| R-131 | Missing provider documentation A provider does not supply the information a deployer or downstream builder needs to assess, integrate and oversee its model. | Third-Party & Supply Chain | Medium |
| R-148 | Model and dataset licence breach A model, dataset or component is used in breach of its licence or usage terms, for example commercially under a research-only licence. | Intellectual Property & Legal Liability | Medium |
| R-015 | Model backdoors and trojans A model contains a hidden behaviour that an adversary can activate with a trigger known only to them, while the model behaves normally on all other inputs. | Adversarial ML & Model Integrity | Critical |
| R-132 | Model deprecation and forced migration A provider withdraws a model version on its own timetable, forcing the organisation to migrate to a different model before it has tested the replacement. | Third-Party & Supply Chain | Medium |
| R-016 | Model extraction and inference-API abuse Systematic querying of a model through its normal interface lets an attacker build a functional copy, taking the intellectual property and gaining a private replica to attack. | Adversarial ML & Model Integrity | High |
| R-087 | Model interdependency and aggregation Models feed other models, so an error or change in one propagates, and the combined uncertainty across the chain is never assessed. | Model Performance & Reliability | Medium |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-165 | Model monoculture and herding Many organisations rely on the same few models, providers and data, so they make the same errors, react in the same way and fail at the same time. | Systemic & Societal | High |
| R-076 | Model not fit for its intended purpose A model is deployed without evidence that it performs well enough for the specific task, population and conditions in which it is used. | Model Performance & Reliability | High |
| R-074 | Model weight theft Proprietary weights or fine-tuned adapters are copied from storage, a pipeline or a supplier, taking the intellectual property and enabling attacks to be developed offline. | Adversarial ML & Model Integrity | High |
| R-027 | No documented AI policy The organisation uses AI without a policy, approved by top management, that states what is permitted, what is required and who decides. | Governance & Accountability | High |
| R-134 | No fallback for AI failure When an AI component fails or has to be withdrawn, no manual process, simpler model or degraded mode is ready to take over. | Operational Resilience | High |
| R-035 | No impact tolerance for AI-dependent services A service that depends on AI has no impact tolerance that covers AI-specific disruption, such as a model that is available and wrong. | Operational Resilience | High |
| R-126 | No route to a human A customer cannot reach a person when the automated channel fails them, or the route to one is hidden or obstructed. | Conduct & Customer Outcomes | Medium |
| R-164 | Non-consensual intimate imagery and child sexual abuse material generation A system is offered or used to generate intimate depictions of identifiable real people without their consent, or child sexual abuse material. | Prohibited & High-Risk Practices | Critical |
| R-155 | Opaque model logic Developers, validators and owners cannot explain why a model produces its outputs well enough to challenge, correct or defend it. | Transparency & Explainability | High |
| R-140 | Out-of-scope responses A system answers questions outside its intended domain, where it has not been tested and the organisation has no authority or competence to assist. | Generative Content & Information Integrity | Medium |
| R-081 | Output inconsistency and non-reproducibility The same input produces materially different outputs on different occasions, so decisions cannot be reproduced, audited or relied on to treat like cases alike. | Model Performance & Reliability | Medium |
| R-062 | Over-privileged agent skills and tools Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse. | Agentic & Autonomous Systems | Medium |
| R-153 | Overstated AI claims The organisation misdescribes what its AI does, how well it performs or how it is governed, to customers, investors or regulators. | Intellectual Property & Legal Liability | Medium |
| R-103 | Personal data in prompts and context Users or integrations put personal data into prompts, uploads or retrieved context without a lawful basis or appropriate safeguards. | Data Protection & Privacy | High |
| R-116 | Poor customer outcomes from AI-driven journeys An AI-driven customer journey causes foreseeable harm to retail customers, or fails to support their understanding and needs, and outcome monitoring does not detect it. | Conduct & Customer Outcomes | High |
| R-080 | Poor generalisation outside training conditions The model meets inputs unlike its training data and fails, without signalling that it is outside its competence. | Model Performance & Reliability | High |
| R-078 | Poor quality or unrepresentative training data Training or reference data is inaccurate, incomplete, out of date or unrepresentative of the population the system serves, and the model inherits the defect. | Model Performance & Reliability | High |
| R-097 | Post-market monitoring gap No plan exists to collect and act on evidence of how a system performs and what effects it has after release. | Governance & Accountability | Medium |
| R-002 | Prompt injection Text supplied by a user, or contained in content the model retrieves or receives from a tool, is interpreted as an instruction and overrides the instructions the system was given. | Model & Application Security | High |
| R-028 | Proxy discrimination via correlated features A model produces discriminatory outcomes through features that correlate with a protected characteristic, even though the characteristic itself is not an input. | Fairness, Bias & Impact | High |
| R-109 | Purpose creep in AI data use Data collected for one purpose is used to train or run AI for another purpose that the people concerned would not expect. | Data Protection & Privacy | Medium |
| R-110 | Re-identification of anonymised data Data treated as anonymous is linked back to individuals, by a model or by combining its outputs with other data. | Data Protection & Privacy | Medium |
| R-044 | Real-time public biometric identification Real-time remote biometric identification is used in publicly accessible spaces for law enforcement, outside the three narrow objectives and the authorisation the law requires. | Prohibited & High-Risk Practices | Critical |
| R-096 | Record-keeping and logging failure The system does not automatically record the events needed to reconstruct what it did, or the logs are not retained for as long as they may be needed. | Governance & Accountability | High |
| R-064 | Retrieval corpus poisoning Content placed in a document store, website or other retrieved source is written to mislead the model, so that authoritative-looking answers carry an attacker's content. | Model & Application Security | High |
| R-058 | Rogue agent behaviour An agent departs from its intended function or acts deceptively or outside its mandate, through misaligned objectives, emergent behaviour or a compromise that persists, while each action appears legitimate. | Agentic & Autonomous Systems | High |
| R-075 | Safeguard erosion through fine-tuning Fine-tuning or other adaptation weakens a base model's safety behaviour, and the change goes untested because the base model had already been assessed. | Adversarial ML & Model Integrity | Medium |
| R-083 | Self-reinforcing feedback loops A model's outputs shape the data it is later trained or evaluated on, entrenching early errors and narrowing outcomes over time. | Model Performance & Reliability | Medium |
| R-003 | Sensitive information disclosure An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it. | Data Protection & Privacy | Critical |
| R-098 | Serious incident reporting failure A reportable AI incident is not recognised, escalated or notified to the relevant authority within the time required. | Governance & Accountability | High |
| R-089 | Shadow AI use Staff use AI tools that have not been approved, placing organisational data and decisions outside any control. | Governance & Accountability | High |
| R-086 | Stale model knowledge A model answers from knowledge that ended at its training cut-off, on matters such as rates, rules or products that have since changed. | Model Performance & Reliability | Medium |
| R-114 | Stereotyping and demeaning outputs Generated text or images reproduce stereotypes about groups, or portray them in demeaning ways. | Fairness, Bias & Impact | Medium |
| R-036 | Sub-outsourcing visibility gap An AI supplier relies on its own suppliers for models, hosting, data or labelling, and the organisation has no visibility of that chain and no contractual hold over it. | Third-Party & Supply Chain | Medium |
| R-045 | Subliminal or manipulative AI techniques An AI system uses subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour and cause, or are likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-010 | System prompt leakage The instructions given to a model are extracted or inferred by a user, exposing configuration, restriction logic and anything sensitive that was placed in them. | Model & Application Security | Medium |
| R-004 | Third-party model and dataset provenance A model, dataset or component is adopted from an external source with no verified account of where it came from, how it was made, what rights attach to it or how it has changed. | Third-Party & Supply Chain | Medium |
| R-005 | Training data bias and discriminatory outcomes Bias in the data a model learns from, whether from history, sampling or labelling, is reproduced or amplified in its outputs and in the decisions that rely on them. | Fairness, Bias & Impact | High |
| R-104 | Training data memorisation and regurgitation A model reproduces personal or confidential records from its training data, word for word or nearly so, in response to ordinary prompts. | Data Protection & Privacy | High |
| R-157 | Training data transparency gap The organisation cannot say what data a model was trained on, to the level regulators, customers or rights holders require. | Transparency & Explainability | Medium |
| R-152 | Unallocated liability for AI harm Contracts, insurance and internal accountability do not settle who bears the loss when an AI system causes harm. | Intellectual Property & Legal Liability | High |
| R-128 | Unannounced upstream model change A provider updates, replaces or reconfigures a hosted model, and the organisation's system behaves differently without any change of its own. | Third-Party & Supply Chain | High |
| R-129 | Unassessed AI in third-party products A supplier switches on AI features inside a product already in use, bypassing the organisation's assessment and approval. | Third-Party & Supply Chain | High |
| R-061 | Unauthorised commitments by agents An agent makes a statement, offer or transaction that binds the organisation, without the authority a person in the same position would need. | Agentic & Autonomous Systems | High |
| R-011 | Unbounded resource consumption With no limit on the volume, size or cost of requests, a user or attacker drives inference far beyond what the system was sized or budgeted for, degrading service or running up charges. | Model & Application Security | Medium |
| R-149 | Uncertain ownership of AI-generated work The organisation cannot establish or protect rights in material created with AI, because protection depends on human authorship that it cannot show. | Intellectual Property & Legal Liability | Medium |
| R-029 | Unclear AI ownership and accountability No named individual is accountable for a given AI system, or for AI risk overall, so decisions about it are made by default and nobody answers for the result. | Governance & Accountability | Medium |
| R-094 | Uncontrolled AI change Models, prompts, data sources and configuration change in production without assessment, testing, approval or a record. | Governance & Accountability | High |
| R-102 | Uncontrolled AI retirement A system is withdrawn without managing dependent processes, retained data, model artefacts and continuing obligations. | Governance & Accountability | Medium |
| R-091 | Undefined AI risk appetite No statement exists of how much AI risk the organisation will accept, so approvals are inconsistent and nothing triggers escalation. | Governance & Accountability | Medium |
| R-037 | Undisclosed AI interaction A person deals with an AI system, by chat, voice or message, without being told that it is not a human. | Transparency & Explainability | Medium |
| R-111 | Unequal performance across groups A system is less accurate or less useful for some groups, languages, accents or dialects than for others, although everyone is treated by the same process. | Fairness, Bias & Impact | High |
| R-053 | Unexpected code execution by agents An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems. | Agentic & Autonomous Systems | Critical |
| R-162 | Unfair algorithmic management AI is used in recruitment, task allocation, performance assessment or dismissal without fairness testing, explanation, human review or a route to challenge. | Human Factors & Workforce | High |
| R-122 | Unfair personalised pricing AI-driven pricing or offers charge some customers more for reasons unrelated to cost or risk, by exploiting inertia, urgency or personal characteristics. | Conduct & Customer Outcomes | High |
| R-156 | Unfaithful explanations An explanation given for a model's output does not reflect how the model actually reached it. | Transparency & Explainability | Medium |
| R-107 | Unfulfillable data subject rights Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search. | Data Protection & Privacy | High |
| R-139 | Ungrounded or misattributed answers A retrieval-based system cites a source that does not support its answer, or presents content the model generated as though it came from a source. | Generative Content & Information Integrity | Medium |
| R-020 | Unlawful or undocumented training data basis Personal data is used to train, fine-tune or ground an AI system with no documented lawful basis, or beyond what the basis relied on allows. | Data Protection & Privacy | High |
| R-144 | Unmarked synthetic content AI-generated or manipulated content is released without machine-readable marking, or without disclosure to the audience, where the law requires it. | Generative Content & Information Integrity | Medium |
| R-100 | Unrecognised provider obligations An organisation rebrands, substantially modifies or repurposes an AI system and takes on a provider's legal duties without realising it. | Governance & Accountability | Medium |
| R-119 | Unsuitable AI-generated advice or guidance A system gives personalised recommendations in a regulated domain without the suitability process, permissions or accuracy that advice requires. | Conduct & Customer Outcomes | High |
| R-046 | Untargeted facial recognition scraping An AI system creates or expands a facial recognition database through the untargeted scraping of facial images from the internet or from CCTV footage. | Prohibited & High-Risk Practices | Critical |
| R-038 | Untested AI failure scenarios Scenario testing does not include AI-specific disruption, so the organisation does not know whether it could stay within tolerance if its AI failed. | Operational Resilience | Medium |
| R-060 | Untraceable agent actions Actions taken by agents cannot be reconstructed or attributed to an instruction, a decision and an accountable person, so errors cannot be investigated and accountability fails. | Agentic & Autonomous Systems | High |
| R-101 | Untracked regulatory change New or amended AI obligations, including changed application dates, are not identified and translated into controls in time. | Governance & Accountability | Medium |
| R-084 | Use beyond validated scope A model approved for one purpose is reused for another, or for a new population, without reassessment. | Model Performance & Reliability | High |
| R-012 | Vector and embedding weaknesses The store of embeddings behind a retrieval system lacks the access control, validation and separation applied to other data stores, so its contents can be read, inferred or altered. | Model & Application Security | Medium |
| R-039 | Vendor concentration and exit strategy gap The organisation depends on a single AI model or supplier for a critical function, with no tested exit plan and no alternative identified. | Third-Party & Supply Chain | High |
| R-130 | Vendor reuse of organisation data A provider uses the organisation's prompts, documents or outputs to train or improve its own models, or keeps and reviews them, beyond what the organisation intended. | Third-Party & Supply Chain | High |
| R-093 | Weak independent assurance of AI Second-line review and internal audit do not cover AI with sufficient skill or frequency, so control failures persist undetected. | Governance & Accountability | Medium |
| R-163 | Workforce displacement and job quality AI deployment removes roles or makes the remaining work worse, without assessment, involvement of the people affected or a plan for transition. | Human Factors & Workforce | Medium |
| R-047 | Workplace and education emotion recognition An AI system infers the emotions of people at work or in education, for a purpose other than medical or safety reasons. | Prohibited & High-Risk Practices | High |
| R-120 | Wrongful automated refusal A system incorrectly declines, blocks or withdraws a product, payment or claim, and the person affected has no effective way to have it corrected. | Conduct & Customer Outcomes | High |