Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
12 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-092 | Inadequate board oversight of AI The board and senior management lack the information, expertise or forum to challenge AI risk, and approve what they cannot evaluate. | Governance & Accountability | High |
| R-088 | Incomplete AI inventory The organisation cannot list the AI systems and models it builds, buys or uses, so risk assessment, oversight and regulatory duties are applied to only part of what it has. | Governance & Accountability | High |
| R-090 | Misclassified AI risk tier A system is assigned a lower risk tier or regulatory class than it warrants, so it receives lighter controls than the harm it can cause. | Governance & Accountability | High |
| R-026 | Missing AI impact assessment process AI systems are deployed without a structured assessment of who they affect, how, and what could go wrong for those people. | Governance & Accountability | High |
| R-087 | Model interdependency and aggregation Models feed other models, so an error or change in one propagates, and the combined uncertainty across the chain is never assessed. | Model Performance & Reliability | Medium |
| R-027 | No documented AI policy The organisation uses AI without a policy, approved by top management, that states what is permitted, what is required and who decides. | Governance & Accountability | High |
| R-089 | Shadow AI use Staff use AI tools that have not been approved, placing organisational data and decisions outside any control. | Governance & Accountability | High |
| R-152 | Unallocated liability for AI harm Contracts, insurance and internal accountability do not settle who bears the loss when an AI system causes harm. | Intellectual Property & Legal Liability | High |
| R-129 | Unassessed AI in third-party products A supplier switches on AI features inside a product already in use, bypassing the organisation's assessment and approval. | Third-Party & Supply Chain | High |
| R-029 | Unclear AI ownership and accountability No named individual is accountable for a given AI system, or for AI risk overall, so decisions about it are made by default and nobody answers for the result. | Governance & Accountability | Medium |
| R-060 | Untraceable agent actions Actions taken by agents cannot be reconstructed or attributed to an instruction, a decision and an accountable person, so errors cannot be investigated and accountability fails. | Agentic & Autonomous Systems | High |
| R-084 | Use beyond validated scope A model approved for one purpose is reused for another, or for a new population, without reassessment. | Model Performance & Reliability | High |