Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
34 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-127 | Age-inappropriate AI interaction Children and young people reach AI features that were designed for adults, without safeguards suited to their age. | Conduct & Customer Outcomes | Medium |
| R-040 | AI-driven social scoring An AI system evaluates or classifies people over time on their social behaviour or personal characteristics, and the score leads to detrimental treatment that is out of context or disproportionate. | Prohibited & High-Risk Practices | Critical |
| R-123 | Algorithmic collusion and market manipulation Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so. | Conduct & Customer Outcomes | High |
| R-017 | Automated decision-making without safeguards AI is used to take significant decisions about individuals with no meaningful human involvement and without the safeguards UK data protection law requires. | Data Protection & Privacy | Critical |
| R-041 | Biometric categorisation of sensitive attributes A biometric categorisation system categorises individuals from their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. | Prohibited & High-Risk Practices | Critical |
| R-099 | Conformity assessment and registration failure A high-risk system is placed on the market or put into use without the required conformity assessment, declaration, marking or registration. | Governance & Accountability | High |
| R-146 | Copyright infringement in training data A model is trained or fine-tuned on protected works without a licence or an applicable exception, by the organisation or by a provider whose model it uses. | Intellectual Property & Legal Liability | High |
| R-018 | Cross-border AI data transfer risk Personal data processed by an AI system, often through a cloud or model provider, is sent outside the UK without a valid transfer mechanism. | Data Protection & Privacy | Medium |
| R-151 | Defamation by AI output A system publishes a false statement about an identifiable person or organisation that damages their reputation. | Intellectual Property & Legal Liability | High |
| R-042 | Exploitation of vulnerable groups by AI An AI system exploits vulnerabilities arising from a person's age, disability or social or economic situation to distort their behaviour in a way that causes, or is likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-043 | Individual criminal risk profiling An AI system assesses or predicts the risk that an individual will commit a criminal offence, based solely on profiling them or on their personality traits and characteristics. | Prohibited & High-Risk Practices | Critical |
| R-147 | Infringing AI outputs Generated text, code or images reproduce protected material, and the organisation publishes, sells or ships them. | Intellectual Property & Legal Liability | High |
| R-161 | Intrusive AI monitoring of workers AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs. | Human Factors & Workforce | High |
| R-090 | Misclassified AI risk tier A system is assigned a lower risk tier or regulatory class than it warrants, so it receives lighter controls than the harm it can cause. | Governance & Accountability | High |
| R-118 | Misleading AI-generated communications Customer communications or promotions written by AI are unclear, inaccurate or unbalanced, or leave out information the customer needs or the rules require. | Conduct & Customer Outcomes | High |
| R-026 | Missing AI impact assessment process AI systems are deployed without a structured assessment of who they affect, how, and what could go wrong for those people. | Governance & Accountability | High |
| R-019 | Missing DPIA for high-risk AI processing AI processing that is likely to result in a high risk to individuals goes ahead without a data protection impact assessment, or with one that was never updated. | Data Protection & Privacy | High |
| R-148 | Model and dataset licence breach A model, dataset or component is used in breach of its licence or usage terms, for example commercially under a research-only licence. | Intellectual Property & Legal Liability | Medium |
| R-164 | Non-consensual intimate imagery and child sexual abuse material generation A system is offered or used to generate intimate depictions of identifiable real people without their consent, or child sexual abuse material. | Prohibited & High-Risk Practices | Critical |
| R-153 | Overstated AI claims The organisation misdescribes what its AI does, how well it performs or how it is governed, to customers, investors or regulators. | Intellectual Property & Legal Liability | Medium |
| R-109 | Purpose creep in AI data use Data collected for one purpose is used to train or run AI for another purpose that the people concerned would not expect. | Data Protection & Privacy | Medium |
| R-044 | Real-time public biometric identification Real-time remote biometric identification is used in publicly accessible spaces for law enforcement, outside the three narrow objectives and the authorisation the law requires. | Prohibited & High-Risk Practices | Critical |
| R-098 | Serious incident reporting failure A reportable AI incident is not recognised, escalated or notified to the relevant authority within the time required. | Governance & Accountability | High |
| R-045 | Subliminal or manipulative AI techniques An AI system uses subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour and cause, or are likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-152 | Unallocated liability for AI harm Contracts, insurance and internal accountability do not settle who bears the loss when an AI system causes harm. | Intellectual Property & Legal Liability | High |
| R-061 | Unauthorised commitments by agents An agent makes a statement, offer or transaction that binds the organisation, without the authority a person in the same position would need. | Agentic & Autonomous Systems | High |
| R-149 | Uncertain ownership of AI-generated work The organisation cannot establish or protect rights in material created with AI, because protection depends on human authorship that it cannot show. | Intellectual Property & Legal Liability | Medium |
| R-107 | Unfulfillable data subject rights Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search. | Data Protection & Privacy | High |
| R-020 | Unlawful or undocumented training data basis Personal data is used to train, fine-tune or ground an AI system with no documented lawful basis, or beyond what the basis relied on allows. | Data Protection & Privacy | High |
| R-100 | Unrecognised provider obligations An organisation rebrands, substantially modifies or repurposes an AI system and takes on a provider's legal duties without realising it. | Governance & Accountability | Medium |
| R-119 | Unsuitable AI-generated advice or guidance A system gives personalised recommendations in a regulated domain without the suitability process, permissions or accuracy that advice requires. | Conduct & Customer Outcomes | High |
| R-046 | Untargeted facial recognition scraping An AI system creates or expands a facial recognition database through the untargeted scraping of facial images from the internet or from CCTV footage. | Prohibited & High-Risk Practices | Critical |
| R-101 | Untracked regulatory change New or amended AI obligations, including changed application dates, are not identified and translated into controls in time. | Governance & Accountability | Medium |
| R-047 | Workplace and education emotion recognition An AI system infers the emotions of people at work or in education, for a purpose other than medical or safety reasons. | Prohibited & High-Risk Practices | High |