Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
34 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-054 | Agent memory and context poisoning False or hostile content is written into an agent's persistent memory or shared context, so later sessions and other users inherit corrupted instructions or facts. | Agentic & Autonomous Systems | High |
| R-041 | Biometric categorisation of sensitive attributes A biometric categorisation system categorises individuals from their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. | Prohibited & High-Risk Practices | Critical |
| R-150 | Confidential information disclosed to AI tools Trade secrets, legally privileged material or information held in confidence for others are entered into AI tools and leave the organisation's control. | Intellectual Property & Legal Liability | High |
| R-146 | Copyright infringement in training data A model is trained or fine-tuned on protected works without a licence or an applicable exception, by the organisation or by a provider whose model it uses. | Intellectual Property & Legal Liability | High |
| R-018 | Cross-border AI data transfer risk Personal data processed by an AI system, often through a cloud or model provider, is sent outside the UK without a valid transfer mechanism. | Data Protection & Privacy | Medium |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-006 | Data and model poisoning Training, fine-tuning or embedding data is manipulated so that the resulting model carries a vulnerability, a hidden behaviour or a bias its developers did not intend. | Model & Application Security | High |
| R-168 | Degraded information environment The growing volume of synthetic content lowers the reliability of the public and internal information that the organisation and its models depend on. | Systemic & Societal | Low |
| R-108 | Excessive retention of prompts and logs Prompts, outputs and conversation histories that contain personal data are kept indefinitely by the organisation or its provider. | Data Protection & Privacy | Medium |
| R-106 | Inaccurate personal data in outputs A generative model states false information about an identifiable person as though it were fact. | Data Protection & Privacy | High |
| R-105 | Inference of sensitive attributes A system infers health, beliefs, sexual orientation or other special category information about a person from data that does not state it. | Data Protection & Privacy | High |
| R-161 | Intrusive AI monitoring of workers AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs. | Human Factors & Workforce | High |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-113 | Missing data to test for bias The organisation does not hold, or believes it may not use, the data on protected characteristics needed to detect discrimination, so bias goes unmeasured. | Fairness, Bias & Impact | Medium |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-103 | Personal data in prompts and context Users or integrations put personal data into prompts, uploads or retrieved context without a lawful basis or appropriate safeguards. | Data Protection & Privacy | High |
| R-078 | Poor quality or unrepresentative training data Training or reference data is inaccurate, incomplete, out of date or unrepresentative of the population the system serves, and the model inherits the defect. | Model Performance & Reliability | High |
| R-109 | Purpose creep in AI data use Data collected for one purpose is used to train or run AI for another purpose that the people concerned would not expect. | Data Protection & Privacy | Medium |
| R-110 | Re-identification of anonymised data Data treated as anonymous is linked back to individuals, by a model or by combining its outputs with other data. | Data Protection & Privacy | Medium |
| R-044 | Real-time public biometric identification Real-time remote biometric identification is used in publicly accessible spaces for law enforcement, outside the three narrow objectives and the authorisation the law requires. | Prohibited & High-Risk Practices | Critical |
| R-064 | Retrieval corpus poisoning Content placed in a document store, website or other retrieved source is written to mislead the model, so that authoritative-looking answers carry an attacker's content. | Model & Application Security | High |
| R-083 | Self-reinforcing feedback loops A model's outputs shape the data it is later trained or evaluated on, entrenching early errors and narrowing outcomes over time. | Model Performance & Reliability | Medium |
| R-003 | Sensitive information disclosure An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it. | Data Protection & Privacy | Critical |
| R-089 | Shadow AI use Staff use AI tools that have not been approved, placing organisational data and decisions outside any control. | Governance & Accountability | High |
| R-004 | Third-party model and dataset provenance A model, dataset or component is adopted from an external source with no verified account of where it came from, how it was made, what rights attach to it or how it has changed. | Third-Party & Supply Chain | Medium |
| R-005 | Training data bias and discriminatory outcomes Bias in the data a model learns from, whether from history, sampling or labelling, is reproduced or amplified in its outputs and in the decisions that rely on them. | Fairness, Bias & Impact | High |
| R-104 | Training data memorisation and regurgitation A model reproduces personal or confidential records from its training data, word for word or nearly so, in response to ordinary prompts. | Data Protection & Privacy | High |
| R-157 | Training data transparency gap The organisation cannot say what data a model was trained on, to the level regulators, customers or rights holders require. | Transparency & Explainability | Medium |
| R-102 | Uncontrolled AI retirement A system is withdrawn without managing dependent processes, retained data, model artefacts and continuing obligations. | Governance & Accountability | Medium |
| R-107 | Unfulfillable data subject rights Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search. | Data Protection & Privacy | High |
| R-020 | Unlawful or undocumented training data basis Personal data is used to train, fine-tune or ground an AI system with no documented lawful basis, or beyond what the basis relied on allows. | Data Protection & Privacy | High |
| R-046 | Untargeted facial recognition scraping An AI system creates or expands a facial recognition database through the untargeted scraping of facial images from the internet or from CCTV footage. | Prohibited & High-Risk Practices | Critical |
| R-012 | Vector and embedding weaknesses The store of embeddings behind a retrieval system lacks the access control, validation and separation applied to other data stores, so its contents can be read, inferred or altered. | Model & Application Security | Medium |
| R-130 | Vendor reuse of organisation data A provider uses the organisation's prompts, documents or outputs to train or improve its own models, or keeps and reviews them, beyond what the organisation intended. | Third-Party & Supply Chain | High |