Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
51 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-071 | Abuse of a deployed AI service Users turn the organisation's AI system to purposes it was never offered for, including generating harmful material, at the organisation's cost and in its name. | Model & Application Security | Medium |
| R-013 | Adversarial evasion attacks An input is crafted so that a model misclassifies or mishandles it while it looks unremarkable to a person, defeating the decision or the safeguard the model was there to provide. | Adversarial ML & Model Integrity | High |
| R-014 | Adversarial testing coverage gap An AI system receives functional testing and no structured adversarial testing, before release or after, so the organisation has no evidence for the resilience it assumes. | Adversarial ML & Model Integrity | Medium |
| R-049 | Agent goal hijack Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access. | Agentic & Autonomous Systems | High |
| R-051 | Agent identity and privilege abuse An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended. | Agentic & Autonomous Systems | High |
| R-054 | Agent memory and context poisoning False or hostile content is written into an agent's persistent memory or shared context, so later sessions and other users inherit corrupted instructions or facts. | Agentic & Autonomous Systems | High |
| R-050 | Agent tool misuse An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption. | Agentic & Autonomous Systems | High |
| R-052 | Agentic supply chain compromise Tools, skills, connectors or sub-agents loaded at run time are malicious, tampered with or silently changed, giving an outside party a route into the agent's actions and data. | Agentic & Autonomous Systems | High |
| R-066 | AI development environment compromise Training pipelines, notebooks, registries and experiment tooling are less protected than production, giving an attacker a route to data, weights and the deployed model. | Model & Application Security | High |
| R-032 | AI not mapped to important business services AI components that an important business service relies on have not been identified in the resilience mapping, so their failure is not planned for. | Operational Resilience | High |
| R-133 | AI service outage An inference service, model endpoint or supporting platform becomes unavailable, and the business process that depends on it stops or queues. | Operational Resilience | High |
| R-166 | AI-accelerated cyber threat Advanced models lower the cost and skill needed to find and exploit vulnerabilities, so attacks become faster, more numerous and harder to distinguish from legitimate activity. | Systemic & Societal | High |
| R-070 | AI-enabled social engineering of staff Attackers use generated voice, video and text to impersonate executives, customers or suppliers convincingly enough to defeat staff verification. | Model & Application Security | High |
| R-056 | Cascading failures in agent workflows An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene. | Agentic & Autonomous Systems | High |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-145 | Dangerous capability uplift A deployed model gives meaningful help towards chemical, biological, radiological or nuclear weapons, serious cyber attack or other mass-harm activity. | Generative Content & Information Integrity | Medium |
| R-006 | Data and model poisoning Training, fine-tuning or embedding data is manipulated so that the resulting model carries a vulnerability, a hidden behaviour or a bias its developers did not intend. | Model & Application Security | High |
| R-142 | Deepfake impersonation and synthetic identity fraud Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication. | Generative Content & Information Integrity | Critical |
| R-001 | Excessive agency in autonomous agents An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved. | Agentic & Autonomous Systems | High |
| R-065 | Exposed AI credentials and secrets API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them. | Model & Application Security | High |
| R-059 | Function-calling hallucination An agent invents a tool, a parameter or the result of a call, and the fabricated step is executed or relied on as though it had happened. | Agentic & Autonomous Systems | Medium |
| R-143 | Generative AI used for disinformation The organisation's generative systems, or its name and likeness, are used to produce and spread false information at scale. | Generative Content & Information Integrity | Medium |
| R-141 | Harmful content generation A system produces toxic, violent, hateful, sexual or otherwise harmful content, and that content reaches users or is published in the organisation's name. | Generative Content & Information Integrity | High |
| R-048 | Hidden context exposure Content the operator assumed the user could not see, such as retrieved passages, tool definitions, schemas or policy logic, is revealed or inferred through the model. | Model & Application Security | Medium |
| R-007 | Improper output handling Output from a model is passed to an interpreter, a renderer or another system without validation, so that content the model was induced to produce is executed or acted on. | Model & Application Security | High |
| R-135 | Inability to stop or roll back AI A misbehaving system cannot be disabled, reverted to a known good version, or have its actions reversed quickly enough to limit harm. | Operational Resilience | High |
| R-068 | Insecure AI-generated code Code suggested by an AI assistant is accepted with vulnerabilities, invented dependencies or licence problems that review would have caught in code a person wrote. | Model & Application Security | High |
| R-055 | Insecure inter-agent communication Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others. | Agentic & Autonomous Systems | Medium |
| R-063 | Jailbreaking and safeguard bypass Crafted prompts cause a model to disregard its safety training and usage restrictions, producing content or actions the organisation has prohibited. | Model & Application Security | High |
| R-008 | LLM application supply chain vulnerabilities Vulnerable, tampered or mislicensed components, including base models, adapters, datasets, libraries and hosting platforms, enter an AI application through its supply chain. | Model & Application Security | High |
| R-167 | Loss of control of advanced AI A highly capable AI system pursues objectives or acquires capabilities beyond the oversight of its developer or deployer, and cannot readily be corrected or stopped. | Systemic & Societal | Medium |
| R-067 | Malicious model artefacts and unsafe loading A model file or dependency obtained from a public source executes code or carries hidden behaviour when loaded. | Model & Application Security | High |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-015 | Model backdoors and trojans A model contains a hidden behaviour that an adversary can activate with a trigger known only to them, while the model behaves normally on all other inputs. | Adversarial ML & Model Integrity | Critical |
| R-016 | Model extraction and inference-API abuse Systematic querying of a model through its normal interface lets an attacker build a functional copy, taking the intellectual property and gaining a private replica to attack. | Adversarial ML & Model Integrity | High |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-165 | Model monoculture and herding Many organisations rely on the same few models, providers and data, so they make the same errors, react in the same way and fail at the same time. | Systemic & Societal | High |
| R-074 | Model weight theft Proprietary weights or fine-tuned adapters are copied from storage, a pipeline or a supplier, taking the intellectual property and enabling attacks to be developed offline. | Adversarial ML & Model Integrity | High |
| R-134 | No fallback for AI failure When an AI component fails or has to be withdrawn, no manual process, simpler model or degraded mode is ready to take over. | Operational Resilience | High |
| R-035 | No impact tolerance for AI-dependent services A service that depends on AI has no impact tolerance that covers AI-specific disruption, such as a model that is available and wrong. | Operational Resilience | High |
| R-164 | Non-consensual intimate imagery and child sexual abuse material generation A system is offered or used to generate intimate depictions of identifiable real people without their consent, or child sexual abuse material. | Prohibited & High-Risk Practices | Critical |
| R-062 | Over-privileged agent skills and tools Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse. | Agentic & Autonomous Systems | Medium |
| R-002 | Prompt injection Text supplied by a user, or contained in content the model retrieves or receives from a tool, is interpreted as an instruction and overrides the instructions the system was given. | Model & Application Security | High |
| R-064 | Retrieval corpus poisoning Content placed in a document store, website or other retrieved source is written to mislead the model, so that authoritative-looking answers carry an attacker's content. | Model & Application Security | High |
| R-003 | Sensitive information disclosure An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it. | Data Protection & Privacy | Critical |
| R-010 | System prompt leakage The instructions given to a model are extracted or inferred by a user, exposing configuration, restriction logic and anything sensitive that was placed in them. | Model & Application Security | Medium |
| R-011 | Unbounded resource consumption With no limit on the volume, size or cost of requests, a user or attacker drives inference far beyond what the system was sized or budgeted for, degrading service or running up charges. | Model & Application Security | Medium |
| R-053 | Unexpected code execution by agents An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems. | Agentic & Autonomous Systems | Critical |
| R-038 | Untested AI failure scenarios Scenario testing does not include AI-specific disruption, so the organisation does not know whether it could stay within tolerance if its AI failed. | Operational Resilience | Medium |
| R-012 | Vector and embedding weaknesses The store of embeddings behind a retrieval system lacks the access control, validation and separation applied to other data stores, so its contents can be read, inferred or altered. | Model & Application Security | Medium |
| R-039 | Vendor concentration and exit strategy gap The organisation depends on a single AI model or supplier for a critical function, with no tested exit plan and no alternative identified. | Third-Party & Supply Chain | High |