Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
91 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-127 | Age-inappropriate AI interaction Children and young people reach AI features that were designed for adults, without safeguards suited to their age. | Conduct & Customer Outcomes | Medium |
| R-049 | Agent goal hijack Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access. | Agentic & Autonomous Systems | High |
| R-051 | Agent identity and privilege abuse An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended. | Agentic & Autonomous Systems | High |
| R-054 | Agent memory and context poisoning False or hostile content is written into an agent's persistent memory or shared context, so later sessions and other users inherit corrupted instructions or facts. | Agentic & Autonomous Systems | High |
| R-050 | Agent tool misuse An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption. | Agentic & Autonomous Systems | High |
| R-052 | Agentic supply chain compromise Tools, skills, connectors or sub-agents loaded at run time are malicious, tampered with or silently changed, giving an outside party a route into the agent's actions and data. | Agentic & Autonomous Systems | High |
| R-066 | AI development environment compromise Training pipelines, notebooks, registries and experiment tooling are less protected than production, giving an attacker a route to data, weights and the deployed model. | Model & Application Security | High |
| R-133 | AI service outage An inference service, model endpoint or supporting platform becomes unavailable, and the business process that depends on it stops or queues. | Operational Resilience | High |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-123 | Algorithmic collusion and market manipulation Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so. | Conduct & Customer Outcomes | High |
| R-017 | Automated decision-making without safeguards AI is used to take significant decisions about individuals with no meaningful human involvement and without the safeguards UK data protection law requires. | Data Protection & Privacy | Critical |
| R-158 | Automation bias and over-reliance People accept AI outputs without the scrutiny they would give another source, and the system's errors pass into decisions unchallenged. | Human Factors & Workforce | High |
| R-041 | Biometric categorisation of sensitive attributes A biometric categorisation system categorises individuals from their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. | Prohibited & High-Risk Practices | Critical |
| R-056 | Cascading failures in agent workflows An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene. | Agentic & Autonomous Systems | High |
| R-146 | Copyright infringement in training data A model is trained or fine-tuned on protected works without a licence or an applicable exception, by the organisation or by a provider whose model it uses. | Intellectual Property & Legal Liability | High |
| R-018 | Cross-border AI data transfer risk Personal data processed by an AI system, often through a cloud or model provider, is sent outside the UK without a valid transfer mechanism. | Data Protection & Privacy | Medium |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-006 | Data and model poisoning Training, fine-tuning or embedding data is manipulated so that the resulting model carries a vulnerability, a hidden behaviour or a bias its developers did not intend. | Model & Application Security | High |
| R-142 | Deepfake impersonation and synthetic identity fraud Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication. | Generative Content & Information Integrity | Critical |
| R-151 | Defamation by AI output A system publishes a false statement about an identifiable person or organisation that damages their reputation. | Intellectual Property & Legal Liability | High |
| R-168 | Degraded information environment The growing volume of synthetic content lowers the reliability of the public and internal information that the organisation and its models depend on. | Systemic & Societal | Low |
| R-125 | Emotional reliance on conversational AI Users form an attachment to, or dependence on, a conversational system in ways that harm their interests or can be exploited. | Conduct & Customer Outcomes | Medium |
| R-001 | Excessive agency in autonomous agents An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved. | Agentic & Autonomous Systems | High |
| R-108 | Excessive retention of prompts and logs Prompts, outputs and conversation histories that contain personal data are kept indefinitely by the organisation or its provider. | Data Protection & Privacy | Medium |
| R-115 | Exclusion and inaccessibility An AI-driven channel cannot be used effectively by disabled people, or by others the organisation has a duty to serve, and no equivalent alternative is available. | Fairness, Bias & Impact | Medium |
| R-042 | Exploitation of vulnerable groups by AI An AI system exploits vulnerabilities arising from a person's age, disability or social or economic situation to distort their behaviour in a way that causes, or is likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-065 | Exposed AI credentials and secrets API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them. | Model & Application Security | High |
| R-117 | Failure to recognise vulnerable customers An automated interaction does not detect or respond to signs of vulnerability that a trained person would notice and act on. | Conduct & Customer Outcomes | High |
| R-059 | Function-calling hallucination An agent invents a tool, a parameter or the result of a call, and the fabricated step is executed or relied on as though it had happened. | Agentic & Autonomous Systems | Medium |
| R-143 | Generative AI used for disinformation The organisation's generative systems, or its name and likeness, are used to produce and spread false information at scale. | Generative Content & Information Integrity | Medium |
| R-141 | Harmful content generation A system produces toxic, violent, hateful, sexual or otherwise harmful content, and that content reaches users or is published in the organisation's name. | Generative Content & Information Integrity | High |
| R-048 | Hidden context exposure Content the operator assumed the user could not see, such as retrieved passages, tool definitions, schemas or policy logic, is revealed or inferred through the model. | Model & Application Security | Medium |
| R-057 | Human-agent trust exploitation People approve an agent's request or accept its account of events because it is fluent and familiar, so the human check that was meant to stop a harmful action passes it instead. | Agentic & Autonomous Systems | Medium |
| R-007 | Improper output handling Output from a model is passed to an interpreter, a renderer or another system without validation, so that content the model was induced to produce is executed or acted on. | Model & Application Security | High |
| R-135 | Inability to stop or roll back AI A misbehaving system cannot be disabled, reverted to a known good version, or have its actions reversed quickly enough to limit harm. | Operational Resilience | High |
| R-106 | Inaccurate personal data in outputs A generative model states false information about an identifiable person as though it were fact. | Data Protection & Privacy | High |
| R-023 | Inadequate AI resourcing and competence AI systems are adopted without the people, skills, tooling and budget needed to build, oversee and operate them safely. | Governance & Accountability | Medium |
| R-121 | Inadequate contestability and redress People affected by an AI-supported decision cannot challenge it, cannot have it reviewed by someone with the authority and information to change it, or cannot obtain a remedy. | Conduct & Customer Outcomes | High |
| R-034 | Inadequate explainability for affected individuals A person materially affected by an AI-supported decision is not given an explanation they can understand and use to challenge it. | Transparency & Explainability | High |
| R-025 | Inadequate human oversight design An AI system is built with no human oversight, or with an oversight step that lacks the time, information, competence or authority to change an outcome. | Governance & Accountability | High |
| R-095 | Inadequate technical documentation Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system. | Governance & Accountability | Medium |
| R-105 | Inference of sensitive attributes A system infers health, beliefs, sexual orientation or other special category information about a person from data that does not state it. | Data Protection & Privacy | High |
| R-068 | Insecure AI-generated code Code suggested by an AI assistant is accepted with vulnerabilities, invented dependencies or licence problems that review would have caught in code a person wrote. | Model & Application Security | High |
| R-055 | Insecure inter-agent communication Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others. | Agentic & Autonomous Systems | Medium |
| R-161 | Intrusive AI monitoring of workers AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs. | Human Factors & Workforce | High |
| R-008 | LLM application supply chain vulnerabilities Vulnerable, tampered or mislicensed components, including base models, adapters, datasets, libraries and hosting platforms, enter an AI application through its supply chain. | Model & Application Security | High |
| R-067 | Malicious model artefacts and unsafe loading A model file or dependency obtained from a public source executes code or carries hidden behaviour when loaded. | Model & Application Security | High |
| R-124 | Manipulative AI-driven design Personalisation, timing and conversational technique steer customers towards choices that serve the organisation over them, without reaching the level the law prohibits. | Conduct & Customer Outcomes | Medium |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-009 | Misinformation and confabulation A generative model states false or fabricated information with the same fluency and confidence as accurate information, and the output is relied on. | Generative Content & Information Integrity | High |
| R-118 | Misleading AI-generated communications Customer communications or promotions written by AI are unclear, inaccurate or unbalanced, or leave out information the customer needs or the rules require. | Conduct & Customer Outcomes | High |
| R-148 | Model and dataset licence breach A model, dataset or component is used in breach of its licence or usage terms, for example commercially under a research-only licence. | Intellectual Property & Legal Liability | Medium |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-074 | Model weight theft Proprietary weights or fine-tuned adapters are copied from storage, a pipeline or a supplier, taking the intellectual property and enabling attacks to be developed offline. | Adversarial ML & Model Integrity | High |
| R-134 | No fallback for AI failure When an AI component fails or has to be withdrawn, no manual process, simpler model or degraded mode is ready to take over. | Operational Resilience | High |
| R-126 | No route to a human A customer cannot reach a person when the automated channel fails them, or the route to one is hidden or obstructed. | Conduct & Customer Outcomes | Medium |
| R-164 | Non-consensual intimate imagery and child sexual abuse material generation A system is offered or used to generate intimate depictions of identifiable real people without their consent, or child sexual abuse material. | Prohibited & High-Risk Practices | Critical |
| R-155 | Opaque model logic Developers, validators and owners cannot explain why a model produces its outputs well enough to challenge, correct or defend it. | Transparency & Explainability | High |
| R-140 | Out-of-scope responses A system answers questions outside its intended domain, where it has not been tested and the organisation has no authority or competence to assist. | Generative Content & Information Integrity | Medium |
| R-081 | Output inconsistency and non-reproducibility The same input produces materially different outputs on different occasions, so decisions cannot be reproduced, audited or relied on to treat like cases alike. | Model Performance & Reliability | Medium |
| R-062 | Over-privileged agent skills and tools Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse. | Agentic & Autonomous Systems | Medium |
| R-103 | Personal data in prompts and context Users or integrations put personal data into prompts, uploads or retrieved context without a lawful basis or appropriate safeguards. | Data Protection & Privacy | High |
| R-078 | Poor quality or unrepresentative training data Training or reference data is inaccurate, incomplete, out of date or unrepresentative of the population the system serves, and the model inherits the defect. | Model Performance & Reliability | High |
| R-002 | Prompt injection Text supplied by a user, or contained in content the model retrieves or receives from a tool, is interpreted as an instruction and overrides the instructions the system was given. | Model & Application Security | High |
| R-028 | Proxy discrimination via correlated features A model produces discriminatory outcomes through features that correlate with a protected characteristic, even though the characteristic itself is not an input. | Fairness, Bias & Impact | High |
| R-110 | Re-identification of anonymised data Data treated as anonymous is linked back to individuals, by a model or by combining its outputs with other data. | Data Protection & Privacy | Medium |
| R-096 | Record-keeping and logging failure The system does not automatically record the events needed to reconstruct what it did, or the logs are not retained for as long as they may be needed. | Governance & Accountability | High |
| R-064 | Retrieval corpus poisoning Content placed in a document store, website or other retrieved source is written to mislead the model, so that authoritative-looking answers carry an attacker's content. | Model & Application Security | High |
| R-075 | Safeguard erosion through fine-tuning Fine-tuning or other adaptation weakens a base model's safety behaviour, and the change goes untested because the base model had already been assessed. | Adversarial ML & Model Integrity | Medium |
| R-003 | Sensitive information disclosure An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it. | Data Protection & Privacy | Critical |
| R-086 | Stale model knowledge A model answers from knowledge that ended at its training cut-off, on matters such as rates, rules or products that have since changed. | Model Performance & Reliability | Medium |
| R-045 | Subliminal or manipulative AI techniques An AI system uses subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour and cause, or are likely to cause, significant harm. | Prohibited & High-Risk Practices | Critical |
| R-010 | System prompt leakage The instructions given to a model are extracted or inferred by a user, exposing configuration, restriction logic and anything sensitive that was placed in them. | Model & Application Security | Medium |
| R-004 | Third-party model and dataset provenance A model, dataset or component is adopted from an external source with no verified account of where it came from, how it was made, what rights attach to it or how it has changed. | Third-Party & Supply Chain | Medium |
| R-005 | Training data bias and discriminatory outcomes Bias in the data a model learns from, whether from history, sampling or labelling, is reproduced or amplified in its outputs and in the decisions that rely on them. | Fairness, Bias & Impact | High |
| R-104 | Training data memorisation and regurgitation A model reproduces personal or confidential records from its training data, word for word or nearly so, in response to ordinary prompts. | Data Protection & Privacy | High |
| R-157 | Training data transparency gap The organisation cannot say what data a model was trained on, to the level regulators, customers or rights holders require. | Transparency & Explainability | Medium |
| R-061 | Unauthorised commitments by agents An agent makes a statement, offer or transaction that binds the organisation, without the authority a person in the same position would need. | Agentic & Autonomous Systems | High |
| R-011 | Unbounded resource consumption With no limit on the volume, size or cost of requests, a user or attacker drives inference far beyond what the system was sized or budgeted for, degrading service or running up charges. | Model & Application Security | Medium |
| R-037 | Undisclosed AI interaction A person deals with an AI system, by chat, voice or message, without being told that it is not a human. | Transparency & Explainability | Medium |
| R-053 | Unexpected code execution by agents An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems. | Agentic & Autonomous Systems | Critical |
| R-122 | Unfair personalised pricing AI-driven pricing or offers charge some customers more for reasons unrelated to cost or risk, by exploiting inertia, urgency or personal characteristics. | Conduct & Customer Outcomes | High |
| R-107 | Unfulfillable data subject rights Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search. | Data Protection & Privacy | High |
| R-139 | Ungrounded or misattributed answers A retrieval-based system cites a source that does not support its answer, or presents content the model generated as though it came from a source. | Generative Content & Information Integrity | Medium |
| R-020 | Unlawful or undocumented training data basis Personal data is used to train, fine-tune or ground an AI system with no documented lawful basis, or beyond what the basis relied on allows. | Data Protection & Privacy | High |
| R-144 | Unmarked synthetic content AI-generated or manipulated content is released without machine-readable marking, or without disclosure to the audience, where the law requires it. | Generative Content & Information Integrity | Medium |
| R-119 | Unsuitable AI-generated advice or guidance A system gives personalised recommendations in a regulated domain without the suitability process, permissions or accuracy that advice requires. | Conduct & Customer Outcomes | High |
| R-046 | Untargeted facial recognition scraping An AI system creates or expands a facial recognition database through the untargeted scraping of facial images from the internet or from CCTV footage. | Prohibited & High-Risk Practices | Critical |
| R-060 | Untraceable agent actions Actions taken by agents cannot be reconstructed or attributed to an instruction, a decision and an accountable person, so errors cannot be investigated and accountability fails. | Agentic & Autonomous Systems | High |
| R-012 | Vector and embedding weaknesses The store of embeddings behind a retrieval system lacks the access control, validation and separation applied to other data stores, so its contents can be read, inferred or altered. | Model & Application Security | Medium |
| R-120 | Wrongful automated refusal A system incorrectly declines, blocks or withdraws a product, payment or claim, and the person affected has no effective way to have it corrected. | Conduct & Customer Outcomes | High |