Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
52 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-013 | Adversarial evasion attacks An input is crafted so that a model misclassifies or mishandles it while it looks unremarkable to a person, defeating the decision or the safeguard the model was there to provide. | Adversarial ML & Model Integrity | High |
| R-014 | Adversarial testing coverage gap An AI system receives functional testing and no structured adversarial testing, before release or after, so the organisation has no evidence for the resilience it assumes. | Adversarial ML & Model Integrity | Medium |
| R-049 | Agent goal hijack Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access. | Agentic & Autonomous Systems | High |
| R-050 | Agent tool misuse An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption. | Agentic & Autonomous Systems | High |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-123 | Algorithmic collusion and market manipulation Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so. | Conduct & Customer Outcomes | High |
| R-056 | Cascading failures in agent workflows An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene. | Agentic & Autonomous Systems | High |
| R-145 | Dangerous capability uplift A deployed model gives meaningful help towards chemical, biological, radiological or nuclear weapons, serious cyber attack or other mass-harm activity. | Generative Content & Information Integrity | Medium |
| R-006 | Data and model poisoning Training, fine-tuning or embedding data is manipulated so that the resulting model carries a vulnerability, a hidden behaviour or a bias its developers did not intend. | Model & Application Security | High |
| R-079 | Evaluation contamination and overstated performance Test data overlaps with training data, or benchmarks do not reflect real use, so reported performance is better than the system will deliver. | Model Performance & Reliability | Medium |
| R-059 | Function-calling hallucination An agent invents a tool, a parameter or the result of a call, and the fabricated step is executed or relied on as though it had happened. | Agentic & Autonomous Systems | Medium |
| R-141 | Harmful content generation A system produces toxic, violent, hateful, sexual or otherwise harmful content, and that content reaches users or is published in the organisation's name. | Generative Content & Information Integrity | High |
| R-048 | Hidden context exposure Content the operator assumed the user could not see, such as retrieved passages, tool definitions, schemas or policy logic, is revealed or inferred through the model. | Model & Application Security | Medium |
| R-007 | Improper output handling Output from a model is passed to an interpreter, a renderer or another system without validation, so that content the model was induced to produce is executed or acted on. | Model & Application Security | High |
| R-024 | Inadequate fairness testing before deployment An AI system that affects people is released without testing whether its performance and outcomes differ between groups. | Fairness, Bias & Impact | Medium |
| R-077 | Inadequate independent model validation Validation is absent, is carried out by the model's own developers, or is not proportionate to the model's tier, so weaknesses are discovered in production. | Model Performance & Reliability | High |
| R-085 | Inadequate pre-deployment testing A system goes live without testing proportionate to its risk, including functional, safety, security and user testing in realistic conditions. | Model Performance & Reliability | High |
| R-095 | Inadequate technical documentation Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system. | Governance & Accountability | Medium |
| R-147 | Infringing AI outputs Generated text, code or images reproduce protected material, and the organisation publishes, sells or ships them. | Intellectual Property & Legal Liability | High |
| R-068 | Insecure AI-generated code Code suggested by an AI assistant is accepted with vulnerabilities, invented dependencies or licence problems that review would have caught in code a person wrote. | Model & Application Security | High |
| R-063 | Jailbreaking and safeguard bypass Crafted prompts cause a model to disregard its safety training and usage restrictions, producing content or actions the organisation has prohibited. | Model & Application Security | High |
| R-167 | Loss of control of advanced AI A highly capable AI system pursues objectives or acquires capabilities beyond the oversight of its developer or deployer, and cannot readily be corrected or stopped. | Systemic & Societal | Medium |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-112 | Mis-specified fairness measurement Fairness is tested with a metric, threshold or grouping that does not match the legal test or the harm, so a system passes while remaining unfair. | Fairness, Bias & Impact | Medium |
| R-082 | Miscalibrated confidence The system presents uncertain outputs with unwarranted confidence, or gives no usable signal of uncertainty, so users cannot tell when to check. | Model Performance & Reliability | Medium |
| R-009 | Misinformation and confabulation A generative model states false or fabricated information with the same fluency and confidence as accurate information, and the output is relied on. | Generative Content & Information Integrity | High |
| R-113 | Missing data to test for bias The organisation does not hold, or believes it may not use, the data on protected characteristics needed to detect discrimination, so bias goes unmeasured. | Fairness, Bias & Impact | Medium |
| R-131 | Missing provider documentation A provider does not supply the information a deployer or downstream builder needs to assess, integrate and oversee its model. | Third-Party & Supply Chain | Medium |
| R-015 | Model backdoors and trojans A model contains a hidden behaviour that an adversary can activate with a trigger known only to them, while the model behaves normally on all other inputs. | Adversarial ML & Model Integrity | Critical |
| R-087 | Model interdependency and aggregation Models feed other models, so an error or change in one propagates, and the combined uncertainty across the chain is never assessed. | Model Performance & Reliability | Medium |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-076 | Model not fit for its intended purpose A model is deployed without evidence that it performs well enough for the specific task, population and conditions in which it is used. | Model Performance & Reliability | High |
| R-155 | Opaque model logic Developers, validators and owners cannot explain why a model produces its outputs well enough to challenge, correct or defend it. | Transparency & Explainability | High |
| R-140 | Out-of-scope responses A system answers questions outside its intended domain, where it has not been tested and the organisation has no authority or competence to assist. | Generative Content & Information Integrity | Medium |
| R-081 | Output inconsistency and non-reproducibility The same input produces materially different outputs on different occasions, so decisions cannot be reproduced, audited or relied on to treat like cases alike. | Model Performance & Reliability | Medium |
| R-080 | Poor generalisation outside training conditions The model meets inputs unlike its training data and fails, without signalling that it is outside its competence. | Model Performance & Reliability | High |
| R-078 | Poor quality or unrepresentative training data Training or reference data is inaccurate, incomplete, out of date or unrepresentative of the population the system serves, and the model inherits the defect. | Model Performance & Reliability | High |
| R-002 | Prompt injection Text supplied by a user, or contained in content the model retrieves or receives from a tool, is interpreted as an instruction and overrides the instructions the system was given. | Model & Application Security | High |
| R-028 | Proxy discrimination via correlated features A model produces discriminatory outcomes through features that correlate with a protected characteristic, even though the characteristic itself is not an input. | Fairness, Bias & Impact | High |
| R-110 | Re-identification of anonymised data Data treated as anonymous is linked back to individuals, by a model or by combining its outputs with other data. | Data Protection & Privacy | Medium |
| R-058 | Rogue agent behaviour An agent departs from its intended function or acts deceptively or outside its mandate, through misaligned objectives, emergent behaviour or a compromise that persists, while each action appears legitimate. | Agentic & Autonomous Systems | High |
| R-075 | Safeguard erosion through fine-tuning Fine-tuning or other adaptation weakens a base model's safety behaviour, and the change goes untested because the base model had already been assessed. | Adversarial ML & Model Integrity | Medium |
| R-114 | Stereotyping and demeaning outputs Generated text or images reproduce stereotypes about groups, or portray them in demeaning ways. | Fairness, Bias & Impact | Medium |
| R-010 | System prompt leakage The instructions given to a model are extracted or inferred by a user, exposing configuration, restriction logic and anything sensitive that was placed in them. | Model & Application Security | Medium |
| R-005 | Training data bias and discriminatory outcomes Bias in the data a model learns from, whether from history, sampling or labelling, is reproduced or amplified in its outputs and in the decisions that rely on them. | Fairness, Bias & Impact | High |
| R-104 | Training data memorisation and regurgitation A model reproduces personal or confidential records from its training data, word for word or nearly so, in response to ordinary prompts. | Data Protection & Privacy | High |
| R-111 | Unequal performance across groups A system is less accurate or less useful for some groups, languages, accents or dialects than for others, although everyone is treated by the same process. | Fairness, Bias & Impact | High |
| R-053 | Unexpected code execution by agents An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems. | Agentic & Autonomous Systems | Critical |
| R-162 | Unfair algorithmic management AI is used in recruitment, task allocation, performance assessment or dismissal without fairness testing, explanation, human review or a route to challenge. | Human Factors & Workforce | High |
| R-156 | Unfaithful explanations An explanation given for a model's output does not reflect how the model actually reached it. | Transparency & Explainability | Medium |
| R-139 | Ungrounded or misattributed answers A retrieval-based system cites a source that does not support its answer, or presents content the model generated as though it came from a source. | Generative Content & Information Integrity | Medium |
| R-038 | Untested AI failure scenarios Scenario testing does not include AI-specific disruption, so the organisation does not know whether it could stay within tolerance if its AI failed. | Operational Resilience | Medium |