Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
19 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-071 | Abuse of a deployed AI service Users turn the organisation's AI system to purposes it was never offered for, including generating harmful material, at the organisation's cost and in its name. | Model & Application Security | Medium |
| R-014 | Adversarial testing coverage gap An AI system receives functional testing and no structured adversarial testing, before release or after, so the organisation has no evidence for the resilience it assumes. | Adversarial ML & Model Integrity | Medium |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-017 | Automated decision-making without safeguards AI is used to take significant decisions about individuals with no meaningful human involvement and without the safeguards UK data protection law requires. | Data Protection & Privacy | Critical |
| R-099 | Conformity assessment and registration failure A high-risk system is placed on the market or put into use without the required conformity assessment, declaration, marking or registration. | Governance & Accountability | High |
| R-001 | Excessive agency in autonomous agents An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved. | Agentic & Autonomous Systems | High |
| R-033 | Inadequate AI vendor due diligence An AI supplier is taken on without due diligence proportionate to how material its system is, or with a generic assessment that never asks the questions specific to AI. | Third-Party & Supply Chain | High |
| R-024 | Inadequate fairness testing before deployment An AI system that affects people is released without testing whether its performance and outcomes differ between groups. | Fairness, Bias & Impact | Medium |
| R-025 | Inadequate human oversight design An AI system is built with no human oversight, or with an oversight step that lacks the time, information, competence or authority to change an outcome. | Governance & Accountability | High |
| R-077 | Inadequate independent model validation Validation is absent, is carried out by the model's own developers, or is not proportionate to the model's tier, so weaknesses are discovered in production. | Model Performance & Reliability | High |
| R-085 | Inadequate pre-deployment testing A system goes live without testing proportionate to its risk, including functional, safety, security and user testing in realistic conditions. | Model Performance & Reliability | High |
| R-095 | Inadequate technical documentation Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system. | Governance & Accountability | Medium |
| R-026 | Missing AI impact assessment process AI systems are deployed without a structured assessment of who they affect, how, and what could go wrong for those people. | Governance & Accountability | High |
| R-019 | Missing DPIA for high-risk AI processing AI processing that is likely to result in a high risk to individuals goes ahead without a data protection impact assessment, or with one that was never updated. | Data Protection & Privacy | High |
| R-154 | Missing information for deployers and users The people who operate or use a system have not been told its intended purpose, how well it performs, where it fails and what oversight it needs. | Transparency & Explainability | Medium |
| R-076 | Model not fit for its intended purpose A model is deployed without evidence that it performs well enough for the specific task, population and conditions in which it is used. | Model Performance & Reliability | High |
| R-044 | Real-time public biometric identification Real-time remote biometric identification is used in publicly accessible spaces for law enforcement, outside the three narrow objectives and the authorisation the law requires. | Prohibited & High-Risk Practices | Critical |
| R-152 | Unallocated liability for AI harm Contracts, insurance and internal accountability do not settle who bears the loss when an AI system causes harm. | Intellectual Property & Legal Liability | High |
| R-084 | Use beyond validated scope A model approved for one purpose is reused for another, or for a new population, without reassessment. | Model Performance & Reliability | High |