Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
19 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-051 | Agent identity and privilege abuse An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended. | Agentic & Autonomous Systems | High |
| R-052 | Agentic supply chain compromise Tools, skills, connectors or sub-agents loaded at run time are malicious, tampered with or silently changed, giving an outside party a route into the agent's actions and data. | Agentic & Autonomous Systems | High |
| R-066 | AI development environment compromise Training pipelines, notebooks, registries and experiment tooling are less protected than production, giving an attacker a route to data, weights and the deployed model. | Model & Application Security | High |
| R-030 | AI literacy gap in the deploying organisation Staff who use, rely on or make decisions about AI systems do not understand what those systems can and cannot do, so they misuse or over-trust them. | Human Factors & Workforce | Medium |
| R-136 | AI monitoring and alerting gap A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident. | Operational Resilience | High |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-099 | Conformity assessment and registration failure A high-risk system is placed on the market or put into use without the required conformity assessment, declaration, marking or registration. | Governance & Accountability | High |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-115 | Exclusion and inaccessibility An AI-driven channel cannot be used effectively by disabled people, or by others the organisation has a duty to serve, and no equivalent alternative is available. | Fairness, Bias & Impact | Medium |
| R-065 | Exposed AI credentials and secrets API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them. | Model & Application Security | High |
| R-135 | Inability to stop or roll back AI A misbehaving system cannot be disabled, reverted to a known good version, or have its actions reversed quickly enough to limit harm. | Operational Resilience | High |
| R-085 | Inadequate pre-deployment testing A system goes live without testing proportionate to its risk, including functional, safety, security and user testing in realistic conditions. | Model Performance & Reliability | High |
| R-067 | Malicious model artefacts and unsafe loading A model file or dependency obtained from a public source executes code or carries hidden behaviour when loaded. | Model & Application Security | High |
| R-154 | Missing information for deployers and users The people who operate or use a system have not been told its intended purpose, how well it performs, where it fails and what oversight it needs. | Transparency & Explainability | Medium |
| R-015 | Model backdoors and trojans A model contains a hidden behaviour that an adversary can activate with a trigger known only to them, while the model behaves normally on all other inputs. | Adversarial ML & Model Integrity | Critical |
| R-016 | Model extraction and inference-API abuse Systematic querying of a model through its normal interface lets an attacker build a functional copy, taking the intellectual property and gaining a private replica to attack. | Adversarial ML & Model Integrity | High |
| R-074 | Model weight theft Proprietary weights or fine-tuned adapters are copied from storage, a pipeline or a supplier, taking the intellectual property and enabling attacks to be developed offline. | Adversarial ML & Model Integrity | High |
| R-062 | Over-privileged agent skills and tools Reusable skills and tool definitions request broader permissions than their function needs and run without isolation, enlarging the effect of any misuse. | Agentic & Autonomous Systems | Medium |
| R-153 | Overstated AI claims The organisation misdescribes what its AI does, how well it performs or how it is governed, to customers, investors or regulators. | Intellectual Property & Legal Liability | Medium |