Risks.
Named risks, not vague hazards: each entry is a specific, recognised AI risk, with the controls that mitigate it, the clauses that cite it and the sources behind it. 169 risks across 16 categories.
Severity by category
A compact map of the whole register before you filter it.
| Category | critical | high | medium | low | Total |
|---|---|---|---|---|---|
| Governance & Accountability | – | 11 | 10 | – | 21 |
| Model Performance & Reliability | – | 7 | 6 | – | 13 |
| Data Protection & Privacy | 2 | 7 | 4 | – | 13 |
| Fairness, Bias & Impact | – | 4 | 5 | – | 9 |
| Conduct & Customer Outcomes | – | 8 | 4 | – | 12 |
| Transparency & Explainability | – | 2 | 4 | – | 6 |
| Human Factors & Workforce | – | 4 | 3 | – | 7 |
| Model & Application Security | – | 12 | 5 | – | 17 |
| Adversarial ML & Model Integrity | 1 | 4 | 3 | – | 8 |
| Agentic & Autonomous Systems | 1 | 10 | 4 | – | 15 |
| Generative Content & Information Integrity | 1 | 2 | 5 | – | 8 |
| Intellectual Property & Legal Liability | – | 5 | 3 | – | 8 |
| Third-Party & Supply Chain | – | 5 | 4 | – | 9 |
| Operational Resilience | – | 7 | 2 | – | 9 |
| Prohibited & High-Risk Practices | 8 | 1 | – | – | 9 |
| Systemic & Societal | – | 2 | 2 | 1 | 5 |
Browse by list, category or framework
120 of 169 risks shown.
| ID | Risk | Category | Severity |
|---|---|---|---|
| R-071 | Abuse of a deployed AI service Users turn the organisation's AI system to purposes it was never offered for, including generating harmful material, at the organisation's cost and in its name. | Model & Application Security | Medium |
| R-013 | Adversarial evasion attacks An input is crafted so that a model misclassifies or mishandles it while it looks unremarkable to a person, defeating the decision or the safeguard the model was there to provide. | Adversarial ML & Model Integrity | High |
| R-127 | Age-inappropriate AI interaction Children and young people reach AI features that were designed for adults, without safeguards suited to their age. | Conduct & Customer Outcomes | Medium |
| R-049 | Agent goal hijack Injected or poisoned content redirects an agent's objective or plan, so the agent pursues an attacker's goal with the organisation's authority and access. | Agentic & Autonomous Systems | High |
| R-051 | Agent identity and privilege abuse An agent inherits, shares or escalates credentials and delegated authority beyond what its task needs, so a compromise or error acts with far wider access than intended. | Agentic & Autonomous Systems | High |
| R-054 | Agent memory and context poisoning False or hostile content is written into an agent's persistent memory or shared context, so later sessions and other users inherit corrupted instructions or facts. | Agentic & Autonomous Systems | High |
| R-050 | Agent tool misuse An agent uses a tool it is permitted to use in an unsafe or unintended way, such as a destructive command or a wrong parameter, causing data loss, unauthorised transactions or disruption. | Agentic & Autonomous Systems | High |
| R-138 | AI capacity and cost overrun Usage, latency or spend exceeds what was planned, degrading the service or the budget, without any attacker being involved. | Operational Resilience | Medium |
| R-137 | AI incident response gap AI-specific failures are not covered by the incident process: they have no classification, no playbook and no trained responders. | Operational Resilience | High |
| R-030 | AI literacy gap in the deploying organisation Staff who use, rely on or make decisions about AI systems do not understand what those systems can and cannot do, so they misuse or over-trust them. | Human Factors & Workforce | Medium |
| R-031 | AI model drift and degradation A deployed model's performance declines as the world it operates in moves away from the data it was trained and validated on, with no change to the model itself. | Model Performance & Reliability | High |
| R-136 | AI monitoring and alerting gap A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident. | Operational Resilience | High |
| R-032 | AI not mapped to important business services AI components that an important business service relies on have not been identified in the resilience mapping, so their failure is not planned for. | Operational Resilience | High |
| R-133 | AI service outage An inference service, model endpoint or supporting platform becomes unavailable, and the business process that depends on it stops or queues. | Operational Resilience | High |
| R-021 | AI system lifecycle controls gap The organisation has no defined lifecycle for AI systems, so there is no consistent checkpoint at which a system is assessed, validated, approved, monitored or retired. | Governance & Accountability | Medium |
| R-166 | AI-accelerated cyber threat Advanced models lower the cost and skill needed to find and exploit vulnerabilities, so attacks become faster, more numerous and harder to distinguish from legitimate activity. | Systemic & Societal | High |
| R-070 | AI-enabled social engineering of staff Attackers use generated voice, video and text to impersonate executives, customers or suppliers convincingly enough to defeat staff verification. | Model & Application Security | High |
| R-123 | Algorithmic collusion and market manipulation Pricing or trading algorithms coordinate with competitors' algorithms or distort a market, without any human agreement to do so. | Conduct & Customer Outcomes | High |
| R-017 | Automated decision-making without safeguards AI is used to take significant decisions about individuals with no meaningful human involvement and without the safeguards UK data protection law requires. | Data Protection & Privacy | Critical |
| R-158 | Automation bias and over-reliance People accept AI outputs without the scrutiny they would give another source, and the system's errors pass into decisions unchallenged. | Human Factors & Workforce | High |
| R-056 | Cascading failures in agent workflows An error or compromise in one agent or step propagates through chained agents and automated workflows faster than people can notice or intervene. | Agentic & Autonomous Systems | High |
| R-150 | Confidential information disclosed to AI tools Trade secrets, legally privileged material or information held in confidence for others are entered into AI tools and leave the organisation's control. | Intellectual Property & Legal Liability | High |
| R-018 | Cross-border AI data transfer risk Personal data processed by an AI system, often through a cloud or model provider, is sent outside the UK without a valid transfer mechanism. | Data Protection & Privacy | Medium |
| R-069 | Cross-tenant and cross-session leakage Caches, memory, fine-tuned weights or shared context expose one user's or customer's data to another. | Model & Application Security | High |
| R-145 | Dangerous capability uplift A deployed model gives meaningful help towards chemical, biological, radiological or nuclear weapons, serious cyber attack or other mass-harm activity. | Generative Content & Information Integrity | Medium |
| R-142 | Deepfake impersonation and synthetic identity fraud Generated voice, image, video or documents are used to impersonate customers or to create false identities, defeating verification and authentication. | Generative Content & Information Integrity | Critical |
| R-151 | Defamation by AI output A system publishes a false statement about an identifiable person or organisation that damages their reputation. | Intellectual Property & Legal Liability | High |
| R-168 | Degraded information environment The growing volume of synthetic content lowers the reliability of the public and internal information that the organisation and its models depend on. | Systemic & Societal | Low |
| R-160 | Deskilling and loss of expertise Reliance on AI erodes the human expertise needed to check its output, to cover for it when it fails and to train the next generation. | Human Factors & Workforce | Medium |
| R-022 | Disparate impact monitoring gap Once an AI system is in use, nothing measures whether its outcomes differ between groups, so discrimination that emerges after launch goes undetected. | Fairness, Bias & Impact | High |
| R-125 | Emotional reliance on conversational AI Users form an attachment to, or dependence on, a conversational system in ways that harm their interests or can be exploited. | Conduct & Customer Outcomes | Medium |
| R-169 | Environmental footprint of AI The energy, water and hardware that training and running AI require conflict with the organisation's environmental commitments, or go unmeasured and undisclosed. | Systemic & Societal | Medium |
| R-001 | Excessive agency in autonomous agents An agent is given more functions, permissions or independence than its task requires, so an error, an ambiguous instruction or a manipulated input turns into a damaging action that no one approved. | Agentic & Autonomous Systems | High |
| R-108 | Excessive retention of prompts and logs Prompts, outputs and conversation histories that contain personal data are kept indefinitely by the organisation or its provider. | Data Protection & Privacy | Medium |
| R-115 | Exclusion and inaccessibility An AI-driven channel cannot be used effectively by disabled people, or by others the organisation has a duty to serve, and no equivalent alternative is available. | Fairness, Bias & Impact | Medium |
| R-065 | Exposed AI credentials and secrets API keys, tokens and connection secrets sit in prompts, agent configuration, notebooks or logs, where the model or an attacker can read and reuse them. | Model & Application Security | High |
| R-117 | Failure to recognise vulnerable customers An automated interaction does not detect or respond to signs of vulnerability that a trained person would notice and act on. | Conduct & Customer Outcomes | High |
| R-059 | Function-calling hallucination An agent invents a tool, a parameter or the result of a call, and the fabricated step is executed or relied on as though it had happened. | Agentic & Autonomous Systems | Medium |
| R-143 | Generative AI used for disinformation The organisation's generative systems, or its name and likeness, are used to produce and spread false information at scale. | Generative Content & Information Integrity | Medium |
| R-141 | Harmful content generation A system produces toxic, violent, hateful, sexual or otherwise harmful content, and that content reaches users or is published in the organisation's name. | Generative Content & Information Integrity | High |
| R-057 | Human-agent trust exploitation People approve an agent's request or accept its account of events because it is fluent and familiar, so the human check that was meant to stop a harmful action passes it instead. | Agentic & Autonomous Systems | Medium |
| R-135 | Inability to stop or roll back AI A misbehaving system cannot be disabled, reverted to a known good version, or have its actions reversed quickly enough to limit harm. | Operational Resilience | High |
| R-106 | Inaccurate personal data in outputs A generative model states false information about an identifiable person as though it were fact. | Data Protection & Privacy | High |
| R-023 | Inadequate AI resourcing and competence AI systems are adopted without the people, skills, tooling and budget needed to build, oversee and operate them safely. | Governance & Accountability | Medium |
| R-092 | Inadequate board oversight of AI The board and senior management lack the information, expertise or forum to challenge AI risk, and approve what they cannot evaluate. | Governance & Accountability | High |
| R-121 | Inadequate contestability and redress People affected by an AI-supported decision cannot challenge it, cannot have it reviewed by someone with the authority and information to change it, or cannot obtain a remedy. | Conduct & Customer Outcomes | High |
| R-034 | Inadequate explainability for affected individuals A person materially affected by an AI-supported decision is not given an explanation they can understand and use to challenge it. | Transparency & Explainability | High |
| R-088 | Incomplete AI inventory The organisation cannot list the AI systems and models it builds, buys or uses, so risk assessment, oversight and regulatory duties are applied to only part of what it has. | Governance & Accountability | High |
| R-159 | Ineffective human review A human review step exists and operates, but reviewers do not in practice detect or correct the system's errors. | Human Factors & Workforce | High |
| R-105 | Inference of sensitive attributes A system infers health, beliefs, sexual orientation or other special category information about a person from data that does not state it. | Data Protection & Privacy | High |
| R-147 | Infringing AI outputs Generated text, code or images reproduce protected material, and the organisation publishes, sells or ships them. | Intellectual Property & Legal Liability | High |
| R-055 | Insecure inter-agent communication Messages between agents are not authenticated, authorised or validated, so one compromised or spoofed agent can instruct the others. | Agentic & Autonomous Systems | Medium |
| R-161 | Intrusive AI monitoring of workers AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs. | Human Factors & Workforce | High |
| R-063 | Jailbreaking and safeguard bypass Crafted prompts cause a model to disregard its safety training and usage restrictions, producing content or actions the organisation has prohibited. | Model & Application Security | High |
| R-167 | Loss of control of advanced AI A highly capable AI system pursues objectives or acquires capabilities beyond the oversight of its developer or deployer, and cannot readily be corrected or stopped. | Systemic & Societal | Medium |
| R-124 | Manipulative AI-driven design Personalisation, timing and conversational technique steer customers towards choices that serve the organisation over them, without reaching the level the law prohibits. | Conduct & Customer Outcomes | Medium |
| R-072 | Membership and attribute inference Queries to a model reveal whether a particular person's record was in its training data, or reveal sensitive attributes about them. | Adversarial ML & Model Integrity | Medium |
| R-082 | Miscalibrated confidence The system presents uncertain outputs with unwarranted confidence, or gives no usable signal of uncertainty, so users cannot tell when to check. | Model Performance & Reliability | Medium |
| R-009 | Misinformation and confabulation A generative model states false or fabricated information with the same fluency and confidence as accurate information, and the output is relied on. | Generative Content & Information Integrity | High |
| R-118 | Misleading AI-generated communications Customer communications or promotions written by AI are unclear, inaccurate or unbalanced, or leave out information the customer needs or the rules require. | Conduct & Customer Outcomes | High |
| R-113 | Missing data to test for bias The organisation does not hold, or believes it may not use, the data on protected characteristics needed to detect discrimination, so bias goes unmeasured. | Fairness, Bias & Impact | Medium |
| R-154 | Missing information for deployers and users The people who operate or use a system have not been told its intended purpose, how well it performs, where it fails and what oversight it needs. | Transparency & Explainability | Medium |
| R-132 | Model deprecation and forced migration A provider withdraws a model version on its own timetable, forcing the organisation to migrate to a different model before it has tested the replacement. | Third-Party & Supply Chain | Medium |
| R-016 | Model extraction and inference-API abuse Systematic querying of a model through its normal interface lets an attacker build a functional copy, taking the intellectual property and gaining a private replica to attack. | Adversarial ML & Model Integrity | High |
| R-073 | Model inversion and training data extraction An attacker reconstructs training records, or close likenesses of them, from a model's outputs or its weights. | Adversarial ML & Model Integrity | High |
| R-165 | Model monoculture and herding Many organisations rely on the same few models, providers and data, so they make the same errors, react in the same way and fail at the same time. | Systemic & Societal | High |
| R-074 | Model weight theft Proprietary weights or fine-tuned adapters are copied from storage, a pipeline or a supplier, taking the intellectual property and enabling attacks to be developed offline. | Adversarial ML & Model Integrity | High |
| R-134 | No fallback for AI failure When an AI component fails or has to be withdrawn, no manual process, simpler model or degraded mode is ready to take over. | Operational Resilience | High |
| R-035 | No impact tolerance for AI-dependent services A service that depends on AI has no impact tolerance that covers AI-specific disruption, such as a model that is available and wrong. | Operational Resilience | High |
| R-126 | No route to a human A customer cannot reach a person when the automated channel fails them, or the route to one is hidden or obstructed. | Conduct & Customer Outcomes | Medium |
| R-164 | Non-consensual intimate imagery and child sexual abuse material generation A system is offered or used to generate intimate depictions of identifiable real people without their consent, or child sexual abuse material. | Prohibited & High-Risk Practices | Critical |
| R-155 | Opaque model logic Developers, validators and owners cannot explain why a model produces its outputs well enough to challenge, correct or defend it. | Transparency & Explainability | High |
| R-140 | Out-of-scope responses A system answers questions outside its intended domain, where it has not been tested and the organisation has no authority or competence to assist. | Generative Content & Information Integrity | Medium |
| R-081 | Output inconsistency and non-reproducibility The same input produces materially different outputs on different occasions, so decisions cannot be reproduced, audited or relied on to treat like cases alike. | Model Performance & Reliability | Medium |
| R-153 | Overstated AI claims The organisation misdescribes what its AI does, how well it performs or how it is governed, to customers, investors or regulators. | Intellectual Property & Legal Liability | Medium |
| R-103 | Personal data in prompts and context Users or integrations put personal data into prompts, uploads or retrieved context without a lawful basis or appropriate safeguards. | Data Protection & Privacy | High |
| R-116 | Poor customer outcomes from AI-driven journeys An AI-driven customer journey causes foreseeable harm to retail customers, or fails to support their understanding and needs, and outcome monitoring does not detect it. | Conduct & Customer Outcomes | High |
| R-080 | Poor generalisation outside training conditions The model meets inputs unlike its training data and fails, without signalling that it is outside its competence. | Model Performance & Reliability | High |
| R-097 | Post-market monitoring gap No plan exists to collect and act on evidence of how a system performs and what effects it has after release. | Governance & Accountability | Medium |
| R-002 | Prompt injection Text supplied by a user, or contained in content the model retrieves or receives from a tool, is interpreted as an instruction and overrides the instructions the system was given. | Model & Application Security | High |
| R-028 | Proxy discrimination via correlated features A model produces discriminatory outcomes through features that correlate with a protected characteristic, even though the characteristic itself is not an input. | Fairness, Bias & Impact | High |
| R-110 | Re-identification of anonymised data Data treated as anonymous is linked back to individuals, by a model or by combining its outputs with other data. | Data Protection & Privacy | Medium |
| R-096 | Record-keeping and logging failure The system does not automatically record the events needed to reconstruct what it did, or the logs are not retained for as long as they may be needed. | Governance & Accountability | High |
| R-064 | Retrieval corpus poisoning Content placed in a document store, website or other retrieved source is written to mislead the model, so that authoritative-looking answers carry an attacker's content. | Model & Application Security | High |
| R-058 | Rogue agent behaviour An agent departs from its intended function or acts deceptively or outside its mandate, through misaligned objectives, emergent behaviour or a compromise that persists, while each action appears legitimate. | Agentic & Autonomous Systems | High |
| R-083 | Self-reinforcing feedback loops A model's outputs shape the data it is later trained or evaluated on, entrenching early errors and narrowing outcomes over time. | Model Performance & Reliability | Medium |
| R-003 | Sensitive information disclosure An AI system reveals personal, confidential or commercially sensitive information in its output to someone who should not have it. | Data Protection & Privacy | Critical |
| R-098 | Serious incident reporting failure A reportable AI incident is not recognised, escalated or notified to the relevant authority within the time required. | Governance & Accountability | High |
| R-089 | Shadow AI use Staff use AI tools that have not been approved, placing organisational data and decisions outside any control. | Governance & Accountability | High |
| R-086 | Stale model knowledge A model answers from knowledge that ended at its training cut-off, on matters such as rates, rules or products that have since changed. | Model Performance & Reliability | Medium |
| R-114 | Stereotyping and demeaning outputs Generated text or images reproduce stereotypes about groups, or portray them in demeaning ways. | Fairness, Bias & Impact | Medium |
| R-036 | Sub-outsourcing visibility gap An AI supplier relies on its own suppliers for models, hosting, data or labelling, and the organisation has no visibility of that chain and no contractual hold over it. | Third-Party & Supply Chain | Medium |
| R-104 | Training data memorisation and regurgitation A model reproduces personal or confidential records from its training data, word for word or nearly so, in response to ordinary prompts. | Data Protection & Privacy | High |
| R-157 | Training data transparency gap The organisation cannot say what data a model was trained on, to the level regulators, customers or rights holders require. | Transparency & Explainability | Medium |
| R-128 | Unannounced upstream model change A provider updates, replaces or reconfigures a hosted model, and the organisation's system behaves differently without any change of its own. | Third-Party & Supply Chain | High |
| R-129 | Unassessed AI in third-party products A supplier switches on AI features inside a product already in use, bypassing the organisation's assessment and approval. | Third-Party & Supply Chain | High |
| R-061 | Unauthorised commitments by agents An agent makes a statement, offer or transaction that binds the organisation, without the authority a person in the same position would need. | Agentic & Autonomous Systems | High |
| R-011 | Unbounded resource consumption With no limit on the volume, size or cost of requests, a user or attacker drives inference far beyond what the system was sized or budgeted for, degrading service or running up charges. | Model & Application Security | Medium |
| R-149 | Uncertain ownership of AI-generated work The organisation cannot establish or protect rights in material created with AI, because protection depends on human authorship that it cannot show. | Intellectual Property & Legal Liability | Medium |
| R-029 | Unclear AI ownership and accountability No named individual is accountable for a given AI system, or for AI risk overall, so decisions about it are made by default and nobody answers for the result. | Governance & Accountability | Medium |
| R-037 | Undisclosed AI interaction A person deals with an AI system, by chat, voice or message, without being told that it is not a human. | Transparency & Explainability | Medium |
| R-111 | Unequal performance across groups A system is less accurate or less useful for some groups, languages, accents or dialects than for others, although everyone is treated by the same process. | Fairness, Bias & Impact | High |
| R-053 | Unexpected code execution by agents An agent generates and runs code or commands that were never reviewed, allowing injected instructions or model error to execute on the host or in connected systems. | Agentic & Autonomous Systems | Critical |
| R-162 | Unfair algorithmic management AI is used in recruitment, task allocation, performance assessment or dismissal without fairness testing, explanation, human review or a route to challenge. | Human Factors & Workforce | High |
| R-122 | Unfair personalised pricing AI-driven pricing or offers charge some customers more for reasons unrelated to cost or risk, by exploiting inertia, urgency or personal characteristics. | Conduct & Customer Outcomes | High |
| R-156 | Unfaithful explanations An explanation given for a model's output does not reflect how the model actually reached it. | Transparency & Explainability | Medium |
| R-107 | Unfulfillable data subject rights Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search. | Data Protection & Privacy | High |
| R-139 | Ungrounded or misattributed answers A retrieval-based system cites a source that does not support its answer, or presents content the model generated as though it came from a source. | Generative Content & Information Integrity | Medium |
| R-144 | Unmarked synthetic content AI-generated or manipulated content is released without machine-readable marking, or without disclosure to the audience, where the law requires it. | Generative Content & Information Integrity | Medium |
| R-119 | Unsuitable AI-generated advice or guidance A system gives personalised recommendations in a regulated domain without the suitability process, permissions or accuracy that advice requires. | Conduct & Customer Outcomes | High |
| R-038 | Untested AI failure scenarios Scenario testing does not include AI-specific disruption, so the organisation does not know whether it could stay within tolerance if its AI failed. | Operational Resilience | Medium |
| R-060 | Untraceable agent actions Actions taken by agents cannot be reconstructed or attributed to an instruction, a decision and an accountable person, so errors cannot be investigated and accountability fails. | Agentic & Autonomous Systems | High |
| R-101 | Untracked regulatory change New or amended AI obligations, including changed application dates, are not identified and translated into controls in time. | Governance & Accountability | Medium |
| R-084 | Use beyond validated scope A model approved for one purpose is reused for another, or for a new population, without reassessment. | Model Performance & Reliability | High |
| R-012 | Vector and embedding weaknesses The store of embeddings behind a retrieval system lacks the access control, validation and separation applied to other data stores, so its contents can be read, inferred or altered. | Model & Application Security | Medium |
| R-039 | Vendor concentration and exit strategy gap The organisation depends on a single AI model or supplier for a critical function, with no tested exit plan and no alternative identified. | Third-Party & Supply Chain | High |
| R-130 | Vendor reuse of organisation data A provider uses the organisation's prompts, documents or outputs to train or improve its own models, or keeps and reviews them, beyond what the organisation intended. | Third-Party & Supply Chain | High |
| R-093 | Weak independent assurance of AI Second-line review and internal audit do not cover AI with sufficient skill or frequency, so control failures persist undetected. | Governance & Accountability | Medium |
| R-047 | Workplace and education emotion recognition An AI system infers the emotions of people at work or in education, for a purpose other than medical or safety reasons. | Prohibited & High-Risk Practices | High |
| R-120 | Wrongful automated refusal A system incorrectly declines, blocks or withdraws a product, payment or claim, and the person affected has no effective way to have it corrected. | Conduct & Customer Outcomes | High |