AI risk taxonomy
Nine categories and 42 sub-categories, drawn so that every AI risk has one primary home and every category lines up with the function that owns its controls.
The MIT AI Risk Repository is organised by harm to the world, the EU AI Act by obligation and ISO/IEC 42001 Annex C by organisational objective. None of the three is a taxonomy an organisation can run a register on. The categories below place every risk in those sources, with its secondary links recorded on the register line: a cause in one category, a failure in another and a harm in a third is normal.
The taxonomy has three levels. Level 1 is the enterprise view, Level 2 is where identification happens, and Level 3 is the register itself, an open list of specific risks. Every register line also carries three tags: the lifecycle stage, the role exposed (provider, deployer or both) and who is harmed.
AI risk categories and the EU AI Act's risk levels
Searches for AI risk categories often mean the EU AI Act's levels, which classify AI systems, not risks. The Act prohibits some practices (Article 5), sets requirements for high-risk systems (Article 6 with Annexes I and III), sets transparency duties for systems such as chatbots and generators of synthetic content (Article 50), and leaves other systems largely free of obligations. General-purpose AI models have their own rules. Classifying a system tells you which duties apply. It does not tell you what can go wrong, which is what the nine categories below are for. Classification is recorded once per system in the inventory, and risks are recorded per line in the register.
| Sub-category | ISO/IEC 42001 | EU AI Act | MIT domains | Register lines |
|---|---|---|---|---|
| Data (DAT), 8 lines | ||||
| 1.1 Training, validation and test data quality and representativeness | C.2.3, C.3.4, A.7.2–A.7.4 | Art 10 | 7.3, 1.3 | DAT-01, DAT-02 |
| 1.2 Data provenance, rights and lawful basis for training data | A.7.3, A.7.5 | Art 10, GDPR Art 5–6 | 2.1 | DAT-03, DAT-04 |
| 1.3 Run-time input data: drift, quality, missing fields, manipulation | A.7.4, A.6.2.6 | Art 26(4) | 7.3 | DAT-05, DAT-06 |
| 1.4 Data retention, minimisation and access within the AI system | A.7.2, A.7.6 | GDPR Art 5(1)(c),(e) | 2.1 | DAT-07, DAT-08 |
| Model and performance (MOD), 14 lines | ||||
| 2.1 Accuracy, error and fabrication (hallucination) | C.2.8, A.6.2.4 | Art 15 | 7.3, 3.1 | MOD-01, MOD-02 |
| 2.2 Robustness, generalisation and edge cases | C.2.8, C.3.1 | Art 15 | 7.3 | MOD-03, MOD-04 |
| 2.3 Drift and degradation over time, including vendor model changes | C.3.7, A.6.2.6 | Art 9(2)(c), 72 | 7.3 | MOD-05, MOD-06 |
| 2.4 Evaluation and validation gaps: no metrics, no thresholds, wrong benchmark | A.6.2.4 | Art 9(6)–(8) | 7.3 | MOD-07, MOD-08, MOD-13 |
| 2.5 Technology readiness and capability limits (including agentic autonomy) | C.3.7, C.3.3 | Art 14 | 7.1, 7.2, 7.6 | MOD-09, MOD-10, MOD-11, MOD-12, MOD-14 |
| Fairness and discrimination (FAI), 7 lines | ||||
| 3.1 Biased outcomes against protected groups | C.2.5 | Art 10(2)(f), 27 | 1.1 | FAI-01, FAI-02, FAI-03 |
| 3.2 Unequal performance across groups | C.2.5 | Art 10, 15 | 1.3 | FAI-04 |
| 3.3 Proxy discrimination and feedback loops | C.2.5 | Art 5(1)(c) social scoring | 1.1 | FAI-05 |
| 3.4 Toxic, offensive or demeaning content | C.2.5 | Art 50 | 1.2 | FAI-06, FAI-07 |
| Transparency, explainability and accountability (TRA), 8 lines | ||||
| 4.1 Opacity to affected persons: no notice, no explanation, no contest | C.2.11, C.3.2, A.8.2 | Art 13, 26(11), 50, 86; GDPR 22 | 7.4 | TRA-01, TRA-02 |
| 4.2 Opacity to the organisation: black box, vendor opacity, undocumented system | C.3.2, A.6.2.7, A.10.3 | Art 13, 25 | 7.4 | TRA-03, TRA-04 |
| 4.3 Accountability gaps: no owner, unclear roles, decisions without a responsible person | C.2.1, A.3.2, A.10.2 | Art 26(2), 25; GDPR Art 5(2) | 6.5 | TRA-05, TRA-06 |
| 4.4 Records, logging and audit-trail gaps | A.6.2.8, A.5.3 | Art 12, 26(6), 19 | 6.5 | TRA-07, TRA-08 |
| Human oversight and use (HUM), 9 lines | ||||
| 5.1 Automation bias and over-reliance | C.3.3 | Art 14(4)(b), 26(2) | 5.1 | HUM-01, HUM-02 |
| 5.2 Use outside the intended purpose; reasonably foreseeable misuse | A.9.4, A.6.2.5 | Art 9(2)(b), 26(1), 25 | 5.1, 4.x | HUM-03, HUM-04, HUM-09 |
| 5.3 Operator competence and deskilling | 7.2, A.4.6 | Art 4, 26(2) | 5.2, 6.3 | HUM-05, HUM-06 |
| 5.4 Oversight design: no override, alert fatigue, rubber-stamping | A.9.3 | Art 14 | 5.1 | HUM-07 |
| 5.5 Loss of agency, manipulation and emotional dependence of users | C.2.5 | Art 5(1)(a),(b), 50 | 5.2 | HUM-08 |
| Security and adversarial (SEC), 11 lines | ||||
| 6.1 Prompt injection and jailbreak | C.2.10 | Art 15(5) | 2.2 | SEC-01, SEC-02, SEC-11 |
| 6.2 Data and model poisoning | C.2.10, C.3.4 | Art 15(5) | 2.2 | SEC-03, SEC-04 |
| 6.3 Model theft, extraction, membership and attribute inference | C.2.10 | Art 15(5) | 2.1, 2.2 | SEC-05, SEC-06 |
| 6.4 Insecure output handling and excessive agency (tools, actions, agents) | C.2.10, C.3.3 | Art 14, 15 | 2.2, 7.6 | SEC-07, SEC-08 |
| 6.5 AI supply chain and classic information security | A.10.3 | Art 15, NIS2 | 2.2 | SEC-09, SEC-10 |
| Privacy, legal and regulatory (LEG), 13 lines | ||||
| 7.1 Personal data leakage, memorisation and sensitive inference | C.2.7 | GDPR Art 5, 9, 32 | 2.1 | LEG-01, LEG-02 |
| 7.2 Unlawful processing: no basis, purpose creep, no DPIA, special categories | C.2.7 | GDPR Art 6, 9, 35; AI Act 26(9) | 2.1 | LEG-03, LEG-04, LEG-13 |
| 7.3 Intellectual property and confidentiality | C.2.7 | Art 53(1)(c) GPAI | 6.3 | LEG-05, LEG-06 |
| 7.4 AI Act and sector non-compliance: misclassification, prohibited practice, transparency, registration, dates | 4.1 NOTE 2 | Art 5, 6(4), 26, 27, 49, 50, 99 | 6.5 | LEG-07, LEG-08, LEG-09, LEG-10 |
| 7.5 Liability and contractual exposure | A.10.2, A.10.4 | Product Liability Directive 2024/2853 | 6.5 | LEG-11, LEG-12 |
| Third party, operations and lifecycle (OPS), 11 lines | ||||
| 8.1 Vendor dependence and concentration | A.10.3 | Art 25, DORA Art 28 | 6.4 | OPS-01, OPS-02 |
| 8.2 Service availability, latency, cost and capacity | C.3.5, A.4.5 | Art 15 | 7.3 | OPS-03, OPS-04 |
| 8.3 Change management: updates, re-training, re-deployment without re-assessment | 6.3, 8.1, C.3.6 | Art 9(2), 25(1)(b), 43(4) | 7.3 | OPS-05, OPS-06 |
| 8.4 Shadow AI and uninventoried use | 4.3, A.4.2 | Art 4, 26 | 6.5 | OPS-07, OPS-08 |
| 8.5 Maintainability, decommissioning and hardware | C.2.6, C.3.5, C.3.6 | — | 7.3 | OPS-09, OPS-10, OPS-11 |
| Societal, environmental and strategic (SOC), 10 lines | ||||
| 9.1 Misinformation and synthetic content at scale | C.2.11 | Art 50(2),(4) | 3.1, 3.2, 4.1 | SOC-01, SOC-02 |
| 9.2 Environmental impact | C.2.4 | Art 95 (codes) | 6.6 | SOC-03 |
| 9.3 Workforce, skills and labour effects | 7.2 | Art 26(7) | 6.2, 6.3 | SOC-04, SOC-05, SOC-09, SOC-10 |
| 9.4 Strategic over- and under-investment, competitive dynamics | 4.1 | — | 6.1, 6.4 | SOC-06, SOC-07 |
| 9.5 Reputational and trust harm from the use of AI itself | C.2.11 | — | 6.5 | SOC-08 |
Questions about the taxonomy
What types of AI risk are there?
The taxonomy has nine: data; model and performance; fairness and discrimination; transparency, explainability and accountability; human oversight and use; security and adversarial; privacy, legal and regulatory; third party, operations and lifecycle; and societal, environmental and strategic.
What is the difference between a risk taxonomy and a risk register?
A taxonomy is the fixed set of categories. A register is the list of specific risks, each placed in one category. The taxonomy makes sure no area is left out and that each risk has an owner. The register records the risks themselves.
Does it cover agentic AI?
Yes. Sub-category 2.5 covers capability limits, including agentic autonomy, and the register has lines for agents that act beyond their mandate, for interacting agents and for excessive agency.
ISO/IEC 42001 references are Annex C objectives and risk sources (C.x) and Annex A controls (A.x). MIT domains are the sub-domains of the MIT AI Risk Repository, version of 3 December 2025. The full mapping, including NIST AI RMF, NIST AI 600-1 and OWASP, is in Chapter 4 and Appendix C of the book.