AI Risk Taxonomy

The ways AI systems fail, organised so you can check for each one deliberately rather than hoping.

The six families

Family	What goes wrong	Who notices first
Accuracy	Output is confidently wrong	Usually nobody, for a while
Data	Information goes somewhere it should not	Often nobody
Bias	Systematic unfairness to a group	The affected group
Security	The system is manipulated	Nobody, by design
Dependency	Capability or access is lost	Everyone, at once
Accountability	No human owns the outcome	Only after harm

The pattern worth noticing: the failures with the worst consequences are the ones nobody notices.

1. Accuracy

Fabrication. Invented facts, citations, quotes, case law, statistics — delivered in the same confident register as correct output.

Plausible drift. A summary that subtly changes the meaning of the source.

Stale knowledge. Confident answers about a world that has moved on since training.

Arithmetic. Numbers predicted rather than computed.

Over-agreement. Folds when you push back, even when it was right.

Controls: verify every factual claim; quote the source rather than paraphrasing; execute code for arithmetic; ask "what would make this wrong"; never let AI be the sole source for anything consequential.

2. Data

Leakage. Confidential material pasted into a tool with weak terms.

Retention. Data stored longer than you assumed, or in a jurisdiction you did not expect.

Training. Your inputs improving a model others use.

Third-party exposure. Client data entered without their agreement — their contract, not just your policy.

Shared conversations. Publicly linkable transcripts, sometimes indexable.

Controls: data classification; approved tools per class; training disabled; anonymise before pasting; audit shared links; DPAs where personal data is involved.

3. Bias

Inherited bias. Reproducing patterns in the training data.

Amplification. A small skew becoming a large one at scale.

Evaluative bias. Systematically different treatment of equivalent inputs — CVs, applications, complaints.

Language and dialect penalty. Non-standard English scored as lower quality, including by AI-detection tools.

Controls: test with matched inputs that vary only the protected characteristic; never automate a decision about a person; measure outcomes by group where you lawfully can; keep the human decision documented.

4. Security

Prompt injection. Instructions hidden in content the AI reads. The most serious risk for anything with tools attached.

Indirect injection. The malicious content arrives through a document, email or web page the AI processes.

Data exfiltration. An agent persuaded to send information somewhere.

Tool abuse. An agent with write access made to act.

Over-permissioned integration. An assistant with access to everything because it was easier to set up.

Controls: treat all read content as untrusted; a human between reading and acting; least-privilege tool access; log every agent action; never put secrets in a prompt.

5. Dependency

Vendor. Price change, deprecation, shutdown, or terms you cannot accept.

Silent model change. Behaviour shifts under the same model name.

Skill atrophy. The team can no longer do the thing manually.

Single maintainer. One person understands the automation.

Controls: own the portable parts — prompts, documents, processes; pin model versions; document everything; re-test monthly; keep a manual fallback for anything critical.

6. Accountability

Diffusion. AI drafted it, someone forwarded it, nobody reviewed it.

Automation bias. Humans rubber-stamping because the machine said so.

No audit trail. Cannot reconstruct what happened or why.

Unclear ownership. No named person responsible for the system.

Controls: a named owner per system; the sender owns the output; log inputs and outputs; periodic sampling of automated decisions.

Your risk register

For each AI use in your organisation:

Use	Family	Likelihood	Impact	Control in place	Owner	Reviewed

The triage question

For anything you build:

If this runs wrong 100 times before anyone notices, what is the damage?

Answer	What it needs
Nothing, it is a suggestion	Ship it
Wasted time	Sampling review
An internal record is wrong	Logging and a correction process
A customer sees something wrong	Human before output
Money moves, or a person is affected	Human before output, second check, audit trail

The risks people underrate

Accuracy in the boring case. Everyone guards against a dramatic fabrication. Almost nobody catches a summary that quietly changed a number.

Prompt injection with tools. Still treated as theoretical by most teams building agents. It is not.

Skill atrophy. Invisible for a year, then very visible the first time the tool is unavailable.

Automation bias. The control you designed — a human reviewer — stops working because the human stops actually reviewing.