An AI risk taxonomy is a structured way to group and name risks associated with artificial intelligence. It gives people a shared vocabulary for identifying, comparing and discussing risks, while helping organisations see where their assessments may have gaps.

A taxonomy is a map, not a complete risk assessment. A category can point to a type of harm or a cause, but it cannot decide how likely the risk is in a specific use, how serious its impact would be or which control will work. Those questions depend on context: the system’s purpose, affected people, deployment environment, operating scale and the controls already in place.

The MIT AI Risk Repository

The AI Risk Repository is maintained by MIT FutureTech as a living reference of risks drawn from existing AI frameworks and classifications. Its database contains more than 1,700 categorised risks. Its Domain Taxonomy groups risks into seven domains and 24 subdomains, while a separate causal taxonomy helps describe how, when and why risks arise. The repository is licensed under Creative Commons Attribution 4.0 (CC BY 4.0), which permits reuse with appropriate attribution.

That breadth makes the repository useful for discovery and shared analysis. Teams can use it to compare their own risk registers with a wider set of published concerns, or to find language for an issue that is otherwise described inconsistently. It can also support research, audits and discussions across technical, policy and organisational roles.

Explore the MIT AI Risk Repository.

Using categories responsibly

Large inventories can create a false sense of completeness. A risk may fit several categories, and new uses or combinations of systems can create exposures that were not anticipated when a taxonomy was assembled. A team should therefore record the concrete scenario behind each selected item: what could happen, who or what might be affected, and under which conditions.

From there, the organisation can assess impact and likelihood, choose proportionate controls and identify an owner. Some risks need technical testing; others need changes to training, process design, human review or supplier arrangements. A taxonomy helps organise this work, but it should not replace local judgement or monitoring after deployment.

For an enterprise, the value lies in connecting classifications to decisions. A risk register that uses a common taxonomy can support reporting across teams, while retaining enough detail to reflect individual systems. Review the register when the purpose, model, data, user group or operating environment changes, and record any new risks that the current categories do not describe well.