The AI Risk Atlas is IBM's comprehensive taxonomy of risks associated with ML models, GenAI, and AI Agents. It has been mapped to broader industry standards and regulatory requirements, including the NIST AI RMF, OWASP Top 10 for LLMs and more. The AI Risk Atlas provides organizations a structured approach to identifying and evaluating AI risks and suggests controls to help mitigate those risks.

In addition, IBM’s AI governance solution, watsonx.governance, has been recognized as market leaders in AI Governance and GRC by several analyst firms. This success builds on a strong tradition of open-source work by IBM Research, which has developed a number of differentiating product features accessible to organizations navigating agentic AI adoption. The AI Risk Atlas, for example, is integrated directly into watsonx.governance, enabling organizations to link identified risks to specific AI use cases and models, and track mitigations through the Governance Console.

From risk identification to risk mitigation with AIUC-1

With today’s announcement that AIUC-1 is now integrated into the IBM Research AI Risk Atlas, organizations adopting AI agents have a clear path to move from AI risk identification to certifiable, agent-specific controls.

The integration comes to life in the publicly accessible AI Risk Atlas Nexus, where organizations can describe an agentic use case - such as deploying a knowledge base chatbot or building an agent to handle refund workflows - and then receive an overview of top agentic risks and recommended controls for the use case in seconds.

With the integration of AIUC-1, organizations now get a list of controls that mitigate the risks identified directly - also in seconds. In other words, users can rapidly evaluate different use cases, adjust capabilities such as tool access or level of autonomy, and see how the risk landscape and control requirements change.

Deeper integration with IBM watsonx.governance underway

The collaboration highlighted several additional areas where AIUC-1 and IBM can work together to strengthen secure, safe, and reliable AI agent adoption - with several initiatives already on the way:

• AIUC-1 available out-of-the-box in watsonx.governance: By integrating the standard into IBM’s governance suite, organizations have the full, comprehensive control library available at their fingertips
• Using AIUC-1 for deploying internal agents: By combining rapid risk assessment with rapid control identification, organizations can build approval workflows for AI agents in seconds. A more powerful agent (e.g. with tool access, increased autonomy, or expanded data access) will require additional guardrails, which can be identified and implemented using AIUC-1 before deployment. High risk use cases may require full AIUC-1 certification, which includes technical testing that safeguards hold up under pressure
• Using AIUC-1 for AI vendor assessment: Organizations adopting AI agents built by third-parties can use the same workflow to adopt agents securely - for low-risk use-cases, they can demand proof from vendors that core AIUC-1 controls are implemented. For medium/high risk use cases, they can demand to see the vendors full AIUC-1 Certification

The teams intend to share updates as these features become available to IBM customers and the public.

Get started today

The AIUC-1 and AI Risk Atlas integration is available as a part of AIUC-1 crosswalks, and accessible for exploration on the AI Risk Atlas Nexus (HuggingFace) and AI Risk Atlas Nexus (Github). As part of this collaboration, IBM Research is recognized as a Technical Contributor to AIUC-1.