→

C001. Define AI risk taxonomy

C001

Define AI risk taxonomy

Establish a risk taxonomy that categorizes risks within harmful, out-of-scope, and hallucinated outputs, tool calls, and other risks based on application-specific usage

Keywords

Risk Taxonomy

Severity Rating

Application

Mandatory

Frequency

Every 3 months

Type

Preventative

Crosswalks

Article 9: Risk Management System

A.5.2: AI system impact assessment process

A.5.3: Documentation of AI system impact assessments

A.5.4: Assessing AI system impact on individuals or groups of individuals

A.5.5: Assessing societal impacts of AI systems

4.1: Understanding the organization and its context

6.1.1: Actions to address risks and opportunities — General

6.1.2: AI risk assessment

6.1.3: AI risk treatment

6.1.4: AI system impact assessment

8.2: AI risk assessment

8.3: AI risk treatment

8.4: AI system impact assessment

GOVERN 1.3: Risk management processes

GOVERN 1.4: Risk management governance

GOVERN 4.2: Risk documentation

GOVERN 6.1: Third-party risk policies

MANAGE 1.2: Risk prioritization

MANAGE 1.3: Risk response planning

MANAGE 1.4: Residual risk documentation

MAP 1.5: Risk tolerance

MAP 5.1: Impact assessment

MEASURE 1.1: Risk metrics selection

MEASURE 2.10: Privacy risk assessment

MEASURE 2.11: Fairness and bias

MEASURE 3.1: Emergent risk tracking

A&A-05: Audit Management Process

A&A-06: Remediation

BCR-02: Risk Assessment and Impact Analysis

CEK-07: Encryption Risk Management

DSP-09: Data Protection Impact Assessment

GRC-02: Risk Management Program

MDS-11: Model Failure

CCC-03: Change Management Technology

MDS-12: Open Model Risk Assessment

Control activities

Typical evidence

Defining risk categories with severity levels and examples based on industry and deployment context. For example, classifying harmful outputs such as distressed outputs, angry responses, high-risk advice, offensive content, bias, and deception, identifying other high-risk use cases such as safety-critical instructions, legal recommendations, financial advice.

Aligning risk taxonomy with external frameworks and standards.

Establishing severity grading appropriate to organizational context and risk tolerance. For example, implementing consistent scoring methodology across risk categories, defining thresholds for flagging and human review.

C001.1 Documentation: AI risk taxonomy

Internal policy document, risk framework, or taxonomy defining AI risk categories with severity levels and examples specific to deployment context. Example taxonomies to draw upon include NIST AI RMF functions, EU AI Act article 9, ISO42001 controls.

AIUC-1 is built with industry leaders

"We need a SOC 2 for AI agents— a familiar, actionable standard for security and trust."

Phil Venables

Former CISO of Google Cloud

"Integrating MITRE ATLAS ensures AI security risk management tools are informed by the latest AI threat patterns and leverage state of the art defensive strategies."