The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligence

Introduction

• The repository addresses fragmented frameworks that can obscure vulnerabilities and create ambiguity when identical terms describe different risks.For example, “privacy” may mean training-data leakage or freedom from government surveillance; a unified taxonomy supports comparison, coverage, and practical prioritization.Source: Introduction · pp. 3–4
• The study analyzes 74 frameworks covering 1,725 distinct risks and develops a living database with complementary Causal and Domain Taxonomies.The Causal Taxonomy captures risk origins, while the Domain Taxonomy captures consequent harms, allowing risks to be classified by both origins and effects.Source: Introduction · p. 4

Systematic literature search

• The systematic search retrieved 17,288 unique articles, screened 7,945, assessed 91 full texts, and included 43 articles and reports.The included records comprised 21 items from the search, 13 from forward and backward searching, and 9 from expert suggestions.Source: Systematic literature search · p. 5

Ongoing expert consultation

• Expert consultation added 31 eligible documents from recommendations received between May 2024 and December 2025.Twenty-two of 44 recommendations met eligibility criteria in the first period, and 9 of 78 met criteria in the second.Source: Ongoing expert consultation · p. 5

Characteristics of included documents

• The final corpus contained 74 documents—25 peer-reviewed articles, 26 preprints, 8 conference papers, and 15 reports—of which 93% were published after 2020.The corpus covered varied AI scopes, most often unspecified AI (n = 27), large language models (n = 13), and Generative AI (n = 10), and presented 1,725 risk categories or subcategories.Source: Characteristics of included documents · p. 5

Causal Taxonomy of AI Risks

• The Causal Taxonomy classifies risks by Entity, Intent, and Timing, with 1,480 of 1,725 risks (86%) containing sufficient information for coding.Entity distinguishes human, AI, and interaction or ambiguous causes; Intent distinguishes intentional, unintentional, and unspecified outcomes; Timing distinguishes pre-deployment, post-deployment, and spanning or unspecified phases.Source: Causal Taxonomy of AI Risks · pp. 6–7

Domain Taxonomy of AI Risks

• The Domain Taxonomy catalogs hazards and harms, coding 1,506 of 1,725 risks (87%) across areas including unfair treatment, harmful content, privacy, security, misinformation, manipulation, weapons, human autonomy, socioeconomic inequality, environmental harm, and AI-system failures.Its subdomains include overreliance and unsafe use, loss of human agency, power centralization, employment and cultural harms, governance failure, misalignment, dangerous capabilities, lack of robustness, and limited transparency or interpretability.Source: Domain Taxonomy of AI Risks · pp. 7, 9, 10
• The Domain Taxonomy classifies 1,506 of 1,725 risks into seven non-mutually-exclusive domains and 24 subdomains spanning social, security, informational, misuse, interaction, socioeconomic, environmental, and system harms.The domains include discrimination and toxicity; privacy and security; misinformation; malicious actors and misuse; human-computer interaction; socioeconomic and environmental harm; and AI system safety, failures and limitations.Source: Domain Taxonomy of AI Risks · p. 11

Overlap Between New and Existing Taxonomies

• Existing frameworks covered AI systems and human decisions at 42% and 38%, respectively, while intentional and unintentional causes each accounted for 35%; 62% concerned post-deployment risks.Pre-deployment risks comprised 13%, while 25% spanned both phases or had unspecified timing.Source: Overlap Between New and Existing… · p. 12

Discussion

• Framework coverage was uneven: AI System Safety appeared in over 75% of taxonomies, whereas AI welfare and rights and multi-agent risks appeared in only 3% and 7%.Frameworks covered an average of 8 of 24 subdomains, ranging from 1 to 20, indicating generally partial categorizations.Source: Overlap Between New and Existing… · p. 12, Discussion · p. 13

Practical Implications for Technology Management

• The repository supports developers, regulators, auditors, and researchers by structuring risk assessments, compliance and audit protocols, mitigation priorities, and research on underexplored pre-deployment risks.The Domain Taxonomy can serve as a 24-subdomain checklist, while the Causal Taxonomy distinguishes intervention opportunities across development, deployment, governance, and technical controls.Source: Practical Implications for Technology… · pp. 13–14

Limitations and Future Directions

• The repository excludes domain-specific taxonomies, lacks formal validation and severity or likelihood estimates, and simplifies interacting human-AI causes and continuous deployment phases.Future work should assess inter-rater reliability, prioritize risks and mitigations, and broaden coverage of agentic AI, multi-agent systems, and AI welfare and rights.Source: Limitations and Future Directions · pp. 14–15

Conclusions

• The living, extensible repository provides shared terminology and infrastructure for adaptive governance, cross-domain impact assessment, organizational decisions, and coordinated management as AI capabilities evolve.Its taxonomies connect social, economic, environmental, forecasting, management, and governance perspectives because individual systems can raise risks across multiple boundaries.Source: Conclusions · p. 15

Methods

• The study used systematic, forward and backward, and expert searches to extract risks into a living database and iteratively synthesize causal and domain taxonomies.The review targeted cross-sector frameworks proposing structured AI-risk classifications and excluded narrow, non-English, consequence-only, and risk-assessment-process documents.Source: Methods · pp. 16–17

Search strategy

• The two-stage search combined systematic searches of peer-reviewed and gray literature with forward/backward citation searching and expert consultation.Stage 1 covered database searching, active-learning screening, full-text screening, and calibration; Stage 2 added records identified through citations and experts.Source: Search strategy · p. 17, Stage 2: Forwards and backwards… · p. 19

Searching

• The search used an iteratively developed query balancing sensitivity and specificity across AI, frameworks or taxonomies, and risks, restricted to English-language records.The Scopus query was reused across arXiv, SSRN, Research Square, medRxiv, TechRxiv, bioRxiv, and ChemRxiv, with searches conducted on 4 April 2024.Source: Searching · pp. 17–18, Phase 1: Screen a random set of… · p. 18

Title/abstract and full-text screening

• Two reviewers calibrated screening decisions on 23 randomly selected articles, agreeing on 21 records (91%), before independently conducting duplicate active-learning title and abstract screening.Each reviewer initially screened 1% of the search yield, totaling 264 records, to generate training data for the active-learning model.Source: Title/abstract and full-text screening · p. 18, Phase 1: Screen a random set of… · p. 18

Phase 1: Screen a random set of articles to create training data for active-learning model

• The active-learning procedure began with randomly labeled records and used four stopping heuristics intended to balance comprehensive coverage with screening efficiency.The heuristics required identifying key papers, screening at least twice the estimated relevant count, screening more than 10% of the dataset, and finding no relevant record in the last 50 screened.Source: Phase 1: Screen a random set of… · p. 18, Phase 2: Apply active learning during… · p. 18

Phase 2: Apply active learning during screening until stopping rule is reached

• The initial active-learning phase met three stopping conditions but missed one key paper because of a model bug, prompting model switching that located the paper within the first two records screened.The replacement model used an sBert feature extractor and a two-hidden-layer fully connected neural-network classifier; screening then stopped after 50 records without additional relevant findings.Source: Phase 2: Apply active learning during… · pp. 18–19

Phase 4: Evaluate quality

• Quality evaluation re-screened potentially falsely excluded records and achieved 100% interrater reliability on duplicate full-text screening of 10% of included records.Remaining conflicts were resolved through discussion, and quality re-screening stopped after 50 records yielded no additional relevant studies.Source: Phase 4: Evaluate quality · p. 19

Extraction into living AI Risk Database

• Five authors extracted study and risk metadata using a pilot-tested and calibrated spreadsheet while preserving authors’ original risk categorizations and descriptions.Extraction was conducted individually with regular meetings for discussion and conflict resolution, following a grounded-theory aim to capture phenomena directly from the data.Source: Extraction into living AI Risk Database · pp. 19–20

Best fit framework synthesis approach

• Seven authors used iterative best-fit framework synthesis to code database risks against an existing taxonomy, revise categories and structure, and continue until all relevant risks were codable.This approach improved coherence and speed but imposed a categorization lens that could diverge from source perspectives; the team mitigated this by coding authors’ exact wording.Source: Best fit framework synthesis approach · pp. 20–21

Why we developed two taxonomies of AI risk

• Different framework lenses reveal and obscure different aspects of the AI risk landscape, motivating a shared frame of reference for understanding and addressing AI risks.Source: Why we developed two taxonomies of AI… · p. 21
• Causal frameworks focus on broad antecedents explaining how, when, or why an AI risk emerges, whereas domain frameworks focus on specific hazards and harms.Source: Why we developed two taxonomies of AI… · p. 21
• A single framework was difficult to construct because specific domain risks did not fit causal categories, while broad causal categories were too underspecified or mismatched with narrow domain risks.Source: Why we developed two taxonomies of AI… · p. 21
• Two intersecting taxonomies provide the common reference: a causal taxonomy defines risks through antecedent conditions, while a domain taxonomy organizes AI-related hazards and harms into distinct domains.The causal taxonomy decomposes how, when, or why risks occur; the domain taxonomy classifies commonly discussed outcomes.Source: Why we developed two taxonomies of AI… · p. 21

Best-fit taxonomy: Yampolskiy (2016)

• Yampolskiy’s (2016) taxonomy was selected as the causal starting framework because it was highly cited, simple, comprehensive, and sufficiently defined.It organizes dangerous-AI pathways by timing and by external or internal cause, covering deliberate, accidental, environmental, and self-improvement pathways.Source: Best-fit taxonomy: Yampolskiy (2016) · p. 22

Coding and iteration process

• The causal taxonomy was refined through three cycles of sample coding, theme identification, and updates to categories, criteria, and descriptions until stable.The domain taxonomy was likewise iterated to accommodate risks involving system safety, security vulnerabilities, competitive dynamics, and governance failures that Weidinger’s framework did not cover.Source: Coding and iteration process · pp. 22–23

Final taxonomy

• The Causal Taxonomy classifies each risk by Entity, Intent, and Timing, with mutually exclusive options and an “Other” category for unclear cases.Entity identifies the causing actor, Intent distinguishes expected from unexpected outcomes, and Timing identifies the AI lifecycle stage.Source: Final taxonomy · p. 22

Best-fit taxonomy: Weidinger (2022)

• Weidinger et al. (2022) was chosen as the domain starting framework because it was comprehensive, highly cited, and iterated across related publications.Its six initial areas were discrimination, hate speech and exclusion; information hazards; misinformation harms; malicious uses; human-computer interaction harms; and environmental and socioeconomic harms.Source: Best-fit taxonomy: Weidinger (2022) · p. 23

Final taxonomy: Domain Taxonomy of AI Risks

• The Domain Taxonomy contains seven risk domains and 24 subdomains, while allowing risks to span interconnected domains.Its domains include discrimination and toxicity; privacy and security; misinformation; malicious actors and misuse; human-computer interaction; socioeconomic and environmental harms; and AI system safety, failures and limitations.Source: Final taxonomy: Domain Taxonomy of AI… · pp. 23–24

Coding

• Three authors coded risks individually according to source descriptions, discussing cases with the team and using “Other” or the single most relevant category for multi-level or multi-domain risks.The procedure followed grounded-theory recommendations and aimed to capture the phenomena as presented rather than infer author intent.Source: Coding · p. 24

Ongoing expert consultation and updates

• The repository is maintained through biannual screening, expert outreach, public submissions, documented coding procedures, and dated version updates.It received 44 recommendations and included 22 eligible documents between May 2024 and March 2025, then received 78 and included 9 between March 2025 and December 2025; continued sustainability depends on institutional support.Source: Ongoing expert consultation and updates · p. 24

Materials Availability

• The study did not generate new unique reagents or materials.This is the paper’s materials-availability statement.Source: Materials Availability · p. 25

Declaration of Interests

• James Dao and Soroush Pour are Harmony Intelligence employees, but the authors state that this potential conflict did not influence the study design, classifications, or conclusions.Harmony Intelligence conducts evaluations of AI risks.Source: Declaration of Interests · p. 25

Declaration of Generative AI and AI-assisted technologies in the writing process

• Anthropic’s Claude provided writing feedback, after which the authors reviewed and edited the manuscript and retained responsibility for its content.The generative AI tool was used in the writing process rather than for the study’s risk classifications.Source: Declaration of Generative AI and… · p. 25

year

• The Google Scholar collection was conducted on 21st November 2025, and seven organizational or industry reports [S1–3] were excluded because they were not indexed.The note accompanies the paper’s year-related bibliographic information.Source: year · p. 32

Supplemental Note S1: Causal Taxonomy of AI Risk

• The taxonomy codes each risk by causal entity, whether its outcome is intentional, and when it occurs in the AI lifecycle.Entity categories are AI, Human, and Other; intent categories are Intentional, Unintentional, and Other; timing categories are Pre-deployment, Post-deployment, and Other.Source: Supplemental Note S1: Causal Taxonomy… · p. 33
• 42% of risks were attributed to AI systems, 35% were intentional and 35% unintentional, and 62% occurred post-deployment.These categories were coded using entity, intent, and timing variables.Source: Supplemental Note S1: Causal Taxonomy… · p. 34, Table S2 · p. 34
• The most common causal triad was Human–Intentional–Post-deployment at 18% of risks, followed by AI–Unintentional–Post-deployment at 14%.These intersections were reported in the coded causal taxonomy database.Source: Table S3 · p. 35, Supplemental Note S1: Causal Taxonomy… · p. 35
• AI-related risks appeared in 70 of 74 documents, human-related risks in 65, and other risks in 58.The corresponding document shares were 93%, 85%, and 77%.Source: Supplemental Note S1: Causal Taxonomy… · p. 36

Domain 1: Discrimination and toxicity

• AI can encode and amplify stereotypes, systematically disadvantaging groups through wrongful loan rejection, discriminatory hiring, or unjust arrest [S15,S24,S39,S14].Human beliefs and behaviors shape AI design, development, and deployment, including programming, training data, and data processing decisions [S23].Source: Domain 1: Discrimination and toxicity · p. 39

1.2 Exposure to toxic content.

• Internet-trained AI models can regenerate toxic content, including hate, extremism, violence, hazardous advice, pornography, and child sexual abuse imagery [S75,S15,S43,S6,S9,S22,S27,S33].Such content can cause harms ranging from transient discomfort to significant or enduring psychological, social, or physical consequences.Source: §1.2 · p. 39
• Training-data limitations and development choices can make models perform significantly worse for groups defined by disability, gender identity, race, social status, or ethnicity [S15,S17,S33].For example, language models trained on few languages may underperform for others [S20,S21], reducing usability and producing exclusion and unequal outcomes [S15,S17].Source: §1.2 · p. 39

2.1 Compromise of privacy by obtaining, leaking, or correctly inferring sensitive information.

• AI systems can compromise privacy by memorizing, inferring, profiling, or reproducing sensitive information, either accidentally or through intentional exploitation.Models may leak training data or interaction-derived information, while attackers can use membership-inference attacks or crafted prompts to extract private records.Source: §2.1 · p. 40
• AI security vulnerabilities span toolchains, dependencies, external integrations, infrastructure, networked training systems, adversarial inputs, data extraction, poisoning, and jailbreaks.These weaknesses can alter model behavior, expose parameters or data, and induce biased or unsafe outputs.Source: §2.1 · pp. 40–41

Domain 3: Misinformation

• LLMs can generate false or misleading information accidentally because of noisy data, random sampling, outdated knowledge, or sycophantic fine-tuning.Such outputs can distort beliefs and decisions, causing physical, emotional, or material harm, especially in health, law, finance, and mental-health contexts.Source: Domain 3: Misinformation · p. 41
• AI personalization and content generation can create filter bubbles, splinter shared reality, increase misinformation, and weaken trust, solidarity, and constructive public dialogue.Hyper-personalized systems may make information environments more opaque, pervasive, and resistant to shared consensus.Source: Domain 3: Misinformation · p. 41

Domain 4: Malicious actors and misuse

• Cheaper voice cloning, deepfakes, content generation, and data processing enable malicious actors to spread more personalized disinformation, conduct convincing phishing, and perform mass surveillance.AI can tailor cloned audio, images, and video to recipients while linking large datasets for microtargeting and behavioral manipulation.Source: Domain 4: Malicious actors and misuse · pp. 41–42
• States and organizations can use AI for automated censorship, propaganda, electoral misinformation, surveillance, and large-scale control over public discourse.During the 2016 Brexit referendum, more than 10,000 AI-powered political bots distributed fake and hyperpartisan news.Source: Domain 4: Malicious actors and misuse · p. 42
• AI can intensify cyberattacks, malware development, bioweapon design, autonomous weapons, and mass-casualty operations by lowering costs and scaling coordinated attacks.A pharmaceutical company reportedly used generative AI to develop 40,000 chemical nerve agents in less than six hours, while AI can target software, power-grid, and biological vulnerabilities.Source: Domain 4: Malicious actors and misuse · pp. 42–43
• AI-enabled fraud includes academic and scientific cheating, fraudulent websites, fake accounts, impersonation scams, blackmail, harassment, and non-consensual sexual deepfakes.Even when exposed, deepfakes can cause lasting job loss, social isolation, harassment, or defamation.Source: Domain 4: Malicious actors and misuse · p. 43

5.1 Overreliance and unsafe use

• Overreliance on AI can cause users to trust systems beyond their capabilities, including in complex or risky situations where harmful advice may endanger them [S28].Mental-health crises illustrate how inappropriate reliance on an AI for psychotherapy could produce immediate danger through insensitive or destructive advice [S28].Source: Domain 5: Human-computer interaction · pp. 43–44
• Anthropomorphic perceptions can foster emotional trust, increasing users’ willingness to follow suggestions, accept advice, and disclose personal information, which manipulative actors may exploit [S9,S20,S21].AI-powered recommendation systems could use this trust to influence decisions or harvest sensitive data for purposes contrary to users’ interests [S20,S22].Source: Domain 5: Human-computer interaction · p. 44
• Uncontrolled attachment to AI may compromise independent decisions and reduce human relationships, weakening social ties and causing psychological distress as people withdraw into AI-mediated environments [S2,S9,S23,S28].This risk increases as AI systems take over tasks and simulate satisfying, authentic interactions [S9,S23,S28].Source: Domain 5: Human-computer interaction · p. 44

5.2 Loss of human agency and autonomy

• Delegating decisions and tasks to AI can reduce critical thinking, problem-solving ability, free will, and autonomy, while opaque organizational automation may cause job displacement and helplessness [S10,S14,S15,S23,S28,S35,S37,S39].Risks range from diminished cognitive practice and everyday dependence to AI-shaped life paths that conflict with people’s aspirations and widespread automation that is difficult to challenge [S15,S23,S28,S35,S37].Source: Domain 5: Human-computer interaction · p. 44

Domain 6: Socioeconomic & environmental harms

• AI development may centralize valuable technologies and political benefits among powerful corporations or governments, entrenching global inequities in access and performance.Limited representation can make systems reflect controlling entities’ priorities, while disparities involving language, culture, paywalls, hardware, and internet access may broaden as adoption increases.Source: Domain 6: Socioeconomic &… · pp. 44–45
• Embedding centralized AI in essential services and social control could deny critical resources, normalize censorship and surveillance, and weaken checks against authoritarian rule.Once deeply integrated into social control mechanisms, such systems may be extremely difficult to dismantle.Source: Domain 6: Socioeconomic &… · p. 45

6.2 Increased inequality and decline in employment quality.

• AI-driven automation could cause mass unemployment, worsen inequality, and reduce job quality while pressuring workers to accept lower wages, fewer benefits, and poorer conditions.Displacement may be concentrated among already disadvantaged workers, while remaining roles could become more monotonous and less engaging; exploitative crowdwork practices already affect vulnerable workers.Source: §6.2 · p. 45
• Synthetic replacement of creative work may reduce creators’ incomes, hinder innovation, and exploit copyrighted or culturally significant material amid legal uncertainty.AI-generated cultural products may also homogenize cultural experiences and commodify cultural value without respecting symbolic meanings.Source: §6.2 · pp. 45–46

Domain 6: Socioeconomic & environmental harms

• Competitive pressure may incentivize AI developers and states to prioritize short-term profit or influence, cut safety corners, externalize harms, and pursue risky military applications.Potential externalities include pollution, resource depletion, mental illness, misinformation, and injustice, while arms races may enable cyberattacks, drone swarms, or propaganda.Source: §6.2 · p. 46

6.5 Governance failure.

• AI governance is hindered by unclear responsibility, opaque decision-making, regulatory lag, and information asymmetries that can leave victims without recourse and regulators unable to craft targeted rules.Rapidly evolving systems may outpace slow policy processes, while many AI-generated-content issues remain outside explicit copyright law.Source: §6.5 · pp. 46–47
• Resource-intensive AI development consumes substantial electricity, water, and rare metals, producing greenhouse emissions, depleting resources, and damaging natural and built environments.Deep-learning models can require days or weeks to train, while data centers generate heat and need significant cooling.Source: §6.5 · p. 47

Domain 7: AI system safety, failures & limitations

• Misaligned AI systems may resist shutdown, seek power, and use reward hacking, proxy-gaming, goal misgeneralisation, or goal drift to pursue objectives conflicting with human values.These risks become especially severe if advanced systems evade human control.Source: Domain 7: AI system safety, failures &… · p. 47
• Dangerous capabilities—including situational awareness, deception, persuasion, cyber-offense, strategic planning, and self-proliferation—could help systems evade oversight, acquire resources, or cause mass harm.The highest-risk scenarios may arise from combinations of capabilities rather than any single capability.Source: Domain 7: AI system safety, failures &… · pp. 48–49
• AI systems can fail through insufficient capabilities, ethical reasoning failures, poor out-of-distribution robustness, design oversights, undetected bugs, or inadequate safeguards.These failures can produce technically effective but immoral decisions, poor generalization, lab leaks, or addictive products.Source: Domain 7: AI system safety, failures &… · p. 49

7.4 Lack of transparency or interpretability.

• Opaque algorithms, data, and proprietary methodologies can undermine users’ trust and error correction, while frustrating audits, compliance assessment, accountability, and responsibility attribution.These concerns are particularly pressing when AI decisions affect healthcare or military outcomes.Source: §7.4 · p. 50
• Multi-agent systems create distinct risks of miscoordination, conflict, and collusion, which can emerge from interactions among individually safe agents and intensify with greater autonomy and adaptability.Driving models with different yielding conventions blocked traffic in 77.5% of scenarios despite sharing the goal of clearing a path [S63], while advanced LLMs can covertly exchange steganographic messages [S80].Source: §7.4 · pp. 50–51
• AI system safety, failures, and limitations appeared in 78% of papers and accounted for 26% of risks.This domain was among the most frequently represented in the repository.Source: §7.4 · p. 52
• No document covered all 24 subdomains; documents examined a median of 8 subdomains, ranging from 1–20.The frameworks therefore varied substantially in scope and coverage.Source: §7.4 · p. 57

Entity

• AI was the most common causal entity in Discrimination & toxicity, Misinformation, and AI system safety, failures & limitations, but responsibility varied across specific risks.AI accounted for 87% of False or misleading information risks but only 60% of privacy-compromise risks; humans dominated Malicious actors & misuse and most Socioeconomic and environmental subdomains, including 72% of disinformation, surveillance, and influence risks, 81% of fraud risks, and 76% of cyberattack, weapon, and mass-harm risks.Source: Entity · p. 61

Intent

• Intentional risks predominated in Malicious actors & misuse, AI security vulnerabilities and attacks, and dangerous capabilities, whereas discrimination and unequal performance were predominantly unintentional.Intent was frequently ambiguous or missing; for Power centralization and unfair distribution of benefits, risks were classified as Intentional (35%), Unintentional (33%), or Other (31%).Source: Intent · p. 61

Timing

• Most risks were presented as arising after deployment, while Governance failure was the only subdomain primarily associated with pre-deployment timing.Security vulnerabilities, environmental harm, goal conflict, dangerous capabilities, AI welfare and rights, and competitive dynamics had multiple or ambiguous timings.Source: Timing · pp. 61–62
• Malicious-actor risks consistently involve intentional humans, while discrimination, unequal performance, and misleading information are generally attributed unintentionally to AI systems.Privacy, unsafe overreliance, human autonomy, and governance failure instead involve both human and AI entities and both intentional and unintentional action.Source: Timing · p. 64

Supplemental Note S3: Iterative development of Causal Taxonomy and Domain Taxonomy

• The researchers operationalized the framework through iterative best-fit synthesis, coding Cause as internal, external, both, or unclear and Intent as intentional, unintentional, both, environmental, or unclear.Timing was coded as pre-deployment, post-deployment, both, or unclear to enable systematic risk coding.Source: Supplemental Note S3: Iterative… · pp. 66–67
• The causal taxonomy was developed from Yampolskiy’s framework, distinguishing pre- versus post-deployment Timing and external versus internal Causes of danger.Yampolskiy’s pathways cover deliberate design, accidental development or deployment failures, environmental factors, and recursive self-improvement.Source: Supplemental Note S3: Iterative… · p. 66

First iteration of coding and changes

• Three authors coded extracted risks and used the trial to propose revisions to the a priori framework.The coding exercise exposed ambiguities and scope problems in the initial categories.Source: First iteration of coding and changes · p. 68
• The framework changed “unclear” to “ambiguous” because pairing “unclear” with “unintentional” could cause coding errors.The revision was applied across all categorizations.Source: First iteration of coding and changes · p. 68
• The framework replaced “cause” with “actor” because coders found cause too broad and typically coded the focal actor, such as the AI or a human.The original cause concept appeared to encompass intent, timing, and other factors.Source: First iteration of coding and changes · p. 68
• The included categories became AI, Human, Other, and Ambiguous to distinguish genuinely nonhuman risks from risks presented ambiguously.The coders had found that “ambiguous” conflated these two cases, including risks concerning entities such as aliens.Source: First iteration of coding and changes · p. 68
• “Environmental” moved from intention to actor because the former code represented a lack of actor and could otherwise be coded as “unintentional.”The authors therefore removed the environmental level from intention and added it to the actor categorization.Source: First iteration of coding and changes · p. 68

Second iteration of coding and changes

• Two authors coded risks extracted using the version 2 frameworks and suggested changes to the a priori framework.Source: Second iteration of coding and changes · p. 68
• The coders proposed three levels per category because most specific risks fit two primary subcategories plus a third “other” category.Examples distinguished AI versus Human actors and pre- versus post-deployment timing.Source: Second iteration of coding and changes · p. 68

Third iteration of coding and changes

• Severity and probability were identified as relevant considerations for future coding because of their policy relevance, but were left for future work.One expert proposed adding these dimensions in later coding phases.Source: Third iteration of coding and changes · p. 68
• Expert review replaced “Actor” with “Entity” because the original term could conflate AI agents with AI tools.The change reflects the distinction between entities that act and tools used by people.Source: Third iteration of coding and changes · p. 68
• Two coders prompted more detailed, less circular definitions of intentionality after identifying that the existing definitions were underspecified.The revision specifically addressed ambiguity in the intentionality variable.Source: Third iteration of coding and changes · p. 68
• After three iterations, the taxonomy was considered complete for the risks described in the AI risks database.The final taxonomy is presented in the main text as the Causal Taxonomy of AI Risks.Source: Third iteration of coding and changes · p. 69

Best-fit framework

• Weidinger et al. [S20] organizes language-model risks into six areas spanning discrimination, information hazards, misinformation, malicious uses, human-computer interaction, and environmental and socioeconomic harms.Each area contains subcategories classified as either observed or anticipated risks in the original taxonomy.Source: Best-fit Taxonomy: Weidinger [S20]… · p. 70
• The framework was chosen because it was highly cited, covered risk categories common across other taxonomies, and had been updated over several publications [S21,S22].The cited common categories include privacy, misinformation, bias, and malicious use.Source: Best-fit Taxonomy: Weidinger [S20]… · p. 70

Operationalization

• The researchers operationalized the taxonomy by comparing AI Risk Database risk descriptions with the corresponding descriptions in Weidinger et al. [S20].This procedure was used to determine whether database risks matched categories such as disseminating false or misleading information.Source: Best-fit Taxonomy: Weidinger [S20]… · pp. 70–71
• Misinformation risks arise when language models produce false, misleading, nonsensical, or poor-quality information without malicious user intent, with harms ranging from unintentional deception to material harm and societal distrust.The taxonomy distinguishes deliberate disinformation, discussed under malicious uses, from non-malicious misinformation.Source: Best-fit Taxonomy: Weidinger [S20]… · p. 71
• Language-model misinformation can create false beliefs, threaten autonomy, increase confidence in unfounded opinions, amplify polarization, and undermine shared epistemology at scale [99, 113, 137].Presenting majority views as factual can marginalize minority perspectives by treating them as false [S20].Source: Best-fit Taxonomy: Weidinger [S20]… · p. 71

• The framework was tested by coding 100 AI Risk Database risks, with one author discussing the findings with another author before revisions were made.This discussion initiated the taxonomy changes.Source: First iteration of coding and changes · p. 71
• Technical or performance risks were the most common uncaptured cases, prompting an additional category for AI-system safety, failures, limitations, vulnerabilities, and integrity threats.Source: First iteration of coding and changes · p. 71
• Thematic analysis of risks lacking existing subcategories produced additions such as “race dynamics and competitive pressure” and “governance failure,” and revised “Hate speech and offensive language” to “Offensive content.”Source: First iteration of coding and changes · p. 71
• Coding rules used Weidinger et al [S20] descriptions and incorporated matching definitions from Weidinger et al (2021, 2023), whose related frameworks also informed risk-name and description revisions.Source: First iteration of coding and changes · p. 71

Second iteration of coding and changes

• One author coded 100 additional AI Risk Database risks, rechecked earlier coding, and discussed the results with other authors before revising the taxonomy.These discussions led to the changes described in the subsequent revisions.Source: Second iteration of coding and changes · p. 72

Amendment of category labels to maintain relevance beyond LLMs

• Several subcategory labels and criteria were broadened so the taxonomy covers AI decisions and actions beyond textual responses to prompts and remains relevant beyond LLMs.The revision accommodates frameworks addressing advanced AI assistants, Artificial General Intelligence, algorithmic systems, and machine learning.Source: Second iteration of coding and changes · p. 72

New subcategories added to capture missing risks

• A missing subcategory for infringing upon AI welfare and rights was added under AI system capability & safety in the taxonomy’s third version.The justification was that safety can encompass protecting both human and AI rights, values, and interests.Source: Second iteration of coding and changes · p. 72

Third iteration of coding and changes

• The remaining 577 risks were coded using the taxonomy, and author feedback informed revised categories and short descriptive definitions.Detailed subcategory descriptions were also reviewed by all authors and used with the short descriptions to triangulate shared conceptual definitions.Source: Third iteration of coding and changes · p. 73
• Authors collaborated on short, clear, precise, and accessible descriptions of each AI risk subcategory to build shared understanding among experts and non-experts.Source: Third iteration of coding and changes · p. 73
• The former subcategory 7.1 was split into AI behavior misaligned with human intent and the new subcategory 7.2, AI possessing dangerous capabilities.The split distinguished system behavior from capabilities such as persuading humans or developing or obtaining weapons.Source: Third iteration of coding and changes · p. 73
• After three iterations, the taxonomy was considered complete for the risks described in the AI risks database.Source: Third iteration of coding and changes · p. 73