PaperlayerView exact revision on arXiv

Source-linked AI summary

AI Risk Ontologies for the EU AI Act Compliance: AIRO, VAIR, and their Integration with DPV

Delaram Golpayegani, Harshvardhan J. Pandit, Declan O'Sullivan, Dave Lewis

arXiv:2610.31380v1cs.CYcs.AI

TL;DR

AI risks are increasingly salient, and the paper identifies the need for interoperable ways to represent AI use cases and their associated risks. It develops AIRO and VAIR and integrates them with DPV; the paper reports practitioner review during integration and uptake in academic and industry projects, while noting limits in taxonomy scope and real-world evaluation.

  • Problem

    The paper addresses the need for interoperable, machine-readable representation of context-dependent AI use cases and risks amid growing evidence of AI harms.

    Source: §1 · p. 1

  • Method

    The authors develop AIRO to model AI use cases and risks, extend it with VAIR taxonomies informed by the EU AI Act and international standards, and integrate both into DPV through consensus-building.

    Source: §1 · pp. 1–2

  • Results

    AIRO and VAIR received practitioner review during DPV integration and have been adopted in academic and industry projects, providing complementary evidence of practical applicability.

    Source: §7.3 · p. 11, §10 · p. 15

  • Takeaways & Limitations

    The iterative and modular approach shows how risk ontologies can evolve amid legal uncertainty and support construction of more specific AI-risk ontologies and taxonomies.

    Source: §10 · p. 15

    An exhaustive, commonly agreed VAIR taxonomy was not practical without broader stakeholder consensus, and the paper does not apply AIRO and VAIR in real-world settings.

    Source: §5.1 · p. 8, §7.3 · p. 11

Abstract

from arXiv · show

As the use of AI, and consequently its harms, becomes more prevalent, the global discourse around AI has become increasingly risk-aware. With new risks emerging more frequently than ever, a key challenge is how to represent, document, and catalogue AI risks in an effective, interoperable, and queryable manner. Additionally, the European Union (EU) AI Act's requirements for "high-risk" AI systems to manage and document the risks creates the need for open and interoperable tools, methods, and standards that facilitate AI risk management in an ever-changing environment. In this paper, we present ontologies and taxonomies developed to assist with risk management and documentation, in line with the requirements of the EU the AI Act. We developed the AI Risk Ontology (AIRO) to specify AI use cases and their associated risks, complemented by the Vocabulary of AI Risks (VAIR), which populates AIRO with taxonomies of concepts. Key international standards on AI and risk, namely ISO/IEC 23894 on AI risk management and ISO/IEC 22989 on AI terminology informed the development of the ontologies. To promote reuse and enable multi-regulatory compliance, AIRO and VAIR have been integrated in the Data Privacy Vocabulary (DPV) through a consensus-building process, expanding DPV's scope from data to AI.

1. Introduction

The AI Act takes a precautionary, risk-based approach to addressing potential AI harms, while its compliance requirements demand information that can keep pace with changing systems and legal requirements. The paper presents AIRO and VAIR as interoperable, standards-informed tools for modelling AI use cases and risks, and integrates them into DPV.

1. Introduction

  • AI Act compliance requires extensive risk-management and technical-documentation information to be maintained, queried, inferred, and shared as systems, contexts, and legal requirements evolve.The Act also provides mechanisms to update its requirements, creating uncertainty about the information needed for ongoing compliance.Source: §1 · p. 1
  • AIRO models AI use cases and their associated risks as a reusable, machine-readable semantic model, designed to support interoperability across technologies, domains, and sectors.The paper links this interoperability to information sharing across the AI value chain and with authorities for conformity assessment.Source: §1 · p. 1
  • VAIR specialises AIRO with concept hierarchies informed by the EU AI Act and international AI and risk standards, while AIRO and VAIR are integrated into DPV through a consensus-driven process.The integration extends DPV beyond data protection to include AI and the EU AI Act.Source: §1 · p. 2

2. State of the Art

The review covers AI-risk taxonomies and ontologies, with emphasis on generic approaches relevant to the paper’s objectives. It notes that many taxonomies remain in research-paper formats rather than Linked Open Data, and that holistic AI-risk ontologies are absent at the time of writing.

2.1. Taxonomies for Cataloguing AI Incidents

  • Incident-derived taxonomies classify AI incidents and harms, with frameworks covering system context, technologies, impacts, and incident causes.The CSET framework distinguishes actual harm events from potential harm issues and can link harms to systems and affected entities; AVID uses a JSON schema to support interoperability and extensibility.Source: §2.1 · p. 2

2.2. AI Risk Taxonomies

  • Generic AI-risk taxonomies vary in structure, from mapped risk categories and origins to large collections organised by causes or consequences.The reviewed work also includes taxonomies scoped to particular technologies or domains, which the authors note are often disseminated as text without standardised formats.Source: §2.2 · pp. 2–3

2.3. AI Risk Ontologies

  • At the time of writing, reviewed ontologies address ethical assessment, trustworthy-AI principles, explainability, accountability, and requirements mapping [47], but none provides a holistic model of AI risks.Source: §2.3 · p. 3
  • Doc-BiasO [87] is proposed for documenting biases across ML/AI workflows; AIO [60] comprises 444 AI concepts in six modules; the dual-use ontology models regulatory requirements for civilian and military AI deployment.Source: §2.3 · p. 3

3. Ontology Development Methodology

The ontology scope centres on AI-system risk management, documentation, and information sharing, using the AI Act as the primary source and relevant ISO/IEC standards to assist its interpretation. The authors adapt an iterative ontology-development methodology to legislative and standards changes, then evaluate, document, publish, and maintain AIRO and VAIR.

3.1. Scope

  • Development used seven successive versions of the AI Act, from the 2021 Commission proposal to the final text published in July 2024.The ontology sources also included candidate ISO/IEC standards to assist with interpreting the Act while harmonised standards were not yet published.Source: §3.1 · p. 4
  • The ontologies focus on AI systems—not general-purpose AI models—and on risk management, documentation, and information-sharing requirements.The EU AI Act is the primary knowledge source, with relevant ISO/IEC standards used where the Act does not provide details needed for the competency questions.Source: §3.1 · pp. 3–4

3.2. Methodology

  • The authors followed LOT’s iterative development activities, adding iteration loops for changing legal requirements and treating evaluation as a distinct activity.Requirements were framed as competency questions, and implementation drew primarily on the Act, supplementing it with standards where needed; Figure 1 illustrates the development methodology.Source: §3.2 · pp. 4–5, Figure 1 · p. 5
  • AIRO and VAIR were evaluated against competency questions and quality practices, tested with ontology scanners, and applied to AI use cases and compliance tasks.They were documented and published online under CC-BY-4.0; iterative updates addressed changing Act and standards drafts, while the authors aimed for a stable release aligned with the final Act.Source: §3.2 · pp. 5–6

4. AI Risk Ontology (AIRO)

AIRO formally represents AI systems and their risks for the EU AI Act, drawing on international standards and adapting through changes to standards and legislation. Its foundational concepts link system context to risk, while separate vocabularies and reused ontologies support extensibility.

4.1. Iterative Development of AIRO

  • AIRO’s development incorporated successive revisions to ISO standards and the AI Act, with legislative changes primarily affecting definitions drawn from Article 3.The AI Act was the primary source for definitions; standards supplied definitions when the Act lacked one.Source: §4.1 · p. 6
  • The authors separated foundational AIRO concepts and relations from VAIR specializations after a single expanding ontology became less reusable and harder to manage.Source: §4.1 · p. 6

4.2. AIRO Overview

  • AIRO models AI use cases and risks, with hasRisk linking a risk to an AI system or component and impacts distinguishing effects on people and society from direct consequences.AIRO defines risk as uncertainty associated with an AI system that has the potential to cause harms, expressed through sources, consequences, impacts, likelihood, and severity.Source: §4.2 · pp. 6, 8
  • AIRO contains 56 classes, 61 object properties, and 3 data properties; it reuses 10 concepts, 9 object properties, and all data properties from existing ontologies.Source: §4.2 · p. 6

4.3. Ontology Reuse

  • AIRO reuses concepts and relations from DPV, DQV, DCAT, and DCMI Metadata Terms rather than modelling available open ontology terms from scratch.Source: §4.3 · p. 8

5. VAIR: A Vocabulary of AI Risks

VAIR specializes AIRO with taxonomies for expressing AI use cases and risks in line with the AI Act. Its separate, iteratively updated structure supports reuse, while its scope is deliberately limited rather than exhaustive.

5. VAIR: A Vocabulary of AI Risks

  • VAIR specializes AIRO with taxonomies for expressing and exchanging AI-system and risk information aligned with AI Act requirements.Source: §5 · p. 8

5.1. Iterative Development of VAIR

  • Separating evolving subclasses from AIRO preserves a foundational ontology and supports reuse, including the creation of domain-specific risk taxonomies.VAIR was populated iteratively using AI Act mandates, the EU AI Watch taxonomy, and ISO/IEC 22989:2022.Source: §5.1 · p. 8
  • VAIR is not exhaustive or commonly agreed: the authors limit it to concepts needed for competency questions and Semantic Web approaches, noting that consensus requires stakeholder involvement.Source: §5.1 · p. 8
  • AIRO and VAIR were proposed to the W3C DPVCG and included in DPV through a consensus-based process.Source: §5.1 · p. 9

6. Overview of VAIR

VAIR is an OWL 2 hierarchical taxonomy that specializes AIRO concepts and supports their use as both classes and instances. Its 402 classes cover AI systems, use cases, risks, stakeholders, documentation, and standards.

6. Overview of VAIR

  • VAIR specializes AIRO’s concepts in a hierarchy, with concepts defined as both skos:Concept and rdfs:Class and linked through rdfs:subClassOf.This representation allows concepts to be used as classes and instances in AI-system specifications.Source: §6 · p. 9
  • VAIR contains 402 classes spanning taxonomies for AI systems and components, use-case purposes and domains, risks and controls, stakeholders, documentation, and standards.The categories include 118 purposes, 44 risk sources, 20 risk controls, and 23 standards.Source: §6 · p. 9
  • The vocabulary is published as an open resource under a CC-BY-4.0 license and indexed in the LOV registry.Source: §6 · p. 9

7. Evaluation

The evaluation demonstrates AIRO and VAIR by modelling three varied use cases and related risks, and by applying them in Semantic Web compliance tools. Quality checks found full FAIRness compliance, while the authors note that the demonstrations do not establish real-world application.

7.1. Demonstartion of Applicabilty through Proof Of Concept

  • The proof of concept manually annotated one synthetic use case and two AIAAIC incidents, then used more-specific VAIR classes or concepts where applicable.The authors explicitly aimed to demonstrate applicability, not comprehensiveness, because comprehensive AI risk ontologies were not feasible to develop.Source: §7.1 · pp. 9–10

7.1.1. Use Case #1: Proctify

  • Proctify models a potentially high-risk education proctoring tool that analyses facial behaviour to flag suspicious activity for human instructors.Its specification includes facial-recognition inaccuracy risk for darker skin and bias testing as a risk control.Source: §7.1 · p. 10, §7.1.1 · p. 10

7.1.2. Use Case #2: Uber’s Real-time ID Check System

  • Uber’s Real Time ID use case models a high-risk employment system whose repeated verification failures affected ethnic-minority and vulnerable-group drivers, leading to unfair dismissals.Figure 3 depicts the AIRO/VAIR graph for the use case.Source: §7.1.2 · pp. 10–11, Figure 3 · p. 11

7.2. Use Case #3: VioGén Domestic Violence Risk Assessment System

  • VioGén models police assessment of repeat domestic-violence risk, where questionable input data and officers’ over-reliance on scores could leave victims without needed protection.The system may fall under AI Act high-risk categories for assessing victimisation risk and eligibility for public assistance.Source: §7.2 · p. 11

7.3. Demonstration of Applicability thorough Semantic Web-based Applications

  • AIRO and VAIR also underpin SHACL checks, AI-use policies, SPARQL documentation queries, and an AI-systems catalogue for compliance tasks.The authors report that they had not applied the ontologies in real-world settings, although academic and industry projects had adopted them.Source: §7.3 · p. 11

7.4. Quality Assessment

  • OOPS! flagged missing annotations for reused classes and properties, missing disjointness, and absent inverse-property declarations; the equivalent-class warning was a false positive.Some omitted domain and range restrictions and inverse relations were intentional design choices to preserve flexibility and simplicity.Source: §7.4 · p. 13
  • Both AIRO and VAIR fully complied with the ontology FAIRness principles according to FOOPS! assessment.The assessment also checked syntax validity, logical consistency, ontology-development practices, and common pitfalls.Source: §7.4 · pp. 12–13

8. Integration of AIRO and VAIR with DPV

After DPV community deliberations, AIRO and VAIR concepts were accepted into new and expanded DPV extensions, broadening the vocabulary’s scope to AI. The integration also created a route for continued maintenance and multi-regulation RegTech, while AIRO and VAIR remain independently reusable.

8. Integration of AIRO and VAIR with DPV

  • DPVCG deliberations expanded DPV from its personal-data focus to include AI and regulation, accepting AIRO and VAIR concepts into new and expanded extensions.The EU-AIACT and AI extensions were created, while the TECH and RISK extensions were expanded.Source: §8 · p. 13
  • The integration was DPV’s first major externally developed resource and added community assessment, discoverability, stakeholder-engaged maintenance, and a basis for multi-regulation RegTech solutions.It also involved developing vocabulary for the AI Act while maintaining legal relevance to the GDPR.Source: §8 · p. 13
  • Integration into DPV does not prevent independent use of AIRO and VAIR, whose narrower single-purpose scope can make them simpler to reuse.Source: §8 · p. 13

9. Impacts and Uptake of AIRO and VAIR

The authors reviewed studies citing AIRO and VAIR and found reuse across risk management, documentation, compliance, and related applications. Uptake includes reuse of the ontologies and their AI Act interpretation, while the authors report comparatively little methodology adoption and identify external assessments.

9. Impacts and Uptake of AIRO and VAIR

  • The authors analysed 121 studies after exclusions: 63 cited AIRO, 58 cited VAIR, and 10 appeared in both sets.Source: §9 · p. 13
  • Related-work citations formed the largest category, while methodology adoption was identified in one contribution; individual studies could count in multiple categories.Source: §9 · p. 14, Table 5 · p. 14
  • AIRO reuse spans compliance checking, risk cataloguing and analysis, risk management, impact assessment, AI documentation, and bias documentation; VAIR is reused for documentation, risk assessment, incident analysis, and AI-flaw annotation.Source: §9 · p. 14
  • AIRO has also been reused in medical AI quality management, linguistic uncertainty, applied ethics, and enterprise architecture, while only two identified studies reused it indirectly through DPV.Source: §9 · p. 14
  • The five-concept structure for identifying Annex III high-risk systems was adopted by multiple studies, and another study used AIRO and VAIR definitions to guide LLM analysis of incident harms.Source: §9 · p. 14
  • IBM research and a Nokia Bell Labs research cluster reused the work, which the authors describe as an indication of usability in applied settings.Source: §9 · p. 14
  • One reuse concerned the authors’ iterative, modular ontology-development approach, and two studies assessed contributions through direct VAIR evaluation or practitioner and expert consultation.Source: §9 · p. 14

10. Conclusion

AIRO and VAIR model AI use cases and associated risk-management information, drawing on the EU AI Act and international standards. The authors note limits in evaluation and interpretation, alongside practitioner and industry evidence of applicability.

10. Conclusion

  • The ontologies model AI use cases and risk-management information using the EU AI Act and related ISO/IEC standards, but their interpretation of these sources may limit use.As open knowledge graphs, they can also be adopted and enhanced through inheritance or concept specialisations; evaluation used illustrative examples rather than a comprehensive set of real-world use cases.Source: §10 · p. 14
  • Industry reuse provides complementary evidence of real-world applicability, while DPVCG experts reviewed AIRO and VAIR during their integration into DPV.The expert review provided a further assessment by practitioners.Source: §10 · p. 15
  • The iterative design approach illustrates how ontologies can evolve amid legal uncertainty, while modular vocabularies support development of sector- or technology-specific AI risk ontologies and taxonomies.Source: §10 · p. 15

Funding

The work received support from European Union research programmes and the ADAPT Centre for Digital Media Technology.

Funding

  • Funding came from Horizon 2020’s PROTECT ITN, Horizon Europe’s FORSEE and RECITALS projects, and the ADAPT Centre for Digital Media Technology.The ADAPT Centre funding was co-funded through the European Regional Development Fund.Source: Funding · p. 15
Loading 2610.31380v1…