{
  "name": "The AI Risk Taxonomy (AI GOVERNANCE CHAIN™)",
  "version": "1.0.0",
  "verified": "Q2 2026",
  "author": "Mathieu K. Gouanou",
  "credential": "Member, Harvard Business Review Advisory Council",
  "publisher": "AI GOVERNANCE CHAIN™",
  "license": "CC BY-NC-ND 4.0. Attribution required. No commercial use. No derivatives. Commercial licensing: contact@aigovernancechain.com",
  "citation": "Mathieu K. Gouanou (2026). The AI Risk Taxonomy. AI GOVERNANCE CHAIN™.",
  "description": "Thirty named AI risks organized into six mutually exclusive and collectively exhaustive (MECE) categories. Machine-readable edition of the free reference map.",
  "usage": "For each risk ask three questions: Could this happen to us? Would we know if it did? Do we have an owner for it? A no, maybe, no answer marks a priority.",
  "paid_depth": "Scoring, treatment planning, risk appetite, and monitoring live in the AI Risk Management Kit (paid). The full catalog: https://github.com/aigovernancechain",
  "category_count": 6,
  "risk_count": 30,
  "categories": [
    {
      "id": "technical",
      "number": 1,
      "name": "Technical Risks",
      "definition": "The system itself fails.",
      "risks": [
        {
          "id": 1,
          "slug": "model-error-inaccuracy",
          "name": "Model error and inaccuracy",
          "definition": "The system produces wrong outputs within its intended use."
        },
        {
          "id": 2,
          "slug": "model-drift",
          "name": "Model drift",
          "definition": "Performance degrades silently as the world changes around a static model."
        },
        {
          "id": 3,
          "slug": "robustness-failure",
          "name": "Robustness failure",
          "definition": "The system breaks on inputs outside its training distribution."
        },
        {
          "id": 4,
          "slug": "adversarial-manipulation",
          "name": "Adversarial manipulation",
          "definition": "A bad actor crafts inputs to force a harmful output."
        },
        {
          "id": 5,
          "slug": "hallucination-fabrication",
          "name": "Hallucination and fabrication",
          "definition": "The system invents facts, citations, or confident falsehoods."
        }
      ]
    },
    {
      "id": "data",
      "number": 2,
      "name": "Data Risks",
      "definition": "The inputs are flawed or mishandled.",
      "risks": [
        {
          "id": 6,
          "slug": "training-data-bias",
          "name": "Training data bias",
          "definition": "Skewed data teaches the model a skewed view of the world."
        },
        {
          "id": 7,
          "slug": "data-quality-failure",
          "name": "Data quality failure",
          "definition": "Incomplete, stale, or mislabeled data corrupts outputs."
        },
        {
          "id": 8,
          "slug": "privacy-violation",
          "name": "Privacy violation",
          "definition": "Personal data is used or exposed without basis or consent."
        },
        {
          "id": 9,
          "slug": "data-provenance-failure",
          "name": "Data provenance failure",
          "definition": "The origin and rights of training data cannot be established."
        },
        {
          "id": 10,
          "slug": "data-security-breach",
          "name": "Data security breach",
          "definition": "Training data or prompts are exfiltrated."
        }
      ]
    },
    {
      "id": "ethical-societal",
      "number": 3,
      "name": "Ethical and Societal Risks",
      "definition": "The system harms people or the public good.",
      "risks": [
        {
          "id": 11,
          "slug": "discrimination-unfair-outcomes",
          "name": "Discrimination and unfair outcomes",
          "definition": "The system treats groups inequitably."
        },
        {
          "id": 12,
          "slug": "sycophancy-truthfulness-failure",
          "name": "Sycophancy and truthfulness failure",
          "definition": "The system agrees, flatters, or tells people what they want to hear instead of what is true.",
          "flagship": true,
          "instrument": "The AI Sycophancy Risk Register™"
        },
        {
          "id": 13,
          "slug": "manipulation-dark-patterns",
          "name": "Manipulation and dark patterns",
          "definition": "The system nudges people against their interest."
        },
        {
          "id": 14,
          "slug": "erosion-human-autonomy",
          "name": "Erosion of human autonomy",
          "definition": "People defer to the system and stop deciding."
        },
        {
          "id": 15,
          "slug": "societal-labor-disruption",
          "name": "Societal and labor disruption",
          "definition": "Automation displaces work faster than institutions adapt."
        }
      ]
    },
    {
      "id": "legal-regulatory",
      "number": 4,
      "name": "Legal and Regulatory Risks",
      "definition": "The organization breaches its obligations.",
      "risks": [
        {
          "id": 16,
          "slug": "regulatory-non-compliance",
          "name": "Regulatory non-compliance",
          "definition": "The system violates the EU AI Act, sector rules, or local law."
        },
        {
          "id": 17,
          "slug": "liability-exposure",
          "name": "Liability exposure",
          "definition": "Harm caused by the system creates legal claims."
        },
        {
          "id": 18,
          "slug": "ip-infringement",
          "name": "Intellectual property infringement",
          "definition": "Training or outputs breach copyright or licensing."
        },
        {
          "id": 19,
          "slug": "contractual-disclosure-failure",
          "name": "Contractual and disclosure failure",
          "definition": "The organization misrepresents what its AI does."
        },
        {
          "id": 20,
          "slug": "cross-border-conflict",
          "name": "Cross-border conflict",
          "definition": "The system meets contradictory rules across jurisdictions."
        }
      ]
    },
    {
      "id": "operational",
      "number": 5,
      "name": "Operational Risks",
      "definition": "The organization cannot run or control the system.",
      "risks": [
        {
          "id": 21,
          "slug": "lack-human-oversight",
          "name": "Lack of human oversight",
          "definition": "No one can meaningfully intervene."
        },
        {
          "id": 22,
          "slug": "no-off-switch",
          "name": "No off switch",
          "definition": "The system cannot be stopped quickly and safely."
        },
        {
          "id": 23,
          "slug": "vendor-supply-chain-dependency",
          "name": "Vendor and supply-chain dependency",
          "definition": "A third-party model or service fails or changes."
        },
        {
          "id": 24,
          "slug": "monitoring-blind-spots",
          "name": "Monitoring blind spots",
          "definition": "Failures occur with no detection."
        },
        {
          "id": 25,
          "slug": "skills-capacity-gap",
          "name": "Skills and capacity gap",
          "definition": "The people running the system cannot govern it."
        }
      ]
    },
    {
      "id": "strategic-existential",
      "number": 6,
      "name": "Strategic and Existential Risks",
      "definition": "The system threatens the mission or beyond.",
      "risks": [
        {
          "id": 26,
          "slug": "reputational-damage",
          "name": "Reputational damage",
          "definition": "A public failure destroys trust faster than any control can rebuild it."
        },
        {
          "id": 27,
          "slug": "mission-misalignment",
          "name": "Mission misalignment",
          "definition": "The system optimizes for a goal that conflicts with the organization's purpose."
        },
        {
          "id": 28,
          "slug": "agentic-over-reach",
          "name": "Agentic over-reach",
          "definition": "An autonomous system takes consequential actions beyond intended scope."
        },
        {
          "id": 29,
          "slug": "concentration-lock-in",
          "name": "Concentration and lock-in",
          "definition": "Dependence on a single model or provider becomes irreversible."
        },
        {
          "id": 30,
          "slug": "frontier-emergent-risk",
          "name": "Frontier and emergent risk",
          "definition": "The most advanced systems behave in ways no one anticipated."
        }
      ]
    }
  ],
  "document_standard": "human-first AI governance"
}