The AI risk repository: A meta-review, database, and taxonomy of risks from artificial intelligence

In plain words

Many groups have written lists of the ways AI can go wrong, and they often use different names for the same problem. "Privacy" can mean a model leaking its training data, or people being free from surveillance. This paper gathers 74 such lists and reads them carefully, which produced a single database of 1,725 individual risks, each taken from the wording of its source.

The authors then sort the risks in two ways. The first asks where a risk comes from: a person, an AI system, or both; whether it was meant to happen; and whether it shows up before or after the AI is deployed. The second asks what harm the risk does, in seven broad areas such as discrimination, privacy, misinformation, and loss of human control. Together the two sorts give a shared vocabulary.

A rough headline is that people cause about as many of these risks as the AI systems do, and that the source frameworks lean toward risks that appear after deployment. The database is meant to be kept up to date. Anyone who needs to compare studies, plan safety work, or check an audit against a complete list can use it as a common reference.

TL;DR

• A systematic meta-review of 74 AI risk frameworks, reviews and reports, which yields 1,725 risks p. 4.
• Causal Taxonomy: each risk is tagged by entity (human, AI, or other), intent (intentional, unintentional, or other) and timing (pre-deployment, post-deployment, or other) tab. 1 p. 6.
• Domain Taxonomy: seven domains and 24 subdomains of harm, which may overlap tab. 2 p. 10.
• Author-reported: 42% of coded risks are attributed to AI systems and 38% to human decisions; 62% are post-deployment p. 11.
• Relevant if you need a shared risk list for safety cases, audits, or policy. Not a source of likelihood or severity estimates p. 13.

Problem

AI risk terms are used inconsistently across frameworks, so the same risk gets different names and the same name covers different risks. Comparing findings across studies needs a mapping between frameworks, and full coverage needs several taxonomies with different organising principles p. 2. Earlier reviews were often narrative, or focused on one AI category such as generative AI or AGI rather than AI in general p. 3. The authors state that few existing taxonomies describe how they are revised p. 3.

Method

The study is a systematic review with a registered protocol (April 2024, OSF) p. 15. It has three inputs: a database and preprint search, forward and backward citation searching with initial expert consultation, and an ongoing expert consultation that ran into 2025 fig. 1 fig. 2 p. 4.

1. Search. A Scopus search and searches of arXiv, SSRN, Research Square, medRxiv, TechRxiv, bioRxiv and ChemRxiv used the same string, run on 4 April 2024 p. 16 p. 17.
2. Screening. Title and abstract screening used active learning in ASReview, in duplicate, following the four-phase SAFE procedure p. 17 p. 18.
3. Full text. One author screened the full texts of all records included at the title and abstract step; 10% were screened in duplicate p. 18.
4. Forward, backward and expert searches. Records from these were screened by one author, and added to the extraction backlog if eligible p. 18.
5. Extraction. Five authors extracted risks verbatim (title, outlet, risk category and subcategory names and descriptions, and page number) into a living AI Risk Database, with pilot rounds and individual extraction followed by discussion p. 18.
6. Best-fit framework synthesis. Seven authors built two taxonomies by starting from an existing framework, coding all risks with it, revising it where risks did not fit, and repeating until every risk could be coded fig. 3 p. 19 p. 20.

# Best-fit framework synthesis  [fig. 3] [p. 19-20]
# Start from one published framework, then revise until every risk fits
def best_fit_synthesis(risks, framework):
    # Starting taxonomy, chosen for the purpose  [p. 19]
    taxonomy = framework
    while True:
        # Code each extracted risk against the current taxonomy  [p. 19]
        uncoded = [risk for risk in risks if not taxonomy.codes(risk)]
        if not uncoded:
            return taxonomy
        # Thematic pass: add, merge or restructure categories for the
        # uncoded risks, then repeat  [p. 19-20]
        taxonomy = revise(taxonomy, uncoded)

# Title and abstract screening with active learning  [p. 17-18]
# Phase 1: a random 1% of the search yield is labelled by hand
labels = screen_by_hand(random_sample(records, share=0.01))
while not stopping_rule_met(labels):
    # Phase 2: the model ranks the records not yet labelled  [p. 17]
    ranking = model.rank(unlabelled(records, labels))
    # The top-ranked record is screened by hand and labelled
    labels[ranking[0]] = screen_by_hand(ranking[0])
    model.train(labels)

The stopping rule was designed with four conditions: all key papers marked relevant; at least twice the estimated number of relevant records screened; more than 10% of the dataset screened; and no relevant record in the last 50 screened p. 17. The authors did not meet the first condition (see Pitfalls).

The Causal Taxonomy began from Yampolskiy's (2016) taxonomy of pathways to dangerous AI and went through three iterations p. 21. The Domain Taxonomy was built the same way, from a framework the paper does not name in the text read here p. 19 p. 20.

Hyperparameters

These are the review settings, not model hyperparameters. "Not stated" means the paper does not give the value in the text read.

Results

Author-reported. Setup: systematic search and screening of the literature, with the framework documents as the unit of analysis. No model is trained or evaluated.

The Causal and Domain Taxonomies themselves:

Subdomain names (short labels, tab. 2): 1.1 unfair discrimination and misrepresentation; 1.2 exposure to toxic content; 1.3 unequal performance across groups; 2.1 compromise of privacy; 2.2 AI system security vulnerabilities; 3.1 false or misleading information; 3.2 pollution of the information ecosystem; 4.1 disinformation, surveillance and influence at scale; 4.2 cyberattacks, weapons and mass harm; 4.3 fraud, scams and targeted manipulation; 5.1 overreliance and unsafe use; 5.2 loss of human agency; 6.1 power centralisation and unequal benefits; 6.2 inequality and decline in job quality; 6.3 devaluation of human effort; 6.4 competitive dynamics; 6.5 governance failure; 6.6 environmental harm; 7.1 AI pursuing goals in conflict with human goals; 7.2 dangerous capabilities; 7.3 lack of capability or robustness; 7.4 lack of transparency or interpretability; 7.5 AI welfare and rights; 7.6 multi-agent risks.

Paper vs code

No official code. The paper points to a living database at airisk.mit.edu and to the OSF protocol and extracted data p. 1 p. 4 p. 15. These are data and protocol, not code, and were not fetched for this card. Code search: the GitHub API was queried for "ai risk repository" and "airisk mit" (no results), and "airisk" (107 results, none from the authors or MIT FutureTech in the portion read). No repository was found that the authors own.

Pitfalls

• Entity percentages disagree. The abstract and Results give human decisions as 38% p. 1 p. 11, while the Practical Implications text gives 37% p. 12. The Introduction gives Other as 21% p. 3. The three figures sum to 101% with 38%, so treat the human share as 37 to 38% and check the Supplementary Tables before quoting one value.
• Causal counts do not fully reconcile. Of 1,725 risks, 1,480 are coded, which leaves 245. The text gives 136 with insufficient information and 87 discarded, which is 223. The remaining 22 are explained only as "other reasons" including descriptions too broad to code, with no count p. 6.
• Protocol drift. Two exclusion criteria (focus on a single risk category; focus on the risk-assessment process) were added after protocol registration to keep the most relevant documents p. 16.
• Missed key paper. One of the four stopping conditions was never met: only three of four key papers appeared in screening, and the fourth turned up several thousand records later. The team switched models to find it p. 17 p. 18. Recall is therefore not guaranteed by the stopping rule.
• Single-coder steps. Full-text screening, forward and backward searches, and extraction were done by one or a few authors with calibration on subsets only. The authors state that no validation with external raters was done, so inter-rater reliability is unknown p. 13 p. 18.
• Frequencies are not risk. Counts measure how often a risk appears in the source documents. The authors say they do not estimate likelihood or severity, or interactions between risks p. 13. The 42% and 38% shares are shares of coded risks, not of frameworks.
• Domains overlap; causal levels do not. The seven domains are not mutually exclusive, so a risk can appear in several p. 10. Each causal category has exactly one level per risk tab. 1 p. 6.
• Coverage is uneven by design. Most frameworks cover 8 of the 24 subdomains, and 3% and 7% of documents cover AI welfare and multi-agent risks respectively. Do not read the database as a complete list of risks that exist, only of risks that appeared in the 74 included documents p. 11 p. 14.
• Search language and type. Only English items were eligible; book chapters, theses, commentaries, editorials and protocols were excluded; and documents on a single location, sector or category, or on the process of risk assessment, were excluded p. 16.
• Dates. The search ran on 4 April 2024, but expert recommendations ran to December 2025 p. 4 p. 17. The content here describes the 74 included documents as published in the paper, not the living database as of today.
• Version. arXiv metadata is version 3, updated 2026-05-05. The PDF read for this card is the published Patterns version (March 2026) p. 1.

Lineage

• Builds on: Yampolskiy (2016), "Taxonomy of pathways to dangerous AI", as the starting framework for the Causal Taxonomy p. 21. No arXiv id is given in the paper. Best-fit framework synthesis is adapted from the cited method papers p. 19.
• Compared against: the 74 included frameworks and reports, listed in Supplementary Table S10 p. 4. Not reproduced here.
• Superseded by: not stated.