A PLAIN-ENGLISH REFERENCE
AI Risk, Explained
AI risk is the possibility of harm, loss or unintended outcomes arising from the development, deployment or use of artificial intelligence systems. It includes risks to people, organisations and the systems on which they depend.
Browse the reference libraryA starting point
Three broad families of AI risk
Three families offer a starting point; one event can affect several layers at once.
Strategic risk
Strategic risk concerns whether an organisation should use AI, whether it is ready and whether expected benefits justify exposure. It includes misalignment with goals, unsuitable uses, weak accountability and unacceptable dependencies.
Operational risk
Operational risk arises in AI design, acquisition, deployment and use. It includes unreliable outputs, biased or incomplete data, privacy and security failures, misuse, weak review and disruption. Controls must consider models, people, suppliers and processes together.
Systemic risk and AI Black Swans
Systemic risks spread across organisations or society through shared models, infrastructure, data or incentives. Some high-impact tail risks sit outside an operational taxonomy. Resilience planning asks how to sense and respond without pretending to predict every unknown.
Why AI risk differs from conventional technology risk
Traditional software is expected to follow rules written in advance. AI systems produce outputs from learned patterns, so results can vary across contexts and updates. Behaviour may be difficult to explain, reproduce or test exhaustively, especially when models combine with data, people and other systems.
This can make the path from a decision to harm harder to trace. An output may shape a human decision, trigger an action or pass between agents. Risk analysis should examine the model, wider system, purpose, operating conditions and accountable people. The aim is to make assumptions, ownership and response plans explicit.
Reference library
Explore AI risk terms
Each entry begins with a short definition, then explains how the idea applies in practice.
Common questions
AI risk: quick answers
- Is AI risk the same as cybersecurity risk?
- No. Cybersecurity is one part of AI risk, and the two overlap, but AI risk also includes behavioural, ethical and systemic dimensions.
- Who is responsible for AI risk in an organisation?
- Ultimately, the board is responsible for the organisation’s risk oversight. Each deployed AI system should also have a named human owner with the authority to monitor it and act when conditions change.
- What is the difference between AI risk management and AI governance?
- Governance sets accountability, decision rights and risk appetite. Risk management is the operating discipline that identifies, assesses and treats risk within that governance.