The 13 risk families AIR checks

A risk theme is one kind of problem an AI system can have. A family is a group of related themes. AIR checks the same 63 themes for every system, so two reports can be compared side by side.

The families

1. Governance & Accountability (5 themes): missing or unclear decision rights; weak approval and change governance.
2. Legal, Regulatory & Rights (5 themes): unlawful or unsupported automated decisioning; missing notice of AI involvement, basis, or rights.
3. Data Governance & Provenance (5 themes): unverifiable or unknown data provenance; data retention period breach.
4. Privacy, Confidentiality & Intellectual Property (5 themes): leakage or unintended exposure of personal or confidential data; re-identification or inference-based privacy risk.
5. Security, Adversarial Resilience & Malicious Use (6 themes): prompt injection or tool-use abuse; insecure access pathways and authentication weaknesses.
6. Model Quality, Reliability & Robustness (5 themes): hallucination or factual unreliability; performance degradation after deployment.
7. Safety & Human Harm (3 themes): unsafe recommendations or high-impact automated harm; unsafe degraded-mode behaviour.
8. Fairness, Non-discrimination & Accessibility (5 themes): unequal performance across protected or vulnerable groups; exclusion or accessibility barrier.
9. Transparency, Explainability & Auditability (5 themes): opaque or unjustifiable output rationale; insufficient logging and audit trail.
10. Human Oversight, Autonomy & Use (4 themes): ineffective human review and override capability; workflow-induced over-reliance on AI recommendations.
11. Content Integrity, Manipulation & Misinformation (5 themes): fabricated facts and disinformation generation; synthetic media and deepfake risk.
12. Third-Party, Supply Chain & Concentration (5 themes): opaque or unreviewed vendor AI controls; organisation-critical single-provider dependency.
13. Societal, Labor & Environmental Impact (5 themes): labour displacement and workforce harm; environmental burden from AI compute.

How the families show up in a report

Every risk card carries its family tag. To see one family, use the Category filter on the Risks tab. Each theme ends up in one group: Outstanding, Needs evidence, Potential or Ruled out. A theme in Needs evidence is one your documents did not cover; the risk may still be there.