----------------
📚 Frameworks: AI Risk Map v1.3 (RiskFramework.org)
===================
What it is
AI Risk Map is a single-page visual reference for AI-specific risk: 196 risk factors across 55 categories and 12 domains, arranged by which function owns the risk in the enterprise rather than by technology. The domains are governance, strategy, data, model development, security, safety, operations, legal, third-party, workforce, financial, and autonomous action. Current release is v1.3, licensed CC BY-SA 4.0, with eight new factors and four narrowed ones versus the previous version. A change log accompanies the update for anyone revising an existing mapping.
Formats
Available artifacts:
• Poster at 48×36 in (PDF, PNG, SVG), a standard large-format print size
• Taxonomy workbook (XLSX)
• Flat table (CSV) keyed by stable IDs, AIRM-001 through AIRM-197, for mapping against internal tooling
• Markdown corpus intended to be loaded into an AI assistant for domain-specific questions
Inclusion methodology
The map lists risks AI introduces, or amplifies in a specific and nameable way. Generic IT, cyber, and vendor risk that exists identically without AI stays off the map, and the author names that single constraint as what keeps the map focused. A candidate earned a place by clearing any one of three gates:
1. AI-specific: remove AI and the risk vanishes
2. Management delta: the risk is not new, but the way it must be managed is, and the delta has to be specific
3. Corroboration: two or more independent AI standards name it
Sources span regulation and supervisory guidance, standards (NIST, ISO/IEC), threat frameworks, and academic taxonomies. All 196 factors carry citations verified against primary texts.
Scope boundaries
• Not a control framework: it names risk factors, never controls
• Not a threat register: malicious use of AI against the organization, such as deepfakes and AI-enabled fraud, is deliberately out of scope; the effect of competitors' and customers' AI on the value of existing strategy is in scope
• Not a scoring tool: position, order, and ID number say nothing about likelihood or severity
One caveat worth flagging before operational use: entries mix conditions, failure modes, threat events, and loss events. They are not well-formed loss-event statements in the FAIR sense, so each factor needs scoping into a proper risk scenario before CRQ or FAIR analysis.
How to use it
Three documented paths:
• Workshop: put the poster up and ask which factors nobody has discussed
• AI assistant: load the markdown corpus and ask domain-specific questions
• Own tooling: map against the CSV using the stable IDs
Limitations
Point-in-time view of a fast-moving field. The map surfaces possibilities; it does not determine which risks matter most to a given organization. The twelve domains assume a typical enterprise structure and may not match every structure. It seeds threat modeling and risk assessment; it complements system-specific models rather than replacing them. The author notes that hard inclusion decisions were required and that some entries may look like duplicates without actually being so.
For anyone who remembers cloud risk posters from the early public-cloud wave, this is the same idea applied to AI: a visual reminder to widen perspective, backed by citation work most teams will not redo themselves. The FAIR-scoping requirement is the main cost to budget for before using it in quantified analysis.
🔹 AIRiskMap #RiskManagement #AIGovernance #FAIR #AI