AI Risk Taxonomy for General, Agentic, and Physical AIHEARTHybrid Evidence-based AI Risk Taxonomy

About HEART

HEART (Hybrid Evidence-based AI Risk Taxonomy) organizes 622 bilingual, evidence-linked risk cards into 55 categories across General, Agentic, and Physical AI. It provides a shared vocabulary for identifying risks that arise from model outputs, delegated decisions, and physical actions. Each card links a risk definition to its place in the hierarchy and to its supporting evidence. The categories were designed from the literature, and experts wrote and assigned the cards; these assignments serve as the reference for the evaluations below.

Key results

Iterative consolidation. The grouping algorithm (Algorithm 1) consolidated 1,612 candidate formulations into 792 representatives after five iterations, which experts then refined into the 622 cards.

Category assignment. Using bilingual names and definitions within known L1 domains, the assignment algorithm (Algorithm 2) agrees with the expert reference for 65.11% of cards at Top-1 and 84.41% at Top-3 (BGE-M3, 55-category release).

Method

The construction evidence comprises 82,971 scholarly publications, policy and technical reports, and patents. Candidate risks were generated with HDBSCAN grouping and class-based TF-IDF summaries and then consolidated iteratively (Algorithm 1). Cards are assigned by embedding similarity within eligible domains, with category centroids anchored to the expert definitions and refined iteratively (Algorithm 2).

The AI risk space is an exploration layer built on the same embeddings. Each card is linked to its eight nearest neighbors (BGE-M3 cosine similarity of at least 0.60), and node positions are computed with ForceAtlas2. Color indicates hierarchy-related semantic shades and node size indicates weighted degree; neither represents severity, likelihood, or causality.

How to use it

HEART can be explored in three ways, depending on your question.

  1. Browse the hierarchy. Open AI risk taxonomy to move from the three domains down to individual risk cards. Use the search box to find cards by ID, name, definition, or evidence, or narrow the list by domain and L3 category.
  2. Explore related risks. Open AI risk space to see how cards relate in meaning. Select a keyword (for example, Prompt injection) or an application (for example, Financial AI Agent) to highlight relevant cards, then select any node to read its definition, hierarchy, and evidence in the side panel. Scroll or pinch to zoom, drag to pan, and double-click the background to reset the view; your filters remain in place.
  3. Apply it to a service. Treat the highlighted cards as a starting checklist. For your own service, confirm which risks apply to its actual capabilities, then record the relevant controls and accountable owners.

AI risk incidents outlines planned incident monitoring; collection has not yet started.

Keywords & applications

Keyword filters combine semantic similarity with reviewed scope decisions, and application filters apply capability-based rules. Filters highlight candidate risks; they do not change taxonomy assignments.

Mapping and application profiles

Keyword concepts are compared with English card names and definitions using BGE-M3 cosine similarity, concept-specific thresholds (0.60–0.75), and reviewed inclusions and exclusions. Application profiles combine eligible domains, approved card or category IDs, and English text terms, followed by exclusions. Both are applicability rules rather than validated classification scores.

AI for Everyone (Korea) is based on reported service plans for chatbot responses, search, and delegated tasks such as applications, bookings, and payments. The profile highlights 294 candidate risks (259 General AI and 35 Agentic AI); Physical AI is excluded, and Agentic AI risks apply only when delegation is enabled. The profile reflects HEART's conditional assessment, not evidence of service failures.

Financial AI Agent follows the Financial Security Institute's 17 security inspection items across six areas. Each item was restated as the risk that arises when its control fails, and candidate L4 cards retrieved with bilingual BGE-M3 embeddings were adjudicated by mechanism, protected object, and harm. Sixteen items map to 23 unique cards; resource exhaustion has no exact match, and memory isolation and kill-switch coverage match partially. View the criterion-level mapping table.

Scope and limits

Coverage reflects published evidence and expert judgment. The evaluations compare the algorithms with the expert reference on the current inventory, and results vary with the embedding model and input text. Probability and severity are not assigned, and application profiles should be validated for each service. HEART supports risk identification and review rather than automatic risk scoring or certification.