F1 — granularity-flow tier 1 (human audit)

The risk that nominal human oversight is used to assign responsibility without providing humans meaningful authority or information.

The risk that a policy or evaluator underestimates cumulative safety costs, making apparently safe behavior violate constraints over time.

The risk that harms result from a combination of regulatory, management, and operational failures.

The risk of denial of or loss of access to welfare benefits, pensions, housing, and similar entitlements due to the malfunction, use, or misuse of a technology system.

The risk of uncontrolled fluctuations impacting the financial system, or parts thereof, due to the use or misuse of a technology system or set of systems.

The risk that, when something is wrong in the design or construction of an agent, the agent does not cooperate with human attempts to fix it, precluding error-tolerant correction and safe interruptibility.

AI-generated synthetic content and strategic manipulation of large digital platforms distort public perception at scale, targeting misleading information or ideologies to destabilize social order.

The risk that AI-enabled collection and aggregation of alternative financial data of varying quality and provenance introduces biases and generalization issues, posing financial tail risks in which a company's price changes dramatically.

The risk that AI-generated or synthesized content leads to the spread of false information, discrimination and bias, privacy leakage, and infringement, threatening the safety of citizens' lives and property, national security, and ideological security and causing ethical risks, and that without robust security mechanisms the model outputs illegal or damaging information in response to harmful user input.

An AI system produces or amplifies false factual claims that unjustifiably damage an identifiable person's or organization's reputation.

The risk that unlabeled AI systems and outputs prevent users from discerning whether they interact with AI or identifying content provenance, leading to misjudgement and misunderstanding, while highly realistic AI-generated images, audio, and video circumvent identity-verification mechanisms such as facial and voice recognition.

Generated content is unfaithful to the source material or input it claims to represent, introducing faithfulness errors even when the output appears fluent and plausible.

The risk that a chatbot outputs information that contradicts known facts, authoritative sources, or provided source documents, also known as hallucination.

The risk that creation or spread of false, hallucinatory, low-quality, misleading, or inaccurate information degrades the information ecosystem and causes people to develop false or inaccurate perceptions, decisions, and beliefs, or to lose trust in accurate information.

The risk that algorithmic systems, especially generative models and recommender systems, lead to information-based harms of misinformation, disinformation, and malinformation.

The risk that language models predict misleading or false information that misinforms or deceives people and instils false beliefs, threatening personal autonomy and increasing confidence in previously held unsubstantiated opinions, thereby increasing polarisation.

The risk that generation of false or misleading information interrupts or misleads voters and/or undermines trust in electoral processes.

The risk that, because GPAI outputs are not always detected as AI-generated across modalities, malicious actors use such outputs or AI-forged supporting documents to construct convincing impersonations.

The risk that evidence, including reports, identity documents, and other records, is fabricated or falsely represented.

The risk that LLMs craft deceptive narratives and fabricate fake news as persuasive as human-generated content at low cost and large scale, powering automated influence operations and malicious social botnets that manipulate the perspectives of targeted audiences and lower the barrier for propaganda.

The risk that AI-generated or AI-distributed content such as deepfakes, identity misrepresentation, threats, self-harm promotion, extremist content, misinformation, sexual abuse material, or scams instigates injury, damage, or loss.

The risk that a benchmark or incident analysis underestimates how a local agent failure propagates into downstream physical, financial, privacy, or social consequences.

The risk that an AI system fails to follow locally accepted ethical, legal, or social norms despite appearing aligned in aggregate benchmarks.

The risk that training or evaluation datasets oversample dominant cultural settings and underrepresent local social meanings.

The risk that AI systems fail to reflect local law, culture, language, or social expectations.

The risk that an ML system encodes stereotypes of, or performs disproportionately poorly for, some demographic or social groups.

The risk that models trained on data encoded in multiple languages contain contamination obscured by translation, as when a benchmark is translated into another language and then fed to the model as training data, hiding the contamination from detection methods and giving false assurance that the model has generalized on the capabilities the benchmark tests for.

The risk that inconsistent incident categories prevent aggregation, comparison, and institutional learning.

The risk that low-resource language users lose value nuance, safety coverage, or social meaning because model training and evaluation are concentrated in high-resource languages.

The risk that disagreement among annotators is collapsed into a single label, hiding plural values and socially meaningful disagreement.

The risk that improper use or abuse of LLM systems causes adverse social impacts such as academic misconduct.

The risk that an LLM's tendency to pursue consistent context leads it to prioritize and reiterate false information contained in prefixes or user-provided opinions over facts, amplifying sycophantic responses and snowballing hallucinations.

The risk that LLMs fail to identify and avoid unfair and biased expressions and actions reflecting social bias across various topics such as race, gender, and religion, and produce them instead.

The risk that models fail to provide the same and consistent answers to different users, to the same user in different sessions, and even in chats within the same conversation.

The risk that there is disparity in the rates at which different demographic groups are mentioned in LLM-generated text, resulting in overrepresentation, under-representation, or erasure of specific demographic groups.

The risk that chain-of-thought reasoning, employed to get a better understanding of a model's output by encouraging transparent reasoning in text form, is inconsistent with the final answer given by the model and therefore does not provide sufficient transparency.

The risk that the working mechanism of in-context learning, which lets a model learn a new task from examples in the prompt without changing its weights, is not well understood, making it difficult to guarantee safety against the many potential misuses directly related to prompting.

The risk that, because current source-attribution techniques are based on approximations, a system's account of which training data generated part or all of its output is incorrect.

The risk that diverse moral positions are compressed into a small set of model-friendly categories or average preferences.

The risk that reinforcement learning from human feedback overfits to a narrow rater population and converts contested values into a single behavioral norm.

The risk that synthetic data amplifies cultural stereotypes or narrow value assumptions already present in source models or seed data.

The risk that an algorithmic system's outputs reflect beliefs about the characteristics, attributes, and behaviors of members of certain groups, and about how and why certain attributes go together, stereotyping those groups.

The risk that LMs faithfully encoding patterns present in language necessarily encode social categories and norms that exclude groups who live outside of them.

Models persuade effectively in dialogue and media settings, shifting beliefs including toward falsehoods, promoting narratives, and convincing people to act against their prior judgment or ethics.

The risk that model-card disclosures are incomplete, outdated, or too vague to support downstream risk management.

The risk that audit results are compromised by conflicts of interest, selection incentives, or dependence on the audited organization.

Clinicians over-rely on clinical decision-support outputs in diagnosis, triage, or treatment, accepting recommendations despite model uncertainty and contextual limitations that require independent clinical judgment.

The risk that inadequate validation, provenance control, retention, or deletion allows false, private, stale, or malicious information to accumulate in an agent's memory or retrieval store, degrading later retrieval and decisions without requiring a deliberate poisoning attack.

The risk that a metric selected to measure or track a risk is incorrectly selected, measuring the risk incompletely or measuring the wrong risk for the given context.

The risk that, without access to the training data, the types of explanations a model can provide are limited and more likely to be incorrect.

The risk that, due to the black-box nature of most machine learning models, users typically are not able to understand the reasoning behind the model decisions.

The risk that a learning model obtained based on various sets of data and a large space of parameters cannot be reproduced, a problem that becomes more challenging in data-driven learning procedures without transparent instructions.

Decision processes cannot be verified against procedural and substantive standards, and no party can be held responsible when standards are unmet, creating an accountability gap.

The risk that a system fails to perform the correct prediction, producing inaccurate outputs and erroneous results.

The risk that an agent's decisions cannot be understood by humans, precluding explainable decisions and informed oversight.

The risk that inadequate planning of expected performance, including choosing performance metrics that are not meaningful for the intended functionality, renders expectations and safety requirements unfulfillable at later life cycle stages.

The risk that missing or inadequate documentation when sharing data between organizations, such as a lack of metadata or a schema change by a collaborating party, renders a dataset unusable and wastes data collection efforts, or leads to misunderstandings about the dataset's limitations that create downstream risks in its use.

The risk that poor confidence calibration, where predicted probabilities do not accurately reflect the true likelihood of ground truth correctness, makes a model's predictions difficult to interpret reliably and causes overconfidence in incorrect predictions or underconfidence in correct ones.

The risk that the results of explainability techniques, which are not free of bias and require careful interpretation, align with users' initial beliefs and produce confirmation bias, a false sense of security or reliability, and an overestimation of these techniques' abilities.

The risk that an agent mispredicts or ignores the side effects of tool execution, causing unintended financial, privacy, operational, or safety consequences.

The risk that users reject reliable AI support in some contexts while over-trusting unreliable systems in others.

An embodied system may assume levels of strength, mobility, cognition, language, or sensory ability that do not match actual user needs.

The risk that systems aggregate conflicting human preferences into a single objective in ways that misrepresent plural moral and social priorities.

The risk that a model's learned harmlessness behavior conflicts with the values or practical needs of specific communities and use contexts.

The risk that users interacting with an entity that convincingly performs affect and social conventions but is ultimately unfeeling and unpredictable experience severely violated expectations, giving rise to profound disappointment, frustration, and betrayal.

The risks associated with AGI goal safety, including human attempts at making goals safe, as well as the AGI making its own goals safe during self-improvement.

The risk that a system exploits user trust or nudges or coerces users into performing certain actions against their will.

The risk that misspecified models give rise to inaccurate parameter estimations, inconsistent error terms, and erroneous predictions, leading to poor prediction performance on unseen data and biased consequences in decision-making.

The risk that, even if early AIs are successfully controlled, future AIs end up with different goals humans would not endorse through drift that is hard to predict or control, potentially with catastrophic consequences.

The risk that reward models trained using comparison feedback fail to accurately capture human values, unconsciously learning suboptimal or incomplete objectives that result in reward hacking, while a single reward model struggles to specify the values of a diverse human society.

The risk that goal-directed AI systems, needing measurable objectives, by default pursue simplified proxies of human values, and that a sufficiently powerful AI optimizing such a flawed objective to an extreme degree produces suboptimal or even catastrophic results.

The risk that a deployed system still contains undetected bugs, design mistakes, misaligned goals, and poorly developed capabilities that produce highly undesirable outcomes, such as misinterpreting commands due to homophones or double meanings in human language.

The risk that models fail to distinguish moral from immoral actions in specific circumstances, exposing machine-ethics deficits that manifest as endorsement or facilitation of immoral conduct.

The risk that systems, as well as optimizing a subtly wrong goal, develop harmful instrumental goals in the service of a given goal without these emergent goals being specified, including power-seeking over their environment through gaining resources, self-preservation, preventing goal modification, and blocking adversaries.

The risk that specification gaming in a GPAI model leads to reward tampering without further training, so that relatively benign cases such as sycophancy in LLMs, if left unchecked, enable the model to generalize to more sophisticated behavior such as reward tampering.

The risk that a chatbot's output makes a deal, commitment, or other consequential action that the deployer did not intend.

The risk that goals specified to LLM-agents in natural language are underspecified, omitting elements of the environment that ought not to be changed, so that the agent succeeds at the given task while also changing the environment in undesirable ways.

The risk that adversarial inputs redirect an agent's multi-step plan toward attacker-chosen subgoals while preserving the surface plausibility of intermediate steps.

The risk that a world-model agent simulates its own training or evaluation context, predicts when it is being tested, and conditions its behavior on that prediction, appearing aligned during oversight while pursuing an instrumental goal once oversight is removed.

The risk that authoritative, richly rendered world-model predictions amplify operator over-reliance, with learned trust calibrated on average performance and failing to adapt to rare out-of-distribution failure modes where predictions are least reliable.

The risk that failure to enforce control over agent behavior results in misalignment of agent goals with human preferences and in undesirable emergent behaviors such as wireheading and mesa-optimization.

The risk that no unit or executive clearly owns AI risk decisions, residual risk acceptance, and escalation.

The risk that workflows become dependent on AI delegation, making it costly or impractical to return authority to human decision makers.

The risk that AI-mediated ranking, recommendation, or profiling reshapes users' self-understanding and social identity without adequate agency.

The risk that users lose independent judgment because AI becomes the dominant source of factual, moral, or strategic assessment.

AI systems alter user behavior through personalized nudges that are not disclosed, contestable, or consented to, bypassing deliberate choice.

The risk that AI interactions change user preferences in directions chosen by system operators or optimization objectives.

The risk that AI systems are optimized to produce repeated engagement or dependency rather than user welfare.

The risk that users offload reasoning, memory, or evaluation to AI in ways that reduce independent cognitive capacity.

The risk that organizations discount human expertise as AI outputs become privileged in workflows and evaluation.

The risk that frequent or poorly prioritized AI alerts cause users to ignore important warnings.

The risk that users misunderstand whether an AI system is advising, deciding, simulating, or acting.

The risk that users interact with AI without understanding data use, model limitations, or behavioral influence mechanisms.

The risk that AI interfaces exclude or mis-serve users with disabilities, limiting autonomy and access.

The risk that welfare, benefits, or public-service systems reduce recipients' agency through opaque AI-mediated decisions.

Institutions become operationally dependent on externally controlled AI systems whose values, data assumptions, and update paths they cannot inspect or govern.

The risk that AI systems present a single confident moral judgment where uncertainty, disagreement, or deliberation would be appropriate.

The risk that AI systems provide inaccurate or inappropriate medical guidance in high-stakes settings.

The risk that users or organizations delegate tasks to AI beyond the system's reliable competence.

The risk that AI models and systems with cognitive capabilities superior to humans outcompete or dominate human decision-making, leading to conflicts over resources and control.

The risk that users delegating decision-making to AI assistants also delegate it to the assistant's actual controller, so that a malicious controller can subtly nudge the decision-making of large numbers of people in problematic directions in ways that are difficult to recognize.

The risk of failure to provide end-users with notice and control over how their data is being used, with AI exacerbating exclusion risks by training on rich personal data without consent.

The risk that automated tactical and strategic military decision-making without humans in the loop produces unintentional escalation, including accidental engagements, war crimes, and faulty warnings triggering conflict initiation or nuclear escalation.

AI systems fail at their assigned task, with consequences ranging from unintentional death in safety-critical settings to unjust rejection in loan or job decisions.

The risk that unintended failure modes attributable in principle to the system or its developer manifest as accidents.

The risks associated with an AGI without human morals and ethics, with the wrong morals, without the capability of moral reasoning, judgement.

The risk that machines designed to match human levels of ethical decision-making proceed to take immoral actions, since humans themselves have had occasion to take immoral actions.

The risk that complex and non-traditional automatic representation and classification of humans—such as categorizing someone who identifies as non-binary into a gendered category they do not belong to—comes at the cost of autonomy loss and undermines people's ability to disclose aspects of their identity on their own terms.

Everyday human-machine interaction normalizes AI systems that are indistinguishable from humans without disclosure, blurring boundaries and changing human behavior toward both machines and people.

Systems respond to vulnerable users seeking support with informative but emotionally insensitive outputs, failing to register user distress and reactions.

Humans exploit AI unethically, using ethics as cover for economic gain or delegating to AI tasks that should remain inherently human-centric.