The Taxonomy

A shared vocabulary for describing technology.

Each category is a question people ask about a technology, and its elements are the answers. Choose a category, then an element, to see its icon and what it means. New to the terms? Read the concepts.

Risks & Mitigation

Elements 11

What are the risks and how are they mitigated?

The risks this system could create and how they’re being addressed.

About this category

Risks & Mitigation

What are the risks and how are they mitigated?

The risks this system could create and how they’re being addressed.

Datachain

Answer: Not every system carries a risk worth naming. Answer it whenever a risk is known.
Icon shape: Guardrails: what could go wrong and what you can do about it.

Variables

Description of the risk Required
Description of the mitigation Optional

Sources

A Collaborative, Human-Centred Taxonomy of AI, Algorithmic, and Automation HarmsAbercrombie et al. (2024). arXiv:2407.01294. CC BY-SA 4.0.

Loss of autonomyThe risk that this system limits a person's ability to make their own decisions, control their identity, or choose freely. This includes risks of restricted access to alternatives, deceptive design that nudges decisions toward a particular outcome, and lack of meaningful consent. Mitigations may include opt-out mechanisms, transparent recommendations, defaults that protect agency, and human review of consequential decisions.

Civil liberties harmThe risk that this system compromises fundamental human rights and civil liberties — speech, assembly, movement, due process, or freedom from arbitrary surveillance. This includes risks from mass facial recognition, predictive policing, censorship of lawful expression, and chilling effects on protest. Mitigations may include strict purpose limits, judicial or independent oversight, narrow data retention, and human-rights impact assessments before deployment.

Environmental harmThe risk that this system causes environmental degradation through energy consumption, water use, e-waste, carbon emissions, or resource extraction for hardware. This includes risks from training-time compute, always-on inference, cooling demands of data centers, and rapid hardware churn. Mitigations may include energy and water efficiency targets, transparent reporting of compute footprint, hardware-lifecycle planning, and renewable-energy procurement for data-centre operations.

Financial & business harmThe risk that this system causes financial losses to individuals or organizational damage through erroneous pricing, denied services, fraud, or market manipulation. This includes risks from automated credit decisions, dynamic-pricing inequities, AI-enabled scams, and supply-chain disruption from misuse. Mitigations may include affordability guards, fairness audits of pricing models, fraud-detection layers, and clear redress procedures.

Physical harmThe risk that this system's outputs lead to physical injury to individuals or damage to property. This includes risks from autonomous vehicles, robotic actuation, faulty navigation guidance, or critical-infrastructure errors that put bodies or property in harm's way. Mitigations may include rigorous safety testing, fail-safe defaults, geofencing of hazardous behavior, and human oversight of high-stakes physical actions.

Political & economic harmThe risk that this system manipulates political discourse, interferes with elections, concentrates market power, or damages public institutions. This includes risks of synthetic media targeting voters, opaque ad-targeting, competitive distortion from monopoly access to data and compute, and erosion of institutional trust. Mitigations may include disclosure of synthetic content, antitrust attention to AI markets, audit access for regulators, and political-ad transparency requirements.

Loss of privacyThe risk that this system captures, infers, or reveals more about people than they expect or agreed to. This includes risks of tracking people's movements over time, re-identifying data that was meant to be anonymous, linking records across systems to build profiles, and reusing data for purposes beyond the one stated. Mitigations may include collecting only what is needed, processing on the device, anonymizing at the point of capture, short retention periods, and privacy impact assessments before deployment.

Psychological harmThe risk that this system causes emotional or mental-health impairment, directly or indirectly. This includes risks from addictive feedback loops, distress caused by surveillance, harassment via generated content, and anxiety from automated denials. Mitigations may include content warnings, well-being safeguards, age-appropriate design, accessible support channels, and rate limits on engagement-maximizing behavior.

Reputational harmThe risk that this system damages the reputation of individuals, groups, or organizations through misidentification, false categorization, or stigmatizing labels. This includes risks of inaccurate face recognition, defamatory generated content, and unfair public scoring that follow people across contexts. Mitigations may include accuracy thresholds before public-facing labels are applied, human review of high-impact identifications, takedown procedures, and clear rights to correction.

Security & data breachThe risk that this system or the data it holds is accessed, stolen, altered, or taken over by someone who should not have it. This includes risks from hacked cameras or sensors, leaked databases, intercepted transmissions, insider misuse, and tampering that makes a system report or act falsely. Mitigations may include encryption in storage and in transit, strict access controls, regular security testing, prompt software updates, and notifying affected people when a breach occurs.

Societal & cultural harmThe risk that this system harms communities or culture through erosion of trust, loss of linguistic and cultural diversity, or unhealthy dependency on opaque systems. This includes risks of misinformation at scale, homogenization of cultural expression, replacement of local knowledge, and degradation of public-information ecosystems. Mitigations may include multilingual support, partnerships with affected communities, provenance signals on generated content, and investment in local-language and local-context models.

Security & data breach

The risk that this system or the data it holds is accessed, stolen, altered, or taken over by someone who should not have it. This includes risks from hacked cameras or sensors, leaked databases, intercepted transmissions, insider misuse, and tampering that makes a system report or act falsely. Mitigations may include encryption in storage and in transit, strict access controls, regular security testing, prompt software updates, and notifying affected people when a breach occurs.

Variables

Description of the risk Required
Description of the mitigation Optional