MIT AI Risk Library and Navigator
A Practical Resource for AI Governance
Introduction
AI governance can be difficult to operationalise because AI risks span multiple areas, including privacy, cybersecurity, fairness, reliability, transparency, and human oversight.
Organisations may understand individual risks but struggle to connect them to practical controls and governance decisions. The MIT AI Risk Initiative offers resources that can help teams navigate this complex landscape.
Two useful resources are the MIT AI Risk Repository and the AI Risk Navigator.
What Is the MIT AI Risk Repository?
The MIT AI Risk Repository is a living database that brings together risks identified across existing AI risk frameworks, research, and classifications.
The repository contains more than 1,700 coded AI risks, drawing on dozens of existing frameworks and classifications. Its taxonomies organise risks by their causes and domains, helping users explore how risks arise and where potential harms may occur.
For organisations, this can help with:
- Identifying risks that may otherwise be overlooked.
- Comparing different AI risk classifications.
- Supporting research and internal risk workshops.
- Building a more structured AI risk register.
- Informing governance policies and employee training.
What Is the AI Risk Navigator?
The AI Risk Navigator connects datasets from the MIT AI Risk Initiative through shared taxonomies, allowing users to explore relationships between AI risks, real-world incidents, and governance resources.
Rather than treating each resource as an isolated reference, users can explore the wider AI risk landscape and identify patterns that matter to their organisation.
Explore the resources directly:
How Can Businesses Use These Resources?
Step 1: Identify the AI systems in scope
List the AI systems your organisation develops, purchases, or uses. Include internal productivity tools, customer-facing models, and AI embedded in third-party products.
Step 2: Identify relevant risk categories
Consider how each system could affect privacy, security, fairness, reliability, safety, and decision-making.
Step 3: Assess organisational exposure
Not every risk applies equally to every system. Consider the intended use, data sensitivity, affected individuals, deployment environment, and potential impact.
Step 4: Map risks to controls
For each relevant risk, identify the existing control, accountable owner, supporting evidence, and any outstanding action.
Step 5: Review risks throughout the lifecycle
AI risks may change when models, data, vendors, or use cases change. Assessments should therefore be revisited when meaningful changes occur.
What These Resources Cannot Replace
A risk repository is a reference tool, not a complete governance programme. It does not automatically determine an organisation's risk exposure, establish legal compliance, or implement controls.
Businesses must adapt their findings to their context, applicable obligations, and risk tolerance.
Conclusion
The MIT AI Risk Repository and Navigator offer useful starting points for understanding the breadth of AI risks and organising governance discussions.
The next step is translating that understanding into operational processes: assigned ownership, documented assessments, proportionate controls, and evidence that can be reviewed over time.