ID,Domain,Category,Risk factor — full description (L3),Poster label,Source(s),X-ref,Status,Superseded by,Condition type
AIRM-001,1. AI Governance & Accountability,Governance & oversight,Inadequate executive/board oversight of AI adoption and risk,Inadequate executive/board oversight of AI adoption and risk,NIST Govern; ISO A.2,,active,,safeguard gap
AIRM-002,1. AI Governance & Accountability,Governance & oversight,Ungoverned ‘shadow AI’ adoption outside sanctioned channels,Ungoverned ‘shadow AI’ adoption outside sanctioned channels,NIST Govern; CRI GV-1.6.3; COSO GenAI 2026; Original,,active,,cause
AIRM-003,1. AI Governance & Accountability,Governance & oversight,Absence of an AI governance body or charter with a clear mandate,Absence of an AI governance body or charter with a clear mandate,ISO A.3,,active,,safeguard gap
AIRM-004,1. AI Governance & Accountability,Roles & accountability,Unclear ownership and accountability (RACI) for AI risk decisions,Unclear ownership and accountability (RACI) for AI risk decisions,NIST Govern; ISO A.3,,active,,safeguard gap
AIRM-005,1. AI Governance & Accountability,Roles & accountability,"No clear executive owner for AI adoption: responsibility for strategy, prioritization, and integration into the business diffuses across technology, data science, and business leaders, with no convention for who decides, or against what criteria, to start, scale, or stop an initiative",No clear executive owner for AI adoption,Original,,active,,safeguard gap
AIRM-006,1. AI Governance & Accountability,Roles & accountability,"Failure to define accountability for autonomous / agent-driven decisions — internally, and across the AI stack of model provider, platform, developer, and deployer, where the allocation shifts as autonomy increases","Accountability for agent decisions undefined, internally and across the AI stack",EU Art 14; EU Art 25 (amended 2026); CSA AICM; CoSAI AI SRF,→12,active,,safeguard gap
AIRM-007,1. AI Governance & Accountability,Roles & accountability,"Segregation of duties collapses where the same person or agent configures the AI, operates it, and reviews its output","Segregation of duties collapses across AI config, operation, and review",COSO GenAI 2026; OWASP AISVS AC.8,,active,,safeguard gap
AIRM-008,1. AI Governance & Accountability,Policy & standards,Absence of an AI acceptable-use policy and model-approval gates,Absence of an AI acceptable-use policy and model-approval gates,ISO A.2; NIST Govern,,active,,safeguard gap
AIRM-009,1. AI Governance & Accountability,Policy & standards,AI policies not kept current with evolving capabilities and regulation,AI policies not kept current with evolving capabilities and regulation,ISO A.2; Original,,active,,safeguard gap
AIRM-010,1. AI Governance & Accountability,Policy & standards,"Inconsistent standards across business units, as AI adoption proliferates independently faster than central standards can follow",Inconsistent standards as AI proliferates faster than governance,Databricks AIGF; Original,,active,,safeguard gap
AIRM-011,1. AI Governance & Accountability,Policy & standards,"No agreed definition of what counts as ‘AI’, leaving policy scope, inventory boundaries, and regulatory classification undefined","No agreed definition of ‘AI’, leaving policy and inventory scope undefined",CRI FS-AI-RMF GV-1.2.2,,active,,safeguard gap
AIRM-012,1. AI Governance & Accountability,Risk-management integration,AI risk not integrated into enterprise risk management (ERM),AI risk not integrated into enterprise risk management (ERM),NIST Govern; CRI MG-1.2.1; Original,,active,,safeguard gap
AIRM-013,1. AI Governance & Accountability,Risk-management integration,Failure to conduct AI impact assessments for individuals and society,Failure to conduct AI impact assessments for individuals and society,EU Art 27 (amended 2026); ISO A.5,,active,,safeguard gap
AIRM-014,1. AI Governance & Accountability,Risk-management integration,No defined risk appetite or tolerance thresholds for AI,No defined risk appetite or tolerance thresholds for AI,NIST Govern; CRI GV-2.3.2; Original,,active,,safeguard gap
AIRM-015,1. AI Governance & Accountability,Audit & assurance,"Inability to audit AI due to a missing or incomplete inventory of models, agents, and connectors, and their lineage","Inability to audit AI: no complete inventory of models, agents, and connectors",ISO A.4; NIST Govern; CRI GV-1.6.1,,active,,safeguard gap
AIRM-016,1. AI Governance & Accountability,Audit & assurance,Insufficient internal-audit competence to assess AI controls,Insufficient internal-audit competence to assess AI controls,Original,,active,,safeguard gap
AIRM-017,1. AI Governance & Accountability,Audit & assurance,Absence of independent assurance over AI control effectiveness,Absence of independent assurance over AI control effectiveness,CRI GV-1.5.4; Original,,active,,safeguard gap
AIRM-018,1. AI Governance & Accountability,Audit & assurance,AI output relied upon as evidence in financial-reporting or other regulated control chains without recognizing the expansion of assurance scope,AI output relied on in financial-reporting controls without scope change,COSO GenAI 2026 p.13,,active,,cause
AIRM-019,1. AI Governance & Accountability,Audit & assurance,"No reliable way to identify which artifacts, code, or analyses were AI-generated, so a systemic model or prompt flaw cannot be scoped or remediated after the fact","No way to identify which artifacts AI produced, so a model flaw cannot be scoped",OWASP AISVS AC.9 / AC.10; COSO GenAI 2026 (AI bill of materials),,active,,safeguard gap
AIRM-193,2. Strategy & Value Realization,Competitive position,"Advantages built on knowledge, data, or skilled work lose their value as competitors, and even customers, approximate them with general-purpose AI, faster and more cheaply than earlier automation allowed, and our own adoption of AI does not restore the advantage",Our advantage erodes as competitors and customers approximate it with AI,Original,,active,,cause
AIRM-194,2. Strategy & Value Realization,Competitive position,"Third-party AI assistants and agents increasingly stand between the organization and its customers, searching, comparing, and choosing on the customer's behalf, so the organization loses direct access to the customer, brand preference counts for less, and its offering is compared as a commodity",AI agents disintermediate us from our customers,Original,,active,,cause
AIRM-026,2. Strategy & Value Realization,Competitive position,Failure to weigh the competitive risk of not adopting AI (inaction),Failure to weigh the competitive risk of not adopting AI (inaction),Databricks AIGF; Cloud Risk Map analog; Original,,active,,cause
AIRM-020,2. Strategy & Value Realization,AI strategy & roadmap,Lack of a coherent AI strategy aligned to objectives and risk appetite,Lack of a coherent AI strategy aligned to objectives and risk appetite,Databricks AIGF; Original,,active,,cause
AIRM-021,2. Strategy & Value Realization,AI strategy & roadmap,AI adoption driven by hype rather than demonstrated business value,AI adoption driven by hype rather than demonstrated business value,Original,→11,active,,cause
AIRM-022,2. Strategy & Value Realization,AI strategy & roadmap,Inability to adapt the roadmap as foundation-model capabilities shift,Inability to adapt the roadmap as foundation-model capabilities shift,Original,,active,,cause
AIRM-204,2. Strategy & Value Realization,AI strategy & roadmap,"Blanket bans or restrictions on AI use driven by fear rather than assessed risk, pushing use into unsanctioned tools and forgoing value",Fear-driven AI bans push use into the shadows,Original,,active,,cause
AIRM-023,2. Strategy & Value Realization,Use-case selection & sourcing,"Selection of use cases without a clearly defined problem and success measure, or without weighing incremental risk against benefit","Use cases chosen without a clear problem, success measure, or risk–benefit weighing",CRI MP-3.2.1; Original,,active,,cause
AIRM-024,2. Strategy & Value Realization,Use-case selection & sourcing,"‘Pilot purgatory’ — pilots stalling on data readiness, evaluation difficulty, or inability to demonstrate value","‘Pilot purgatory’ — pilots stalling on data readiness, evaluation difficulty, or inability to demonstrate value",Original,→11,active,,cause
AIRM-025,2. Strategy & Value Realization,Use-case selection & sourcing,"Misjudged AI sourcing fork — train, fine-tune, retrieval-augment, or call an API — each carrying a different risk and obligation profile","Misjudged AI sourcing fork: train, fine-tune, RAG, or API",Original,,active,,cause
AIRM-027,2. Strategy & Value Realization,Value measurement / ROI,"Unrealistic ROI expectations, where AI benefits are diffuse, hard to attribute, or depend on redesigning workflows around the AI rather than adding it to existing ones","Unrealistic ROI expectations, including returns that need workflow redesign",Original,,active,,cause
AIRM-028,2. Strategy & Value Realization,Value measurement / ROI,Inability to attribute value actually delivered by AI investments,Inability to attribute value actually delivered by AI investments,Original,,active,,safeguard gap
AIRM-029,2. Strategy & Value Realization,Value measurement / ROI,"Hidden total cost of ownership (e.g., data, talent, integration) eroding returns","Hidden total cost of ownership (data, talent, integration) eroding returns",Databricks AIGF; CRI MP-3.2.2; Original,,active,,cause
AIRM-030,3. Data & Privacy,Sourcing & provenance,"Unknown, undocumented, or unverified provenance and integrity of training, fine-tuning, or retrieval (RAG) data","Unverified provenance or integrity of training, fine-tuning, or RAG data",NIST GenAI #10; DASF 1.6,,active,,safeguard gap
AIRM-031,3. Data & Privacy,Sourcing & provenance,Reliance on data scraped without lawful basis or clear rights,Reliance on data scraped without lawful basis or clear rights,EU Art 10 (amended 2026); NIST Map,,active,,cause
AIRM-032,3. Data & Privacy,Sourcing & provenance,Inadequate data lineage to trace data through the AI pipeline,Inadequate data lineage to trace data through the AI pipeline,DASF 1.6,,active,,safeguard gap
AIRM-033,3. Data & Privacy,Quality & labeling,Poor data quality undermining model reliability,Poor data quality undermining model reliability,DASF 1.3,,active,,cause
AIRM-034,3. Data & Privacy,Quality & labeling,Inadequate or biased labeling introducing systematic error,Inadequate or biased labeling introducing systematic error,Original,,active,,cause
AIRM-035,3. Data & Privacy,Quality & labeling,"Stale data, including grounding and retrieval sources that drift out of date behind a confident-sounding model","Stale data, including grounding and retrieval sources that drift out of date behind a confident-sounding model",DASF 1.9,,active,,cause
AIRM-036,3. Data & Privacy,Privacy & consent,Personal data used for training without consent or purpose limitation,Personal data used for training without consent or purpose limitation,EU Art 10 (amended 2026); NIST GenAI #4,,active,,cause
AIRM-037,3. Data & Privacy,Privacy & consent,Inability to honor data-subject rights once data is in a model,Inability to honor data-subject rights once data is in a model,GDPR; DASF 1.8; Original,,active,,cause
AIRM-038,3. Data & Privacy,Privacy & consent,Re-identification of individuals from aggregated or model-derived data,Re-identification of individuals from aggregated or model-derived data,MIT 2.1,,active,,cause
AIRM-039,3. Data & Privacy,Privacy & consent,No guardrails preventing confidential or personal data from appearing in model output,No guardrails keeping confidential or personal data out of model output,OWASP LLM02; DASF 10.6,,active,,safeguard gap
AIRM-040,3. Data & Privacy,Privacy & consent,"Sensitive or regulated data used in AI without classification, so handling and access controls are not applied","Unclassified sensitive data in AI, so handling controls never apply",Databricks AIGF; ISO A.7,,active,,safeguard gap
AIRM-041,3. Data & Privacy,Privacy & consent,"Users pasting confidential or client data into a sanctioned AI tool, moving data outside its control boundary despite upstream access controls working","Confidential data pasted into an approved AI tool, leaving despite working controls",OWASP AISVS AC.3; COSO GenAI 2026; Original,,active,,cause
AIRM-042,3. Data & Privacy,Training-data rights & IP,Use of copyrighted or licensed material in training without rights,Use of copyrighted or licensed material in training without rights,NIST GenAI #10; EU Art 53(1)(c) (amended 2026),,active,,cause
AIRM-043,3. Data & Privacy,Training-data rights & IP,Contamination of datasets with third-party IP or trade secrets,Contamination of datasets with third-party IP or trade secrets,Original,,active,,cause
AIRM-044,3. Data & Privacy,Training-data rights & IP,Inability to prove the organization held the rights to the training data it used,Inability to prove you held rights to the training data used,OWASP AISVS 1.1.2; DASF 1.8; Original,,active,,safeguard gap
AIRM-045,3. Data & Privacy,Retention & disposal,"Failure to preserve prompts, outputs, and agent traces subject to litigation hold or e-discovery","Failure to preserve prompts, outputs, and agent traces subject to litigation hold or e-discovery",Cloud Risk Map analog; Original,,active,,cause
AIRM-046,3. Data & Privacy,Retention & disposal,"Inadequate retention / disposal, where deletion from source systems does not remove data already absorbed into models, embeddings, or caches",Deletion at source does not remove data absorbed into models,DASF 1.8; ISO A.7; Original,,active,,cause
AIRM-047,3. Data & Privacy,Retention & disposal,"Persistence of sensitive data in embeddings, caches, or model weights","Persistence of sensitive data in embeddings, caches, or model weights",OWASP LLM09; DASF 1.8; Original,,active,,cause
AIRM-048,3. Data & Privacy,Retention & disposal,Failure to remove data across distributed / replicated AI stores,Failure to remove data across distributed / replicated AI stores,Original,,active,,cause
AIRM-049,4. Model Development & Performance,Design & training,Inappropriate model/algorithm choice for the problem and risk context,Inappropriate model/algorithm choice for the problem and risk context,Original,,active,,cause
AIRM-050,4. Model Development & Performance,Design & training,Poorly documented or untracked model development,Poorly documented or untracked model development,DASF 5.1,,active,,safeguard gap
AIRM-051,4. Model Development & Performance,Design & training,Insecure or unmanaged hyperparameters and training configuration,Insecure or unmanaged hyperparameters and training configuration,DASF 5.3,,active,,cause
AIRM-052,4. Model Development & Performance,Accuracy & validation,"Fluent but incorrect output (hallucination), or summaries and transformations that change what the source said, accepted as reliable",Hallucinated or meaning-changing output accepted as reliable,NIST GenAI #2; DASF 9.8,→6,active,,cause
AIRM-053,4. Model Development & Performance,Accuracy & validation,"Validation/evaluation data not representative of real-world use, so performance can only be established once real users are exposed, as in pilots and phased rollouts",Validation data unrepresentative; real performance shows only with live users,DASF 6.2; MAS AIRG fn 28 / fn 45,,active,,safeguard gap
AIRM-054,4. Model Development & Performance,Accuracy & validation,"Skipped or insufficient adversarial, safety, and fairness testing before deployment","Skipped or insufficient red-teaming, safety, and fairness testing",EU Art 9; NIST Measure,,active,,safeguard gap
AIRM-055,4. Model Development & Performance,Accuracy & validation,Absence of independent model validation / effective challenge,Absence of independent model validation / effective challenge,SR 11-7; CRI MS-2.5.1; Original,,active,,safeguard gap
AIRM-056,4. Model Development & Performance,Robustness & drift,Model drift degrading performance as data / conditions change,Model drift degrading performance as data / conditions change,DASF 5.2,,active,,cause
AIRM-057,4. Model Development & Performance,Robustness & drift,Lack of robustness to edge cases and distribution shift,Lack of robustness to edge cases and distribution shift,NIST Measure,,active,,cause
AIRM-058,4. Model Development & Performance,Robustness & drift,Small changes to the input produce very different output,Small changes to the input produce very different output,Original,,active,,cause
AIRM-059,4. Model Development & Performance,Explainability,Black-box models used in high-stakes decisions without interpretability,Black-box models used in high-stakes decisions without interpretability,NIST Measure; EU Art 13; DASF 6.3,,active,,cause
AIRM-060,4. Model Development & Performance,Explainability,Inability to produce adverse-action / decision explanations,Inability to produce adverse-action / decision explanations,EU Art 86; Colorado SB 26-189; CRI MS-2.9.2; DASF 6.3; Original,,active,,cause
AIRM-061,4. Model Development & Performance,Explainability,Over-reliance on post-hoc explanations that misrepresent the model,Over-reliance on post-hoc explanations that misrepresent the model,Original,,active,,cause
AIRM-062,4. Model Development & Performance,Reproducibility & documentation,Non-reproducible training pipelines undermining validation and audit,Non-reproducible training pipelines undermining validation and audit,DASF 5.1; Original,,active,,safeguard gap
AIRM-063,4. Model Development & Performance,Reproducibility & documentation,Inadequate model documentation / model cards,Inadequate model documentation / model cards,EU Art 11 (amended 2026); NIST Map,,active,,safeguard gap
AIRM-064,4. Model Development & Performance,Reproducibility & documentation,"Loss of traceability between model versions, data, and results","Loss of traceability between model versions, data, and results",DASF 4.1,,active,,safeguard gap
AIRM-065,5. Security & Adversarial Threats,Data & pipeline attacks,Training-data poisoning that degrades or backdoors model behavior,Training-data poisoning that degrades or backdoors model behavior,DASF 3.1; OWASP LLM05; ATLAS AML.T0020,,active,,cause
AIRM-066,5. Security & Adversarial Threats,Data & pipeline attacks,Tampering with RAG / knowledge-base sources consumed at inference,Tampering with RAG / knowledge-base sources consumed at inference,OWASP LLM09; DASF 9.9,,active,,cause
AIRM-067,5. Security & Adversarial Threats,Data & pipeline attacks,Label-flipping or adversarial dataset partitioning to skew outputs,Label-flipping or adversarial dataset partitioning,DASF 3.3 / 2.4,,active,,cause
AIRM-068,5. Security & Adversarial Threats,Model attacks,"Model, reasoning, or insight extraction through API or product use, reproducing what our AI learned, how it reasons, or what it produces","Model, reasoning, or insight extraction through use",DASF 8.2; ATLAS AML.T0024.002,,active,,cause
AIRM-069,5. Security & Adversarial Threats,Model attacks,Membership-inference or model-inversion exposing training data,Membership-inference or model-inversion exposing training data,DASF 9.2 / 9.5; NIST GenAI #4,,active,,cause
AIRM-070,5. Security & Adversarial Threats,Model attacks,Backdoored / trojaned pre-trained model from a public hub,Backdoored / trojaned pre-trained model from a public hub,DASF 7.1,,active,,cause
AIRM-071,5. Security & Adversarial Threats,Inference-time (input) attacks,Direct prompt injection altering behavior or bypassing guardrails,Direct prompt injection altering behavior or bypassing guardrails,OWASP LLM01; DASF 9.1,,active,,cause
AIRM-072,5. Security & Adversarial Threats,Inference-time (input) attacks,Indirect / cross-domain prompt injection via retrieved content,Indirect / cross-domain prompt injection via retrieved content,OWASP LLM01; DASF 9.1 / 9.9,,active,,cause
AIRM-073,5. Security & Adversarial Threats,Inference-time (input) attacks,Jailbreaks defeating safety controls and restrictions,Jailbreaks defeating safety controls and restrictions,OWASP LLM01; DASF 9.12,→6,active,,cause
AIRM-074,5. Security & Adversarial Threats,Inference-time (input) attacks,System-prompt leakage exposing operational instructions,System-prompt leakage exposing operational instructions,OWASP LLM08,,active,,cause
AIRM-197,5. Security & Adversarial Threats,Inference-time (input) attacks,"Inputs crafted so a model misclassifies or misses what it is meant to catch, such as fraud, malware, or content and identity checks, without touching the model or its data",Inputs crafted to evade AI detection models,ATLAS AML.T0015; ATLAS AML.T0043; NIST AI 100-2 E2025 §2.2; Original,,active,,cause
AIRM-205,5. Security & Adversarial Threats,Inference-time (input) attacks,"Untrusted content the AI processes (e.g., user input, retrieved documents, tool results) treated with the same authority as the organization's own instructions",Untrusted content treated as instructions,OWASP LLM01; CSA AICM AIS-15,,active,,safeguard gap
AIRM-075,5. Security & Adversarial Threats,Output & integration security,Unsanitized output reaching downstream interpreters (code exec / XSS / SQLi),Unsanitized output reaching downstream interpreters,OWASP LLM10,,active,,cause
AIRM-076,5. Security & Adversarial Threats,Output & integration security,Interception or manipulation of the inference output stream,Interception or manipulation of the inference output stream,DASF 10.2,,active,,cause
AIRM-077,5. Security & Adversarial Threats,Output & integration security,Over-trusted output triggering unsafe automated actions,Over-trusted output triggering unsafe automated actions,OWASP LLM10 / LLM06,,active,,cause
AIRM-078,5. Security & Adversarial Threats,Supply-chain & artifact integrity,Compromised or malicious model / component from the AI supply chain,Compromised or malicious model from the AI supply chain,OWASP LLM04; NIST GenAI #12,→9,active,,cause
AIRM-079,5. Security & Adversarial Threats,Supply-chain & artifact integrity,Known vulnerabilities in ML dependencies and libraries left unpatched,Known vulnerabilities in ML dependencies left unpatched,OWASP LLM04,,active,,cause
AIRM-080,5. Security & Adversarial Threats,Supply-chain & artifact integrity,"Tampering with model artifacts, prompts, or agent configuration in registries or during deployment","Tampering with model artifacts, prompts, or configuration",DASF 7.3; ATLAS AML.T0010.004; Original,,active,,cause
AIRM-081,5. Security & Adversarial Threats,Supply-chain & artifact integrity,"Model-invented package, image, or endpoint names that resolve to adversary-registered artifacts, because the same hallucination recurs across users and model families",Model-invented dependencies registered by attackers,OWASP AISVS AC.13,,active,,cause
AIRM-082,5. Security & Adversarial Threats,AI access & identity,Inadequate access controls and usage limits on serving endpoints and inference APIs,Weak access controls and usage limits on AI endpoints,DASF 9.11,,active,,safeguard gap
AIRM-083,5. Security & Adversarial Threats,AI access & identity,Over-privileged service accounts and keys for AI platform components (distinct from an agent's tool scope),Over-privileged service accounts and keys for AI components,DASF 1.1; Original,,active,,safeguard gap
AIRM-084,5. Security & Adversarial Threats,AI access & identity,"Insecure storage / exposure of credentials and tokens, as AI tool, harness, and agent-framework sprawl outpaces credential governance",Credential sprawl as AI tools and agent frameworks outpace governance,DASF 13.19 / 13.27,,active,,safeguard gap
AIRM-085,5. Security & Adversarial Threats,AI access & identity,"Retrieval and RAG pipelines serving content beyond the requesting user’s own entitlements, because authorization is applied when the index is built rather than when it is queried",Retrieval serving content beyond the user’s own entitlements,OWASP AISVS 5.2.2,,active,,cause
AIRM-196,5. Security & Adversarial Threats,AI access & identity,"Insiders direct a sanctioned AI assistant or agent, within its broad access, to find, aggregate, or move data or take actions beyond their own entitlements, with the activity attributed to the agent rather than the person",Insiders use AI agents to reach beyond their own access,OWASP ASI T3; Original,,active,,cause
AIRM-086,"6. Safety, Ethics & Responsible AI",Bias & fairness,Discriminatory or biased outputs causing disparate impact,Discriminatory or biased outputs causing disparate impact,NIST GenAI #6; Weidinger I; Shelby,,active,,cause
AIRM-087,"6. Safety, Ethics & Responsible AI",Bias & fairness,"Inequitable performance or accessibility across languages, demographics, and disabilities, marginalizing underrepresented groups","Inequitable performance across languages, demographics, and disabilities",MIT 1.3; Shelby QoS; Original,,active,,cause
AIRM-088,"6. Safety, Ethics & Responsible AI",Bias & fairness,Bias amplification / homogenization from feedback and scale,Bias amplification / homogenization from feedback and scale,NIST GenAI #6,,active,,cause
AIRM-089,"6. Safety, Ethics & Responsible AI",Bias & fairness,"Culturally insensitive or inappropriate output, or erosion of local norms, when AI is scaled across regions",Culturally inappropriate output as AI scales across regions,Databricks AIGF,,active,,cause
AIRM-090,"6. Safety, Ethics & Responsible AI",Harmful / inaccurate output,"Generation of toxic, dangerous, or hateful content","Generation of toxic, dangerous, or hateful content",NIST GenAI #3; Weidinger I,,active,,cause
AIRM-091,"6. Safety, Ethics & Responsible AI",Harmful / inaccurate output,"Harmful, misleading, or defamatory output driving decisions","Harmful, misleading, or defamatory output driving decisions",NIST GenAI #2; Original,→4,active,,outcome
AIRM-092,"6. Safety, Ethics & Responsible AI",Harmful / inaccurate output,Inappropriate or unsafe AI output reaching minors or other vulnerable users,Inappropriate or unsafe AI output reaching minors or other vulnerable users,NIST GenAI #11; Colorado HB 26-1263,,active,,cause
AIRM-199,"6. Safety, Ethics & Responsible AI",Harmful / inaccurate output,No content guardrails constraining what a customer-facing AI service can publish or say on the organization's behalf,No guardrails on what customer-facing AI says in our name,Original,,active,,safeguard gap
AIRM-202,"6. Safety, Ethics & Responsible AI",Harmful / inaccurate output,"AI output that makes false or defamatory statements about real, identifiable people or organizations",AI makes false statements about real people or organizations,Original,,active,,cause
AIRM-093,"6. Safety, Ethics & Responsible AI","Transparency, disclosure & provenance",Failure to disclose to users that they are interacting with AI,Failure to disclose to users that they are interacting with AI,EU Art 50 (amended 2026); Weidinger V,,active,,cause
AIRM-094,"6. Safety, Ethics & Responsible AI","Transparency, disclosure & provenance",Undisclosed synthetic media / deepfakes lacking provenance,Undisclosed synthetic media / deepfakes lacking provenance,EU Art 50 (amended 2026); NIST GenAI #8,,active,,cause
AIRM-095,"6. Safety, Ethics & Responsible AI","Transparency, disclosure & provenance",Inadequate transparency to affected parties about AI's role,Inadequate transparency to affected parties about AI's role,EU Art 13; ISO A.8,,active,,cause
AIRM-192,"6. Safety, Ethics & Responsible AI","Transparency, disclosure & provenance","Changes to the model, prompts, or guardrails behind an AI-powered service we provide, made without notice to the customers and deployers who depend on it, so their validations, disclosures, and controls silently go stale","Our AI service changes under customers without notice, so their validations go stale",EU Art 13(3)(c); EU Art 25 (amended 2026); NIST GenAI #12,,active,,cause
AIRM-096,"6. Safety, Ethics & Responsible AI",Misuse & dual-use,"Misuse of AI for disinformation, fraud, or social engineering","Misuse of AI for disinformation, fraud, or social engineering",NIST GenAI; Weidinger IV; IAISR,,active,,cause
AIRM-097,"6. Safety, Ethics & Responsible AI",Misuse & dual-use,"Dangerous-capability uplift: the model gives meaningful help toward chemical, biological, radiological, nuclear, or cyber attack capability",Model gives meaningful help toward weapons or cyberattack capability,NIST GenAI #1; Weidinger IV; IAISR,→5,active,,cause
AIRM-098,"6. Safety, Ethics & Responsible AI",Misuse & dual-use,"AI optimized for a proxy measure (e.g., engagement, conversion, or revenue) that diverges from users' interests, driving addiction, polarization, or unsuitable recommendations",AI optimized for a proxy measure that diverges from users' interests,Shelby societal; MAS AIRG §1.9(c); Original,,active,,cause
AIRM-099,"6. Safety, Ethics & Responsible AI",Human agency & over-reliance,User over-trust / automation bias in AI outputs,User over-trust / automation bias in AI outputs,NIST GenAI #7; Weidinger V,,active,,amplifier
AIRM-100,"6. Safety, Ethics & Responsible AI",Human agency & over-reliance,Anthropomorphism and emotional dependence on conversational AI,Anthropomorphism and emotional dependence on conversational AI,Weidinger V; Colorado HB 26-1263,,active,,cause
AIRM-101,"6. Safety, Ethics & Responsible AI",Human agency & over-reliance,Erosion of meaningful human control over decisions,Erosion of meaningful human control over decisions,EU Art 14; MIT 5.2,,active,,amplifier
AIRM-102,"6. Safety, Ethics & Responsible AI",Human agency & over-reliance,"Human review, approval, and triage capacity cannot scale to the volume AI produces — code, alerts, content, decisions — so oversight gates degrade into rubber-stamping while still appearing effective","Review capacity cannot scale to AI output volume, degrading oversight to rubber-stamping",COSO GenAI 2026; OWASP AISVS AC.4; CRI MP-3.5.4,,active,,safeguard gap
AIRM-103,7. Operations & Resilience,MLOps & deployment,Immature MLOps / fragile deployment pipelines,Immature MLOps / fragile deployment pipelines,DASF 11.1; Original,,active,,safeguard gap
AIRM-104,7. Operations & Resilience,MLOps & deployment,Inconsistent or unsanctioned (shadow) model deployment,Inconsistent or unsanctioned (shadow) model deployment,DASF 8.3; Original,,active,,cause
AIRM-105,7. Operations & Resilience,MLOps & deployment,"Inadequate environment and configuration management across model versions, dependency pinning, and accelerator configuration, undermining reproducibility",Environment and config management gaps undermining reproducibility,DASF 12.5,,active,,safeguard gap
AIRM-106,7. Operations & Resilience,MLOps & deployment,"Training-serving skew: features or input data differ between training and production, degrading live performance",Training-serving skew degrading live performance,Databricks AIGF; Original,,active,,cause
AIRM-107,7. Operations & Resilience,MLOps & deployment,"Containment of AI tool or code execution, or of a test, evaluation, or development environment, fails — unverified, misconfigured, defeated, or degraded over time — allowing the system to reach production or third-party systems",AI tool-execution or test containment fails and AI reaches real systems,OpenAI/Anthropic 2026 incidents,,active,,safeguard gap
AIRM-108,7. Operations & Resilience,Monitoring & observability,"Absence of monitoring, acted on, for degraded performance, drift, biased outcomes, or abuse in any environment — including evaluation, test, and sandbox environments assumed to be contained","No monitoring, acted on, for drift, biased outcomes, or abuse",DASF 10.1; NIST Manage; CSA HF post-mortem,,active,,safeguard gap
AIRM-109,7. Operations & Resilience,Monitoring & observability,"Inadequate logging / audit of inputs, outputs, tool calls, agent decision paths, and the human authorization behind them","Inadequate logging of inputs, outputs, tool calls, agent decisions, and who authorized them",EU Art 12; DASF 10.1,,active,,safeguard gap
AIRM-110,7. Operations & Resilience,Monitoring & observability,"Inability to detect anomalous or degraded behavior, where non-determinism makes 'anomalous' hard to define and baseline",Non-determinism making anomalous behavior hard to define or detect,DASF 10.1; Original,,active,,safeguard gap
AIRM-111,7. Operations & Resilience,Monitoring & observability,Sanctioned agent activity indistinguishable from agentic attack in telemetry,Sanctioned agent activity indistinguishable from agentic attack in telemetry,CSA HF post-mortem,,active,,safeguard gap
AIRM-112,7. Operations & Resilience,Availability & scalability,Inference latency or unavailability degrading dependent services,Inference latency or unavailability degrading dependent services,Databricks AIGF; CSA AICM; Original,,active,,outcome
AIRM-113,7. Operations & Resilience,Availability & scalability,Inability to scale inference to peak demand,Inability to scale inference to peak demand,Original,,active,,cause
AIRM-114,7. Operations & Resilience,Availability & scalability,Deliberate resource exhaustion or denial-of-wallet: requests crafted to run up AI compute costs or exhaust capacity,Denial-of-wallet: attackers run up AI compute costs,OWASP LLM06,,active,,cause
AIRM-115,7. Operations & Resilience,Incident management,Immature AI incident response and escalation processes,Immature AI incident response and escalation processes,NIST Manage; CRI GV-4.3.2; DASF 12.3; Original,,active,,safeguard gap
AIRM-116,7. Operations & Resilience,Incident management,Inability to investigate AI incidents due to non-determinism / poor logs,Inability to investigate AI incidents due to non-determinism / poor logs,DASF 12.3; CRI MS-2.4.4; Original,,active,,safeguard gap
AIRM-117,7. Operations & Resilience,Incident management,Inadequate content-moderation / trust-&-safety operations at scale,Inadequate content-moderation / trust-&-safety operations at scale,Colorado HB 26-1263; Original,,active,,safeguard gap
AIRM-118,7. Operations & Resilience,Incident management,"Safety guardrails on models relied on for defense refusing to assist incident response, blocking analysis of attack data",Defensive model refuses to analyze attack data mid-incident,CSA HF post-mortem,,active,,cause
AIRM-201,7. Operations & Resilience,Incident management,"No tested way to quickly disable, or fall back from, a customer-facing AI feature that misbehaves",No tested off-switch or fallback for a misbehaving AI feature,NIST Manage; Original,,active,,safeguard gap
AIRM-119,7. Operations & Resilience,Change & lifecycle management,Silent vendor / model updates changing behavior without notice,Silent vendor / model updates changing behavior without notice,COSO GenAI 2026; OWASP AISVS 3.2.3; Original,,active,,cause
AIRM-120,7. Operations & Resilience,Change & lifecycle management,"Inadequate versioning, change control, and tested rollback to a known-good model version","Inadequate versioning, change control, and tested rollback to a known-good model version",DASF 8.3; CRI MG-4.1.4; Original,,active,,safeguard gap
AIRM-121,7. Operations & Resilience,Change & lifecycle management,Unmanaged model decommissioning / sunset leaving orphaned dependencies,Unmanaged model decommissioning / sunset leaving orphaned dependencies,CRI GV-1.7.1; CRI MG-2.4.2; Original,,active,,cause
AIRM-122,7. Operations & Resilience,Change & lifecycle management,"Uncontrolled continuous or online learning, where the model keeps changing in production without validation, introducing drift",Uncontrolled continuous learning introducing drift,DASF 5.2; Original,,active,,cause
AIRM-123,7. Operations & Resilience,Change & lifecycle management,"Guardrails, access scopes, and approval gates re-verified less often than the AI system's capability and integration surface changes",Controls re-verified less often than the AI system changes,2026 sandbox-escape incidents; Original,,active,,safeguard gap
AIRM-124,7. Operations & Resilience,Change & lifecycle management,"Prompts, system prompts, and retrieval configuration changed outside change control, though they determine system behavior as directly as code",Prompts and retrieval config changed outside change control,COSO GenAI 2026 Principle 11; OWASP AISVS AC.11,,active,,cause
AIRM-125,"8. Legal, Regulatory & Compliance",Regulatory compliance,Unknowingly deploying a prohibited or high-risk AI use case,Unknowingly deploying a prohibited or high-risk AI use case,EU Art 5 / Annex III,,active,,cause
AIRM-126,"8. Legal, Regulatory & Compliance",Regulatory compliance,"AI-specific legal and regulatory obligations (e.g., risk management, documentation, human oversight) not identified, or not built into the system before it is deployed",AI obligations not identified or built in before deployment,EU Arts 9-15,,active,,cause
AIRM-127,"8. Legal, Regulatory & Compliance",Regulatory compliance,"Inability to keep pace with fragmented, fast-changing AI regulation","Inability to keep pace with fragmented, fast-changing AI regulation",Colorado SB 26-189; CRI GV-1.1.1; Databricks AIGF; Original,,active,,safeguard gap
AIRM-128,"8. Legal, Regulatory & Compliance",Regulatory compliance,User inability to contest or seek recourse on an AI-driven decision,User inability to contest or seek recourse on an AI-driven decision,EU Arts 85 / 86; Colorado SB 26-189,,active,,safeguard gap
AIRM-129,"8. Legal, Regulatory & Compliance",Regulatory compliance,"Misclassifying the organization's regulatory role (deployer vs. provider), missing obligations triggered by fine-tuning or rebranding a model",Misclassified as deployer when fine-tuning makes you a provider,EU Arts 16 / 25,,active,,cause
AIRM-200,"8. Legal, Regulatory & Compliance",Regulatory compliance,"No ability to identify everyone a flawed AI decision or output affected once the flaw is found, and to notify and remediate them",No way to find and make whole everyone a flawed AI decision affected,Original,,active,,safeguard gap
AIRM-130,"8. Legal, Regulatory & Compliance",IP & liability,"Unsettled liability for harm caused by AI decisions or outputs, leaving the organization exposed to claims it cannot price or pass on",Unsettled liability for harm caused by AI decisions,Databricks AIGF; Original,,active,,amplifier
AIRM-131,"8. Legal, Regulatory & Compliance",IP & liability,AI-generated output that closely reproduces or imitates others' copyrighted work or trademarks,AI-generated output that closely reproduces or imitates others' copyrighted work or trademarks,NIST GenAI #10; Original,,active,,cause
AIRM-132,"8. Legal, Regulatory & Compliance",IP & liability,Uncertain ownership / copyrightability of AI-generated content,Uncertain ownership / copyrightability of AI-generated content,Databricks AIGF; Original,,active,,cause
AIRM-133,"8. Legal, Regulatory & Compliance",Contractual & licensing,"Vendor contracts lacking AI-specific terms: training use of your data, output ownership, model-change notice, evaluation rights","Vendor contracts lacking AI terms: training use, output ownership, change notice",CRI GV-6.2.3; Databricks AIGF; Original,,active,,safeguard gap
AIRM-134,"8. Legal, Regulatory & Compliance",Contractual & licensing,Use of open-weight or licensed models outside their license terms,Use of open-weight or licensed models outside their license terms,Databricks AIGF; Original,,active,,cause
AIRM-135,"8. Legal, Regulatory & Compliance",Contractual & licensing,Failure to update contracts as AI use and regulation evolve,Failure to update contracts as AI use and regulation evolve,CRI GV-6.2.3; Databricks AIGF; Cloud Risk Map analog; Original,,active,,safeguard gap
AIRM-198,"8. Legal, Regulatory & Compliance",Contractual & licensing,"No terms or visibility over how customers and partners use our data, insights, or AI outputs in their own AI, where training on them cannot be undone","Customers and partners feeding our data into their AI, with no terms or visibility",Original,,active,,safeguard gap
AIRM-136,"8. Legal, Regulatory & Compliance",Cross-border,"Personal or regulated data crossing borders through AI services, including inference requests a provider routes to other regions without visibility","Data crossing borders through AI services, including hidden routing",GDPR; Original,,active,,cause
AIRM-137,"8. Legal, Regulatory & Compliance",Cross-border,Conflicting regional AI requirements the organization cannot reconcile for a single system (externally imposed),Conflicting regional AI requirements the organization cannot reconcile for a single system (externally imposed),Databricks AIGF; Original,,active,,cause
AIRM-138,"8. Legal, Regulatory & Compliance",Cross-border,Inability to evidence and audit AI compliance across jurisdictions (internal evidence burden),Inability to evidence and audit AI compliance across jurisdictions (internal evidence burden),CRI GV-1.1.4; Databricks AIGF; Original,,active,,safeguard gap
AIRM-139,9. Third-Party & Model Supply Chain,Foundation-model dependence,Concentration risk from dependence on a few model providers,Concentration risk from dependence on a few model providers,IAISR; CRI GV-6.1.8; Original,,active,,amplifier
AIRM-140,9. Third-Party & Model Supply Chain,Foundation-model dependence,"Systemic / correlated ‘model monoculture’ — shared-model failure, including the same defect or blind spot reproduced across everything one model produces","Model monoculture, including one model's blind spot reproduced across everything it produces",IAISR; Original,,active,,amplifier
AIRM-141,9. Third-Party & Model Supply Chain,Foundation-model dependence,Model deprecation or behavior change forcing unplanned migration,Model deprecation or behavior change forcing unplanned migration,Original,,active,,cause
AIRM-142,9. Third-Party & Model Supply Chain,Vendor due diligence,"Inadequate vendor due diligence, including whether prompts and outputs are retained, used for training, or exposed to sub-processors","Vendor diligence missing: are prompts retained, trained on, or shared?",NIST GenAI #12; CRI GV-6.1.4; Original,,active,,safeguard gap
AIRM-188,9. Third-Party & Model Supply Chain,Vendor due diligence,"No defined method to assess whether a vendor's claimed AI capability is real, secure, and fit for purpose: conventional vendor assurance says nothing about model behavior, and the buyer inherits whatever sits behind the claim",No way to verify a vendor's 'AI-powered' claim before buying it,CRI GV-6.1.1; Original,,active,,safeguard gap
AIRM-143,9. Third-Party & Model Supply Chain,Vendor due diligence,Vendor viability risk in an unusually volatile provider market with frequent pivots and deprecations,Vendor viability risk in an unusually volatile provider market with frequent pivots and deprecations,Original,,active,,cause
AIRM-144,9. Third-Party & Model Supply Chain,Vendor due diligence,"Accountability for a vendor's AI failures staying with the organization, whatever the contract says","Accountability for a vendor's AI failures staying with the organization, whatever the contract says",EU Art 25 (amended 2026); Original,,active,,amplifier
AIRM-145,9. Third-Party & Model Supply Chain,Lock-in & portability,Vendor / model lock-in limiting portability and leverage,Vendor / model lock-in limiting portability and leverage,Original,,active,,cause
AIRM-146,9. Third-Party & Model Supply Chain,Lock-in & portability,High switching cost from proprietary APIs and fine-tuning,High switching cost from proprietary APIs and fine-tuning,Original,,active,,cause
AIRM-147,9. Third-Party & Model Supply Chain,Lock-in & portability,"Lack of exit provisions, where fine-tunes, embeddings, and prompt assets do not transfer between providers","Lack of exit provisions, where fine-tunes, embeddings, and prompt assets do not transfer between providers",Cloud Risk Map analog; Original,,active,,safeguard gap
AIRM-148,9. Third-Party & Model Supply Chain,Open-source component risk,Malicious or compromised open-source models / components,Malicious or compromised open-source models / components,OWASP LLM04; DASF 7.1; DASF 5.4,→5,active,,cause
AIRM-149,9. Third-Party & Model Supply Chain,Open-source component risk,"Open-source AI dependencies abandoned by their maintainers, leaving no fixes, support, or upgrade path",Open-source AI dependencies abandoned by their maintainers,OWASP LLM04; Original,,active,,cause
AIRM-150,9. Third-Party & Model Supply Chain,Open-source component risk,"Opaque sub-processor chains, including models served behind a vendor's own API, or AI embedded as unannounced features in a service, without disclosure","Opaque sub-processors, including undisclosed models and embedded AI features",CRI GV-6.1.6; MAS AIRG §4.2 / fn 21; Original,,active,,cause
AIRM-189,9. Third-Party & Model Supply Chain,Open-source component risk,"Models and AI components deployed without verifying their integrity or lineage: a tampered artifact goes undetected, and an upstream flaw cannot be scoped to the models that descend from it",Models deployed without verifying integrity or lineage,OWASP AISVS 6.2; Cisco/VAIL provenance-entanglement research 2026; Original,,active,,safeguard gap
AIRM-191,9. Third-Party & Model Supply Chain,Open-source component risk,"Safety training absent, stripped, or eroded in a self-hosted or fine-tuned model (e.g., abliteration, drift from benign fine-tuning, or a variant sourced without it), so guardrails have nothing beneath them",Safety training stripped or eroded in a self-hosted model,NIST GenAI MS-2.7-008; IAISR; OWASP LLM04,,active,,cause
AIRM-151,"10. Workforce, Human & Societal",Skills & talent,"Shortage of AI and AI-risk talent, competing against AI-native employers for scarce skills","Shortage of AI and AI-risk talent, competing against AI-native employers for scarce skills",Original,,active,,cause
AIRM-152,"10. Workforce, Human & Societal",Skills & talent,"Inability to retain specialists, who leave taking undocumented model and prompt knowledge with them","Inability to retain specialists, who leave taking undocumented model and prompt knowledge with them",Cloud Risk Map analog; Original,,active,,cause
AIRM-153,"10. Workforce, Human & Societal",Skills & talent,"Inadequate AI literacy across the workforce, so staff cannot use, question, or oversee the AI they work with",Inadequate AI literacy across the workforce,EU Art 4 (amended 2026); CRI GV-1.2.4; CSA AICM; Original,,active,,safeguard gap
AIRM-195,"10. Workforce, Human & Societal",Skills & talent,"Leaders do not understand how AI differs from earlier technology change (e.g., probabilistic output, capability that shifts mid-rollout, value that depends on redesigning work), so they manage it as a conventional IT rollout and cannot guide the organization through adoption",Leaders manage AI like a conventional IT rollout,Original,,active,,cause
AIRM-154,"10. Workforce, Human & Societal",Deskilling & loss of institutional knowledge,Erosion of staff expertise through over-delegation to AI,Erosion of staff expertise through over-delegation to AI,MIT 5.2; Databricks AIGF; Original,,active,,cause
AIRM-155,"10. Workforce, Human & Societal",Deskilling & loss of institutional knowledge,Loss of institutional knowledge as AI replaces human processes,Loss of institutional knowledge as AI replaces human processes,Original,,active,,cause
AIRM-156,"10. Workforce, Human & Societal",Deskilling & loss of institutional knowledge,Capability atrophy — inability to operate if AI is unavailable,Capability atrophy — inability to operate if AI is unavailable,Original,,active,,safeguard gap
AIRM-157,"10. Workforce, Human & Societal",Workforce disruption / change,"Change management underestimated — sponsorship, communication, and transition support for a change to the nature of the work itself, where capability keeps shifting mid-rollout",Change management underestimated as AI reshapes the work itself,Original,,active,,cause
AIRM-158,"10. Workforce, Human & Societal",Workforce disruption / change,Workforce resistance or low adoption driven by displacement fear or distrust of AI output,Workforce resistance or low adoption driven by displacement fear or distrust of AI output,Original,,active,,cause
AIRM-159,"10. Workforce, Human & Societal",Workforce disruption / change,Labor-relations and morale impacts of AI deployment,Labor-relations and morale impacts of AI deployment,MIT 6.2; Original,,active,,outcome
AIRM-160,"10. Workforce, Human & Societal",Societal & reputational,"Reputational damage from a visible AI failure or misuse, amplified because AI errors draw outsized attention and people lose confidence in an algorithm faster than in a person making the same mistake",Reputational damage amplified when AI fails in public,Databricks AIGF; Original,,active,,amplifier
AIRM-161,"10. Workforce, Human & Societal",Societal & reputational,"Customers and stakeholders distrust or avoid AI-mediated services, so adoption and returns fall short",Customers distrust or avoid AI-mediated services,Databricks AIGF; Original,,active,,cause
AIRM-162,"10. Workforce, Human & Societal",Societal & reputational,"AI decisions or actions affecting people who never chose to use the system (e.g., decision subjects, bystanders, communities)",AI decisions affecting people who never chose to use the system,Shelby societal,,active,,cause
AIRM-163,"10. Workforce, Human & Societal",Societal & reputational,"Overstating AI capability to customers, investors, or regulators (AI-washing), inviting enforcement and loss of trust","AI-washing: overstating capability to customers, investors, or regulators",Original,,active,,cause
AIRM-164,11. Financial & Resource,Cost & compute economics,"Uncontrolled AI consumption, as usage grows, agents loop, or routine work goes to premium models, driving up inference and training spend",Uncontrolled AI consumption driving up inference spend,OWASP LLM06; Original,,active,,cause
AIRM-165,11. Financial & Resource,Cost & compute economics,"Poor cost forecasting, because inference cost scales with usage rather than seats or provisioned capacity, and rises non-linearly as pilots reach production volume",Poor AI cost forecasting as usage scales to production,Databricks AIGF; Original,,active,,cause
AIRM-166,11. Financial & Resource,Cost & compute economics,"Energy and water demands of AI training and inference, not measured or weighed in model and deployment choices, causing environmental harm and undermining sustainability commitments",AI's energy and water use unmeasured and unweighed,NIST GenAI #5; Weidinger VI; MIT 6.6,,active,,cause
AIRM-167,11. Financial & Resource,Investment / procurement,"Stranded investment in failed or abandoned AI initiatives, including initiatives scaled before the evidence supported them or kept funded past the point of failure because their value is hard to attribute","Stranded investment, including AI scaled too early or funded past failure",Databricks AIGF; Original,→2,active,,outcome
AIRM-168,11. Financial & Resource,Investment / procurement,"Procurement exposure where providers reprice tokens, tiers, or context windows unilaterally","Procurement exposure where providers reprice tokens, tiers, or context windows unilaterally",Original,,active,,cause
AIRM-169,11. Financial & Resource,Investment / procurement,"Cyber or liability insurance excludes, sub-limits, or reprices AI-related losses, or defines 'user' in terms that exclude non-human actors","Insurance excludes AI losses, or defines 'user' as human only",CSA HF post-mortem; Original,,active,,safeguard gap
AIRM-170,11. Financial & Resource,Scaling & resource constraints,"Compute, GPU, or power scarcity constraining scaling","Compute, GPU, or power scarcity constraining scaling",Original,,active,,cause
AIRM-172,11. Financial & Resource,Scaling & resource constraints,Concentration of compute supply among few providers,Concentration of compute supply among few providers,IAISR; Original,,active,,amplifier
AIRM-173,12. Autonomy & Delegated Action (Agentic AI),"Autonomy, alignment & oversight",Agent pursues unintended goals or misgeneralizes its objective,Agent pursues unintended goals or misgeneralizes its objective,IAISR; OWASP ASI T6,,active,,cause
AIRM-174,12. Autonomy & Delegated Action (Agentic AI),"Autonomy, alignment & oversight",Agent pursues an authorized objective through unauthorized means,Agent pursues an authorized objective through unauthorized means,OpenAI 2026 incident; IAISR,,active,,cause
AIRM-175,12. Autonomy & Delegated Action (Agentic AI),"Autonomy, alignment & oversight",Excessive autonomy / agency beyond intended mandate,Excessive autonomy / agency beyond intended mandate,OWASP LLM03; DASF 9.13,,active,,cause
AIRM-176,12. Autonomy & Delegated Action (Agentic AI),"Autonomy, alignment & oversight",No human checkpoint or working interrupt / kill switch for an agent mid-task,No human checkpoint or working interrupt / kill switch for an agent mid-task,EU Art 14; OWASP ASI,,active,,safeguard gap
AIRM-203,12. Autonomy & Delegated Action (Agentic AI),"Autonomy, alignment & oversight","Agents able to change their own instructions, tools, memory, or code, so their behavior drifts beyond what was approved",Agents that rewrite their own instructions or tools,Original,,active,,cause
AIRM-177,12. Autonomy & Delegated Action (Agentic AI),Tool access & authorization,Agent granted a broader set of invokable tools / functions than its task requires,Agent granted a broader set of invokable tools / functions than its task requires,OWASP LLM03 / ASI,,active,,safeguard gap
AIRM-178,12. Autonomy & Delegated Action (Agentic AI),Tool access & authorization,"Agent identity misuse, impersonation, or delegated-credential abuse","Agent identity misuse, impersonation, or delegated-credential abuse",OWASP ASI T9; DASF 13.9,,active,,cause
AIRM-179,12. Autonomy & Delegated Action (Agentic AI),Tool access & authorization,Third-party tool and connector servers adopted as a credentialed execution surface without the vetting applied to models or libraries,Third-party tool/connector servers as an unvetted execution surface,OWASP AISVS C10.1 / AC.2; CSA AICM,,active,,safeguard gap
AIRM-180,12. Autonomy & Delegated Action (Agentic AI),Memory & context integrity,Memory poisoning corrupting agent state across sessions,Memory poisoning corrupting agent state across sessions,OWASP ASI T1; DASF 13.1; ATLAS AML.T0080.000; Original,,active,,cause
AIRM-181,12. Autonomy & Delegated Action (Agentic AI),Memory & context integrity,Context-window manipulation altering agent behavior,Context-window manipulation altering agent behavior,OWASP ASI; OWASP LLM01,,active,,cause
AIRM-182,12. Autonomy & Delegated Action (Agentic AI),Memory & context integrity,Persistence of corrupted or sensitive data in agent memory,Persistence of corrupted or sensitive data in agent memory,OWASP ASI; OWASP AISVS 8.3; Original,,active,,cause
AIRM-183,12. Autonomy & Delegated Action (Agentic AI),Multi-agent orchestration,Cascading failures or loops across interacting agents,Cascading failures or loops across interacting agents,OWASP ASI T5; MIT 7.6,,active,,amplifier
AIRM-184,12. Autonomy & Delegated Action (Agentic AI),Multi-agent orchestration,Misplaced inter-agent trust or agent collusion,Misplaced inter-agent trust or agent collusion,OWASP ASI T13; MIT 7.6,,active,,cause
AIRM-185,12. Autonomy & Delegated Action (Agentic AI),Multi-agent orchestration,"Emergent, unpredictable behavior in multi-agent systems","Emergent, unpredictable behavior in multi-agent systems",IAISR; MIT 7.6,,active,,cause
AIRM-186,12. Autonomy & Delegated Action (Agentic AI),Action integrity & traceability,"Agents able to take irreversible real-world actions through tools, APIs, or code execution, so an error or hijack becomes a loss before anyone can intervene",Agents able to take irreversible real-world actions,OWASP ASI T2; DASF 13.2; Original,,active,,amplifier
AIRM-187,12. Autonomy & Delegated Action (Agentic AI),Action integrity & traceability,Accountability gap for harm caused by autonomous action,Accountability gap for harm caused by autonomous action,Databricks AIGF; Original,→1,active,,safeguard gap
AIRM-190,12. Autonomy & Delegated Action (Agentic AI),Action integrity & traceability,"Agent actions not attributable to the organization by the external parties they affect, so those parties cannot detect, warn of, or contest them","Third parties can't tell your agent acted, so no one can warn you",CSA HF post-mortem; OWASP ASI T8; Original,,active,,safeguard gap
AIRM-171,11. Financial & Resource,Scaling & resource constraints,Cost non-linearity as usage scales to production volume,Cost non-linearity as usage scales to production volume,Original,,retired,AIRM-165,