About the Eticas AI Risk Taxonomy

The Eticas AI Risk Taxonomy is a unified, machine-readable vocabulary of AI risk categories developed for use across Eticas’ audit methodologies, assessment frameworks, and reporting outputs. It is maintained by Eticas and published with stable per-concept URIs and a SKOS representation, making it interoperable with knowledge graphs, linked data systems, and semantic web tools.

Purpose and scope

The taxonomy provides a canonical structured vocabulary for naming and locating AI risks, suitable for citation in audit reports, regulatory submissions, research publications, and external framework cross-walks. Each concept carries a definition, alternative labels, lifecycle stage applicability, and formal cross-references to equivalent or related concepts in fourteen external frameworks.

External frameworks are organised in three buckets:

• Compliance instruments — EU AI Act (Regulation 2024/1689), ISO/IEC 42001:2023, AIUC-1, and the Council of Europe Framework Convention on AI (CETS 225).
• Reference frameworks — NIST AI Risk Management Framework (AI 100-1), NIST AI 600-1 (Generative AI Profile), OECD AI Principles (2024 update), TC260 (China’s AI Safety Governance Framework v2.0), the CSA Agentic Profile, and the OWASP Top 10 for Agentic Applications 2026.
• Academic taxonomies and vocabularies — MIT AI Risk Repository V4, AIR 2024, IBM AI Risk Atlas, and W3C Data Privacy Vocabulary v2.3.

The bucketing matters in practice: the compliance bucket lets auditors demonstrate adherence to specific obligations, while the reference and academic buckets establish conceptual interoperability with the wider AI-risk research and policy ecosystem.

Structure

The taxonomy is organised in three levels — categories, sub-groups, and subcategories — covering ten top-level risk areas:

• Bias & Fairness
• Privacy & Confidentiality
• Reliability
• Governance
• Security & Misuse
• Environmental Impact
• Transparency & Explainability
• Autonomy & Agency
• Organisational Readiness
• Agentic AI

Not every category has sub-groups; categories with few subcategories (Environmental Impact, Organisational Readiness) keep a flat structure. Concepts carry a maturity field — established or emerging — reflecting how settled their definition and assessment methods are.

A subset of the taxonomy is published on the public site — categories and sub-groups at established maturity, without match-type qualifiers on the external mappings. The full taxonomy, including all subcategories, emerging-maturity concepts, and match-type-qualified mappings, is retained internally as the source of truth and as a working surface for ongoing methodology development.

Licence and scope

The boundary between public and internal content also marks the licensing boundary.

Public taxonomy — published under CC BY 4.0. What is covered by this open licence:

• The browsable taxonomy at /risk/ — categories and sub-groups at established maturity.
• The SKOS distributions at /dist/taxonomy.ttl and /dist/taxonomy.jsonld — filtered to match the browsable public view.
• This About page and the public landing.

The SKOS distributions emit a dcterms:license triple pointing to the CC BY 4.0 deed, making the licence assertion machine-readable alongside the content.

Internal taxonomy — proprietary to Eticas. What sits on the internal side and is not covered by CC BY 4.0:

• The full browsable taxonomy at /risk-internal/ (Cloudflare Access required) — all subcategories, emerging-maturity concepts, retired concepts retained for institutional memory, match-type-qualified mappings, per-mapping citations.
• The full SKOS distributions at /dist-internal/taxonomy.ttl and /dist-internal/taxonomy.jsonld (Cloudflare Access required). These distributions deliberately do not emit a dcterms:license triple — the absence is intentional, and consumers must not assume any open licence.
• The YAML source, the build pipeline, and the project’s internal documentation.

The open-core split reflects how Eticas uses the taxonomy in practice. The public surface is the canonical structured vocabulary that external parties can cite and remix; the internal surface is a working source where ongoing methodology and assessment-practice development takes place.

How to cite

Eticas. (2026). Eticas AI Risk Taxonomy, v1.4.0.
https://taxonomy.eticas.ai/risk/

The taxonomy follows Semantic Versioning: major for structural breaks affecting concept identifiers, minor for new categories or new framework mappings or schema additions, patch for definition refinements. Concept URIs (e.g., https://taxonomy.eticas.ai/risk/bias-fairness) are committed as stable for external citation from v1.0 onwards.

Contact

For corrections, alignment suggestions, or collaboration enquiries, contact Eticas at eticas.ai.