Back to Risk Catalogue

EU AI Act

Regulation (EU) 2024/1689 establishing harmonised rules on artificial intelligence across the European Union.

II.A5 Prohibited AI Practices

Risks

RI-10Prompt Injection RI-14Inadequate System Alignment RI-16Bias and Discrimination RI-20Reputational Risk

III.S1.A6: Classification Rules for High-Risk AI Systems

Risks

RI-18Model Overreach / Expanded Use

III.S2.A8: Compliance with the Requirements

Risks

RI-22Regulatory Compliance and Oversight

III.S2.A9: Risk Management System

Risks

RI-14Inadequate System Alignment RI-16Bias and Discrimination RI-19Data Quality and Drift RI-20Reputational Risk RI-04Hallucination and Inaccurate Outputs RI-05Foundation Model Versioning RI-06Non-Deterministic Behaviour

Mitigations

MI-05System Acceptance Testing

III.S2.A10: Data and Data Governance

Risks

RI-16Bias and Discrimination RI-19Data Quality and Drift RI-01Information Leaked To Hosted Model RI-22Regulatory Compliance and Oversight RI-23Intellectual Property (IP) and Copyright RI-02Information Leaked to Vector Store RI-09Data Poisoning

Mitigations

MI-06Data Quality & Classification/Sensitivity

III.S2.A11: Technical Documentation

Risks

RI-23Intellectual Property (IP) and Copyright

III.S2.A12: Record-Keeping

Mitigations

MI-21Agent Decision Audit and Explainability

III.S2.A13: Transparency and Provision of Information to Deployers

Risks

RI-17Lack of Explainability RI-01Information Leaked To Hosted Model RI-04Hallucination and Inaccurate Outputs

Mitigations

MI-13Providing Citations and Source Traceability for AI-Generated Information MI-21Agent Decision Audit and Explainability

III.S2.A14: Human Oversight

Risks

RI-10Prompt Injection RI-14Inadequate System Alignment RI-16Bias and Discrimination RI-17Lack of Explainability RI-18Model Overreach / Expanded Use RI-20Reputational Risk RI-06Non-Deterministic Behaviour

Mitigations

MI-11Human Feedback Loop for AI Systems MI-24Human-in-the-Loop Action Approval Gate

III.S2.A15: Accuracy, Robustness and Cybersecurity

Risks

RI-10Prompt Injection RI-19Data Quality and Drift RI-02Information Leaked to Vector Store RI-04Hallucination and Inaccurate Outputs RI-05Foundation Model Versioning RI-06Non-Deterministic Behaviour RI-07Availability of Foundational Model RI-08Tampering With the Foundational Model RI-09Data Poisoning

Mitigations

MI-05System Acceptance Testing

III.S3.A16: Obligations of Providers of High-Risk AI Systems

Risks

RI-22Regulatory Compliance and Oversight RI-02Information Leaked to Vector Store RI-08Tampering With the Foundational Model

III.S3.A21: Cooperation with Competent Authorities

Risks

RI-22Regulatory Compliance and Oversight

III.S3.A26: Obligations of Deployers of High-Risk AI Systems

Risks

RI-18Model Overreach / Expanded Use RI-07Availability of Foundational Model

Mitigations

MI-21Agent Decision Audit and Explainability

III.S3.A27: Fundamental Rights Impact Assessment for High-Risk AI Systems

Risks

RI-16Bias and Discrimination RI-22Regulatory Compliance and Oversight

IV.A50 Transparency Obligations for Providers and Deployers of Certain AI Systems

Risks

RI-17Lack of Explainability

V.S2.A53: Obligations for Providers of General-Purpose AI Models

Risks

RI-01Information Leaked To Hosted Model RI-23Intellectual Property (IP) and Copyright RI-05Foundation Model Versioning RI-07Availability of Foundational Model RI-08Tampering With the Foundational Model RI-09Data Poisoning

IX.S1.A72: Post-Market Monitoring by Providers and Post-Market Monitoring Plan for High-Risk AI Systems

Mitigations

MI-11Human Feedback Loop for AI Systems MI-21Agent Decision Audit and Explainability

IX.S4.A86: Right to Explanation of Individual Decision-Making

Risks

RI-17Lack of Explainability

Mitigations

MI-13Providing Citations and Source Traceability for AI-Generated Information MI-21Agent Decision Audit and Explainability