This work investigates the design of robust risk models to assess societal risks posed by advanced AI systems, an emerging area in AI governance, and identifies a structured agenda of open questions concerning model structure, scope, evidence integration, validation, and governance.
Abstract
We investigate the design of robust risk models to assess societal risks posed by advanced AI systems, an emerging area in AI governance. Many regulatory proposals increasingly require systemic risk assessment, but in the absence of rigorous quantitative methods, the question remains what state of the art risk modeling should look like in practice. We identify the key methodological and institutional challenges that currently limit the adoption of risk modeling. We review five research traditions that inform this problem: probabilistic risk assessment, catastrophic AI risk analysis, cybersecurity risk quantification, Bayesian causal inference, and threshold-based governance. We compare two leading proposals, scenario-based risk estimation and Bayesian network-based threshold setting. Drawing on a workshop with 22 experts and subsequent analysis, we identify a structured agenda of open questions concerning model structure, scope, evidence integration, validation, and governance. We close by outlining priorities for progress, arguing that it will depend on integrating quantitative modeling with independent evaluation, transparent and tiered disclosure, and institutions capable of maintaining and updating risk models over time.
The resulting EU AI Act Risk Source List takes an important step towards bridging the gap between legal obligation and AI risk management practice, providing a structured reference for explicit comparison between existing AI risk taxonomies and the risk sources implicitly addressed by the EU AI Act.
Ronald Schnitzer, Mike Auer, Rumpa Choudhury et al.· 0 citations
This analysis finds substantial variation in coverage: AI risks related to robustness, system security, and governance receive more attention than socioeconomic, environmental, and emerging risks, including multi-agent risks.
Ting-Hung Ho, Angelica Chowdhury, James Teague et al.· 0 citations
This paper investigates whether the concept of risk applies to AI agents. The EU AI Act, in force since 2024, grounds its regulatory architecture in a product-based model of risk: one that presupposes an intended purpose, (a bounded space of) reasonably foreseeable misuses, and a tractable distribution of potential...
Federico L. G. Faroldi· European Journal of Risk Reg...· 0 citations
It is argued that insurers which proactively integrate AI governance into core ERM processes, supported by cross-functional collaboration between risk, compliance, data protection, and technology teams, will be best positioned to realise AI’s benefits while maintaining consumer trust, regulatory compliance, and resilie...
A large-scale structured literature review combined with network-based bibliometric analysis is conducted to systematically examine how adversarial AI security is conceptualized and addressed within the broader AI governance and management perspective.
Mariusz Rafało· 6th Current Issues in Busine...· 0 citations