Free resource · 47-page PDF + Excel workbook · English or French
AI Risk Reference: 1,612 documented AI risks, sorted for business use
A review run at MIT identified 1,612 documented AI risks in 65 reference documents. It is a research piece: it describes risks without saying what to do about them. This document adds what a business needs: how each risk shows up in practice, the warning signs, the expected controls and the regulations that apply.
For an SME of 20 to 100 people
Not all 24 sub-domains apply to you. If your teams use ChatGPT, Copilot or a similar assistant, start with these risks, all described in the document:
- Client or staff data pasted into an unapproved tool (chapter 4).
- A confident but wrong answer sent to a client, or an unsourced figure in a quote (chapter 5).
- CEO or fake-supplier fraud, by email or video call (chapter 6).
- Reviewing on autopilot: approving without reading (chapter 7).
- Dependence on a single vendor, and who owns the documents produced (chapter 8).
- For the rest: a list of your uses, a one-page policy and one person in charge. That is what we set up in AI Adoption Support (from CHF 1,800/month (10 h) excl. VAT).
Get the document
Receive the complete reference.
Fill in the form: the PDF and the Excel workbook are available as soon as it is validated.
What's inside
Why a reference
The three figures that should change your approach, including this one: 54% of risks appear after go-live.
Where this data comes from
The review method, the two classifications used and six limitations of the corpus, stated plainly.
Discrimination and toxic content
204 risks: assisted candidate screening, content sent to customers, uneven quality across languages.
Privacy and security
173 risks: leaks through ordinary use, inferences about people, poorly separated document search, instructions hidden in a document.
Misinformation
64 risks: the invented reference, the unsourced figure, the confident and wrong answer to a customer.
Malicious actors and misuse
235 risks: CEO fraud on a video call, fake suppliers, impersonation of your company.
People and the tool
89 risks: over-reliance, reviews that become a formality, loss of skills.
Economic and environmental effects
274 risks: vendor dependence, employment, ownership of documents produced, footprint.
System failures
370 risks, including those that belong to the tool’s developer, kept apart from what concerns you.
The criticality matrix
A four-level scale and a matrix by type of organisation, cutting 24 sub-domains down to a short list.
What regulation says
EU AI Act, Swiss data protection act, ISO/IEC 42001, FINMA guidance, and the four documents that are enough today.
The register: how to run it
The eight-column template, the update rhythm, and how to check every figure at source.
For management, compliance and IT.
Who this document is for
The document is aimed at organisations of 200 to 2,000 employees. For a smaller SME, the box above says where to start.
Management and board
You must be able to state, in writing, what can go wrong, who answers for it and what you decided to rule out.
Risk, compliance, legal
You want a solid basis rather than an in-house list: 65 reference documents, a published method, every figure verifiable.
IT and security
The warning signs and expected controls are written out plainly, sub-domain by sub-domain, and reusable as they are.
Source, licence and what we added
The corpus comes from the MIT AI Risk Repository (v3, 26 March 2025), distributed under the Creative Commons Attribution 4.0 licence. We restructured, translated and enriched it; the full list of modifications is in chapter 12. MIT has not reviewed, validated or endorsed this adaptation: the manifestations, warning signs, controls, criticality levels and regulatory mapping are Numezis’s alone. This document is not legal advice.
Frequently asked questions
Is it free?
Yes. The PDF and the Excel workbook are complete: no paid version hidden behind a sales call.
What exactly is the source?
The MIT AI Risk Repository, version 3 of 26 March 2025, distributed under CC BY 4.0: a review of 65 reference documents from which 1,612 risks were extracted and classified. We cite the source, indicate our modifications and keep the original file. MIT has neither reviewed nor endorsed our adaptation.
What did you add to the MIT corpus?
The rewriting of the 24 definitions for management, concrete manifestations in a company, warning signs, expected controls, the four-level criticality scale, the matrix by type of organisation, the EU AI Act / Swiss data protection / ISO 42001 mapping and the register template. These contributions are presented as ours, never as MIT’s.
Do all 24 sub-domains apply to me?
No, and the document says so. Most organisations keep 8 to 12 after sorting; an SME often fewer. Chapter 10 gives the method for ruling out the others with a written reason.
What does the Excel workbook contain?
All 1,612 risks, filterable, with their original description and source, both classifications, the 65 source documents and the blank register template. Original descriptions are kept in English, word for word.
Is this legal advice?
No. Chapter 11 places the sub-domains against the EU AI Act, the Swiss data protection act and ISO/IEC 42001 so you know where to look. The law is stated as of August 2026 and must be checked for your own situation.