GCRI · Fields across the Consortium
Artificial intelligence
AI risk management asks what a system can do, how it fails, who is affected and who is accountable. The lifecycle matters: capability can change after deployment, and harms can be diffuse.
Artificial intelligence in six parts.
The field, seen three ways.
From model failure to systemic effect.
Individual AI failures (biased outputs, hallucinated facts, unsafe actions by an agent) are well catalogued. Systemic effects arise when many actors use similar models trained on similar data, when AI is embedded in critical decisions such as credit or triage, or when capability shifts faster than oversight. Assessment has to cover the model, the system it sits in and the institution operating it.
| Layer | Typical risk | Assessment |
|---|---|---|
| Model | Robustness, bias, capability for misuse | Evaluations and red teaming |
| System | Integration errors, over-reliance, data leakage | Impact assessment, human oversight design |
| Institution | Unclear accountability, missing incident response | Management system audit (ISO/IEC 42001) |
| Ecosystem | Homogeneity, concentration, correlated failure | Market and dependency analysis |
Risk frameworks and law.
| Framework or body | What it governs or supplies |
|---|---|
| NIST AI RMF and its generative AI profile | Govern, map, measure and manage functions |
| ISO/IEC 42001 and ISO/IEC 23894 | AI management systems and AI risk management guidance |
| EU AI Act | Risk-tiered obligations applied in stages; check current dates for each obligation |
| OECD AI Principles and UNESCO Recommendation on the Ethics of AI | Intergovernmental principles |
Where AI risk lands.
- Compute: capability concentration and energy demand.
- Work: task exposure and transition.
- Information integrity: synthetic content and trust.
- Financial stability: model risk and herding.
The science sits on AI and Autonomous Systems; methods start from AI assurance.
The methods behind the field.
- Artificial intelligence and machine learning
- AI evaluation and assurance engineering
- High-performance, cloud and edge computing
- Probability and statistics
- Cybersecurity and cryptography
- Social and behavioural science
- Robotics and automation
- Economics and development economics
- Econometrics
- Policy, institutional and decision science
- Systems engineering
- Digital identity and public digital systems
- Uncertainty quantification and model validation
Where this page’s references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
Why does GCRI host field gateways?
Contribute evidence from this page.
Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.