AI risk ontologies help meet EU AI Act documentation rules
AI Risk Ontologies for the EU AI Act Compliance: AIRO, VAIR, and their Integration with DPV
Computers and SocietyArtificial Intelligence
Summary
AI systems can have risks that need to be carefully tracked, especially under the new European Union rules. The authors created tools called AIRO and VAIR to organize information about AI risks clearly and consistently. They based these tools on international standards and connected them with an existing data privacy vocabulary to cover both AI and data risks together. This helps companies and regulators to more easily manage and document AI risks as required by law.
What this means in practice
- •For compliance teams: Document AI system risks following EU regulations using integrated AIRO and VAIR ontologies.
- •For software developers: Embed standardized AI risk ontologies into AI tools to support legal risk management workflows.
Authors
Delaram Golpayegani, Harshvardhan J. Pandit, Declan O'Sullivan, Dave Lewis
Abstract
As the use of AI, and consequently its harms, becomes more prevalent, the global discourse around AI has become increasingly risk-aware. With new risks emerging more frequently than ever, a key challenge is how to represent, document, and catalogue AI risks in an effective, interoperable, and queryable manner. Additionally, the European Union (EU) AI Act's requirements for "high-risk" AI systems to manage and document the risks creates the need for open and interoperable tools, methods, and standards that facilitate AI risk management in an ever-changing environment. In this paper, we present ontologies and taxonomies developed to assist with risk management and documentation, in line with the requirements of the EU the AI Act. We developed the AI Risk Ontology (AIRO) to specify AI use cases and their associated risks, complemented by the Vocabulary of AI Risks (VAIR), which populates AIRO with taxonomies of concepts. Key international standards on AI and risk, namely ISO/IEC 23894 on AI risk management and ISO/IEC 22989 on AI terminology informed the development of the ontologies. To promote reuse and enable multi-regulatory compliance, AIRO and VAIR have been integrated in the Data Privacy Vocabulary (DPV) through a consensus-building process, expanding DPV's scope from data to AI.