AIRO: An Ontology for Representing AI Risks Based on the Proposed EU AI Act and ISO Risk Management Standards

Abstract

The growing number of incidents caused by (mis)using Artificial Intelligence (AI) is a matter of concern for governments, organisations, and the public. To control the harmful impacts of AI, multiple efforts are being taken all around the world from guidelines promoting trustworthy development and use, to standards for managing risks and regulatory frameworks. Amongst these efforts, the first-ever AI regulation proposed by the European Commission, known as the AI Act, is prominent as it takes a risk-oriented approach towards regulating development and use of AI within systems. In this paper, we present the AI Risk Ontology (AIRO) for expressing information associated with high-risk AI systems based on the requirements of the proposed AI Act and ISO 31000 series of standards. AIRO assists stakeholders in determining ‘high-risk’ AI systems, maintaining and documenting risk information, performing impact assessments, and achieving conformity with AI regulations. To show its usefulness, we model existing real-world use-cases from the AIAAIC repository of AI-related risks, determine whether they are high-risk, and produce documentation for the EU’s proposed AI Act.

Towards a Taxonomy of AI Risks in the Health Domain

“…• Implementation: Adopting a bottom-up approach, the identified instances are classified into more general categories. In this process, we consider reusing AI risk concepts from existing risk ontologies such as AIRO (AI Risk Ontology) [40] and RiskOnto [41] and existing classifications including WHO classification of AI for health [29]. The machine-readable format of the taxonomy is generated in OWL (Web Ontology Language) using Protégé 2 -an open-source tool for ontology development.…”

“…Consequence indicates the outcome of an event affecting objectives [43]. Impact represents adverse outcomes of a consequence on individuals, groups, and society [40]. We classified the identified impacts into three categories Wellbeing Impact, Fairness Impact, and Fundamental Rights Infringement.…”

Comparison and Analysis of 3 Key AI Documents: EU’s Proposed AI Act, Assessment List for Trustworthy AI (ALTAI), and ISO/IEC 42001 AI Management System

“…The comparison presented in this paper will be expanded to provide a more comprehensive analysis and alignment of key terms, technical activities, and requirements detailed within AI documents. Starting with the analysis provided in this paper, we aim to identify a common set of AI risk and impact assessment activities from the AI Act, ALTAI, and ISO risk management and management system standards and extend AIRO -an ontology for describing AI risks [13], to represent provenance of activities. Future work also includes updating this work based on changes made in the subsequent drafts and finalisations of the AI Act and ISO/IEC 42001 standard.…”