Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

The Eticas AI Risk Taxonomy: Open Infrastructure for Operationalizing AI Audits

Source

arXiv

arxiv.org/abs/2607.02201v1

Read the source

Source

Plain-Language Brief

The paper introduces Eticas AI Risk Taxonomy v2.0.0, an open-source framework for operationalizing AI audits. It bridges the gap between identifying AI risks and executing audits by providing a method to measure and grade these risks on a real system.

What the Document Says

  • The paper presents the Eticas AI Risk Taxonomy v2.0.0, an operationalization layer for AI audits.
  • The taxonomy is designed to transform identified AI risks into tests, measured values, calibrated severities, and defensible grades.
  • The paper provides an example of how the taxonomy measures a disclosure risk (GPT-4-0314) across increasing adversarial conditions on a public benchmark.
  • The taxonomy categorizes 76 active subcategories under 10 categories and 20 sub-groups, with mappings to 18 external frameworks.
  • The taxonomy's category and sub-group layer is open-source, published under CC BY 4.0.
  • The paper argues that the AI auditing field needs a shared, open, and operable infrastructure.

Key Concepts Mentioned

  • AI Risk Taxonomy
  • Operationalization Layer
  • AI Audits
  • PII Leakage
  • GPT-4-0314
  • Adversarial Conditions
  • Graded Findings

Claims Made by the Document

  • The paper claims to provide a solution for the hard part of auditing, which is operationalizing risks.
  • The taxonomy maps through calibrated severity bands to a subcategory grade.

Evidence Used

  • The provided example of measuring a disclosure risk on a public benchmark

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

The rapid deployment of AI systems across high-stakes domains has created urgent demand for standardized evaluation, yet the field remains fragmented across competing risk taxonomies that catalog risks without showing how an audit is executed. At least 74 AI risk taxonomies exist, and almost all stop at the catalog. The hard part of auditing is not naming a risk but operationalizing it: turning it into a test run against a real system, a measured value, a calibrated severity, and a defensible grade. This paper leads with that bridge. We present the operationalization layer Eticas has built and run, shown end to end on a single risk (PII leakage) against a public benchmark, and then the open taxonomy that makes the method scale. On GPT-4-0314, a disclosure risk that seven external frameworks require be controlled is measured at 0%, 51%, and 84% disclosure as adversarial conditioning increases, mapping through calibrated severity bands to a subcategory grade of E with a SYSTEMIC pattern. Around this example, the Eticas AI Risk Taxonomy v2.0.0 organizes 76 active subcategories across 10 categories and 20 sub-groups, with mappings to 18 external frameworks across compliance, reference, and academic tiers. Its category and sub-group layer is published under CC BY 4.0 as open semantic infrastructure with stable URIs and SKOS/JSON-LD distributions, and a worked subcategory example shows the operational layer down to its severity thresholds. The contribution is the demonstrated bridge from concept to graded finding, anchored by a clean separation of risks from the mechanisms by which they surface, and framed by an open-core model in which the conceptual scaffold is open and the methodology calibration is the practitioner layer. This is the infrastructure the AI auditing field needs: shared, open, and demonstrably operable.