AI Risk Ontologies for the EU AI Act Compliance: AIRO, VAIR, and their Integration with DPV

arXiv:2610.31380v1 Announce Type: new Abstract: As the use of AI, and consequently its harms, becomes more prevalent, the global discourse around AI has become increasingly risk-aware. With new risks emerging more frequently than ever, a key challenge is how to represent, document, and catalogue AI risks in an effective, interoperable, and queryable manner. Additionally, the European Union (EU) AI Act's requirements for "high-risk" AI systems to manage and document the risks creates the need for open and interoperable tools, methods, and standards that facilitate AI risk management in an ever-changing environment. In this paper, we present ontologies and taxonomies developed to assist with risk management and documentation, in line with the requirements of the EU the AI Act. We developed the AI Risk Ontology (AIRO) to specify AI use cases and their associated risks, complemented by the Vocabulary of AI Risks (VAIR), which populates AIRO with taxonomies of concepts. Key international standards on AI and risk, namely ISO/IEC 23894 on AI risk management and ISO/IEC 22989 on AI terminology informed the development of the ontologies. To promote reuse and enable multi-regulatory compliance, AIRO and VAIR have been integrated in the Data Privacy Vocabulary (DPV) through a consensus-building process, expanding DPV's scope from data to AI.

The paper presents AI risk ontologies for EU AI Act compliance, which is neutral.

The paper proposes ontologies to standardize and improve how AI risks are documented and managed, which can enhance risk awareness and compliance with the EU AI Act. While this contributes positively to governance and safety, it is a tool-level improvement and does not directly imply large-scale societal change or guarantee risk mitigation. Hence, the impact is mildly positive but limited to regulatory and technical domains.

This is a technical governance infrastructure paper describing ontology development to support regulatory compliance. It has modest positive implications for AI accountability but is a tooling contribution, not evidence of actual risk reduction or societal outcome.

The paper presents technical tools designed to help manage and document AI risks, specifically for compliance with the EU AI Act. This effort to standardize risk management frameworks is materially optimistic as it could reduce potential harms from AI systems by promoting interoperability and clear documentation.

The development and integration of AIRO and VAIR aim to improve AI risk management and compliance. This could lead to better handling of AI harms and more responsible AI deployment.

SOURCE     arXiv cs.CY (Computers and Society) (tier 1)
   ↓
DOCUMENT   316b0790-36ad-4e0a-9b1d-8520b81f6038
           https://arxiv.org/abs/2610.31380
   ↓
EVIDENCE   3 extracted excerpts
   ↓
MODEL RUN  5 runs, methodology 1.0.1
   ↓
SCORE      -3  (Mixed or uncertain)
   ↓
CONFIDENCE 63%