Taking AI risks seriously: a new assessment model for the AI Act
Open accessAbstract
Abstract The EU Artificial Intelligence Act (AIA) defines four risk categories: unacceptable, high, limited, and minimal. However, as these categories statically depend on broad fields of application of AI, the risk magnitude may be wrongly estimated, and the AIA may not be enforced effectively. This problem is particularly challenging when it comes to regulating general-purpose AI (GPAI), which has versatile and often unpredictable applications. Recent amendments to the compromise text, though introducing context-specific assessments, remain insufficient. To address this, we propose applying the risk categories to specific AI scenarios, rather than solely to fields of application, using a risk assessment model that integrates the AIA with the risk approach arising from the Intergovernmental Panel on Climate Change (IPCC) and related literature. This integrated model enables the estimation of AI risk magnitude by considering the interaction between (a) risk determinants, (b) individual drivers of determinants, and (c) multiple risk types. We illustrate this model using large language models (LLMs) as an example.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
La clasificación de riesgo de la IA se compara con el cambio climático, pues ambos fenómenos comparten riesgos similares, con magnitudes impredecibles y una complejidad creciente por la interacción de múltiples factores.
“Comparan esta clasificación con el cambio climático, pues ambos fenómenos comparten riesgos similares, con magnitudes impredecibles y una complejidad creciente por la interacción de múltiples factores (Novelli et al., 2024;Gstrein, 2022).”
From Hacia una normativa sobre la inteligencia artificial (IA): consideraciones clave y regulaciones internacionales (2024) · cites this paper as Novelli et al., 2024
Se propone una clasificación de riesgo dividida en cuatro categorías: inaceptable, alto, limitado y mínimo.
“Al respecto, Novelli et al. (2024) proponen hacer una clasificación de riesgo dividida en cuatro categorías: inaceptable, alto, limitado y mínimo.”
From Hacia una normativa sobre la inteligencia artificial (IA): consideraciones clave y regulaciones internacionales (2024) · cites this paper as Novelli et al. (2024)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Privacy Risks of General-Purpose Language Models
Pan, X., Zhang, M., Ji, S., & Yang, M. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00095 · Cited by 188 · see citing works
Flagged first, then by citations
Research works printed but not linked: 9
- Alexy R (2002) A theory of constitutional rights. Oxford University Press
- Black J, Baldwin R (2012) When risk-based regulation aims low: approaches and challenges. Regulation & Governance 6(1):2-22. https:// doi. org/ 10. 1111/j. 1748- 5991. 2011. 01124.x
- Cardona OD, Aalst MKV, Birkmann J, Fordham M, Gregor GM, Rosa P, Pulwarty RS, Schipper ELF, Sinh BT, Décamps H, Keim M, Davis I, Ebi KL, Lavell A, Mechler R, Murray V, Pelling M, Pohl J, Smith AO, Thomalla F (2012) Determinants of risk: exposure and vulnerability. Managing the risks of extreme events and disasters to advance climate change adaptation: special report of the intergovernmental panel on climate change. Cambridge University Press, Cambridge, pp 65-108. https:// doi. org/ 10. 1017/ CBO97 81139 177245. 005
- Karliuk M (2022) Proportionality principle for the ethics of artificial intelligence. AI Ethics. https:// doi. org/ 10. 1007/ s43681- 022- 00220-1
- Khanna VS (2021) Compliance as costs and benefits. In: van Rooij B, Sokol DD (eds) The Cambridge handbook of compliance. Cambridge University Press, Cambridge, pp 13-26. https:// doi. org/ 10. 1017/ 97811 08759 458. 002
- Mahler T (2007) Defining legal risk (SSRN Scholarly Paper Fasc. 1014364). Accessed on 15 Sept 2022. https:// papers. ssrn. com/ abstr act= 10143 64
- Simpson NP, Mach KJ, Constable A, Hess J, Hogarth R, Howden M, Lawrence J, Lempert RJ, Muccione V, Mackey B, New MG, O'Neill B, Otto F, Pörtner H-O, Reisinger A, Roberts D, Schmidt DN, Seneviratne S, Strongin S, Trisos CH (2021) A framework for complex climate change risk assessment. One Earth 4(4):489501. https:// doi. org/ 10. 1016/j. oneear. 2021. 03. 005
- Smuha N, Ahmed-Rengers E, Harkens A, Li W, Maclaren J, Piselli R, et al. (2021) How the EU can achieve legally trustworthy AI: a response to the European Commission's proposal for an Artificial Intelligence Act; https:// papers. ssrn. com/ sol3/ papers. cfm? abstr act\_ id= 38999 91
- Sunstein CR (2004) Risk and reason. In Cambridge Books. Cambridge University Press. Accessed on 12 Sept 2022. https:// ideas. repec. org/b/ cup/ cbooks/ 97805 21016 254. html
Cited by
Sorted by citations
A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083 · see citing works
Learning to Prompt in the Classroom to Understand AI Limits: A Pilot Study
Theophilou, E., Koyutürk, C., Yavari, M., Bursic, S., Donabauer, G., Telari, A., Testa, A., Boiano, R., Hernandez-Leo, D., Ruskov, M., et al. (2023) · Lecture Notes in Computer Science · doi:10.1007/978-3-031-47546-7_33 · Cited by 58 · see citing works
Generative Ai in EU Law: Liability, Privacy, Intellectual Property, and Cybersecurity
Novelli, C., Casolari, F., Hacker, P., Spedicato, G., & Floridi, L. (2024) · doi:10.2139/ssrn.4821952 · Cited by 57 · see citing works
Self-citationNavigating the EU AI Act: A Methodological Approach to Compliance for Safety-critical Products
Kelly, J., Zafar, S. A., Heidemann, L., Zacchi, J.-V., Espinoza, D., & Mata, N. (2024) · 2024 IEEE Conference on Artificial Intelligence (CAI) · doi:10.1109/cai59869.2024.00179 · Cited by 30 · see citing works
Bustillos Ortega, O., Murillo Gamboa, J., Núñez Peralta, O., & Rodríguez Sibaja, F. (2024) · Interfases · doi:10.26439/interfases2024.n020.7178 · Cited by 5 · see citing works
“Al respecto, Novelli et al. (2024) proponen hacer una clasificación de riesgo dividida en cuatro categorías: inaceptable, alto, limitado y mínimo.”
Zabolotna, H. (2026) · Visnyk of the Lviv University. Series Law · doi:10.30970/vla.2026.82.182
- Authors
- Novelli, C., Casolari, F., Rotolo, A., Taddeo, M., & Floridi, L.
- Affiliations
- University of Bologna (IT)
- University of Oxford (GB)
- Corresponding author
- Novelli, Claudio
- Venue
- AI & SOCIETY
- Published
- 2023-07-12
- Volume
- 39
- Issue
- 5
- Pages
- 2493-2497
- ISSN
- 0951-5666 (ISSN-L)
- 1435-5655
- OpenAlex
- W4384025135
- Cited by
- 139
- References
- 1
- Citations by year
- 2026: 46 · 2025: 50 · 2024: 37 · 2023: 6
- FWCI
- 248.82
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Locations
- AI & Society (publishedVersion, cc-by)
- SSRN Electronic Journal (acceptedVersion)
- Archivio istituzionale della ricerca (Alma Mater Studiorum Università di Bologna) (submittedVersion, cc-by)
- PhilPapers (PhilPapers Foundation) (submittedVersion, other-oa)
- PhilPapers (PhilPapers Foundation) (submittedVersion)
- Funders
- Fujitsu (rep. 95/2021)
- Alma Mater Studiorum - Università di Bologna
- Topics
- Social Sciences › Law › Digitalization, Law, and Regulation
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Keywords
- EU AI Act, AI risk assessment, risk categories, general-purpose AI, risk assessment model, large language models, AI regulation, risk determinants
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
