The AI Risk Taxonomy for Boards

AI risk has crossed a threshold. It is no longer an IT or compliance footnote — it is an enterprise and fiduciary issue, and the data says the risk is already in the building.

• Incidents are real and rising. Documented AI incidents reached 362 in 2025, up from 233 in 2024 (AI Incident Database, via Stanford HAI 2026 AI Index). The OECD AI Incidents Monitor peaked at 435 monthly incidents in January 2026.
• Most organizations have already been burned. 51% of organizations reported at least one negative AI-related incident in the prior 12 months — output inaccuracy, compliance violations, reputational damage, privacy breaches, unauthorized actions by AI systems (McKinsey State of AI 2025).
• Oversight ownership is thin at the top. Only 28% of organizations say the CEO is directly responsible for AI governance, and just 17% say the board is (McKinsey State of AI 2025). Accountability is diffuse — and that is the single clearest signal that leaders are getting this wrong.

Your role is not to operate controls. It is to be literate enough to ask the right questions — and to make sure that for each risk below, someone is named, the risk is assessed, and it is being monitored.

Governance is a value-enablement function, not a brake. High performers don't govern less — they govern deliberately and ship faster because trust is engineered in.

Here is the full map. A board doesn't need to operate any of these controls, but it must be able to ask whether each risk is owned, assessed, and monitored. For each, there is one sharp question that cuts to the heart of it.

The next sections take the four risks that produce the most board-legible cautionary tales — hallucination, bias, IP, and shadow AI — and make them concrete, then close on the agentic-era risks that scale with autonomy.

Generative models confidently fabricate. They predict plausible next words; they do not consult a database of verified facts, and they never volunteer "I don't know." Output inaccuracy is the single most commonly mitigated AI risk in enterprises (McKinsey 2025) — for good reason.

The board-legible case is the courtroom. By early 2026, well over 1,000 documented cases worldwide involved AI-fabricated legal citations — fake cases, invented quotes, citations to decisions that never existed (Scientific American, 2026 — cite the live tracker, as counts climb weekly). Even elite firms have been caught and have had to apologize and pay sanctions. No legal AI tool produces citation-ready output without human verification.

The executive lesson is not "AI is unreliable, avoid it." It is a question of placement:

Where is a model's wrong answer load-bearing — where it would be acted on in a legal filing, a medical decision, a financial statement, or a safety-critical context? There, a human check must sit before the AI's output acts. Where a wrong answer is cheap and caught quickly, you can let it run.

Two risks here carry the heaviest legal weight, and each has a landmark case a director should know by name.

Bias / fairness — AI can scale discrimination. Algorithms that disproportionately screen out protected groups violate Title VII regardless of intent. The precedent that should be on every board's radar is Mobley v. Workday: a federal judge allowed a nationwide age-discrimination collective action and ruled that an AI screening tool can be the employer's "agent" (Fortune, 2025 — cite live). That is a liability-shifting precedent: the AI you deploy can be treated as acting for you. (Amazon famously scrapped a recruiting tool in 2018 after it penalized resumes containing the word "women's.")

IP & copyright — exposure runs two ways: (a) the model may have been trained on copyrighted data, and (b) its outputs may infringe. The landmark figure: Anthropic settled a class action for $1.5 billion in August 2025 — the largest copyright recovery in US history, roughly $3,000 per title across ~500,000 works (McKool Smith, 2025 — cite live; NYT v. OpenAI remains ongoing). Major vendors offer enterprise copyright indemnification — but coverage varies and has conditions.

Treat vendor indemnification as a contract term to negotiate, not a default you inherit. Ask your General Counsel: do our AI contracts indemnify us for IP claims, and under what conditions does that coverage lapse?

Shadow AI is unsanctioned use: employees adopting AI tools without approval, often pasting sensitive data — customer records, source code, strategy decks — into free consumer apps where it may be retained or used for training.

The numbers are sobering, and the punchline is counterintuitive: ~49% of workers admit using unsanctioned AI tools, and executives are among the worst offenders — roughly 69% of the C-suite tolerate it, and 60% say it's worth the security risk to meet deadlines (CIO / BlackFog, 2025 — cite live). Shadow-AI-linked breaches reportedly carry a higher cost than the baseline.

Here is where leaders most reliably get it wrong:

Banning AI drives it underground. A prohibition doesn't stop usage — it just removes your visibility and control. The fix is not a ban. It is a sanctioned, easy, safe alternative plus a clear policy: give people an approved tool that's at least as good as what they'd reach for on their own, and tell them plainly what's allowed.

This connects directly to the eighth risk: every production AI system needs a named owner. You cannot govern what you can't see, so the antidote to shadow AI is the same as the antidote to ungoverned AI generally — visibility (an inventory), a sanctioned alternative, and an accountable owner for each system.

Three risks behave differently once AI stops merely answering and starts acting. Autonomy plus tool access is a multiplier on every other risk.

Prompt injection / agent security. Prompt injection is hidden malicious instructions — buried in a webpage, email, document, or database the AI reads — that hijack its behavior. For a chatbot this was embarrassing. For an agent that can browse, email, run code, and call APIs, the blast radius becomes data exfiltration, unauthorized transactions, and cascading failures (OWASP Top 10 for Agentic Applications, 2026). You don't need to operate the mitigations, but you can ask for them: least-privilege tool access, sandboxing, input validation, and — the executive lever — human approval for high-impact actions.

Vendor / third-party risk. Most enterprise AI risk is inherited. A large share of your AI is really someone else's model, embedded in software you bought. Centralized third-party risk management is now the norm and is shifting from annual questionnaires to continuous monitoring (PwC; ISO 42001). Ask: which of our critical AI capabilities are really someone else's model, and what happens if that vendor fails, changes, or is breached?

Model / agent oversight. Every production AI system should have a named owner accountable for performance, safety, and compliance — and the scrutiny should be risk-based (a doc-summarizing chatbot is not a loan-approval model). Agentic systems add a control layer of their own: oversight of autonomy, tool permissions, and the ability to halt and roll back.

The governing question for the agentic era: the more autonomy and tool access a system has, who is steering it, and can we stop it?

The taxonomy is only useful if it changes what happens in the boardroom. The translation is simple: for each of the eight risks, you are confirming three things.

This maps cleanly onto the durable frameworks your governance team will use — you don't need to operate them, but you should recognize the names: NIST AI RMF (Govern, Map, Measure, Manage) gives the operating vocabulary; ISO/IEC 42001 is the certifiable management-system standard; and the EU AI Act sets risk-tiered legal requirements (regulatory dates are actively shifting under the 2025–2026 Digital Omnibus — point at the live source rather than memorizing a date).

The board's specific job, per Deloitte and PwC: ensure the AI strategy drives value and fits the risk appetite, decide and document where oversight lives, and build directors' literacy to "ask the right questions." That is exactly what this taxonomy equips you to do.