The MIT AI Risk Repository
The MIT AI Risk Repository catalogues over 1,200 documented AI incidents, the most comprehensive empirical dataset of real-world AI failures available. It spans sectors from financial services and healthcare to criminal justice and autonomous systems.
What makes this dataset valuable is not just its scale but its structure: each incident is categorized by risk type, causal pathway, affected domain, and severity. This allows systematic analysis of how AI risks actually materialise in practice.
How AI Risks Actually Emerge
The data reveals patterns that challenge common assumptions about AI risk. Most incidents are not caused by a single technical failure. They emerge from the interaction between technical behavior, operational context, and governance gaps.
Bias incidents, for example, are rarely caused by biased training data alone. They result from biased data combined with insufficient testing, deployed in a context where impact is amplified, without monitoring that would detect the disparity before harm occurs.
The Compliance Gap
A significant finding: many incidents occurred in organizations that had formal AI policies, ethics guidelines, or compliance frameworks in place. The presence of policy did not prevent the incident. The gap was between what the policy required and what operational controls actually enforced.
This underscores a central theme: compliance documentation is necessary but not sufficient. Without operational risk management (continuous monitoring, escalation protocols, accountability chains), policies become aspirational statements rather than effective controls.
From Reactive to Proactive
The incidents data strongly supports a shift from reactive incident response to proactive risk management. Organizations that identified risks early (through structured risk assessments, red-teaming, and continuous monitoring) contained incidents before they escalated to organizational harm.
This is the case for lifecycle-based AI governance: risk management that operates continuously from design through deployment to retirement, rather than point-in-time assessments that quickly become outdated.