"Death by a thousand taxonomies?": AI Risk Classification In Practice

2026-08-07

AI Summary

Current AI risk classification frameworks, such as the Standard for Organizational Trust (SOT), suffer from weak integration in governance practice and insufficient capacity to support regulation and accountability. Drawing on in-depth interviews with 25 experts from industry, academia, civil society, and government, and grounded in sociotechnical systems theory, this study empirically examines the design logic, implementation patterns, and governance limitations of SOT. The findings reveal that SOT is often misinterpreted as a comprehensive inventory of risks rather than an interpretive tool, leading to a disconnect between enumerated risks and responsible actors, which undermines decision-making relevance and complicates accountability. To address these shortcomings, the paper proposes design principles for governance-oriented classification schemes and advocates for the development of institutional infrastructures that enable the effective operationalization of SOT in real-world governance contexts.

Abstract

The harms in which AI is implicated range in nature and scope from unsafe user interactions through to the societal-wide consequences of AI adoption. Classification of the diverse risks of AI is foundational to AI governance: regulators, technology firms, and policymakers need structured accounts of risk upon which to act. Researchers and practitioners have accordingly developed many Sociotechnical Outcome Taxonomies (SOT). This paper presents an empirical study of SOT development and use, drawing on 25 interviews with researchers and practitioners across industry, academia, civil society, and government. We find SOT are weakly integrated into AI governance processes, and identify two features of SOT design and use that explain why. First, the design choices through which SOT produce structured representations of the complex problem space of AI risks tend to be invisible to downstream taxonomy users. Those users treat the resulting categories as exhaustive accounts of risk rather than as interpretive aids. Second, SOT typically enumerate harms without linking them to decision points or actors implicated in their occurrence, leaving accountability difficult to assign. We close with design recommendations for SOT developers and users, and argue realising the potential of SOT requires governance infrastructure that does not yet exist.

Problem

• AI risk classification
• Sociotechnical Outcome Taxonomies
• AI governance
• accountability
• risk taxonomy

Innovation

• Sociotechnical Outcome Taxonomies
• AI risk classification
• governance infrastructure
• accountability
• empirical study