Datasets / Enterprise AI Risk Matrix

Enterprise AI Risk Matrix

A practical framework for classifying enterprise AI and agentic-AI risks and mapping them to governance controls.

Machine-readable downloads: JSON · CSV

Risk category	Example	Typical impact	Primary control
Unauthorized action	Agent executes an action outside its mandate	High	Scoped permissions + policy enforcement
Identity spoofing	Agent acts under a false or borrowed identity	High	Verifiable agent identity
Prompt injection	Malicious input overrides instructions	High	Input mediation + guard agents
Data leakage	Sensitive data exposed via output or tool call	High	Data governance + output filtering
Hallucinated decision	Action based on fabricated information	Medium	Grounding + human-in-the-loop
Cascading failure	One agent's error propagates across systems	High	Containment + blast-radius limits
Non-compliance	Action violates regulation or policy	High	Compliance-by-design + audit trail
Opacity	No record of why an action occurred	Medium	Operational transparency + logging

How to use it. Score each risk by likelihood × impact for your context, then verify a primary control exists at the appropriate governance layer. Gaps indicate where multi-layer governance (e.g. AINOVA) is required.

Framework by Gianluca Busato, Enkronos ecosystem.