AI Risk overview
What the domain covers, why it exists separately, and how it ties to category RC11.
The risk a supplier brings by using AI
This domain covers risk arising from the use of AI and machine learning — by your suppliers and by your own organization. Automated decision-making, bias, model opacity, the AI supply chain, and the technical surface that production models create.
It corresponds to risk category RC11, the newest in the taxonomy, and is the fourth pillar of the control library.
Why it did not fit inside cyber risk
AI risk carries two natures that the other domains keep apart. It has regulatory consequence, like privacy — automated decisions about people are a matter of law. And it has an exploitable surface, like cyber — model manipulation, training-data poisoning, instruction escape.
Treating it as a subset of either one would mean losing half the question.
Who answers
No AI control enters a P1 supplier's questionnaire. The pillar starts at P2, with 43 cumulative controls, and reaches 66 at P3. The reason is proportionality: asking a low-criticality supplier about model governance produces a long questionnaire and weak answers.
Beyond the profile there is the flag marking that a supplier uses AI for decision-making — the trigger that brings the block into play deliberately.
Maturity of the domain
This is the platform's newest domain and its methodology is still being refined. The catalog already covers ISO 42001 in full, but the scope axis — telling apart whoever consumes a third-party API from whoever operates or provides a model — does not exist yet. It is documented as a known limitation rather than as something solved.