Appendix C Complex Model Specification C.1 Balance Sheet Structure Our model extends the Eisenberg–Noe clearing framework ( Eisenberg and Noe 2001 ) with portfolio-based asset holdings, correlated shocks, fire sale contagion, and priority of claims. The network contagion approach follows the simulation methodology surveyed by Upper (2011) and the theoretical framework of Allen and Gale (2000) ; see Jackson and Pernoud (2021) for a recent survey. Each bank i ∈ { 1 , … , N } i\in\{1,\dots,N\} i ∈ { 1 , … , N } a i e a_{i}^{e} a i e a i b a_{i}^{b} a i b l i b l_{i}^{b} l i b l i e l_{i}^{e} l i e A i \displaystyle A_{i} A i = a i e + a i b , \displaystyle=a_{i}^{e}+a_{i}^{b}, = a i e + a i b , L i \displaystyle L_{i} L i = l i b + l i e , \displaystyle=l_{i}^{b}+l_{i}^{e}, = l i b + l i e , E i \displaystyle E_{i} E i = A i − L i . \displaystyle=A_{i}-L_{i}. = A i − L i . κ i = E i A i , \kappa_{i}=\frac{E_{i}}{A_{i}}, κ i = A i E i , E i > 0 E_{i}>0 E i > 0 κ i > 0 \kappa_{i}>0 κ i > 0 κ i ∗ \kappa_{i}^{*} κ i ∗ A i A_{i} A i ϕ i \phi_{i} ϕ i a i e \displaystyle a_{i}^{e} a i e = A i ( 1 − ϕ i ) , \displaystyle=A_{i}\,(1-\phi_{i}), = A i ( 1 − ϕ i ) , a i b \displaystyle a_{i}^{b} a i b = A i ϕ i , \displaystyle=A_{i}\,\phi_{i}, = A i ϕ i , l i b \displaystyle l_{i}^{b} l i b = A i ϕ i , \displaystyle=A_{i}\,\phi_{i}, = A i ϕ i , l i e \displaystyle l_{i}^{e} l i e = A i ( 1 − κ i ∗ ) − l i b . \displaystyle=A_{i}\,(1-\kappa_{i}^{*})-l_{i}^{b}. = A i ( 1 − κ i ∗ ) − l i b . k ∈ K = { GOV , CORP , MTG , STK } k\in\mathcal{K}=\{\text{GOV},\,\text{CORP},\,\text{MTG},\,\text{STK}\} k ∈ K = { GOV , CORP , MTG , STK } i i i w i , k ≥ 0 w_{i,k}\geq 0 w i , k ≥ 0 ∑ k ∈ K w i , k = 1 , \sum_{k\in\mathcal{K}}w_{i,k}=1, ∑ k ∈ K w i , k = 1 , i i i k k k a i , k e = a i e ⋅ w i , k a_{i,k}^{e}=a_{i}^{e}\cdot w_{i,k} a i , k e = a i e ⋅ w i , k w ~ i , k \tilde{w}_{i,k} w ~ i , k w i , k = w ~ i , k ∑ k ′ ∈ K w ~ i , k ′ . w_{i,k}=\frac{\tilde{w}_{i,k}}{\sum_{k^{\prime}\in\mathcal{K}}\tilde{w}_{i,k^{\prime}}}. w i , k = ∑ k ′ ∈ K w ~ i , k ′ w ~ i , k . G = ( V , E ) G=(V,\mathcal{E}) G = ( V , E ) V = { 1 , … , N } V=\{1,\dots,N\} V = { 1 , … , N } ( i , j ) ∈ E (i,j)\in\mathcal{E} ( i , j ) ∈ E i i i j j j x i j > 0 x_{ij}>0 x ij > 0 C \mathcal{C} C P \mathcal{P} P ∣ C ∣ = N c |\mathcal{C}|=N_{c} ∣ C ∣ = N c ∣ P ∣ = N − N c |\mathcal{P}|=N-N_{c} ∣ P ∣ = N − N c Pr [ ( i , j ) ∈ E ] = p τ ( i ) , τ ( j ) , τ ( i ) ∈ { c , p } , \Pr\bigl[(i,j)\in\mathcal{E}\bigr]=p_{\tau(i),\tau(j)},\quad\tau(i)\in\{c,p\}, Pr [ ( i , j ) ∈ E ] = p τ ( i ) , τ ( j ) , τ ( i ) ∈ { c , p } , τ ( i ) \tau(i) τ ( i ) i i i x i j x_{ij} x ij F τ ( i ) , τ ( j ) F_{\tau(i),\tau(j)} F τ ( i ) , τ ( j ) i i i x i j x_{ij} x ij j j j x i j x_{ij} x ij k k k s k s_{k} s k s MTG = − 0.20 s_{\text{MTG}}=-0.20 s MTG = − 0.20 i i i k k k ℓ i , k shock = ∣ s k ∣ ⋅ a i , k e , \ell_{i,k}^{\text{shock}}=|s_{k}|\cdot a_{i,k}^{e}, ℓ i , k shock = ∣ s k ∣ ⋅ a i , k e , a i , k e ← max ( 0 , a i , k e ( 1 + s k ) ) a_{i,k}^{e}\leftarrow\max\bigl(0,\;a_{i,k}^{e}(1+s_{k})\bigr) a i , k e ← max ( 0 , a i , k e ( 1 + s k ) ) i i i ℓ i shock = ∑ k ℓ i , k shock \ell_{i}^{\text{shock}}=\sum_{k}\ell_{i,k}^{\text{shock}} ℓ i shock = ∑ k ℓ i , k shock a i e ← max ( 0 , a i e − ℓ i shock ) . a_{i}^{e}\leftarrow\max\bigl(0,\;a_{i}^{e}-\ell_{i}^{\text{shock}}\bigr). a i e ← max ( 0 , a i e − ℓ i shock ) . i i i E i ≤ 0 E_{i}\leq 0 E i ≤ 0 t = 0 t=0 t = 0 s ˉ k \bar{s}_{k} s ˉ k ρ ∈ [ 0 , 1 ] \rho\in[0,1] ρ ∈ [ 0 , 1 ] σ \sigma σ Z \displaystyle Z Z ∼ N ( 0 , σ ρ ) , \displaystyle\sim\mathcal{N}\bigl(0,\;\sigma\sqrt{\rho}\bigr), ∼ N ( 0 , σ ρ ) , ε k \displaystyle\varepsilon_{k} ε k ∼ N ( 0 , σ 1 − ρ ) , \displaystyle\sim\mathcal{N}\bigl(0,\;\sigma\sqrt{1-\rho}\bigr), ∼ N ( 0 , σ 1 − ρ ) , s k \displaystyle s_{k} s k = s ˉ k + Z + ε k . \displaystyle=\bar{s}_{k}+Z+\varepsilon_{k}. = s ˉ k + Z + ε k . Z Z Z ε k \varepsilon_{k} ε k ( Z , ε k ) k ∈ K (Z,\varepsilon_{k})_{k\in\mathcal{K}} ( Z , ε k ) k ∈ K s k = s ˉ k + η k , η k ∼ N ( 0 , σ ) , s_{k}=\bar{s}_{k}+\eta_{k},\quad\eta_{k}\sim\mathcal{N}(0,\sigma), s k = s ˉ k + η k , η k ∼ N ( 0 , σ ) , F t \mathcal{F}_{t} F t t t t Δ F t = F t ∖ F t − 1 \Delta\mathcal{F}_{t}=\mathcal{F}_{t}\setminus\mathcal{F}_{t-1} Δ F t = F t ∖ F t − 1 t t t j j j R j = min ( 1 , A j L j ) . R_{j}=\min\!\left(1,\;\frac{A_{j}}{L_{j}}\right). R j = min ( 1 , L j A j ) . R j b = min ( 1 , max ( 0 , A j − l j e ) l j b ) , R_{j}^{b}=\min\!\left(1,\;\frac{\max\bigl(0,\;A_{j}-l_{j}^{e}\bigr)}{l_{j}^{b}}\right), R j b = min ( 1 , l j b m a x ( 0 , A j − l j e ) ) , t ≥ 1 t\geq 1 t ≥ 1 j ∈ Δ F t j\in\Delta\mathcal{F}_{t} j ∈ Δ F t i ∉ F t i\notin\mathcal{F}_{t} i ∈ / F t x i j > 0 x_{ij}>0 x ij > 0 ℓ i j cont = ( 1 − R j b ) x i j . \ell_{ij}^{\text{cont}}=(1-R_{j}^{b})\,x_{ij}. ℓ ij cont = ( 1 − R j b ) x ij . i i i a i b ← a i b − ℓ i j cont . a_{i}^{b}\leftarrow a_{i}^{b}-\ell_{ij}^{\text{cont}}. a i b ← a i b − ℓ ij cont . E i ≤ 0 E_{i}\leq 0 E i ≤ 0 t t t i i i Δ F t + 1 \Delta\mathcal{F}_{t+1} Δ F t + 1 Δ F t = ∅ \Delta\mathcal{F}_{t}=\emptyset Δ F t = ∅ t t t t t t k k k V k , t = ∑ j ∈ Δ F t a j , k e . V_{k,t}=\sum_{j\in\Delta\mathcal{F}_{t}}a_{j,k}^{e}. V k , t = ∑ j ∈ Δ F t a j , k e . M k 0 M_{k}^{0} M k 0 k k k t = 0 t=0 t = 0 δ k , t = λ ⋅ V k , t M k 0 , \delta_{k,t}=\lambda\cdot\frac{V_{k,t}}{M_{k}^{0}}, δ k , t = λ ⋅ M k 0 V k , t , λ ≥ 0 \lambda\geq 0 λ ≥ 0 M k 0 M_{k}^{0} M k 0 M k 0 M_{k}^{0} M k 0 i ∉ F t i\notin\mathcal{F}_{t} i ∈ / F t k k k δ k , t > 0 \delta_{k,t}>0 δ k , t > 0 ℓ i , k fs = δ k , t ⋅ a i , k e , \ell_{i,k}^{\text{fs}}=\delta_{k,t}\cdot a_{i,k}^{e}, ℓ i , k fs = δ k , t ⋅ a i , k e , a i , k e ← max ( 0 , a i , k e ( 1 − δ k , t ) ) a_{i,k}^{e}\leftarrow\max\bigl(0,\;a_{i,k}^{e}(1-\delta_{k,t})\bigr) a i , k e ← max ( 0 , a i , k e ( 1 − δ k , t ) ) i i i t t t ℓ i fs = ∑ k ℓ i , k fs \ell_{i}^{\text{fs}}=\sum_{k}\ell_{i,k}^{\text{fs}} ℓ i fs = ∑ k ℓ i , k fs E i ≤ 0 E_{i}\leq 0 E i ≤ 0 i i i t t t t + 1 t+1 t + 1 G G G { 1 , … , N } \{1,\dots,N\} { 1 , … , N } S \mathcal{S} S λ \lambda λ F \mathcal{F} F i ∈ { 1 , … , N } i\in\{1,\dots,N\} i ∈ { 1 , … , N } s k s_{k} s k k k k E i ≤ 0 E_{i}\leq 0 E i ≤ 0 F 0 ← F 0 ∪ { i } \mathcal{F}_{0}\leftarrow\mathcal{F}_{0}\cup\{i\} F 0 ← F 0 ∪ { i } M k 0 M_{k}^{0} M k 0 k k k t ← 1 t\leftarrow 1 t ← 1 Δ F ← F 0 \Delta\mathcal{F}\leftarrow\mathcal{F}_{0} Δ F ← F 0 Δ F ≠ ∅ \Delta\mathcal{F}\neq\emptyset Δ F = ∅ j ∈ Δ F j\in\Delta\mathcal{F} j ∈ Δ F R j b R_{j}^{b} R j b i i i j j j ℓ i j cont = ( 1 − R j b ) x i j \ell_{ij}^{\text{cont}}=(1-R_{j}^{b})\,x_{ij} ℓ ij cont = ( 1 − R j b ) x ij E i ≤ 0 E_{i}\leq 0 E i ≤ 0 i i i λ > 0 \lambda>0 λ > 0 V k , t V_{k,t} V k , t δ k , t \delta_{k,t} δ k , t i ∉ F t i\notin\mathcal{F}_{t} i ∈ / F t ℓ i , k fs \ell_{i,k}^{\text{fs}} ℓ i , k fs E i ≤ 0 E_{i}\leq 0 E i ≤ 0 i i i Δ F ← \Delta\mathcal{F}\leftarrow Δ F ← + + + F t ← F t − 1 ∪ Δ F \mathcal{F}_{t}\leftarrow\mathcal{F}_{t-1}\cup\Delta\mathcal{F} F t ← F t − 1 ∪ Δ F t ← t + 1 t\leftarrow t+1 t ← t + 1 F \mathcal{F} F Appendix D Complex Model Parameter Calibration D.1 Network Parameters Table 2 reports the full parameterisation for both regulatory regimes. All simulations use N = 50 N=50 N = 50 N c = 10 N_{c}=10 N c = 10 N p = 40 N_{p}=40 N p = 40 N c / N = 20 % N_{c}/N=20\% N c / N = 20% N ( μ , σ ; [ min , max ] ) \mathcal{N}(\mu,\sigma;[\text{min},\text{max}]) N ( μ , σ ; [ min , max ]) U ( a , b ) \mathcal{U}(a,b) U ( a , b ) κ i ∗ \kappa_{i}^{*} κ i ∗ N ( 0.07 , 0.012 ; [ 0.05 , 0.09 ] ) \mathcal{N}(0.07,\,0.012;\,[0.05,\,0.09]) N ( 0.07 , 0.012 ; [ 0.05 , 0.09 ]) N ( 0.13 , 0.015 ; [ 0.10 , 0.18 ] ) \mathcal{N}(0.13,\,0.015;\,[0.10,\,0.18]) N ( 0.13 , 0.015 ; [ 0.10 , 0.18 ]) N ( 0.05 , 0.015 ; [ 0.03 , 0.08 ] ) \mathcal{N}(0.05,\,0.015;\,[0.03,\,0.08]) N ( 0.05 , 0.015 ; [ 0.03 , 0.08 ]) N ( 0.105 , 0.015 ; [ 0.10 , 0.14 ] ) \mathcal{N}(0.105,\,0.015;\,[0.10,\,0.14]) N ( 0.105 , 0.015 ; [ 0.10 , 0.14 ]) A i A_{i} A i 1 − ϕ i 1-\phi_{i} 1 − ϕ i ϕ i \phi_{i} ϕ i N ( 0.15 , 0.05 ; [ 0.08 , 0.30 ] ) \mathcal{N}(0.15,\,0.05;\,[0.08,\,0.30]) N ( 0.15 , 0.05 ; [ 0.08 , 0.30 ]) N ( 0.10 , 0.03 ; [ 0.05 , 0.18 ] ) \mathcal{N}(0.10,\,0.03;\,[0.05,\,0.18]) N ( 0.10 , 0.03 ; [ 0.05 , 0.18 ]) N ( 0.12 , 0.04 ; [ 0.05 , 0.22 ] ) \mathcal{N}(0.12,\,0.04;\,[0.05,\,0.22]) N ( 0.12 , 0.04 ; [ 0.05 , 0.22 ]) N ( 0.08 , 0.025 ; [ 0.04 , 0.14 ] ) \mathcal{N}(0.08,\,0.025;\,[0.04,\,0.14]) N ( 0.08 , 0.025 ; [ 0.04 , 0.14 ]) w ~ i , k \tilde{w}_{i,k} w ~ i , k U ( 0.20 , 0.60 ) \mathcal{U}(0.20,\,0.60) U ( 0.20 , 0.60 ) U ( 0.20 , 0.60 ) \mathcal{U}(0.20,\,0.60) U ( 0.20 , 0.60 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.10 , 0.40 ) \mathcal{U}(0.10,\,0.40) U ( 0.10 , 0.40 ) U ( 0.25 , 0.70 ) \mathcal{U}(0.25,\,0.70) U ( 0.25 , 0.70 ) U ( 0.25 , 0.70 ) \mathcal{U}(0.25,\,0.70) U ( 0.25 , 0.70 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) U ( 0.05 , 0.35 ) \mathcal{U}(0.05,\,0.35) U ( 0.05 , 0.35 ) p p p p p p → \to → U ( 4 , 8 ) \mathcal{U}(4,8) U ( 4 , 8 ) U ( 3 , 6 ) \mathcal{U}(3,6) U ( 3 , 6 ) → \to → U ( 1.5 , 4 ) \mathcal{U}(1.5,4) U ( 1.5 , 4 ) U ( 1 , 3 ) \mathcal{U}(1,3) U ( 1 , 3 ) → \to → U ( 1 , 3 ) \mathcal{U}(1,3) U ( 1 , 3 ) U ( 0.5 , 2 ) \mathcal{U}(0.5,2) U ( 0.5 , 2 ) → \to → U ( 0.5 , 2 ) \mathcal{U}(0.5,2) U ( 0.5 , 2 ) U ( 0.3 , 1.5 ) \mathcal{U}(0.3,1.5) U ( 0.3 , 1.5 ) − 1 % -1\% − 1% − 30 % -30\% − 30% + 2 % +2\% + 2% − 10 % -10\% − 10% − 15 % -15\% − 15% ρ = 0.6 \rho=0.6 ρ = 0.6 σ = 0.03 \sigma=0.03 σ = 0.03 − 20 % -20\% − 20% − 17 % -17\% − 17% − 23 % -23\% − 23% s ˉ MTG \bar{s}_{\text{MTG}} s ˉ MTG − 0.01 -0.01 − 0.01 − 0.30 -0.30 − 0.30 s ˉ k \bar{s}_{k} s ˉ k + 0.02 +0.02 + 0.02 − 0.10 -0.10 − 0.10 − 0.20 -0.20 − 0.20 − 0.15 -0.15 − 0.15 ρ \rho ρ 0.6 0.6 0.6 σ \sigma σ 0.03 0.03 0.03 λ = 0.05 \lambda=0.05 λ = 0.05 − 10 % -10\% − 10% − 14 % -14\% − 14% λ = 0.05 \lambda=0.05 λ = 0.05 λ ∈ { 0 , 0.01 , 0.03 , 0.05 , 0.07 , 0.10 , 0.12 , 0.15 } \lambda\in\{0,\,0.01,\,0.03,\,0.05,\,0.07,\,0.10,\,0.12,\,0.15\} λ ∈ { 0 , 0.01 , 0.03 , 0.05 , 0.07 , 0.10 , 0.12 , 0.15 } λ ≥ 0.10 \lambda\geq 0.10 λ ≥ 0.10 M k 0 M_{k}^{0} M k 0 Appendix E Complex Model Simulation Design E.1 Network Generation Modes The simulation framework supports three network generation modes, offering different trade-offs between control and stochasticity: 1. Fixed mode: A single network is generated with fixed seeds for both structure and parameters, and reused identically across all Monte Carlo runs. This isolates the effect of shock randomness from network variation. 2. Template mode: The network topology (edge set) is generated once and held fixed, but bank parameters (capital ratios, portfolio weights, exposure amounts) are resampled each run. This tests the robustness of a given interconnection structure to parameter variation. 3. Stochastic mode (used in all reported experiments): Both network topology and bank parameters are regenerated each run, producing a population of distinct network realisations. This provides the broadest assessment of systemic risk under structural uncertainty. E.2 Seed Hierarchy and Reproducibility Reproducibility is ensured through a hierarchical seeding scheme. Let s struct s^{\text{struct}} s struct s param s^{\text{param}} s param r ∈ { 0 , 1 , … , R − 1 } r\in\{0,1,\dots,R-1\} r ∈ { 0 , 1 , … , R − 1 } s r struct \displaystyle s_{r}^{\text{struct}} s r struct = s struct + r , \displaystyle=s^{\text{struct}}+r, = s struct + r , s r param \displaystyle s_{r}^{\text{param}} s r param = s param + r . \displaystyle=s^{\text{param}}+r. = s param + r . s struct = 42 s^{\text{struct}}=42 s struct = 42 s param = 100 s^{\text{param}}=100 s param = 100 42 42 42 N N N N c N_{c} N c 8 × 29 8\times 29 8 × 29 Appendix F Complex Model Sensitivity Analysis F.1 Fire Sale Intensity The fire sale parameter sweep (Appendix D.4 ) reveals four dimensions along which increasing λ \lambda λ λ \lambda λ λ \lambda λ λ \lambda λ λ \lambda λ λ \lambda λ λ \lambda λ λ \lambda λ → \to → → \to → → \to → → \to → → \to → Appendix G Complex Model Reproducibility G.1 Software Environment All simulations were implemented in Python 3.11. Key dependencies and their roles are listed in Table 6 . Table 6: Software dependencies. Library Role NumPy Random number generation, numerical operations NetworkX Directed graph construction and analysis Pydantic Configuration validation and type checking Matplotlib Visualisation and plot generation PyYAML Configuration file parsing pytest Automated test suite Exact dependency versions are pinned in a lock file ( uv.lock ) included in the repository. The package manager UV was used for environment management. G.2 Validation The codebase includes an automated test suite with the following coverage: • Unit tests: Bank balance sheet arithmetic, portfolio shock application, recovery rate calculations, and network construction. • Integration tests: End-to-end experiment execution from YAML configuration to JSON output, testing all three network generation modes and all shock modes. • Feature tests: Dedicated tests for each heterogeneity option (A, D, F), truncated distribution bounds (verifying Basel III floor enforcement), and fire sale compounding behaviour. • Numerical reproducibility: Tests verify that identical seeds produce bit-identical results, and that floating-point discrepancies remain below 10 − 10 10^{-10} 1 0 − 10 Appendix I Code and STPA Artefact Availability Material relevant for the reproducability of this project are available at the following URL: https://github.com/Advai-Ltd/quantifying-ai-system-harms At the top level, this repository contains the various tables relating to the systems’ theoretic process analysis, which could not reasonably be attached within even the extended version of this paper. Within two subdirectories of the repository, the code used to produce the component level test results, and the financial contagion simulation code used to produce the system-level results, are available. The repository also contains a README file with instructions for running the various simulations and analyses. Consult the ‘license.md’ file in the repository for information on the licensing of the code and artefacts, which are not necessarily under the same license as the paper itself.
Ethical Considerations This work demonstrates adversarial manipulation of LLM-based systems in a stylised financial setting. The attacks are drawn from published literature and the primary contribution is to surface their potential systemic consequences, not to advance attack capability. The RTGS analysis is conducted at a level of abstraction chosen to avoid disclosing operationally sensitive information, and was reviewed by domain and safety experts. The framework involves normative judgements about system boundaries, stakeholder values, and the relative importance of harms. Making these judgements explicit and auditable, as STPA requires, is intended to support scrutiny and revision.
Adverse Impact Statement We identify two principal ways in which this work could produce adverse impacts once in the world. Dual-use of demonstrated attack techniques. Publishing examples of adversarial attacks on LLM-based financial tools may provide a starting point for actors seeking to exploit similar vulnerabilities in deployed systems. We note that the attacks demonstrated are low-cost, already documented in the literature, and straightforwardly mitigated by prompt-hardening. We recommend that practitioners treat the attacks presented here as a minimum threat baseline rather than a comprehensive threat model, and prioritise deployment of known mitigations. False assurance from partial or improper application. This framework is designed to articulate system-level risks from the adoption of AI, first qualitatively and then quantitatively. However, the fidelity of each stage depends heavily on the quality of inputs, the breadth of expertise brought to the analysis, and the realism of the underlying models. Partial analyses can still be useful when their assumptions and evidential limits are made explicit. They become harmful when treated as comprehensive safety assessments or as definitive evidence that unmodelled risks are absent. Hence the critical importance of highlighting the assumptions, norms and sources of information relied upon when doing this analysis. The outputs should be used to inform judgement rather than to provide assurance on their own, and practitioners should remain alert to residual risks not captured by the analysis performed. If adopted prescriptively as a compliance checklist, the framework could create incentives to perform only those analyses for which favourable results are anticipated, undermining its value as a structured reasoning tool.
Positionality Statement The authors have a background in AI safety and security. This shapes our focus on security-based failure modes and measurable behavioural properties of AI systems, and may lead us to prioritise threat pathways that are more tractable from a technical standpoint over representational or organisational harms. The worked example was conducted entirely from publicly available information, including regulatory surveys, published financial network literature, and open documentation of the RTGS, without direct engagement with operators. Our account of the system is therefore necessarily partial, and our judgements about what constitutes a plausible or significant AI-driven loss scenario are filtered through what is publicly disclosed. The authors are based in the Western hemisphere, and the choice of a UK financial infrastructure case study reflects access to documentation rather than a claim that this context is more important or more representative than others. Practitioners applying this framework in different regulatory, geographic, or sectoral contexts should expect to revisit the normative assumptions embedded in each analytical stage.
Acknowledgements This work was supported by the Laboratory for AI Security Research (LASR); the views expressed in this paper are those of the authors and do not necessarily reflect the position of LASR or His Majesty’s Government. We also acknowledge and thank colleagues whose continued support and feedback were invaluable to the development of this paper, particularly Lee C and other NCSC colleagues for their technical reviews of the work, and Molly Parnham and Michaela Coetsee at Advai for research delivery support and feedback, respectively. Generative AI tools were used throughout this project to support literature familiarisation, iterative development of the STPA analysis, code prototyping, and manuscript drafting and refinement