cs.CYOct 22, 2026

AI Risk Ontologies for the EU AI Act Compliance: AIRO, VAIR, and their Integration with DPV

Authors: Delaram Golpayegani, Harshvardhan J. Pandit, Declan O'Sullivan, Dave Lewis

Organizations: ADAPT Centre, School of Computer Science and Statistics, Trinity College Dublin, Ireland

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

As the use of AI, and consequently its harms, becomes more prevalent, the global discourse around AI has become increasingly risk-aware. With new risks emerging more frequently than ever, a key challenge is how to represent, document, and catalogue AI risks in an effective, interoperable, and queryable manner. Additionally, the European Union (EU) AI Act's requirements for "high-risk" AI systems to manage and document the risks creates the need for open and interoperable tools, methods, and standards that facilitate AI risk management in an ever-changing environment. In this paper, we present ontologies and taxonomies developed to assist with risk management and documentation, in line with the requirements of the EU the AI Act. We developed the AI Risk Ontology (AIRO) to specify AI use cases and their associated risks, complemented by the Vocabulary of AI Risks (VAIR), which populates AIRO with taxonomies of concepts. Key international standards on AI and risk, namely ISO/IEC 23894 on AI risk management and ISO/IEC 22989 on AI terminology informed the development of the ontologies. To promote reuse and enable multi-regulatory compliance, AIRO and VAIR have been integrated in the Data Privacy Vocabulary (DPV) through a consensus-building process, expanding DPV's scope from data to AI.

Figures & tables

Obligations related toSources from the AI Act
Risk managementArticle 5 - Prohibited AI practices Article 6 - Classification rules for high-risk AI systems Annex I - List of Union harmonisation legislation Annex III - High-risk AI systems referred to in Article 6(2) Article 9 - Risk management system
AI and risk documentationArticle 9 - Risk management system Article 11 - Technical documentation Annex IV - Technical documentation referred to in Article 11(1)
AI and risk information sharingArticle 13 - Transparency and provision of information to deployers Article 49 - Registration Article 71 - EU database for high-risk AI systems listed in Annex III Annex VIII - Information to be submitted upon the registration of high-risk AI systems in accordance with Article 49
Table 1: List of articles and annexes from the AI Act [ 26 ] used as key sources in development of the ontologies
Obligations related toStandards
Risk managementISO/IEC 23894:2023 - Artificial intelligence — Guidance on risk management [ 56 ] ISO 31000:2018 - Risk management — Guidelines [ 52 ] ISO 31073:2022 - Risk management — Vocabulary [ 53 ]
AI and risk documentation and sharingISO/IEC 22989:2022 - Information technology — Artificial intelligence — Artificial intelligence concepts and terminology [ 55 ] ISO/IEC 42001:2023 - Information technology — Artificial intelligence — Management system [ 57 ]
Table 2: List of standards used as key sources to assist with interpretation of the AI Act
Figure 1: Ontology development methodology
SourceNo. of conceptsAIRO Concepts
The AI Act, Article 35AI System , AI Operator , AI Deployer , AI Provider , General Purpose AI Model
ISO 31073:2022 [ 53 ]8Risk Source , Hazard , Threat , Vulnerability , Consequence , Risk Control , Frequency , Likelihood
ISO/IEC 22989:2022 [ 55 ]3AI Component , Stakeholder , AI Developer
ISO/IEC TR 24028:2020 [ 54 ]2AI User , AI Model
Regulation (EU) No 1025/2012 on European standardisation [ 83 ]1Standard
Table 3: Non-ontological sources of AIRO
Figure 2: Overview of AIRO’s main concepts and relations
SourceClassesObject propertiesData properties
DCATdcat:DatasetNoneNone
DPVdpv:Processing , dpv:Data , dpv:SensitiveData , dpv:DataSource , dpv:DataSubject , dpv:LegalBasisdpv:hasProcessing , dpv:hasData , dpv:hasDataSource , dpv:hasDataSubject , dpv:hasLegalBasisNone
DQVdqv:QualityMeasurement , dqv:Metric , dqv:Dimensiondqv:hasQualityMeasurement , dqv:isMeasurementOf , dqv:inDimension , dqv:expectedDataTypedqv:value
DCTNoneNonedct:date , dct:title
Table 4: Ontologies reused in AIRO
Figure 3: Visual representation of the graph specifying the Uber’s Real-time ID Check use case
Figure 4: Visual representation of the graph specifying the VioGén use case
Figure 5: The set of Semantic Web-based artefacts built upon AIRO and VAIR, as detailed in [ 40 ]
PaperNo. of works analysed1. Background information2. Related work3. Legal analysis reuse4. Ontology reuse5. Methodology adoption6. Evaluation of contributions7. Future work
AIRO [ 39 ]63936322103
VAIR [ 37 ]582123148121
Table 5: An overview of citation to AIRO and VAIR
More in this topic

AI Risk Management

AI risk management studies how to identify, assess, reduce, and monitor harms from AI across development, deployment, and wider social systems.

See all 108 papers

Explore similar work

CardsList

  1. From Legal Text to AI-specific Risk Sources: A Systematic Analysis of the EU AI Act's High-Risk Requirements

    Sep 11, 2026Ronald Schnitzer, Mike Auer, Rumpa Choudhury +5AI GovernanceAI Risk Management

    Technical University of Munich, School of Computation, Information and Technology, Munich, Germany · Siemens AG, Munich/Vienna, Germany/Austria

  2. The Eticas AI Risk Taxonomy: Open Infrastructure for Operationalizing AI Audits

    Jul 2, 2026Gemma Galdon Clavell, Pablo Accuosto, Usman GoharAI AssuranceAI Risk Management

  3. AI Agents Under EU Law

    Apr 6, 2026Luca Nannini, Adam Leon Smith, Michele Joshua Maggini +6AI Agent GovernanceAI Regulatory Compliance

    Piccadilly Labs, Association of AI Ethicists, Centro Singular de Investigación en Tecnoloxías Intelixentes da USC · Piccadilly Labs, AIQI Consortium · Centro Singular de Investigación en Tecnoloxías Intelixentes da USC +6