All 52 threats in full: description, impact, example, mitigations and verified sources.
To the catalogueDistribution of threats across supply chain, development and production
The catalogue assigns every threat to the phase in which it arises. The lanes show this distribution; the bars beside them show the implementation levels at which the mitigations of the same phase take effect. The two regularly diverge.
Who it is for: For governance, procurement and programme management
Lifecycle
Supply Chain
3 of 52 threats
Where the mitigations of this phase take effect
- Supply chain 6
- Data 4
- Model & training 4
- Infrastructure 2
- Use & operations 1
- Organization 1
Development
4 of 52 threats
Where the mitigations of this phase take effect
- Model & training 17
- Data 8
- Supply chain 2
- Use & operations 1
- Organization 1
Production
45 of 52 threats
Where the mitigations of this phase take effect
- Application, API & agents 166
- Use & operations 89
- Data 49
- Model & training 47
- Infrastructure 47
- Organization 36
- Supply chain 9
The file shows the current state including any filters and carries the note, catalogue version and source.
The phase names where a threat arises, not when it is discovered. A threat that arises in the supply chain may only become visible during live operation.
Versatile AI Risk Assessment is an aid for structuring AI risks and making them transparent. It does not replace legal or professional advice and makes no binding decisions.
Understanding threats
The same data, a different question
What defines a threat, when it arises and how it differs from another.
-
Threat pathway
How does harm arise?
For anyone working through a threat in depth for the first time
-
Threat comparison
Where does the line between two run?
For anyone drafting policies, training material or audit plans
Placing your own system
- System context Which threats affect my system?
- Architecture change What does a rebuild trigger?
Planning mitigations
- Effect matrix How and where do mitigations take effect?
- Ownership Who has to act?
Checking frameworks and evidence
- Framework mappings Where is this anchored professionally and legally?
- Coverage gaps What does my framework not reach?
- Evidence base What is this based on?
Related
From the analysis to the assessment
Four short sections along the EU AI Act for a first, non‑binding orientation of your system.
To the quick checkThe full assessment with system context, threat selection and evidence tracking, free of charge in the browser.
To the live demo