Docs

Appearance

AI System Risks ​

AI System risks represent the concrete risk profile of a specific AI System scope. They are instances of your organization taxonomy scoped to one AI System.

Where in Modulos ​

AI System risks live under AI System → Risks. This is where teams:

  • add risks from the organization taxonomy into an AI System scope
  • select which threat vectors matter in this deployment context
  • quantify risk threats and monitor rollups against limits

For the full operating model, see Operating Model.

Permissions

  • AI System Editor can create and update AI System risks and threat selections.
  • AI System Owner can also start quantification runs.
  • AI System Viewer can view risks and results for review and audit.
AI System Risks list view showing AI System risk value, status counts, and a table of risks with threat vectors.
AI System Risks shows the risk list, threat-vector coverage, and the quantification status rollup in one place. UI shown in light mode.
  1. 1
    Budget guardrail
    Warnings appear when AI System limits do not add up consistently.
  2. 2
    AI System risk value
    See total quantified exposure and how it compares to the AI System limit.
  3. 3
    Status rollup
    Quantified, in progress, and unquantified threats roll up to the AI System view.
  4. 4
    Risk list
    Each risk shows its limit, current value, and associated threat vectors.

How it works ​

AI System risk is taxonomy-driven:

  • you add an organization-defined risk into an AI System
  • you select threat vectors that are relevant in this deployment context
  • Modulos creates risk threats in the AI System that reference the taxonomy threat vectors
  • you run quantification per threat to produce monetary outputs

The AI System risk’s total value is the sum of its threat values, and its status is derived from threat quantification status.

Risk threats ​

A risk threat is an instance of a taxonomy threat vector inside one AI System:

  • it copies the threat vector’s name and description into the AI System context
  • it is quantified independently
  • it rolls up into the AI System risk total

Consistency

You can only add a given taxonomy risk once per AI System. This keeps reporting consistent and avoids duplicate counting.

Selecting threat vectors

When adding a risk, you must select at least one threat vector. The available threat vectors come from the taxonomy risk’s associated threat vectors.

If the right threat vector is missing, update the organization taxonomy first.

How to use it ​

Status and rollups ​

In the platform model:

  • each risk threat gets its status from the latest quantification run: unquantified, in progress, quantified, failed
  • an AI System risk is unquantified when all its risk threats are unquantified, quantified when all are quantified, and in progress otherwise

Only quantified risk threats contribute monetary value to rollups. This prevents “half-finished” work from being mistaken for a final number.

Quantification is asynchronous. After you start a run, the threat moves to “in progress” and updates to “quantified” once the run finishes.

Important considerations ​

Limits turn quantification into governance.

At a high level:

  • each AI System has a total monetary risk limit
  • each category has a share of that limit
  • within a category, individual AI System risk limits are distributed across risks and can be overridden

If limits do not add up consistently, Modulos blocks quantification until configuration is corrected.

Manual overrides

If you override individual risk limits within a category, treat it as explicit budgeting across that category. The sum of individual risk limits should match the AI System’s category budget.

Build vs buy and risk ownership ​

Risk quantification depends on what you can observe and Control.

  • If you build the system, you are effectively both provider and deployer. You can quantify and mitigate both model-level and deployment-level threats with high fidelity.
  • If you buy the system, you are the deployer. You often lack access to training data, model internals, and evaluation artifacts. Your strongest quantification leverage is usually in the deployment context: integration, usage patterns, monitoring, and incident response.

For vendor-provided systems, demand enough documentation to make quantification defensible: known failure modes, evaluation artifacts, and operational constraints.

Operating Model

Views, permissions, rollups, and guardrails

Organization Taxonomy

Curate the shared risk and threat library

Risk Quantification

Run quantification per threat to get monetary outputs

Acting on Quantified Risk

Compare exposure against limits, mitigate through Controls, and re-quantify