{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"ai_governance","domain":["AI Governance","Governance, Policy & Oversight","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-accountability-liability","description":"Ambiguous responsibility across developers, deployers, and operators means no party is clearly accountable when AI causes harm; organizations face reputational damage, regulatory sanctions, and civil liability from AI failures at scale, and operational disruption when AI is unavailable.","details":{"category":"ai_governance","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"ai-accountability-liability","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk"],"treatment":"mitigate"},"id":"risk:ai-accountability-liability","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-accountability-liability","sourceIds":["aiuc-1","eu-ai-act","iso-42001","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"AI accountability gaps and organizational liability","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:069ac1259e7f29f7bbf03232bd2d8b50070b882b90869b336c8a2914671d90d2","properties":{"rationale":"Regulator/assessor-sufficient documentation is the due-diligence evidence that reduces compliance liability.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-06-f47eedcb.json","sourceId":"uc:UC-AI-06","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0ffa2def5c469c649f11402c81e8ed1599c552790a44f28df6589a3bc9e41a5a","properties":{"rationale":"Lifetime event logs provide the traceability/audit trail underpinning accountability for AI operation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:138cee71e2689f1c57ab4ea4a589cc9e8a1a1c0be8ebca8f9307054ad5e0ff03","properties":{"rationale":"A documented quality management system with owned procedures, issue tracking, and corrective action is the organizational accountability structure regulators and customers hold the provider to.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-24-066ea393.json","sourceId":"uc:UC-AI-24","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:19072da7d290c1ae8336503ea461ffd7c87b0f5c39653f1ef42187b9ee29c4fc","properties":{"rationale":"Recording resource owners/locations supports supplier accountability and impact tracing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-03-cba029bc.json","sourceId":"uc:UC-AI-03","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4118ac433b2911887c4c5d66833ab147dd85769f1d4bb9f7cd941e7889a9b8c0","properties":{"rationale":"Assigning roles/responsibilities/authorities in a RACI closes the ambiguous cross-party responsibility gap so a clearly accountable owner exists at each lifecycle stage.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-02-d2679f4e.json","sourceId":"uc:UC-AI-02","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c3ce8677537179c10d2c669f0a25c9a3df258809ff6ac1143364dbe657a29d1","properties":{"rationale":"Clear ownership and usage terms for outputs pre-empt the liability disputes that arise when rights to generated content are undefined.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-17-420198e3.json","sourceId":"uc:UC-AI-17","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5267162df2e31d7b15e365101807288dd2bb43c43c3839f4d1e0d4d549206f9e","properties":{"rationale":"A management-approved AI policy sets governance expectations and evidences due diligence, but the operative accountability defense is role/owner assignment (UC-02/UC-13); the policy contributes rather than closing the responsibility gap.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-01-156cdd4f.json","sourceId":"uc:UC-AI-01","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:84059028aa84c8e1e4ea854971dfa5bf4e8d663dd503d1e7b0f32ed0419c12de","properties":{"rationale":"Timely incident and regulator reporting discharges external duties and reduces sanction exposure, but does not close the core ambiguous-responsibility gap the risk centers on; role/owner assignment (UC-02/UC-13) is operative.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-11-7112e573.json","sourceId":"uc:UC-AI-11","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d1e1c3d34ae1816a1c94e4cbf595b24e2536dc0f9ff2226deebb6cb2eee7e0ee","properties":{"rationale":"Determining value-chain role and allocating responsibilities/obligations to named owners closes the ambiguous cross-party accountability the risk names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-13-2ce71d80.json","sourceId":"uc:UC-AI-13","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e15d5339038dbda4e2e476ff11a6fa9dddcc48cb6e56d2d1e25f8e0d368492d5","properties":{"rationale":"Supplier evaluations and customer communications allocate and evidence responsibility across the relationship.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-14-cc67739e.json","sourceId":"uc:UC-AI-14","targetDetailPath":"/data/v1/records/risk-ai-accountability-liability-193b3f72.json","targetId":"risk:ai-accountability-liability","type":"mitigates"}],"schemaVersion":1}