Sources of Risk in AI Systems Revisited: FCAIR-O, a Faceted Causal Framework and Lightweight Ontology for Risk Management and Assurance
This paper introduces FCAIR-O, a revised conceptual framework and lightweight ontology that resolves role conflation in existing AI risk models by establishing a structured, twelve-node causal backbone with eight orthogonal facets to improve mechanistic traceability, responsibility, and risk management assurance.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Artificial intelligence is no longer just a tool that sits on a shelf; it is woven into the fabric of daily life, making decisions about loans, diagnosing illnesses, and even driving cars. When these systems work well, they are invisible. When they fail, the consequences can be immediate and severe. The challenge for engineers and regulators has long been how to talk about these failures. Too often, lists of risks mix up different things: they might list a "lack of fairness" alongside a "broken sensor" and a "hacker attack" as if they were all the same kind of problem. This confusion makes it hard to know where to fix the issue. Is the problem the code, the data, the person using the system, or the rules the company follows? Without clear distinctions, safety measures can miss the mark entirely.
To solve this, two researchers, Moritz Schneider and André Steimers, have developed a new way to map out where things go wrong. They are building on their own earlier work from 2022, which first tried to organize these risks, but the world of artificial intelligence has changed rapidly since then. New types of systems now exist that can write code, remember past conversations, and pull information from the internet in real time. These capabilities create new kinds of dangers that old checklists simply cannot describe. The researchers realized that to keep people safe, they needed a map that separates the cause of a problem from the harm it causes, and from the rules meant to stop it.
The result of their work is a framework called FCAIR-O. Think of it as a highly detailed, structured dictionary for risk. Instead of one long, confusing list, the researchers created a system with eight different "sides" or dimensions. One side describes the level where the problem happened, such as the computer chip, the software program, the human operator, or the company's management. Another side tracks the timeline, from the moment the idea was first imagined to the day the system is turned off. A third side identifies the specific type of harm, like a physical injury, a loss of privacy, or a financial loss. By forcing analysts to look at a problem through these different lenses at once, the framework prevents the common mistake of blaming the wrong thing. For example, if a system denies a loan unfairly, the framework helps distinguish whether the error came from the data used to train the system, the way the company set up the rules, or the specific moment the decision was made.
The researchers tested this new map by looking at real-world disasters and near-misses. They examined the fatal crash of an Uber self-driving car in Arizona, a case where a pedestrian was struck. In the past, people might have simply called this an "automation failure." The new framework breaks it down into a chain of specific events: the car's sensors saw the person but misidentified them; the software was programmed to disable the emergency brakes while the computer was driving; the human safety driver was looking at a phone; and the company had not properly tested the system in those conditions. By separating these distinct failures, the framework shows that fixing just one part, like the sensors, would not have been enough. The solution required changes to the software logic, the human oversight, and the company's safety culture. This level of detail is what the researchers argue is necessary for true safety.
The paper also addresses how laws and standards fit into this picture. Laws often say what must be done, such as "you must have a human in the loop," but they do not always explain how that human should interact with the machine to be effective. The researchers show that simply having a human present is not a guarantee of safety if that person is distracted or overwhelmed. Their framework treats legal rules as a separate layer that sets the boundaries, while the technical analysis focuses on the actual mechanics of failure. This distinction is crucial because a company can follow all the rules on paper and still have a dangerous system if the underlying mechanics are flawed.
One of the most important findings is that the researchers are not claiming to have found every possible risk. They explicitly state that this is a conceptual tool, a way of thinking, rather than a final, unchangeable list of every danger in the universe. They acknowledge that their work is based on a review of available documents and cases up to a specific date in 2026, and that the technology will continue to evolve. They also note that they did not test their framework on a massive scale of real-world data to prove it works better than other methods. Instead, they argue that the value lies in the clarity it brings. By separating the different roles of risk—what causes it, what it hurts, and how we try to stop it—they provide a language that engineers, lawyers, and regulators can all use without talking past each other.
The researchers also looked at how new types of artificial intelligence, like those that can use tools or act on their own, change the landscape. These systems can make mistakes that are very different from older, simpler programs. A system that can write code might accidentally delete important files, or a system that can access the internet might be tricked into revealing private information. The framework is designed to handle these complex scenarios by tracing the path of the error from the initial command all the way to the final result, including any mistakes made by the people who built or monitored the system.
Ultimately, the paper offers a way to stop treating artificial intelligence risks as a vague, scary cloud. It replaces the cloud with a structured set of questions. Who is responsible? What exactly broke? What evidence do we have? What rules apply? The researchers suggest that by using this structured approach, society can move from simply listing dangers to actually understanding and managing them. They do not promise that this will eliminate all accidents, but they argue that it is a necessary step toward making these powerful systems safer and more reliable. The work stands as a proposal for a better way to think, a tool for clarity in a field that is often clouded by confusion.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.