Figure $2.$ AIRO$-$based representation of Uber's facial recognition system use$-$caseCore Issue: The rising number of incidents caused by misuse of artificial intelligence $($AI$)$ has spurred governments, organizations, and the public to seek ways to manage the associated risks. The EU's proposed AI Act is a significant step towards regulating AI development and use, focusing on a risk$-$based approach.

AIRO's Purpose: AIRO is an ontology $($a formal way to represent knowledge$)$ designed to address this need. It aims to help stakeholders:

Determine if an AI system is 'high$-$risk' according to the AI Act's criteria.

Maintain and document risk information in a structured way.

Perform impact assessments to understand potential consequences.

Achieve compliance with AI regulations like the AI Act.

How AIRO Works:

Information Requirements:

AIRO identifies the key information needed to classify an AI system as high$-$risk. This includes factors like the AI techniques used, the domain of application, the intended purpose, and the potential impact on individuals or groups.

It also specifies the information that must be documented for high$-$risk systems, such as risk assessment details, mitigation measures, and post$-$market monitoring plans.

Modeling Use Cases:

The article demonstrates AIRO's practicality by applying it to real$-$world examples of AI incidents from the AIAAIC repository.

This shows how AIRO can be used to analyze these incidents, determine if they meet the high$-$risk criteria, and generate the required documentation.

Semantic Web Technologies:

AIRO leverages semantic web technologies $($like RDF and SPARQL$)$ to represent information in a machine$-$readable format. This allows for automated queries and reasoning, making it easier to manage and analyze risk information.

Benefits:

Standardized Risk Assessment: AIRO provides a consistent framework for assessing and documenting AI risks, which is crucial for regulatory compliance.

Information Sharing: The machine$-$readable format facilitates sharing risk information between stakeholders, promoting transparency and collaboration.

Automation: AIRO enables automated tools to assist with risk management tasks, saving time and effort for organizations.

Future Work:

Expanding AIRO to include more incident categories and risk assessment details.

Incorporating provenance $($information about the origin and history of data$)$ to improve transparency and traceability.

Investigating how AIRO can support Data Protection Impact Assessments $($DPIAs$)$ under the GDPR$,$ aligning AI risk management with broader data protection efforts.