How to read an AIR report

An AIR report tells you which risks your AI system has, which safeguards are missing, and where the system sits under the EU AI Act.

The five tabs

• Overview: a summary of the system, the main numbers, the top risks, and what still blocks sign-off.
• Risk tier: the EU AI Act class of the system, and the checks behind it.
• Risks: every risk theme AIR checked, sorted into four groups.
• Controls: the safeguards each risk needs, and whether your documents show them.
• Evidence: the documents AIR read, and every passage the report quotes.

Families and themes

AIR checks a fixed list of 63 risk themes. A theme is one kind of problem an AI system can have, for example "Unsafe degraded-mode behaviour". Themes are grouped into 13 families, for example "Safety & Human Harm" or "Privacy, Confidentiality & Intellectual Property". To see one family, use the Category filter on the Risks tab.

The four risk groups

Every theme ends up in exactly one group:

• Outstanding: a real risk for this system now. Only these get a severity, lifecycle stages and linked controls.
• Needs evidence: your documents say nothing about this theme, so AIR could not judge it. Add a document that covers it.
• Potential: the theme may apply, but the evidence is too thin to confirm it.
• Ruled out: AIR checked and found no material risk. It does not mean a safeguard is in place.

The default view, Active, shows Outstanding and Potential together: the themes that need action.

Four ratings on a risk

• Severity: how bad the harm would be. Shown on each risk card.
• Likelihood: how likely the harm is. Not shown on its own; it feeds priority.
• Priority: severity and likelihood combined, from Low to Critical. A high severity with a medium likelihood is High priority; high with high is Critical. Priority orders the risk list and the Top priorities card.
• Confidence: how sure AIR is of its reading. It says nothing about how bad the risk is.

Inside a risk card

Each risk is backed by checks AIR answered from your documents. They are sorted into three columns:

• Contributors: what your documents show that makes the risk more likely, such as a warning sign or a missing safeguard.
• Mitigators: what your documents show that makes the risk less likely, such as a safeguard in place.
• Missing evidence: checks your documents do not answer.

A finding with evidence lists the passages behind it. Click a file name to open the document at that page. Below the columns, Linked controls lists the safeguards for this risk. Click one to jump to it.

Control statuses

• Implemented: your documents show the safeguard in place and working.
• Partially implemented: it is in place, but the documents do not show it working in full.
• Not implemented: it is not shown to be in place. This covers both a safeguard the documents say is missing and one they do not mention at all.
• Needs evidence: AIR could not judge it, and it is not required for its risk.

Each control card also says what AIR found, the action needed, the risks it serves, and how it maps to ISO 42001, the EU AI Act and the NIST AI RMF.

The risk tier

AIR checks the EU AI Act classes from the top down: unacceptable, then high, then limited, then minimal. The first class whose check fires is the tier. When facts are still unknown at a higher class, the tier is not final, and the Risk tier tab lists the answers it still needs.

Scan again

From the second scan of a system, a note under the tabs lists what closed, what is still open and what is new, and says whether your documents changed. If they did not, a change in the result comes from AIR reading the same text differently. Scan again: how AIR shows what changed explains every label.