Consumer AI harms
AI Harms Taxonomy
Mapping the digital ways AI-enabled mechanisms can make consumers worse off, directly or indirectly.
Why this taxonomy exists
Plenty of people have made lists of the ways AI can go wrong. Very few of those lists tell you where different forces could get involved to stop the harms.
So we built this around places to intervene. Each harm is traced through the points it passes on its way to the consumer, and each defense is attached at the point where it would actually have to be built.
Doing it that way makes one thing very obvious: many of these harms are not ours to fix. They can only be fixed by the companies that make the models and run the products, and it seems better to say that than to pretend otherwise.
Finally, this is a work in progress. Many entries list an evidence base, but some are still thin, and we are constantly reevaluating the structure of this taxonomy to keep pace with this fast-moving field. Your feedback is very welcome, especially if you think something is wrong.
How we think about threats
One relationship: threat actor to consumer.
Four parties. Five relationships to defend.
Explore the network
Every harm is part of a bigger picture
AI harms don't happen in isolation. Explore how each harm connects to the layers that contribute to it and the defenses that help prevent it. Follow the connections to see how the different parts of the network fit together.
Scope
What counts as a harm here
A harm gets added if a real person gets hurt, an AI did it or was the tool used to do it, and we can point at the specific steps along the way. Harms that existed before AI and are simply amplified by it typically don't get added. For example, a criminal using AI to clean up the spelling and grammar in a phishing email does not constitute a new entry. The taxonomy currently covers 26 harms across five relationship types: chatbot → consumer, agent → consumer, threat actor → consumer, threat actor → agent, and threat actor → chatbot.
Response
How a harm connects to a defense
A harm crosses one or more of 19 intermediary layers on its way to a person: a foundation model, an agent runtime, a memory store, a consumer device. Each layer has its own defenses and its own answer to who could actually act there. There is no direct harm-to-defense link by design. The connection always runs through a layer, because that tells you not just whether something would help, but where it would have to be deployed and by whom.
Tap a harm, layer or defense to see how it connects.