MediumExclusion○Theoretical

Accessibility & digital-divide exclusion

Description

AI-only channels exclude customers with low digital literacy, disabilities, or language/connectivity constraints.

Example scenario

Pushing service to an AI-only app leaves elderly or rural customers unable to transact.

Real-world evidence○Theoretical

The deliberate use of AI systems to systematically obscure regulatory violations or automate evasion strategies has been articulated in regulatory risk literature but lacks confirmed documented production incidents. Algorithmic trading manipulation cases predate modern AI and do not squarely fit this framing.

No public incident on record — evidence level: Theoretical

Primary mitigations

Accessible design (WCAG)
human/assisted channels
multilingual support
inclusive testing.

Detection signals

Accessibility audits; channel-usage equity analysis; complaint review.

Mitigating controls

Non-agentic controls

ZYC-OREL-001Non-Agentic

Inference with Human Oversight Rate

Over-reliance

ZYC-ETH-001Non-Agentic

Non-Maleficence

Ethical Governance

ZYC-ACCT-001Non-Agentic

Human-in-the-Loop

Accountability & Oversight

ZYC-FAIR-009Non-Agentic

Form Factor Bias

Fairness

ZYC-FAIR-010Non-Agentic

Document Accessibility Bias

Fairness

Risk scoring

Severity

Medium

score 2

Likelihood

Medium

score 2

Risk

Medium

Control depth

5 mapped (below avg 5.2)

Framework refs

3/8 taxonomies

Framework mappings

Regulatory4/5

EU AI Act: Art. 5(1)(a) and Art. 5(1)(b) (Prohibited AI practices — AI systems that manipulate persons or exploit vulnerabilities to circumvent legal obligations are prohibited outright); Art. 5(1)(c)-(e) (further prohibited uses including social scoring and real-time biometric systems that could be weaponised for evasion); Art. 9 (Risk management — providers and deployers must identify foreseeable misuse including deliberate evasion use-cases); Art. 73 (Market surveillance and supervision — regulators have enforcement powers over AI systems used in violation of applicable law); Art. 4 (AI literacy obligations on operators imply governance controls preventing deliberate misuse).
DORA: — Not covered by DORA. DORA is confined to ICT operational resilience, incident reporting, and third-party ICT risk management. Deliberate use of AI to automate or obscure regulatory violations is a conduct and compliance risk outside DORA's material scope; it falls under sectoral supervisory frameworks (e.g., MiFIR, MAR, AML directives) rather than operational resilience regulation.
RBI: Conduct and Customer Protection
NIST AI RMF: MAP 1.1
ISO/IEC 42001: Clause 6.1.1

Risk taxonomies3/4

MIT AI Risk Repository: Domain 6 – Socioeconomic
IBM AI Risk Atlas: Societal impact / fairness
NIST ARIA: Harmful Bias & Homogenization
MAESTRO: — Not mapped

Security0/4

OWASP: — Not covered by OWASP LLM 2025
MITRE ATLAS: — Not covered by MITRE ATLAS
Cisco AI Risk: — Not covered by Cisco AI Defense
Palo Alto AI Risk: — Not covered by Palo Alto Prisma AIRS

Capability‑pattern applicability

Classification

GenAI‑specific

Capability pattern

Chat

Pattern scope

Pattern-agnostic (GenAI)

Why

Generative-AI risk realised without agency/tool-use — applies to chat, RAG, summarization, classification, and content-generation deployments.

Ownership & threshold

Owner (RACI)

AI Governance Office [A]

Threshold

Programme KRI within board-approved tolerance

Inherent vs residual

Inherent

Medium

Residual

2.4

Low

Mapped controls: 3
Assumed control effectiveness: 40%

Modeled, not measured — design-stage; controls not yet tested (reduction capped 40%). Residual applies a uniform assumed reduction to the inherent score; it is not evidence of tested control performance.

Related risks in Societal & Economic

ZNR-SE-001High

Over-reliance / automation bias

ZNR-SE-002Medium

Workforce displacement

ZNR-SE-003Medium

Environmental / compute & energy cost

ZNR-SE-004Medium

Erosion of human skill / deskilling

Search the Atlas

Accessibility & digital-divide exclusion

Description

Primary mitigations

Detection signals

Mitigating controls

Related risks in Societal & Economic