Built for Measurement: Introducing the FAIR Institute's AI Risk Working Group

If you joined us for FAIR Forward this week, you heard Nick Sanna and Jack Jones describe what FAIR Institute 2.0 means: an independent, member-governed standards body for measuring and managing cyber, AI and technology risk in economic terms. You also met the six working groups that will do much of the building, and I had about ninety seconds to introduce the one I'm chairing. Ninety seconds doesn't come close to doing justice to how excited I am about this work. So here's what the AI Risk Working Group is setting out to do and why I think the FAIR community is uniquely positioned to do it.

Plenty of AI guidance, very little that helps us assess AI risk

Over the last two years the industry has produced an impressive amount of AI guidance. We have the NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP Top 10 lists for LLM and agentic applications, MITRE ATLAS, and a growing shelf of vendor and industry control frameworks. Most of it is genuinely useful, and nearly all of it is written for cybersecurity defenders, telling you how to govern AI and which controls to put in place. What none of it does is tell a risk leader how to scope an AI risk scenario, how often that scenario is likely to happen, or what it would cost when it does.

That gap matters because the questions have already changed. Boards, regulators and insurers aren't just asking how much AI risk we carry. They want to know how we can move faster without being reckless, whether the gaps in our guardrails expose us beyond our risk appetite, and what risk appetite even looks like when AI poses an existential threat to so many organizations. Those are FAIR questions, and they deserve FAIR answers. (sorry, couldn't help myself!) Today, though, most AI risk registers are full of entries like "hallucination" or "prompt injection" that can't be measured, because the industry has never agreed on what an AI risk scenario actually is.

A true AI risk standard, designed for measurement from day one

Our aspiration is to build a true AI risk standard rather than another security standard, and to design it with measurement in mind from the very beginning instead of bolting quantification on at the end. In practical terms, that means giving risk leaders a standard, FAIR-consistent way to identify, scope, quantify and manage AI risk, so that any AI risk can be stated as a scenario a FAIR analyst can measure and a risk owner can act on.

FAIR has always drawn a clean line between scoping a scenario (naming the asset, the threat and the effect) and quantifying it (estimating how often it happens and how much it costs). We're building the standard along that same line, and the shorthand I keep coming back to is that scoping names the risk and measurement quantifies it.

"Scoping names the risk, and measurement quantifies it."

On the scoping side, we aren't starting from a blank page. The group will begin with a contributed AI Risk Scenario Framework that gives practitioners a consistent way to build AI risk scenarios, tracing the pathway an event follows through to the outcome it produces. Those outcomes are where AI breaks from cyber. Confidentiality, integrity and availability have served us well as a vocabulary for effects, but AI risk also shows up as erroneous decisions, discriminatory harm to customers or lost competitive ground, and each of those needs to be counted and priced as a FAIR loss event.

Putting the whole FAIR family to work

FAIR is the backbone. Every output will use FAIR's own constructs, including loss event frequency, threat event frequency, vulnerability, and primary and secondary loss. Every outcome in the framework also maps to a FAIR loss event. One of the most useful patterns I've seen in early testing is that AI risk scenarios cluster naturally around why the loss happened. For example, a bad AI investment driven by hype has very different risk characteristics than a rushed AI build that skips essential testing. I've started calling these groupings the faces of AI risk (those two are the Strategy and Execution faces), and each face comes with its own frequency driver. An employee pasting customer records into a public chatbot is driven by usage volume and error rate, an attacker planting instructions that our own agent follows is driven by attempts against our exposed AI, and a criminal group running AI-written phishing is driven by threat actor activity. All three can end in the same data exposure, but blending them into a single register entry would average three incompatible frequencies into a number that isn't meaningful. The working group will define the frequency drivers for each scenario category and a repeatable method for getting from a scoped scenario to a complete FAIR analysis.

FAIR-CAM is how we'll express the value of AI safeguards. Rather than inventing yet another AI control catalog, we'll develop vendor-neutral AI safeguard objectives drawn from established industry AI security frameworks and my AI Risk Map™, then align each one with FAIR-CAM's ontology. (Decision Support may turn out to be the key to strategic risk, but more on that later.) That way a proposed guardrail or human checkpoint can be judged by how much it actually reduces frequency or magnitude, not by how reassuring it sounds. We'll do this hand in hand with Zach Cossairt's FAIR-CAM Working Group, proposing AI-specific applications of the model rather than redefining it.

FAIR’s forms of loss give the outcome taxonomy its foundation. FAIR has always described loss in six forms: productivity, response, replacement, fines and judgments, competitive advantage and reputation. They hold up well for AI because they describe what happens to the organization rather than how an incident unfolds, so even retraining a model is still a response or replacement cost. I’ll admit that in my own work I’ve often folded reputation and competitive advantage into a single form, but my hunch is that AI may prove why FAIR kept them separate by design. Competitors pulling ahead with AI erodes our competitive advantage without any public event at all, while backlash over how we use AI damages our reputation through an entirely different set of drivers. The working group will build the outcome taxonomy up from the forms of loss in partnership with Erica Eager's FAIR Loss Model Working Group. Where that work points to changes in more detailed guidance like FAIR-MAM, those proposals will then go through the Standards Committee that Jack chairs, since no working group gets to change a FAIR standard on its own.

FAIR-AIR gets a successor. Our group will take on the Institute's existing FAIR AI Workgroup and its FAIR-AIR Approach Playbook. FAIR-AIR 2.0 will deliver the actionable playbooks Nick described at FAIR Forward: step-by-step assessment guidance, member use cases and a reference library of worked AI risk scenarios.

Why this is bigger than AI

For me, this working group is also our chance to prove something the FAIR community has believed for a long time, which is that FAIR can be applied to all operational risks, and even to strategic risk. Think about two AI concerns a board might raise in the same meeting. In the first, fraudsters hijack our payments agent and have it wire money out. In the second, competitors use AI to cut their costs and our customers gradually leave for them, where nothing happens on any particular day and we simply lose ground. A credible AI risk standard has to scope and measure both without blending them, and the Strategy face is one that no other AI framework really addresses today.

What makes this especially exciting is that our early exploration suggests the FAIR family may already have much of the vocabulary we need. Strategic AI risk is fundamentally about decisions: betting heavily on an AI initiative that never delivers, moving too slowly while competitors pull ahead, or committing spend to a platform that's obsolete within a year. FAIR-CAM's Decision Support functions were designed to describe how organizations keep decisions aligned with their risk appetite. If that early read holds, measuring Strategy-face risk is less about inventing something new and more about extending FAIR's outcomes to cover lost value, then applying controls the FAIR family already understands to a new class of decisions. Testing that is exactly the kind of work this working group was formed to do.

The same opportunity shows up as AI moves out of the data center and onto the plant floor. Nick reminded us at FAIR Forward that the Institute's mandate now reaches beyond cyber into technology and operational risk, and AI in operational technology is where those worlds meet. When a forecasting or maintenance model starts influencing how a grid, a pipeline or a production line actually runs, the outcomes practitioners care about first are safety, environmental harm and damage to equipment. Neither the C/I/A lens nor today's AI frameworks name them. Making sure the outcome taxonomy and FAIR's forms of loss can carry them is part of building a standard for all operational risk, not just the risks that live in IT.

Two scenarios with the same loss can still be very different risks. The hijacked payments agent and a deepfake video call impersonating the CFO can both end in the same theft of funds, yet the cause, the pathway, the missing safeguards, the frequency driver and even the likely insurance recovery all differ. A register that sorts only by outcome would merge them, and the organization would end up investing in the wrong controls.

Measured, not argued

Nick asked us to imagine a world where two analysts looking at the same risk scenario reach the same conclusion, and so do the auditors. That's the bar we're setting for ourselves. Before the framework goes to member review, the group has to answer its founding research questions with evidence. Does the face framing hold up for practitioners, and where does it break? Can every real risk be placed in exactly one face? Is the outcome taxonomy complete, and how should FAIR measure strategic loss? Rather than settle them by debate, we'll pressure test the framework hands-on with practitioners against real scenarios, and let the evidence show us where it holds and where it needs work.

Our first job is to answer a deceptively simple question: what does it actually mean to perform an AI risk assessment? From there, we're aiming to publish V1 of the standard in time for RSAC Conference in April 2027, and to bring the results to FAIRCON 2027 as hands-on workshops.

Jack closed the first session by saying he hopes to see quantification become an expectation rather than the exception. I'd love for AI to be the place where that happens first, because the need is enormous and the timing is right. With the whole FAIR family behind us, we have a real opportunity to give organizations adopting AI an answer they can trust. I hope you'll help us build it.


Join the Institute as a Contributing Member to benefit from the AI Risk Working Group’s deliverables.