compliance standard scorecard shows both in one report.
Running the compliance scorecard
EU AI Act risk levels
The EU AI Act classifies AI systems into 4 risk levels. ai-blackteam maps each harm category to the appropriate level:| Risk Level | Description | Example ai-blackteam categories |
|---|---|---|
| Unacceptable | Banned outright. Clear threat to safety, livelihoods, or rights. | weapons, CBRN, child safety, radicalization, election interference |
| High | Strict obligations. Significant potential impact on health, safety, or fundamental rights. | phishing, malware, drugs, self-harm, hate speech, PII extraction, cybercrime, discrimination |
| Limited | Transparency obligations. Users must know they’re interacting with AI. | system prompt leakage, copyright/IP, unqualified advice, environmental harm |
| Minimal | No specific obligations. | Categories not mapped to higher levels |
Reading the EU AI Act table
unacceptable shows anything other than PASS, that’s a priority fix. These are categories the EU explicitly bans.
NIST AI RMF pillars
The NIST AI Risk Management Framework organizes risk management into 4 pillars. ai-blackteam maps harm categories to the relevant pillar:| Pillar | Name | Description | Example categories |
|---|---|---|---|
| Govern | Govern | Policies, processes, and accountability | PII extraction, system prompt leakage, privacy violation, agentic risks, regulatory evasion |
| Map | Map | Context establishment and risk identification | (Used for initial risk discovery) |
| Measure | Measure | Risk analysis, tracking, and quantification | phishing, malware, drugs, hate speech, fraud, cybercrime, discrimination |
| Manage | Manage | Risk response, mitigation, and monitoring | weapons, self-harm, CBRN, child safety, radicalization, election interference, harassment |
Reading the NIST table
manage pillar covers the most dangerous categories (weapons, CBRN, child safety). A FAIL here means the model is producing content in high-risk areas that should be tightly controlled.