The Model Instinct: The Use Sets the Risk and the Value

Open the incident table of the AI Incident Database, the public record that the Responsible AI Collaborative keeps of occasions on which an AI system is reported to have caused or nearly caused harm, and look for the column most readers expect: the model. In the export used for this book there is no such column. What each of the 1,786 incidents in the snapshot of 2 November 2026 carries instead is an "alleged deployer", an "alleged developer" and the "alleged harmed or nearly harmed parties", as the database's volunteer editors attributed them from press reports (35, Responsible AI Collaborative, 2026). Sort the deployers by how often they are named and the first three are not organisations at all: "scammers", named in 240 incidents, "deepfake creators" in 129 and "synthetic media creators" in 106 (35, Responsible AI Collaborative, 2026). The first named company comes fourth. Sort the developers and the top of the list is a category of technology rather than a product: "deepfake technology developers" in 452 incidents and "synthetic audio generation technology developers" in 241 (35, Responsible AI Collaborative, 2026).

A reader who expects a league table of models will not find one. What the record holds is a picture of uses: people using a kind of technology to do something to other people, so often that the editors named the practice and not the tool. Reading those entries as categories of people and of technology is my editorial classification, not a field of the database; the entries are attributions from press reports, not legal findings; and what the editors chose to record does not prove that models do not matter. The instinct asks which model. The record answers with what it was used for and by whom.

That gap is the subject of this chapter. Applied to this landscape, the habit of judging a product by its name puts the risk and the value in the wrong place, because the same general-purpose model is a drafting aid at one desk and an agent with its own permissions at another. The chapter draws on two incident records, the structure of the AI Act, and two views of this book's notation.

The questions

Question 11 of the test belongs to this chapter. It asked: "In the AI Incident Database, which kind of harm is the most frequent among the incidents that have been classified?" The options were: An autonomous system escaping control; People using AI to defraud, deceive or manipulate other people; Physical injury from robots and self-driving vehicles. The database classifies 1,498 of its incidents against the MIT AI Risk Repository taxonomy, one classification per incident, and the largest risk domain is "Malicious actors and misuse", with 566 incidents; within it the sub-domain "Fraud, scams, and targeted manipulation" alone accounts for 412 (35, Responsible AI Collaborative, 2026). The next domain, "AI system safety, failures, and limitations", holds 314. The right answer is people using AI against other people. The sub-domain closest to the first option, "AI pursuing its own goals in conflict with human goals or values", holds 3 of the 1,498 (35, Responsible AI Collaborative, 2026).

No survey asked the public to guess this distribution, but three asked how people feel about AI as a whole. The Pew Research Center asked 5,410 adults in the United States in August 2024, "Overall, would you say the increased use of artificial intelligence (AI) in daily life makes you feel…", and 51 per cent answered more concerned than excited, against 15 per cent of the 1,013 AI experts Pew asked the same question (32, McClain et al., 2025). Special Eurobarometer 554, a face-to-face survey of 26,415 residents of the 27 member states aged 15 and over in April and May 2024, asked for agreement with "Due to the use of robots and artificial intelligence, more jobs will disappear than new jobs will be created", and 66 per cent agreed (29, European Commission, 2025). The Ipsos AI Monitor 2025, a vendor survey of 23,216 online adults in 30 countries, asked for agreement with "Products and services using artificial intelligence make me nervous", and 53 per cent agreed on its 30-country average (31, Ipsos, 2025). Each question treats AI as one object, which is the box instinct of Chapter 5, and none can say what the record says: that the harm most often recorded is done by a person, with a tool, to another person.

Question 12 asked when the obligations for high-risk AI systems listed in Annex III of the AI Act apply. Chapter 11 gives the answer, 2 December 2027, and what the date does and does not change. It matters here because Annex III, the Act's list of high-risk uses, is a list of uses and not of models.

The instinct

The model instinct is the habit of treating the model as the thing that carries the risk and the value: asking "which model" first and expecting the answer to say how dangerous, how useful and how well governed an AI use is. Hans Rosling's method, which this book borrows with acknowledgement, was to name the habit of mind before correcting the picture it produces (8, Rosling et al., 2018). This one is the product habit, and it is a good habit almost everywhere else, because the thing you buy is usually the thing that acts: product liability and procurement assume that an artefact carries its properties from the factory to the user. The instinct also has a kernel of truth here, and the chapter's claim has to be stated with it in view. Models differ, and some differences matter: what a model was trained on, whether its weights are open, where it is served from and under whose law, and what it can and cannot do. A use that needs a capability the model lacks cannot be built on it, and a use that must not send data outside a boundary cannot run on a model served from beyond it. A model is also a regulated object in its own right: a general-purpose AI model under Article 3(63) of the AI Act carries Chapter V obligations for its provider, which have applied since 2 August 2025 (39, European Union, 2024).

So the claim is comparative. The model bounds what a use can do. The use, and the usage mode in which it runs, decide what it does do, to whom and with what consequences, and they set the risk and the value more than the model's name does. A general-purpose model does not carry its use with it: the same model drafts a letter for a claims handler, writes code for an engineer or, wrapped in a loop with tools and credentials, acts on a production system without anyone approving each step. AI Governance, Chapter 2, concluded that using a large language model is not one activity but at least six, and its Chapter 25 that the mode, not the brand, sets the governance (2, Nordqvist, 2026). The six usage modes, the ways an organisation comes to use a model, run from Mode 0 Ambient AI, which people meet because a supplier switched a feature on, to Mode 5 Autonomous production agents, which act on business systems without a person approving each step; each puts the organisation's control point in a different place (3, Nordqvist, 2026). The model is the same in all six; most of what decides what can go wrong, and for whom, is different.

Two things follow. Uses drift: a prompt becomes a shared skill, a skill is built into a system, a system becomes an automation, while the controls stay where the use started, which is why AI Governance treats every change of mode as a change that requires review (2, Nordqvist, 2026); a register of models cannot see the drift. And the value sits in the use as surely as the risk does. A board told which model it has licensed and concluding that it knows what it has bought makes the same mistake as a journalist told which model was behind an incident and concluding that the story is about the model.

The evidence

The evidence comes from two incident records and the law, and neither record measures harm itself, so the method comes first. The AI Incident Database records incidents reported in the press or submitted by the public and accepted by volunteer editors, so that failures are catalogued and not repeated (50, McGregor, 2021). Three limits follow. Counts by year reflect media attention and editorial throughput as much as the frequency of harm. The record is revised retroactively: the Stanford AI Index 2025 reported 233 incidents for 2024, and the snapshot of 2 November 2026 holds 313 for the same year (17, Maslej et al., 2025) (35, Responsible AI Collaborative, 2026). And its one geographic field, in the CSET classification of 208 incidents, places 91 of the 143 located incidents in the United States, so the record says little about Europe (35, Responsible AI Collaborative, 2026). It is a record of what was reported, which suits a chapter about a habit of reporting as much as of reading.

Figure 7.1: Of 1,498 classified incidents, 566 fall under malicious actors and misuse (412 of them fraud, scams and targeted manipulation), 314 under system safety, failures and limitations, 244 under discrimination and toxicity, 196 under misinformation, 112 under privacy and security, 42 under human-computer interaction and 24 under socioeconomic and environmental harms. Source: Responsible AI Collaborative, AI Incident Database, snapshot of 2 November 2026 (retrieved 2026).

Figure 7.1 is the distribution that answers Question 11. The same taxonomy classifies each incident on three further axes. By timing, 1,462 of the 1,498 classified incidents occurred post-deployment and 27 pre-deployment; by intent, 736 were classified as intentional and 741 as unintentional; by proximate cause, 961 were attributed to the AI system and 526 to a human, though among classified incidents dated 2025 the human cause, at 217 against 192, is the more frequent for the first time in the record (35, Responsible AI Collaborative, 2026). The record for 2025 and 2026 is still being filled in, so that last point describes what has been recorded so far and is not a measured trend in harm. The record is almost entirely about deployment, split evenly between intended and unintended harm.

Figure 7.2: The three most-named alleged deployers are categories of people (scammers in 240 incidents, deepfake creators in 129, synthetic media creators in 106) and the two most-named alleged developers are categories of technology (deepfake technology developers in 452, synthetic audio generation technology developers in 241), followed by OpenAI in 195; calling these entries categories is my editorial classification. Source: Responsible AI Collaborative, AI Incident Database, snapshot of 2 November 2026 (retrieved 2026).

Figure 7.2 is the opening scene as a chart. The database separates the party that used the system from the party that built it, and at the top of the two lists are categories of people on one side and categories of technology on the other. Chapter 13 takes up what follows for blame; the lesson here is narrower: when the record names who did what, it names a use and a user before a model.

The second record is the OECD's AI Incidents and Hazards Monitor, an automated monitor of news coverage. Its data come from a news-event service that processes over 150,000 articles a day; events tagged with AI-related concepts are classified with AI under the OECD's definitions of an AI incident, where harm occurred, and an AI hazard, where harm was plausible (36, OECD, 2026). The monitor is labelled Beta, and the OECD states that its information "should not be reported as representing the official views of the OECD or of its member countries" (36, OECD, 2026). It counts news-reported events, not harms. For 2025 it counted 4,571 events, 3,022 of them incidents. Its harm types are multi-label, and the most frequent for 2025 were harm to human or fundamental rights in 2,314 events, reputational harm in 1,950, economic or property harm in 1,945 and harm to the public interest in 1,931, with physical injury in 882 (36, OECD, 2026). A monitor built by a method nothing like the volunteer-curated database puts rights, reputation, money and the public interest at the top and physical harm lower down. My reading, which the monitor does not state, is that this is the profile of technology in use rather than of a machine out of control.

The third piece of evidence is the law: the AI Act is a legislature's considered answer to where in an AI system's life the obligations should attach, and it reasons the way the records do. Article 3(3) defines a provider as a body that develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts the AI system into service under its own name or trademark; Article 3(4) defines a deployer as a body "using an AI system under its authority" outside personal non-professional activity (39, European Union, 2024). The roles follow what a body does with a system, not which model is inside it. Risk follows the same logic. Under Article 6(2) the systems listed in Annex III are high-risk, and Annex III is a list of uses: recruitment, the allocation of tasks and the monitoring of workers in point 4, the evaluation of eligibility for essential public benefits and the pricing of life and health insurance in point 5, and so on through education, law enforcement, migration and justice (39, European Union, 2024). Article 6(3) narrows the class again by use: a system in an Annex III area is not high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, as where it performs a narrow procedural or preparatory task, and it is always high-risk where it profiles natural persons (39, European Union, 2024). Article 25(1)(c) closes the loop: a deployer that modifies the intended purpose of an AI system that was not classified as high-risk, so that it becomes a high-risk AI system, is considered to be its provider; and the deployer's duties in Article 26, including human oversight by people with "the necessary competence, training and authority", attach to the use (39, European Union, 2024).

I am not a lawyer and this is a reading of the structure, not advice. The same general-purpose model may sit inside a system in Annex III point 5(c) at an insurer and inside a drafting aid at the next desk that is in no annex at all (39, European Union, 2024). The law asks what the system is for and who uses it, and regulates the general-purpose model separately, through its provider. Regulation (EU) 2026/1744 moved the date from which the Annex III obligations apply to 2 December 2027, and left the classification by use where it was (40, European Union, 2026); that is observable from the adopted text. Whether the Annex III list itself will change before that date is speculation, which this book keeps for Chapter 20.

The picture corrected

The notation of this book, Contour, was designed with this instinct in mind. A unit, the thing it draws, is one AI use, and the same model used in two ways is two units. The mark carries seven dimensions, the autonomy level, reversibility, reach, usage mode, identity, control and evidence, and the model's name is deliberately not among them. Figure 7.3 is Hansa Mutual's one-page landscape at the start of 2027; the organisation is illustrative, and the picture is rendered from its landscape model.

Figure 7.3: Seventeen units of Hansa Mutual at the start of 2027 on the autonomy by reversibility grid; the view names no model, version or vendor, and nothing in it changes if two marks share a model. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Try to find the model. It is not there. What is there is the claims assistant, HM-CA, a circle in the Level 1 Assisted column at R2 Reversible with effort, coloured for Mode 4 Built AI applications, at size L, with a filled diamond for an enforced policy point, a seat carrying T2 and a solid baseline. One column to the right, at Level 2 Supervised, is HM-AWT, the engineers' agentic work tools, coloured for Mode 3 Agentic work tools, a circle because each tool acts with its engineer's own identity, at size M, with the same diamond, seat and baseline. Two modes, two levels, two populations of people. In the model from which the view is rendered, both take their general-purpose model from the same supplier. Nothing in Figure 7.3 says so, and nothing in it would change if one of them moved to a different model tomorrow. The mark encodes what decides the consequences of a use, and the model's name is not among those things.

The model has not been forgotten; it has been given its place. Figure 7.4 is the supply and sovereignty view of the same organisation on the same date, which Chapter 16 teaches in full. It arranges the marks in containers: a solid border for the organisation's own boundary, a dashed border for each supplier labelled by its role rather than its brand, and a dotted border for each jurisdiction outside the EU and the EEA.

Figure 7.4: Inside Hansa Mutual's own boundary the claims assistant HM-CA and the engineers' agentic work tools HM-AWT each run a thin line to one chip labelled "model" in the container of a non-EU model provider, while the conversational assistants HM-CONV sit inside a different provider's container because that provider operates them. Illustrative: rendered from landscape/models/hansa_mutual.yaml.

Here the model appears, as the smallest object on the page: a chip labelled "model" inside a dashed container labelled "model provider (non-EU)", with a note that the group's use of it rests on a recorded exception and a model-origin assessment. Two thin lines run to the chip, one from HM-CA and one from HM-AWT, whose marks stay inside Hansa Mutual's border because the group operates both units itself. The chip tells the reader that the model is supplied, that the supplier sits outside the EU and which units depend on it: supply, jurisdiction and provenance, which is where the model does bound a use. It says nothing about the risk of either unit, because that is written on the marks. Compare HM-CONV, the conversational assistants the group's staff may use under enterprise terms: its mark sits inside the dashed container of a second model provider, because that provider operates the service, and its baseline is dashed because what the group knows about its controls is what the supplier attests. A supplier's AI belongs on an organisation's picture on the seam, as a chip and a line, with the use inside the boundary where the organisation answers for it.

A reader who holds the instinct will want to write the model's name on the chip. The notation forbids it: the name belongs in the AI system register, as text, where it changes with each supplier release without redrawing anything. On the page it would do what a model's name does in a headline, draw the eye to the property of the unit that least decides what happens to the people in it.

The rule of thumb

Rule of thumb: Ask what it is used for and who deploys it before you ask which model it is.

Apply the rule whenever a sentence makes a model its subject: a model was deployed, made a mistake, is safe. Replace it with two questions in order. What is it used for: which mode, at which level, touching whom, with what reversibility. Who deploys it: under whose authority, with whose identity, behind which policy point, with whom in the seat. In the incident record these two questions separate a chatbot a company runs under its own name from a fraud a stranger runs with the same model's output; in the law they separate a provider from a deployer; on the landscape they separate two marks that share a chip. Only then does the third question, which model, add information, about supply, jurisdiction and provenance.

The rule stops applying where the model is the product, since a provider that places a general-purpose model on the market answers for it as such under Chapter V of the Act, and where a model's properties limit what a use can do, as when a model that cannot run on the organisation's own premises cannot serve a unit that must not send special-category data outside them. There the model matters because of what the use requires of it.

What to do

For an executive

Change the first question you ask. When a proposal, an incident report or a newspaper story reaches you with a model's name in the first line, ask for the use and the deployer before you read on: which mode, at what level, for how many people, under whose authority, with whom in the seat. Ask the same of the value: a licence for a model is not a business case for any of its uses. Where your organisation keeps a register of its AI, ask whether the rows are models or uses; a register of models cannot show you that a drafting aid has become an agent. A change of mode should trigger reclassification of the use (2, Nordqvist, 2026).

For an architect

Model the use, and let the model be a supplier the use depends on. In this book's landscape model each unit records its mode, level, reversibility, reach, identity, policy point, decision tier and evidence, and the model appears only as a supplier with the role model and a jurisdiction. The fragment below shows how Hansa Mutual's model records the two units that share one model provider (illustrative; the supplier label is shortened). Neither unit's own fields name the model; the renderer draws the shared chip from the suppliers field.

# landscape/models/hansa_mutual.yaml (fragment, illustrative)
suppliers:
  - {id: us-model, role: model, jurisdiction: non-EU,
     label: "General-purpose model provider (recorded exception)"}  # label shortened
units:
  - id: HM-CA
    name: Claims assistant
    mode: 4                    # Mode 4 Built AI applications
    identity: person
    level: 1                   # Level 1 Assisted
    reversibility: R2
    reach: L
    policy_point: enforced
    decision_tier: T2
    evidence: automatic
    operated_by: self
    hosting: own-premises
    suppliers: [frankfurt-dc, polish-sc, us-model]
  - id: HM-AWT
    name: Agentic work tools (engineering)
    mode: 3                    # Mode 3 Agentic work tools
    identity: person
    level: 2                   # Level 2 Supervised
    reversibility: R2
    reach: M
    policy_point: enforced
    decision_tier: T2
    evidence: automatic
    operated_by: self
    hosting: own-premises
    suppliers: [frankfurt-dc, us-model]

Keep the model's name and version in the AI system register, as text, so that a version change is a change event and not a redraw (2, Nordqvist, 2026); put the policy point outside the model for every unit, because the controls cannot live in the one component the units share (3, Nordqvist, 2026); and when a unit changes mode, review the unit rather than the model.

For a public official

Classify the use before you choose the model, because that is the order in which the AI Act will ask you. Its questions to a public body are questions about use: whether the system is intended to evaluate eligibility for essential public assistance benefits under Annex III point 5(a), whether it performs a narrow procedural or preparatory task under Article 6(3), whether it profiles natural persons, and whether the body uses it under its own authority and so is its deployer, with the duties of Article 26 (39, European Union, 2024). None can be answered by naming a model, and all can be answered before a tender is written. The Annex III obligations apply from 2 December 2027 under Regulation (EU) 2026/1744, which is observable from the text, and the classification that decides whether they apply to a given use can be done now (40, European Union, 2026). Write the use into the contract as the intended purpose, so that a supplier's later change of model does not change what the body has deployed, and a later change of use is seen for what it is.

Nordvik Region and Hansa Mutual

Both organisations are illustrative, and each runs one kind of model behind more than one use. At Hansa Mutual the same model provider sits behind the claims assistant HM-CA, which drafts over policy wordings for claims handlers in six markets, and the engineers' agentic work tools HM-AWT, which edit code and execute commands after an engineer approves each action, with a hybrid set-up that handles sensitive information only on models hosted in the group's own data centre. One supplier, and two units whose governance has almost nothing in common: the claims assistant raises questions about customers and the correctness of a drafted letter; the engineers' tools about what a person's identity may do in a repository. The group's exposure to the instinct is the mirror image of the usual one: a change of mode in one unit may be read as no change because the model is the same.

At Nordvik Region the picture is simpler and the instinct more tempting. The internal staff assistant NR-SA and the citizen-service assistant NR-CS both run open-weight models, the first served by a European cloud provider and the second on reserved capacity at a Nordic hosting provider; a visitor who asked which model the Region had chosen would get a reasonable answer for each, and the landscape shows how little it settles. The staff assistant is a circle at Level 1 Assisted and R1 Reversible at once, drafting with each of about 3,200 employees' own permissions. The citizen-service assistant is a rounded square at Level 4 Autonomous and R2 Reversible with effort, answering residents' questions from published information without a person approving each answer, at size XL, with an enforced policy point and the head of communications in the seat at T2. The second unit raises questions the first does not: what a published answer commits the Region to, how a wrong one is corrected, and which law applies to a system that speaks to residents without a person in between. The Region's profile does not say whether the two share a model, and the landscape does not need to know.

Summary

The model instinct treats the model as the risk and the value, and it is a good instinct almost everywhere else, because the thing you buy is usually the thing that acts. In this landscape a general-purpose model does not carry its use with it: the same model drafts for a claims handler, writes code for an engineer and acts on a production system with its own permissions. The model bounds what a use can do; the use and the usage mode set the risk and the value more than the model's name does.

The evidence agrees from three directions. In the AI Incident Database's classification of 1,498 incidents the most frequent harm is people using AI against other people, 566 incidents of malicious use and 412 of them fraud, scams and targeted manipulation,; the most-named deployers are, by my classification, categories of people. The OECD's news monitor, Beta and not the OECD's official view, puts harm to rights, reputation and property at the top of its 2025 counts. The AI Act allocates the roles of provider and deployer by what a body does with a system, lists uses rather than models in Annex III and moves a deployer into the provider's seat when it changes the intended purpose; the 2026 amendment moved the Annex III date to 2 December 2027 and left that logic where it was.

The notation draws the correction: the one-page landscape names no model, and the supply and sovereignty view draws it as a chip at the edge, in its supplier's container, with a thin line to each unit that depends on it. The rule of thumb is to ask what it is used for and who deploys it before asking which model it is. The next chapter takes up the instinct that sees every line in this landscape as straight, when the series the book has retrieved show pauses, revisions and reversals.

Sources

1. Responsible AI Collaborative (2026). AI Incident Database. Database of reported incidents in which AI systems caused or nearly caused harm; the database collections are licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) according to the terms of use and the licence file of the database snapshots; the weekly snapshot of 2 November 2026 is kept as the dataset data/aiid_incidents. (35, Responsible AI Collaborative, 2026)
2. McClain, C., Kennedy, B., Gottfried, J., Anderson, M. and Pasquini, G. (2025). How the U.S. Public and AI Experts View Artificial Intelligence. Pew Research Center, Washington, D.C., 3 April 2025; American Trends Panel survey of 5,410 US adults (August 2024) and a survey of 1,013 AI experts (14 August to 31 October 2024); the topline values are kept as the dataset data/pew_ai_public_experts_2025. (32, McClain et al., 2025)
3. European Commission, Directorate-General for Employment, Social Affairs and Inclusion (2025). Artificial Intelligence and the future of work. Special Eurobarometer 554, Eurobarometer report; fieldwork 25 April to 22 May 2024 by Verian, 26,415 face-to-face interviews with residents aged 15 and over in the 27 Member States; published 13 February 2025. Publications Office of the European Union, catalogue number KE-01-24-018-EN-N, ISBN 978-92-68-21815-0; the values quoted in the book are kept as the dataset data/eurobarometer_ai_work_2025. DOI: https://doi.org/10.2767/8591026. (29, European Commission, 2025)
4. Ipsos (2025). The Ipsos AI Monitor 2025: A 30-country Ipsos Global Advisor Survey. Ipsos, June 2025; 23,216 adults interviewed online, and in India partly face to face, between 21 March and 4 April 2025 (vendor survey, self-funded by Ipsos); Ipsos's legal mentions deem polls published on its website to be in the public domain, usable with attribution to Ipsos; the values quoted in the book are kept as the dataset data/ipsos_ai_monitor_2025. (31, Ipsos, 2025)
5. Rosling, H., Rosling, O. and Rosling Rönnlund, A. (2018). Factfulness: Ten Reasons We're Wrong About the World – and Why Things Are Better Than You Think. London: Sceptre (Hodder & Stoughton), hardback published 3 April 2018. ISBN 978-1-4736-3746-7. (8, Rosling et al., 2018)
6. European Parliament and Council of the European Union (2024). Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). Official Journal of the European Union, L series, 2024/1689, 12 July 2024; as amended by Regulation (EU) 2026/1744. (39, European Union, 2024)
7. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (2, Nordqvist, 2026)
8. Nordqvist, G. (2026). AI Platform and Security: Building and Securing AI Platforms in European Enterprises and Public Authorities. The Transformed Architecture, Book 3, published at aips.geon.se. (3, Nordqvist, 2026)
9. McGregor, S. (2021). Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. Proceedings of the AAAI Conference on Artificial Intelligence, 35(17), 15458–15463. Association for the Advancement of Artificial Intelligence, 18 May 2021. DOI: https://doi.org/10.1609/aaai.v35i17.17817 (accessed 2026-11-07). (50, McGregor, 2021)
10. Maslej, N., Fattorini, L., Perrault, R., Gil, Y., Parli, V., Kariuki, N., Capstick, E., Reuel, A., Brynjolfsson, E., Etchemendy, J., Ligett, K., Lyons, T., Manyika, J., Niebles, J. C., Shoham, Y., Wald, R., Walsh, T., Hamrah, A., Santarlasci, L., Betts Lotufo, J., Rome, A., Shi, A. and Oak, S. (2025). The AI Index 2025 Annual Report. AI Index Steering Committee, Institute for Human-Centered AI, Stanford University, Stanford, CA, April 2025; licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0); the report and its public data files are kept as the dataset data/stanford_ai_index_2025. DOI: https://doi.org/10.48550/arXiv.2504.07139. (17, Maslej et al., 2025)
11. Organisation for Economic Co-operation and Development (OECD) (2026). AIM: AI Incidents and Hazards Monitor. OECD.AI Policy Observatory; an automated monitor of AI incidents and hazards reported in the news, developed by the OECD.AI expert group on AI incidents, with its method described at https://oecd.ai/en/incidents-methodology; use is subject to the OECD terms and conditions; the counts retrieved on 7 November 2026 are kept as the dataset data/oecd_aim_incidents. (36, OECD, 2026)
12. European Parliament and Council of the European Union (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union, L series, 2026/1744, 24 July 2026; in force from 27 July 2026, the third day after publication. (40, European Union, 2026)