What each harm actually looks like
Classification items never ask for the definition. They give you an incident and ask which box it goes in — which is a different skill, and one that definitions alone do not build. Every category below carries the boundary rule that decides close cases and five concrete examples you can match a fact pattern against.
First: these are two taxonomies, not one
They get merged in revision, and options exploit it. Harm categories (NIST AI RMF — people, organisations, ecosystems) answer who was hurt. Bias categories (NIST SP 1270 — systemic, statistical/computational, human-cognitive) answer where the bias came from. "Societal harm" and "human-cognitive bias" are not alternatives to each other; a single incident normally has one of each, and choosing between them means working out which question the stem asked.
Taxonomy one — who was harmed
The NIST AI RMF categories. Impact assessments are structured around them, so they also tell you what a complete assessment has to consider.
Harm to people
The RMF splits this three ways, and the split is by scale of the thing harmed rather than by severity. An individual harm can be far worse than a societal one.
Individual harm
One identifiable person is worse off.
Harm to a person’s civil liberties, rights, physical or psychological safety, or economic opportunity.
In practice
- A loan application is refused because a credit model scored the applicant poorly on a proxy for their postcode.
- A resume screener rejects a candidate whose employment gap was parental leave.
- A driver is injured when a perception system fails to classify an obstacle.
- A patient is given the wrong triage priority because a model was trained on a population unlike theirs.
- A person is wrongly arrested after a facial recognition match at a low confidence threshold.
Boundary rule: The test is whether a specific person can point at the outcome. If the answer describes a named applicant, patient or defendant, this is the box — even if the same failure affects thousands of others.
Group or community harm
A class of people is systematically worse off.
Harm to a subgroup — discrimination against a protected class or a community, including where no individual can prove they were the one affected.
In practice
- A hiring tool selects women at a materially lower rate than men across a whole applicant pool.
- A medical device performs measurably worse on darker skin tones because the training set under-represented them.
- A predictive policing model concentrates patrols in one neighbourhood, generating the arrest data that justifies more patrols.
- A speech recogniser fails on a regional accent, so a whole region cannot use the phone service.
- An insurance pricing model raises premiums for a religious community through a correlated proxy.
Boundary rule: The distinguishing feature is the pattern. Individual harm is one person’s bad outcome; group harm is a rate difference that shows up only when you look across the population. Disparate impact lives here.
Societal harm
The shared environment everyone lives in is degraded.
Harm to democratic participation, education access, public trust, information integrity, or the systems society depends on — where the victim is not a person or a group but the commons.
In practice
- Generated political content at scale distorts an election campaign.
- Deepfakes erode general trust in video evidence, so genuine footage stops being believed.
- Recommender systems amplify polarising content and fragment the shared information environment.
- Widespread automation of entry-level work removes the rung people used to climb onto a career.
- Model-generated text floods the open web, degrading the corpus everyone trains on next.
Boundary rule: Ask whether removing the individual victims would leave a harm behind. If the damage is to trust, discourse, access or institutions themselves, it is societal. This is the box people under-use, because it has no plaintiff.
Harm to organisations
Easy to overlook because it sounds like a business problem rather than a governance one. The RMF includes it deliberately: organisational harm is what makes the governance case internally.
Organisational harm
The deploying or third-party organisation is damaged.
Reputational damage, business-operation disruption, regulatory penalties, or security breaches arising from the AI system.
In practice
- A chatbot gives binding-sounding pricing the company then has to honour.
- Regulatory fines and an order to delete a model built on unlawfully obtained data.
- A model outage halts a production line dependent on its predictions.
- Trade secrets leak into a public model through unrestricted staff use.
- A supplier’s model change silently degrades a downstream product with no notice clause to fall back on.
Boundary rule: Not a softer version of harm to people. A single incident routinely produces both — the individual denied a service AND the fine that follows — and a well-written question will ask you which the stem is describing.
Harm to ecosystems
The category most often missing from revision notes, and the one that makes the taxonomy exhaustive.
Ecosystem harm
Interconnected systems, the supply chain or the natural environment suffer.
Harm to the global financial system, supply chains, interconnected infrastructure, or natural resources and the environment.
In practice
- Correlated algorithmic trading amplifies a market move into a flash crash.
- A shared foundation model’s flaw propagates simultaneously into every product built on it.
- Training and inference energy and water consumption at data-centre scale.
- Automated demand forecasting across an industry synchronises orders and destabilises a supply chain.
- A grid-balancing model’s failure cascades across interconnected utilities.
Boundary rule: Two flags: the natural environment, and interconnection. If the harm spreads because things are coupled together rather than because a person was wronged, it belongs here.
Taxonomy two — where the bias came from
NIST SP 1270, which the BOK adopts. Worth learning as a diagnostic rather than a list: the category you land on determines which mitigation is the right answer.
Systemic bias
It was in the world before the model existed.
Bias from historical, societal and institutional practices, present in the data because it was present in reality.
In practice
- Historical lending decisions encode decades of redlining, so a model trained on repayment history learns geography as a proxy for race.
- Past promotion records reflect who was actually promoted, so a model trained on "successful employees" learns the old bias faithfully.
- Medical research conducted mostly on one population produces guidelines that fit others poorly, and a model trained on them inherits the gap.
- Arrest data reflects where police patrolled, not where crime occurred.
Boundary rule: The tell is that the model is accurate. It reproduces the world correctly, and the world is unfair. Better sampling does not fix it — reframing the problem or changing the target variable might.
Statistical / computational bias
It came from how the data was drawn or how the algorithm processes it.
Bias from non-representative samples, measurement, or the design and optimisation of the algorithm itself.
In practice
- Sampling bias — the training set under-represents a group, so accuracy drops for them at deployment.
- Temporal bias — data from a period that no longer represents the present, such as a year distorted by a one-off event.
- Measurement bias — the label is a proxy for the thing you care about, such as healthcare spend standing in for health need.
- Aggregation bias — one model is fitted across groups that behave differently, and fits none of them well.
- Evaluation bias — the benchmark used to judge the model is itself unrepresentative.
Boundary rule: The tell is a gap between the training distribution and the deployment distribution, or between the label and the concept. This is the family that responds to data and evaluation work.
Human-cognitive bias
It came from how people designed, read or relied on the system.
Bias in how humans perceive AI output, make decisions with it, or fill in missing information — including at design time.
In practice
- Automation bias — a reviewer accepts the model’s recommendation because the model made it.
- Confirmation bias — evaluators notice the results that match what they expected and explain away the ones that do not.
- Anchoring — a displayed risk score shapes the reviewer’s independent judgement before they form one.
- Groupthink on the design team suppresses the objection that would have surfaced the flaw.
- Selective adherence — a decision-maker follows the model when it agrees with their prior about this applicant, and overrides it when it does not.
Boundary rule: The tell is a person in the loop. If the failure happens in someone’s head — designing, interpreting, or deferring — it is here, however technical the surrounding scenario is.
One incident, every box
The reason classification feels slippery is that real failures occupy several categories at once. Here is a single well-documented pattern, sorted under both taxonomies.
| Who was harmed — individual | A specific patient who needed the programme and was not referred. |
| Who was harmed — group | The under-referred group as a whole, visible only as a rate difference. This is the disparate impact. |
| Who was harmed — societal | Erosion of trust in clinical AI, and in the institution, beyond anyone treated there. |
| Who was harmed — organisational | The regulatory file, the remediation cost and the reputational damage to the hospital. |
| Where the bias came from — systemic | The historical care gap the spend data faithfully records. |
| Where the bias came from — statistical | Measurement bias: spend is a proxy for need, and a poor one. |
| Where the bias came from — human-cognitive | Automation bias in the clinicians who did not challenge the ranking. |
Seven correct answers from one scenario. Which one is keyed depends entirely on what the stem asks — so read the question before you read the options.
Other harm vocabulary that appears in options
Not from the two taxonomies above, but drawn on freely by item writers.
Allocative vs representational harm
Allocative harm withholds a resource or opportunity — a loan, a job, a place. Representational harm demeans or stereotypes a group without withholding anything, such as an image generator that renders every "nurse" as a woman. Representational harm is the one people forget is a harm at all.
Tangible vs intangible
Physical injury and financial loss are tangible. Dignitary harm, loss of autonomy, chilling effects on speech and psychological harm are intangible — and no less real for being hard to quantify in an impact assessment.
First- and second-order effects
The first-order harm is the wrong output. The second-order harm is what the wrong output causes downstream — the feedback loop where a model’s own decisions become tomorrow’s training data.
Intended vs foreseeable misuse
Impact assessments cover both the purpose and reasonably foreseeable misuse. A harm arising from predictable off-label use is in scope; "that is not what we built it for" is not a defence.
Severity, likelihood and reversibility
Risk rating needs all three. Reversibility is the one dropped most often, and it is what separates a wrong recommendation you can retract from an arrest you cannot.
Four rules for classifying under pressure
Two taxonomies, two questions
Harm categories answer "who was hurt?". Bias categories answer "where did this come from?". If an option set mixes societal harm with human-cognitive bias, one of the two is answering a question that was not asked.
One incident occupies several boxes
A real failure is nearly always individual and group and organisational at once. The question fixes which one by what it says the stem is asking about — read the question, not the scenario.
Bias category picks the control
Systemic bias needs the problem reframed or the target variable changed. Statistical bias needs sampling and evaluation work. Human-cognitive bias needs process, training and interface design. If a stem asks for the mitigation, classify first.
Societal harm has no plaintiff
If you are looking for the victim and cannot find one, that is the signal — not evidence that no harm occurred.
The one-line version
Harm asks who; bias asks where from. Individual is one person, group is a rate difference, societal is a harm with no plaintiff, organisational is the deployer, ecosystem is the environment or the coupling between systems. Systemic bias was already in the world, statistical bias came from the data or the algorithm, human-cognitive bias happened in somebody’s head.
Test yourself
5 questions on what is above, with every option explained. Your score is kept in this browser and shown on your dashboard, and saved to your account if you are signed in.
Synthetic video erodes public willingness to believe genuine footage. Which harm category is this?
- ASocietal harm, to the shared information environment.
- BGroup harm, to the communities most often targeted.
- CEcosystem harm, to the interconnected media supply chain.
- DIndividual harm, to each person shown a false video.
Related: Which assessment, and who owes it · Every named thing · Mnemonics · Glossary