A survey of 21 open-source AI risk tools finds governance, legal, and financial controls almost entirely unaddressed

arXiv·medium signalXBlueskyLinkedInCopy link

Submitted 2026-08-07 (arXiv:2608.07446), this taxonomy-driven analysis maps 21 prominent open-source LLM evaluation and security tools against 32 subcategories of the extended MIT AI Risk Mitigation and Response Taxonomy, using an LLM-assisted RAG pipeline for feature extraction (Fleiss' Kappa 0.509 across three reviewers, 75.5% F1 after majority voting). The finding is a coverage map, not a benchmark: tooling clusters densely on technical and operational controls while governance, legal/regulatory, and financial/market controls remain largely unserved. If you are assembling an agent risk stack from open source, this identifies which quadrants you will have to staff with humans.