21 Open-Source AI Risk Tools Leave Governance, Legal Gaps

Researchers checked 21 open-source LLM risk tools against MIT's extended AI risk taxonomy, 32 subcategories deep, per a new paper.

Governance, legal and regulatory, and financial and market controls came back almost empty, the paper finds. Those are exactly the categories a company needs covered before a regulator or an auditor gets involved.

Technical and operational controls carry the weight in the tooling that exists, per the paper. That's the same territory where the field's evaluation and security tools work, testing models directly rather than checking the policies and paperwork around them.

The paper doesn't say why the gap is there. It could be a funding shortfall, a scoping choice by the tool builders, or governance risk being harder to automate than a model evaluation.

Barely any of the 21 tools reach into governance or legal territory, so covering those areas still takes a person, not a script. Anyone assembling an agent risk stack from open source should budget for that hire, not assume a future update fills it in.