poly · AI risks and their controls

Name each risk. Enforce each control in code. Keep every decision on the record.

Buyers now ask which AI risks you address, and how you prove it.

Two recent reports set the bar for enterprise AI. ITX's framework lists ten steps a buyer should take before AI reaches production. MIT FutureTech's study of the world's largest companies shows which AI risks they acknowledge, and which they leave out. This page maps both to Poly, Polyaxion and our evaluation service, and says where the fit is partial.

Poly language, check, gate and journalPolyaxion signed policy and governanceService evaluation and advisory

The ten evaluation steps, and where the stack answers each

The steps are those of ITX's A Repeatable Framework for Evaluating AI at the Enterprise Level (March 2026). The second column is the strong signal a buyer should look for at each step.

Step	What the buyer looks for	Where we answer	Fit
1. Strategic context	A measurable problem; stakeholder and regulator constraints known up front	Service an assessment engagement; the business digital twin states goals and obligations	partial
2. Use-case boundaries	Approval per use case and per group, enforced by technical controls, not by policy statements	Poly the gate refuses what the policy forbids Polyaxion rules per feature and per group	strong
3. Data foundation	Outputs traceable to source data; edge cases handled	Poly facts derived only from what the agent read; an unknown value never counts as true; the journal links each decision to its facts	strong
4. Legal and regulatory risk	Explainability, audit trails, clear liability	Poly every refusal names its rule; a journal that replays Polyaxion signed policy with named signers	strong
5. Technical integration	Modular, no rip and replace, documented interfaces	Poly a gate in front of the tools you already use; an MCP server; open source	partial
6. Workflow and experience	Human review and correction; graceful degradation and a manual fallback	Poly fail closed; escalations in one queue, each with its reason; the workbench read-back	strong
7. Structured pilot	Success criteria before the pilot, baselines, stop conditions, failure cases tested	Service a preregistered pilot with a placebo arm and an independent breach counter, the method of our τ²-bench study	strong
8. Total cost and value	A full cost model, no cost cliffs, value adjusted for risk	Polyaxion one licence per company, unlimited use Service breach rate and pass^k as measures of value	partial
9. Vendor maturity	Stability, support commitments, data portability and exit terms	Open-source and source-available code that you can inspect, fork and keep running	partial
10. Scaling and governance	A registry of approved use cases, drift monitoring, phased rollout with rollback	Polyaxion signed policy as the registry Poly admission certificates, replay before rollout, rollback to the last signed build; polyx proposes new rules from the journal	strong

Six risks few of the largest companies acknowledge, and the mechanism that addresses each

MIT FutureTech coded the public documents of the world's largest companies against the 24 risks of the MIT AI Risk Repository. Of the 100 largest, 32% acknowledge no AI risk at all. The share below is of the 100 largest companies that acknowledge each risk (Saeri et al., 2026, Table 1).

Risk	Of the 100 largest, acknowledging it	How the stack addresses it
Capability and robustness	18%	Poly the check covers every reachable path over declared domains, and says INCONCLUSIVE rather than give a false clean result
Transparency and interpretability	19%	Poly each decision names the rule and the fact behind it; the journal replays every step
AI security vulnerabilities	15%	Poly a least-privilege policy check (polycheck): every path to credential egress crosses a gate, or a witness shows the path that does not
Overreliance and unsafe use	6%	Polyaxion irreversible and large actions go to a person; a human sample stays on automated rules
Loss of human agency	4%	Polyaxion named people sign policy and admit builds; an agent can propose, never sign
Multi-agent risks	1%	Poly crews of agents are checked as one system, and every call from every agent passes the same gate

From a mitigation to the risk it answers

The study finds that "71 of the largest 100 companies reported any mitigations, but companies rarely linked publicly reported mitigations to a specific risk." We are adding that link to Poly. Each policy rule can name the risk it mitigates (from the MIT AI Risk Repository) and the control it implements (NIST AI RMF 1.0 or ISO/IEC 42001). A report built from the verified journal then counts what each rule did: how often it refused, how often it sent a decision to a person, and how each of those ended. The counts are evidence that each rule was applied. They are not proof that a risk was removed.

Start a pilot Poly home Poly on GitHub ↗

Sources

ITX Corp., A Repeatable Framework for Evaluating AI at the Enterprise Level: From Vendor Demos to Production Reality, March 2026. itx.com (PDF).
A. K. Saeri, J. Graham, M. Noetel, P. Slattery, K. Zhao, E. Zhang, E. Howard and N. Thompson, Unmitigated? How are the world's largest companies responding to AI risks?, MIT FutureTech, working paper, October 2026. arXiv:2611.04278. The percentages above are from its Table 1; the quotation is from its Discussion.
MIT AI Risk Repository, Domain Taxonomy, Version 4 (2025-12-04), airisk.mit.edu, licensed under CC BY 4.0.
J.-J. Dubray, Enforcing written policies on AI agents with a checked gate: evidence from τ²-bench, 2026. Available on request.

Conclusion

A buyer's evaluation asks for boundaries enforced in code, decisions that can be explained and a record that can be audited. Poly gives those as mechanisms: a gate that refuses what a signed policy forbids, a check that covers every reachable state, and a journal that replays. The risks the largest companies leave out are mostly the risks of agents, and each has a mechanism here. Where the fit is partial, this page says so.