AI Loss Events: The Three-Year Escalation in Frequency and Severity

4 June 2026 | AIMG

AI loss events have quietly crossed the line from edge‑case anecdotes to a measurable, compounding risk class that boards can no longer treat as “someone else’s problem.”

Over the past three years, both the frequency and severity of incidents have risen faster than most organizations’ ability to govern them.

The incident curve: frequency is compounding

Reported AI incidents grew from 149 in 2023 to 233 in 2024 – a 56.4% year‑on‑year increase and roughly 22 times the 2019 baseline.
By early 2026, international monitors had logged more than 14,500 AI incidents and hazards, indicating that published cases represent only a fraction of the true loss population.
This escalation is driven by three forces: rapid enterprise deployment of generative AI, industrialized adversaries exploiting vulnerabilities in days rather than months, and more systematic tracking of AI incidents by regulators, courts and the media.

Severity: harm is moving up the ladder

In AIMG’s register of 48 independently verified events between January 2023 and June 2026, one third are rated Critical and almost 60% High; moderate, recoverable incidents are the minority.
The harm frontier has shifted from reputational and IP issues in 2023 toward wrongful imprisonment, healthcare denial with 90% model error rates, and litigated loss of life by 2025–26.
The introduction of agentic and autonomous systems with write, financial and safety authority has raised the ceiling of potential harm faster than the organizational “floor of competence” has risen.

Financial losses vs the hidden balance sheet

Where AI loss events crystallise in cash, the numbers are now board‑relevant: single deepfake payment frauds in the tens of millions, and cumulative deepfake‑enabled fraud losses approaching a billion dollars since 2019.
Projections for GenAI‑enabled fraud in the US alone point to a rise from low‑teens billions in 2023 to around $40 billion by 2027.
Yet only 17 of the 48 events carry a clean monetary figure; the remaining 31 involve reputational damage, civil‑rights harm, privacy breaches, or physical and human harm that are severe, slow to remediate, and often absent from traditional loss reporting.

Governance debt: the dominant root cause

Across categories – adversarial attacks, deepfake fraud, biased decisioning, data leakage and hallucination‑driven misinformation – the recurring pattern is not “over‑powerful AI” but under‑powered governance.
In the 2025 breach landscape, 97% of AI‑related breaches occurred where basic access controls were missing and 63% of breached organizations had no AI governance policy in place.
Shadow AI significantly amplifies exposure: unsanctioned tools contributed an additional hundreds of thousands of dollars to average breach costs and featured in a substantial minority of AI‑related incidents.

Implications for boards and risk committees

AI loss events have moved from tail‑risk to base‑rate. The central question is no longer whether a business unit or portfolio company will experience an AI‑related loss, but how severe it will be – and how far financial and reputational contagion will spread.
Enforcement has shifted from advisory to operational: discrimination settlements, bans and model‑disgorgement orders, live prohibitions under horizontal AI regulation, and decisions holding firms liable for their chatbots’ statements have effectively ended any “the AI did it” defence.
Risk is now supply‑chain wide. Vendors and model providers appear as named parties, meaning AI loss exposure propagates through third‑party relationships, not just in‑house development.

What the full three‑year analysis provides

A source‑linked register of 48 real AI loss events from 2023–mid‑2026, mapped to the NIST AI Risk Management Framework and segmented into direct financial and non‑financial impact.
A causation view that highlights where your own exposure is likely to cluster – including adversarial security, deepfake fraud, reliability failures, bias and discrimination, privacy and data leakage, legal and governance failures, and hallucination‑driven misinformation.
A board‑ready action agenda covering AI loss registers, shadow‑AI control, deepfake‑resilient payment protocols, regulatory alignment, AI‑specific clauses in vendor contracts, and the integration of AI loss scenarios into stress‑testing, insurance and board risk reporting.

If you sit on a board, investment committee or risk committee, this three‑year analysis is designed to be read alongside your cyber and financial‑crime reporting – and to change how you size and govern AI risk at enterprise level.

Source: Detailed 22 page AIMG report