Skip to content
92 changes: 66 additions & 26 deletions docs/organizations/ai-risk-hub.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,19 @@

# AI Risk Hub

The **AI Risk Hub** gives you visibility into the AI usage, dependencies, and risks across your organization's repositories. It brings together AI policy compliance, risk assessment, and a detailed inventory of AI resources found in your codebase.
The **AI Risk Hub** gives you visibility into the AI usage, dependencies, and risks across your organization's repositories. It brings together AI policy compliance, risk assessment, and a detailed list of AI assets found in your codebase.
It also provides an overview of all the AI issues detected in the repositories applied to the organization's AI Policy standard and your organization's risk level based on your AI practices. Here, you can navigate through the issues detected in your repositories and filter them by severity and category. You can also filter the issues by selecting specific repositories or using [the segments that you have set up](segments.md).

!!! important
This dashboard is a Business tier feature, generally available until May 18.
This dashboard is a Business tier feature, generally available until May 18, 2026.

Check warning on line 11 in docs/organizations/ai-risk-hub.md

View workflow job for this annotation

GitHub Actions / vale

[vale] reported by reviewdog 🐶 [Microsoft.Adverbs] Consider removing 'generally'. Raw Output: {"message": "[Microsoft.Adverbs] Consider removing 'generally'.", "location": {"path": "docs/organizations/ai-risk-hub.md", "range": {"start": {"line": 11, "column": 48}}}, "severity": "WARNING"}
Comment thread
andrzej-janczak marked this conversation as resolved.

To access the AI Risk Hub, select an organization from the top navigation bar and click on **AI Risk** on the left navigation sidebar.

Inside this hub, you can find the following pages to help you monitor the AI risk of your organization:
Inside this hub, you can find the following tabs to help you monitor the AI risk of your organization:

- [Overview](#overview)
- [AI Inventory](#ai-inventory)
- [AI assets](#ai-assets)
- [Tools & workflows](#tools-workflows)
Comment thread
andrzej-janczak marked this conversation as resolved.

---

Expand All @@ -27,7 +28,7 @@
- [Risk Level](#risk-level)
- [AI Risk Checklist](#ai-risk-checklist)
- [Repositories with most AI issues](#repositories-with-most-ai-issues)
- [AI Inventory summary](#ai-inventory-summary)
- [AI assets summary](#ai-assets-summary)

![AI Risk Hub overview](images/ai-risk-hub.png)

Expand Down Expand Up @@ -107,32 +108,32 @@

---

### AI Inventory summary
### AI assets summary

This section shows a high-level view of the AI resources discovered across your repositories, broken down by provider. For each provider, you can see the number of resources and repositories involved, as well as a breakdown by resource type.

The section surfaces the top AI providers detected in your organization. You can click through to the full [AI Inventory](#ai-inventory) for a detailed view.
The section surfaces the top AI providers detected in your organization. You can click through to the full [AI assets](#ai-assets) tab for a detailed view.

![AI Inventory summary](images/ai-risk-inventory-overview.png)
![AI assets summary](images/ai-risk-ai-asset-overview.png)

---

## AI Inventory
## AI assets

The **AI Inventory** tab gives you a detailed, searchable view of all AI resources discovered across your organization's repositories. Resources are detected through static analysis and represent actual AI usage found in the codenot just configuration.
The **AI assets** tab gives you a detailed, searchable view of all AI resources discovered across your organization's repositories. Resources are detected through static analysis and represent actual AI usage found in the codenot just configuration.
Comment thread
andrzej-janczak marked this conversation as resolved.

![AI Inventory](images/ai-risk-inventory.png)
![AI assets](images/ai-risk-ai-asset-tab.png)

### Resource types

Codacy detects four types of AI resources:

| Type | Pattern ID | Description |
| Type | Categories | Description |
|------|------------|-------------|
| Model usage | `ai_model_usage` | Direct calls to AI model APIs |
| Dependency | `ai_dependency` | AI SDKs and packages included as dependencies |
| API key | `ai_key` | AI service API keys and credentials found in code |
| Endpoint / env variable | `ai_env_endpoint` | Environment variables and endpoint references for AI services |
| Model usage | Model | Direct calls to AI model APIs |

Check failure on line 133 in docs/organizations/ai-risk-hub.md

View workflow job for this annotation

GitHub Actions / vale

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'APIs'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'APIs'?", "location": {"path": "docs/organizations/ai-risk-hub.md", "range": {"start": {"line": 133, "column": 50}}}, "severity": "ERROR"}
| Dependency | Dependency | AI SDKs and packages included as dependencies |

Check failure on line 134 in docs/organizations/ai-risk-hub.md

View workflow job for this annotation

GitHub Actions / vale

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'SDKs'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'SDKs'?", "location": {"path": "docs/organizations/ai-risk-hub.md", "range": {"start": {"line": 134, "column": 32}}}, "severity": "ERROR"}
| API key | Key | AI service API keys and credentials found in code |
| Endpoint / env variable | Endpoint | Environment variables and endpoint references for AI services |

Check failure on line 136 in docs/organizations/ai-risk-hub.md

View workflow job for this annotation

GitHub Actions / vale

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'env'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'env'?", "location": {"path": "docs/organizations/ai-risk-hub.md", "range": {"start": {"line": 136, "column": 14}}}, "severity": "ERROR"}
Comment thread
andrzej-janczak marked this conversation as resolved.

### Supported providers

Expand All @@ -154,31 +155,70 @@

### How it works

The inventory is built from static analysis of your repositories' source code. For each AI resource found, Codacy records:
The AI assets list is built from static analysis of your repositories' source code. For each AI resource found, Codacy records:

- Which **provider** the resource belongs to (e.g. OpenAI, Anthropic)
- What **type** of resource it is (model usage, dependency, API key, endpoint)
- The **marker** that identifies it (e.g. model name, package name)
- How many **repositories** contain it
- How many total **references** to it exist

### Navigating the inventory
### Navigating AI assets

Resources are listed as expandable entries. You can drill into each one to see:

1. **Repositories**which repositories contain the resource, with file counts and reference counts per repository
2. **Files**within each repository, the specific files where the resource appears
3. **Lines**within each file, the exact lines where the resource is referenced, with direct links to the file in your Git provider
1. **Repositories**which repositories contain the resource, with file counts and reference counts per repository
2. **Files**within each repository, the specific files where the resource appears
3. **Lines**within each file, the exact lines where the resource is referenced, with direct links to the file in your Git provider

![AI resource detail](images/ai-risk-resource.png)

### Filtering

You can filter the inventory using the sidebar on the left:
You can filter AI assets using the sidebar on the left:

- **Providers**filter by one or more AI vendors
- **Resource types**filter by resource type (model usage, dependency, API key, endpoint)
- **Repositories**filter by specific repository names
- **Segments**filter by repository segments if segmentation is enabled for your organization
- **Providers**filter by one or more AI vendors
- **Resource types**filter by resource type (model usage, dependency, API key, endpoint)
- **Repositories**filter by specific repository names
- **Segments**filter by repository segments if segmentation is enabled for your organization

You can reset all filters at once using the **Reset filters** button.

---

## Tools & workflows

The **Tools & workflows** tab shows AI tools and coding assistants detected across your organization's repositories.

![Tools & workflows overview](images/ai-risk-tools-wf-overview.png)

Tools are displayed as cards showing the tool name, number of detected resources, repositories involved, and a badge indicating whether the tool was detected as a **usage** or **workflow**.

### Detection categories

Detections are grouped into two categories:

- **Usage**—tool detected via code-level patterns:
- **Code marker**—tool signatures or attribution markers found in source code
- **Commit**—references to the tool in commit messages or metadata
- **Workflow**—tool detected via configuration or process files, such as commands, `.gitignore` entries, hooks, instructions, settings, skills, agent definitions, governance files, or IDE configuration

### Navigating tool details

Clicking a tool card opens a detail view grouped by detection pattern (for example, "Generated with [Claude Code]" or "Generated by Claude"). For each detection pattern, you can drill into:
Comment thread
andrzej-janczak marked this conversation as resolved.

1. **Repositories**—which repositories contain this detection, with file and reference counts
2. **Files**—the specific files within each repository
3. **References**—the exact lines where the tool is referenced, with direct links to the file in your Git provider

![Tools & workflows detail](images/ai-risk-tools-wf-expanded.png)

### Filtering

You can filter the tools list using the sidebar on the left:

- **Segments**—filter by repository segments
- **Repositories**—filter by specific repository names
- **Categories**—filter by detection category and subcategory:
- Usage: Code marker, Commit
- Workflow: Commands, Gitignore, Hooks, Instructions, Settings, Skills
Comment thread
andrzej-janczak marked this conversation as resolved.
Comment thread
andrzej-janczak marked this conversation as resolved.
Comment thread
andrzej-janczak marked this conversation as resolved.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading