AI incident databases are gaining traction, but raw counts don't tell policymakers much. A rise in reported harms could mean genuine risk escalation — or just improved reporting, or increased AI deployment. To distinguish these, you need both a numerator (how many harms actually occurred, adjusted for reporting gaps) and a denominator (how many opportunities for harm existed).

This project adapts epidemiological methods to estimate AI harm rates for incident types relevant to German policy priorities — such as hiring algorithms under anti-discrimination law, clinical decision support in the German healthcare system, or content moderation on platforms operating under the DSA.

The work has two components:
1. Exposure estimation: How many opportunities for harm existed? Depending on data availability, we use direct measurement (e.g., DSA transparency reports), category-based assignment, decomposition into bounded components, or structured expert judgment.

2. Harm estimation: How many incidents actually occurred? Reported counts underestimate true incidence. We apply methods from disease surveillance — such as capture-recapture across overlapping sources and multiplication factors from analogous domains — to adjust for underreporting.

Mentees will:

- Select incident types relevant to German AI governance;
- Estimate both exposure and harm counts, with documented assumptions;
- Calculate crude harm rates and assess trends;
- Produce standardised output cards suitable for policy communication;

Expected outputs include worked examples for German-relevant incident types, a practical methodology guide, and a gap analysis identifying where better data collection would most improve monitoring capacity.