International Business Times ·
Climate Risk Has No Standard, and That Costs Everyone
Ron Dembo on the case for an open standard and wider access to climate-risk measurement.
OPEN-SOURCE SOFTWARE · AGPL-3.0-OR-LATER
An open standard for
physical climate risk.
Climate Risk Commons puts an inspectable physical climate-risk pipeline, schemas, starter impact functions and SDK into your hands. The software is licensed AGPL-3.0-or-later for commercial and non-commercial use, subject to its terms. Data is licensed separately.
Use the tools with datasets you have permission to use, run experiments, build new models and design new damage functions. Built for the extreme tail rather than the average case.
Deciding whether this matters to your institution? Start with why it exists. Don't write code? The without-code guide is an AI agent or a notebook in your browser.
Why it matters
Institutions must report numbers they cannot defend.
Measuring physical climate risk has shifted from a voluntary exercise to a supervised obligation. IFRS S1 and S2, the CSRD, the EU Taxonomy, TCFD and TNFD have made climate and nature risk a required part of corporate and financial reporting, and prudential supervisors from the EBA to BaFin and FINMA now expect institutions to identify, measure, manage and monitor physical climate-risk drivers.
The harder test is ownership, not reporting. Auditors and supervisors increasingly expect you to understand and own the data and models behind a tool, rather than accept a vendor's black box. A closed, proprietary model cannot meet that bar by design.
Independent reviews of the field, including UNEP FI's Climate Risk Landscape work, keep identifying the same compounding problems: provider methodologies that differ substantially and remain largely opaque, so results cannot be benchmarked.
You cannot defend a methodology you are not permitted to see.
The same asset, scored by two providers, can yield materially different risk scores. Relying on any one closed vendor produces a false sense of precision, exactly when supervisors are asking you to understand model uncertainty rather than look past it.
Why now
Standardizing climate data lets the next generation of models, such as CMIP7 and AI/ML emulators, come into workflows that are already benchmarked and accepted as industry standards. Climate Risk Commons is that standard: a shared, open technical architecture. As the new datasets land, model by model, they enter the same pipeline, schemas and verification standards, without breaking downstream workflows or requiring a structural redesign.
Four failures of the closed model
FAILURE 01
Numbers you can't defend
Methodology sits inside a vendor black box, closed to the very regulators, auditors and boards now asking how the figures were produced.
FAILURE 02
Results that don't compare
Every vendor encodes assets, hazards and scenarios differently, so similar portfolios diverge and supervisors cannot aggregate across the system.
FAILURE 03
A costly door, both ways
Evaluation takes months and six figures, and proprietary formats make exit expensive, pricing smaller players out before they even begin.
FAILURE 04
Science that keeps restarting
Without a shared foundation, researchers rebuild the same infrastructure rather than advancing stochastic and multi-hazard methods.
The structural fix
| The closed model is | The open standard is |
|---|---|
| Black-box methodology you are not permitted to inspect | Inspectable methodology, so you own your models |
| Assets, hazards and scenarios encoded differently by every vendor | One shared schema, so results compare across teams and firms |
| Single-vendor point estimates that manufacture false precision | A stochastic, full-distribution engine that makes uncertainty legible |
| Cost and expertise walls that shut out smaller institutions and emerging markets | Open, no-cost access for them and the researchers studying them |
One standard
Assets, climate distributions, damage functions and every metric are described once, in a single form, on a single spatial index. Comparability stops being a negotiation and becomes a property of the data.
What it is
An open standard, with a pipeline that runs it end to end.
Climate Risk Commons is an open technical standard for physical climate-risk analysis. The standard defines the shared contracts, asset schema, reference pipeline, APIs, SDKs and tooling that let hazards, assets and impact functions interoperate. The open reference pipeline runs the entire specification end to end, on a laptop or a cluster, using open reference data.
This is Climate 2.0: stochastic, multi-hazard, coherent across hazards and countries, and built for the extreme tail rather than the average case.
Three open contracts, one comparable result
Hazard
Any open climate data.Fitted hazard curves in one canonical file, ingested from open sources such as EU JRC and OS-Climate, or supplied by any conforming provider.
Exposure
Any open asset data.Your portfolio, loan book or asset register: an identifier and a location. Nothing else is required.
Vulnerability
Your own damage curves.How exposure becomes damage. From the open starter library, a commercial provider, or one you write yourself.
The result
One comparable, auditable number
One row per asset, hazard, horizon and pathway. Each input conforms to a published contract, so you can swap any one without rebuilding the rest.
What's in the open release
- AvailableStandard and asset schema. How assets and exposure are encoded, so analyses share a common vocabulary.
- AvailableReference pipeline. An end-to-end engine that runs on a laptop or a cluster. Scaling out means adding workers, not a rewrite.
- AvailableImpact-function library. Starter functions for common asset and hazard pairs, and a registry you can extend.
- AvailablePython SDK and computation core.
crc-sdkandcrc-framework, the on-ramp to the standard. - AvailableSample notebooks. Portfolio analysis, impact, risk metrics and sensitivity testing, each with a headless pipeline twin, plus AI agent skills.
- AvailableMulti-hazard risk. Combine several hazards for one asset into VaR and CVaR, with every assumption stated.
- AvailableDocumentation. Workflows and uncertainty explainers.
- In developmentConformance test suite. The check an implementation must pass before it can claim its outputs are comparable. The shared pipeline already takes a new dataset without a redesign. This suite is the proof.
- DirectionBroader access and regulatory guidance. Additional language and runtime entry points, plus clearer mapping from outputs to reporting regimes.
crc-sdk and crc-framework are licensed AGPL-3.0-or-later, including for commercial use under those terms. CRC Open data is licensed CC BY-NC 4.0; other datasets retain their own terms. Details are in the licence section of the docs.
What you can build
See your real exposure
Load your asset or loan-book locations and get flood, heat and wildfire exposure for the assets you actually hold, not a headline figure.
Stand up a stress test
Run a stochastic, multi-pathway test in a structure a supervisor can read and an auditor can follow. As CMIP7 output and emulators are published and checked, each one is another input to that same test, with the model recorded.
Bring your own data
Load your own datasets, models and damage functions and still produce a result that compares cleanly with everyone else's.
Screen a city or development portfolio
Development banks, ministries and city networks screen assets for priority physical risks and share the method with anyone who needs to use it.
Reproducible by design
Every result includes a record of exactly how it was produced. Inputs are pinned and cached, and outputs are self-describing Parquet. What you publish is a method someone can disagree with precisely.
How to get started
Start with one sentence.
No account and no application. Ask an AI agent, or install the SDK.
Fastest · any AI agent
Paste this into your favourite AI agent.
Use the crc-screen-mortgage-flood skill from https://github.com/RiskThinking/crc-docs for Toronto, Canada.Swap Toronto for your own city. This is the published river-flood screen: 25-, 100- and 500-year depths at sample locations in that area. Other questions are in the without-code guide. To produce numbers, the agent needs to be able to run Python.
For developers · Python
Install the SDK.
It includes the crc-framework computation core.
uv add crc-sdk
# or
python -m pip install crc-sdk
Want the technical details? The quickstart, schemas, methods and API are in the technical docs.
Open the technical docs →
Go further
Want more than the open tools? Email us.
Ask about Commons membership for hosted research access, institution-wide participation and a voice in the standard. Hosted services and data have their own access terms; membership is not required to use the published software.
Researchers
Get the hosted environment and reference data, and feed the gaps you find into the roadmap.
Ask about research accessFaculties and universities
One short letter of intent enrols all your bona fide students, researchers and faculty.
Enrol your institutionBuilders and data providers
Build against the open contracts, help shape conformance and join the spec discussions.
Talk to the open-source teamThe model
Open software. Separate data and service terms.
You can build a serious, end-to-end risk system on the open release. The commercial layer is additive, not a gate.
The same engine works with public datasets or data you bring. The SDK and framework permit commercial use under AGPL-3.0-or-later; data and hosted services have separate terms.
Build the stochastic pipeline now. Scale anytime.
CRC Open provides stochastic distributions for the SSP585 pathway under CC BY-NC 4.0. Licensed data for additional pathways drops into the pipeline you already wrote.
Software and data have separate licences
What you can use locally
- The published reference pipeline, SDK and computation core under AGPL-3.0-or-later
- The starter impact functions under the licence of the package that supplies them
- CRC Open data under CC BY-NC 4.0, and third-party datasets under their own terms
- Your own data, models and damage functions, subject to applicable rights and licences
Licensed commercially by RiskThinking.AI
What stays proprietary
- A 7M+ asset database with twelve years of curation, and physical-asset discovery data
- 2,000+ pathway scenarios, bias-corrected, downscaled to 10km and recalibrated annually, including derivative hazards
- A patented multi-hazard correlation engine
- Proprietary impact functions beyond the open starter set
- An enterprise pipeline a step ahead of the open release, with enterprise integrations, on-premises deployment, SOC 2, onboarding and support with SLAs
These data, analytics and service offerings have separate commercial agreements with RiskThinking.AI. They compete alongside other providers building against the standard; those agreements do not change the published SDK and framework licences.
The commercial Climate Digital Twin, for scale
These figures describe the commercial platform, not the open reference data.
50+
climate hazards modelled
193
countries
All
IPCC emissions scenarios
15
time horizons to 2100
7M+
curated physical assets
2,000+
pathway scenarios at 10km
Built to pass your security review
There is no opaque third-party binary to fear, because your information-security team can read exactly what runs before it touches your environment. Transparency is the default, precisely what CISOs and regulators have spent years asking closed vendors to provide.
Who's involved
You would be in good company.
Researchers from 27 institutions have taken part, each with their institution's permission, and the list grows daily. Some of these institutions are also signatories. Everyone joined before any capital was raised.
Institutions and researchers on board
- The Fields Institute for Research in Mathematical Sciences
- University of Toronto · Mathematical Finance
- Durham University · Finance and Management Science
- Pacific Institute for Climate Solutions · University of Victoria
- University of Western Ontario · All Science Faculties
- University of Zurich
- Central Bank of Brazil
- Stockholm Environment Institute · SEI Latin America
- University of British Columbia · Sauder School of Business
- University of Amsterdam
- Greenfi.ai
- KPMG
- MKM Research Labs
- UNICEF
- Universidad Torcuato Di Tella
- University of Toronto · Architecture
- Tel Aviv University
- The Cyprus Academy of Sciences, Letters and Arts
- Technical University of Munich · CAMBIR
- London School of Economics · doctoral research
- Queen's University · Smith School of Business · Sustainable Finance
- Jewish Climate Trust
- Twintree.Org
- Life-Links.org
- University of Duisburg-Essen
- Universidade Federal do Rio Grande do Norte (UFRN)
- University of Twente
"Watch this page. A rich database and standardized interfaces for advanced modeling with granular climate data can enable great things."
"If this data only serves the institutions that can already afford it, we have not solved the climate-risk problem. We have just priced some people out of knowing it."
A community, not a release
An open standard is only as strong as the people who use it, test it and extend it. RiskThinking.AI contributed the standard, and RiskThinkingFoundation stewards it, so what you build on remains in place in five years, independent of any one company's commercial decisions.
Commercial vendors cluster around large, listed, global portfolios. The underserved long tail (agriculture and supply chains, real estate and unlisted assets, single river basins, specific hazards and geographies) is exactly where researchers work. Researchers are the people who pressure-test a standard, validate it and extend it into the underserved corners, giving it a legitimacy no single vendor's marketing can buy.
Who governs it
The open assets (the standard, the reference pipeline, open reference data and the open impact-function library) and governance itself are stewarded by RiskThinkingFoundation, a neutral, non-profit foundation. Governance is lightweight but real: clear spec versioning, a published contribution process, reference implementations and a public roadmap.
RiskThinking.AI is a founding contributor and holds no privileged position in the spec. Competing providers are explicitly welcome to conform and contribute.
RiskThinkingFoundation founding board
- Matt Davison, Dean of Science, Western University
- Luis Seco, Professor of Mathematics, University of Toronto; Head of Sustainability, The Fields Institute
- Andrew Zolli, Chief Impact Officer, Planet
Roadmap directions
- Conformance test suite, so an outside implementation can prove it followed the same pipeline and schemas.
- More ways to use the Commons beyond the Python SDK, across additional languages and runtimes where they are useful.
- Dataset onboarding that turns a new community raster or table into a canonical hazard file in one step.
- Calibrated damage-function packs, cited and versioned, with applicability and uncertainty bounds.
- Regulatory mapping from outputs to reporting regimes.
Expect rough edges. Specs, APIs and schemas may change during the preview, sometimes with little notice. Availability is a plan, not a promise; the order and timing of releases may shift.
News
Partner FAQ
Questions we hear from partners.
The project
Why is RiskThinking.AI open-sourcing this?
Because a standard is worth more than an island. A shared, inspectable architecture grows the whole market for physical climate-risk analysis, and RiskThinking.AI chooses to compete on data quality and analytics rather than on lock-in. Open adoption also lets prospects prove value with zero friction before any commercial conversation, which suits a trust-driven market with slow procurement.
Who should join, and what do partners get?
Five kinds of partners: founding institutions, with a seat shaping governance and the v1 standard; data providers, gaining distribution through a common contract; developers and implementers, building on a stable foundation; researchers, gaining reproducible methods and real-world adoption; and adopters (financial institutions, corporates and public agencies) wanting comparable, auditable risk outputs.
Early partners get direct influence on the v1 specification, early access to the reference pipeline and sample data, visibility as founding participants, and a direct channel to the stewardship team.
What should the ecosystem build?
Conforming data products published against the standard's input contracts, including from providers who compete with RiskThinking.AI; sector-, peril- and region-specific impact functions, open or commercial; integrations into risk platforms, portfolio systems, GIS tools, reporting workflows and cloud data platforms; alternative implementations, validation and conformance tooling, and benchmarking suites; research that tests and extends the methods encoded in the spec; and applications for underwriting, lending, asset management, supply chain, infrastructure planning and regulatory reporting.
How do academics, researchers and developers benefit?
Researchers and academics: reproducibility by default, since methods published against the standard can be re-run by anyone on open data in an open pipeline; a path from paper to practice as contributed methods get adopted by practitioners; shared infrastructure that removes months of setup; and influence on how v1 encodes hazards, exposure and vulnerability.
Developers and implementers: a stable foundation of open contracts and versioned specs; distribution through the standard, since every adopter is a prospective user; a zero-friction start, with pipeline, sample data, SDK and docs free to run; and community visibility with a direct line to the team and a voice in the roadmap.
Using it
Can I use the SDK and framework commercially?
Yes. crc-sdk and crc-framework permit commercial and non-commercial use under AGPL-3.0-or-later, subject to its conditions, including applicable source-sharing obligations. Membership is not required. CRC Open data is separately licensed CC BY-NC 4.0 and is restricted to non-commercial use under that licence. Other datasets and hosted services have their own terms. See the licence details.
Are results on open data scientifically credible?
Yes. The engine and schema are the same as the commercial stack. Open data changes precision, not credibility: precision depends on the resolution of the inputs, so report that resolution, exactly as good science already requires.
Do I need to write code?
No. Paste the one-sentence prompt into your favourite AI agent, or follow the without-code guide for that prompt and for notebooks you can run in a browser. The technical docs are there when you want the method itself.
What if I later need high-fidelity data?
CRC Open samples are available for selected regions under CC BY-NC 4.0. For commercial data use or additional resolution and coverage, ask about a separate data licence. Compatible licensed data can use the same pipeline. Write to academic@riskthinking.ai and it will reach the right people.
Where to go next
Two guides, depending on how you work.
The technical docs install the SDK and run a portfolio analysis offline, in about ten minutes. The without-code guide stays in the browser: one sentence to an AI agent, or a notebook you can run yourself.