Navigating AI Risks

Wow, this is actually kind of terrifying. ElevenLabs just made AI agents insurable. Literally. The same way companies insure employees… you can now insure an AI. Which means if an AI voice agent gives the wrong information, leaks something sensitive or triggers a problem, there’s now a policy that can cover the damage. That’s the big story. For the first time, someone is taking responsibility for what AI does. Because until now, that’s been the biggest unsolved problem in AI. Just think about it. An AI tells a customer the wrong return policy → the customer acts on it → loses money → sues the company. Who pays? The company? The vendor? No one? That gray area is what stops companies from putting AI into real use. Because the risks aren’t theoretical. We’re not talking about bugs. We’re talking about lawsuits, compliance violations and reputational damage. That’s what this actually solves. So now, instead of absorbing all that risk, companies can transfer it. If the AI messes up, the loss is covered ✅ And suddenly, deploying AI is no longer a legal gamble. It’s an insurable risk. What makes this even more interesting is how they made it possible. There are two layers behind it: 1-This AI is treated like a regulated product Before anything gets insured, it goes through thousands of adversarial tests (over 5,000 scenarios based on real failures like data leaks, prompt injections and incorrect outputs). 2-You’re not insuring the system, you’re insuring its actions Because the real risk isn’t that AI exists. That’s new. And honestly, this changes how you think about AI adoption. Because failure isn’t hypothetical anymore. And this is the first real attempt to deal with the consequences. You can check out how the certification process works here: https://lnkd.in/g5fuxbvS So now I’m curious… Would something like this actually make you trust AI more or does it just prove how risky it really is?

Every AI failure you've read about traces back to one of these risks. Not a bug. Not bad luck. A known, named, predictable category of risk that every AI team should already be tracking. Here's the AI Risk Periodic Table, mapped across 10 categories every founder, product leader, and enterprise team needs to understand. 𝟭. 𝗠𝗼𝗱𝗲𝗹 𝗥𝗶𝘀𝗸𝘀 Hallucination, bias, drift, overfitting, underfitting, error propagation. The model itself fails before anyone touches it. 𝟮. 𝗗𝗮𝘁𝗮 𝗥𝗶𝘀𝗸𝘀 Mislabeling, source risk, synthetic data risk, duplicate data, data leakage, consent risk, quality loss. Bad data breaks good models. 𝟯. 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗥𝗶𝘀𝗸𝘀 Jailbreaks, prompt injection, adversarial attacks, API abuse, token theft, supply chain risk. Every AI system is a new attack surface. 𝟰. 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗮𝗻𝗱 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 Governance failure, compliance risk, regulatory risk, policy failure, ownership gap, explainability gap. The stuff that gets companies fined or sued. 𝟱. 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗥𝗶𝘀𝗸𝘀 Scaling, cost overrun, latency, deployment, documentation, integration, rollback gaps. Where production AI quietly bleeds money. 𝟲. 𝗕𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗮𝗻𝗱 𝗥𝗲𝗽𝘂𝘁𝗮𝘁𝗶𝗼𝗻 𝗥𝗶𝘀𝗸𝘀 Reliability, reputation, customer trust loss, revenue impact, ROI failure, strategy misalignment. The risks the CFO cares about most. 𝟳. 𝗛𝘂𝗺𝗮𝗻 𝗮𝗻𝗱 𝗘𝘁𝗵𝗶𝗰𝗮𝗹 𝗥𝗶𝘀𝗸𝘀 Fairness, trust gap, ethical risk, automation bias, job displacement fear. The risks that decide whether anyone actually uses your AI. 𝟴. 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 𝗮𝗻𝗱 𝗖𝗼𝗻𝘁𝗿𝗼𝗹 Monitoring gaps, audit gaps, alert failure, logging gap, metric blindness, validation gaps. If you can't see it, you can't fix it. 𝟵. 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗔𝗜 𝗥𝗶𝘀𝗸𝘀 Agent autonomy risk, tool misuse, memory risk, goal misalignment, delegation risk, multi-agent failure, loop failure. The newest, most underestimated category in 2026. 𝟭𝟬. 𝗙𝗮𝗶𝗹-𝗦𝗮𝗳𝗲 𝗥𝗶𝘀𝗸𝘀 Kill switch gap, feedback gap, evaluation failure, red teaming gap. The layer that decides whether AI fails gracefully or catastrophically. 𝗧𝗵𝗲 𝗯𝗶𝗴 𝗶𝗱𝗲𝗮: Most AI teams worry about hallucinations. The best teams worry about all 70+ of these, with a system to monitor each one. AI isn't risky because it's new. It's risky because most teams have never mapped its risks. This table is that map. Which risk is your team underestimating right now? Repost to help another AI leader plan smarter.

Audit, Risk & Compliance (ARC): The Three Pillars of Strong Governance "Let me explain why Audit, Risk, and Compliance aren’t just checkboxes—they’re your governance backbone." I’ve had this conversation many times with peers, clients, and boards. And here’s what I often say when someone asks, “How do you build strong governance?” You start with ARC: - Audit - Risk Management - Compliance Each has its role, but when aligned, they become a strategic force. Let me walk you through it from experience: 🔍 Audit is your independent lens. Think of Audit as the team that tells you what’s happening. Their job is to verify that controls are working not just existing on paper. ▶ Example: I once saw an internal audit uncover a $500K billing discrepancy no one had noticed. That wasn’t just cost savings it was a control failure caught before it became reputational damage. The best audit teams today use data analytics and real-time assurance tools to stay ahead. Traditional static audits no longer suffice. ⚠️ Risk is your radar. Risk Management isn’t about stopping risk, it’s about knowing which risks matter, and how much risk you can take to grow. I’ve seen risk teams run scenario analyses ahead of market expansion that flagged FX volatility. With a solid hedging plan, they avoided a 7% EBITDA hit. That’s what proactive risk management looks like. And right now? The strongest risk programs I’ve seen are integrating AI, ESG risk, and third-party oversight into their frameworks. ✅ Compliance is your moral and legal compass. Compliance isn’t just about avoiding fines. It’s about building trust internally and externally. A solid compliance program is the reason one company I worked with navigated new data privacy regulations across multiple countries without missing a beat or getting penalized. What’s changing? Compliance is becoming more automated, more behavior-driven, and more global. And that means compliance officers need better tech and a seat at the strategy table. Now here’s the key: ARC only works when it's integrated. When Audit, Risk, and Compliance operate in silos, things fall through the cracks. But when they collaborate sharing insights, aligning priorities, and using common platforms governance becomes a value driver. A recent PwC survey backs this up: - 73% of execs say ARC alignment improves decision-making - 65% plan to invest in integrated GRC platforms - Over half say Internal Audit is now a transformation partner If you’re leading or supporting ARC functions, my advice is simple: Don’t build walls, build bridges. The future of governance isn’t in functions. It’s in how those functions work together. Let me know how ARC works in your organization today. Do the functions collaborate, or still operate in silos? #Governance #InternalAudit #RiskManagement #Compliance #GRC #BoardEffectiveness #OperationalResilience #Leadership #3prm #tprm #GovernanceExcellence #RiskStrategy #ComplianceCulture

AI is not failing because of bad ideas; it’s "failing" at enterprise scale because of two big gaps: 👉 Workforce Preparation 👉 Data Security for AI While I speak globally on both topics in depth, today I want to educate us on what it takes to secure data for AI—because 70–82% of AI projects pause or get cancelled at POC/MVP stage (source: #Gartner, #MIT). Why? One of the biggest reasons is a lack of readiness at the data layer. So let’s make it simple - there are 7 phases to securing data for AI—and each phase has direct business risk if ignored. 🔹 Phase 1: Data Sourcing Security - Validating the origin, ownership, and licensing rights of all ingested data. Why It Matters: You can’t build scalable AI with data you don’t own or can’t trace. 🔹 Phase 2: Data Infrastructure Security - Ensuring data warehouses, lakes, and pipelines that support your AI models are hardened and access-controlled. Why It Matters: Unsecured data environments are easy targets for bad actors making you exposed to data breaches, IP theft, and model poisoning. 🔹 Phase 3: Data In-Transit Security - Protecting data as it moves across internal or external systems, especially between cloud, APIs, and vendors. Why It Matters: Intercepted training data = compromised models. Think of it as shipping cash across town in an armored truck—or on a bicycle—your choice. 🔹 Phase 4: API Security for Foundational Models - Safeguarding the APIs you use to connect with LLMs and third-party GenAI platforms (OpenAI, Anthropic, etc.). Why It Matters: Unmonitored API calls can leak sensitive data into public models or expose internal IP. This isn’t just tech debt. It’s reputational and regulatory risk. 🔹 Phase 5: Foundational Model Protection - Defending your proprietary models and fine-tunes from external inference, theft, or malicious querying. Why It Matters: Prompt injection attacks are real. And your enterprise-trained model? It’s a business asset. You lock your office at night—do the same with your models. 🔹 Phase 6: Incident Response for AI Data Breaches - Having predefined protocols for breaches, hallucinations, or AI-generated harm—who’s notified, who investigates, how damage is mitigated. Why It Matters: AI-related incidents are happening. Legal needs response plans. Cyber needs escalation tiers. 🔹 Phase 7: CI/CD for Models (with Security Hooks) - Continuous integration and delivery pipelines for models, embedded with testing, governance, and version-control protocols. Why It Matter: Shipping models like software means risk comes faster—and so must detection. Governance must be baked into every deployment sprint. Want your AI strategy to succeed past MVP? Focus and lock down the data. #AI #DataSecurity #AILeadership #Cybersecurity #FutureOfWork #ResponsibleAI #SolRashidi #Data #Leadership

I came across research last week that I genuinely cannot stop thinking about. In the logic of AI, "man" is to "programmer" as "woman" is to "homemaker." No one explicitly coded that bias into the system; the machines simply learned it from us. They mirrored our job postings, our articles, and our casual conversations and billions of our own blind spots fed into a black box until the algorithm started reflecting our worst habits back at us. Bias in AI isn't always malicious. But sometimes it feels like AI is being weaponized against women's safety at a scale. On platforms like X, a woman posts a photo and the replies are filled with prompts for AI tools to undress her (see the links in comments).These tools then publicly generate explicit, non-consensual images of real women who are students, mothers, leaders. We want to use AI. We must use AI but thoughtfully. And the information it is sharing is just a mere unfortunate reflection of our society. A society where women have fought their way up as they have been historically been reduced, objectified, and pushed to the margins but now those patterns are being encoded into new systems. When a tool can be used to violate a woman's dignity in seconds, that's a design and policy failure. My question is: Can we build AI that doesn't inherit the worst of us? I think we can. But only if the people building it are asking that question out loud before the product ships. #AI #GenderBias #WomenSafety

Two identical CVs. Both written by AI. Both sent to 1,000 people. The only difference: one was named James, one was named Emily. James’s CV got a 97% approval rating. Emily’s got 76% - and reviewers were TWICE as likely to question her competence. Twenty-two percent more likely to question whether she could even be trusted. The feedback on Emily’s CV: “She can’t even write a CV herself - not sure she has the skills to carry out the job.” The feedback on James’s CV: “He just needed a bit of help putting it together.” Same words. Same AI. Different gender. Different verdict. 🚨🚨🚨🚨 How are we STILL HERE?!?!? The study, by former Meta strategist Zehra Chatoo, was reported in Fortune on 10 May. And the most uncomfortable finding wasn’t from older reviewers. It was from Gen Z men. They were 3.5 times more likely to call Emily’s CV “weak.” The generation that is growing up with AI. The generation telling us AI is the great equaliser. The data says otherwise. Chatoo summarised it in a sentence I have not been able to stop thinking about: “When men use AI, we question their effort. When women use AI, we question their integrity.” This is not one study. Harvard Business School has the AI adoption gender gap at 25%. Brookings has found that 86% of the roles with high AI exposure and low capacity to adapt to displacement are held by women. The pattern is consistent and it is widening. The conclusion most people are drawing from this data is “women should be more confident with AI.” I think that misses the point. The bias isn’t in the technology. It is in the people reading the output. Women are not being irrational when they hesitate to use AI openly - they are reading the room accurately. The reputational cost of being seen to use AI is genuinely higher for them. The data confirms what they already sense. The answer is not to ask women to ignore that. The answer is to fix the people doing the judging. To name what is actually happening when an “Emily” CV gets called weak and a “James” CV gets the benefit of the doubt for the same words. To call out the Gen Z men perpetuating a bias they like to claim their generation has moved past. And for women in leadership reading this - use AI anyway. Lead anyway. Document your AI workflows openly. Train your teams in them. Make your usage visible in the rooms where decisions get made. The cost of stepping back from AI in this moment is far higher than the cost of stepping in. We have the data to prove it now. If this resonated, I write about the AI gender gap, ethics, and practical strategy for women in leadership every week in my newsletter. The link is here: https://lnkd.in/emWjxC9t

15 weeks left before the first rules of the AI Act come into effect. Struggling with where to start on AI implementation and compliance? Start with a multidisciplinary team; conduct an AI inventory; carry out AI Impact Assessments; draft AI policies; amend contracts, policies, and data protection documents to reflect AI’s role in your organisation. Ensure your team is trained in AI literacy, as required under the AI Act. To navigate AI implementation and compliance under the EU AI Act, companies must begin by understanding its scope and risk-based approach. The Act categorises AI systems into prohibited, high-risk, or general-purpose. Prohibited AI systems (the first rules coming in) include those exploiting vulnerabilities or engaging in certain AI emotional recognition. High-risk systems, such as those used in management of critical infrastructure, require strict oversight, including documentation, risk assessments, and ongoing monitoring. General-purpose AI systems, widely used across industries, may also face regulatory scrutiny due to their broad impact. The first step for companies is conducting a comprehensive AI inventory. This involves cataloguing all AI systems in use or under development to determine their classification under the AI Act. Through this inventory, companies can assess their compliance obligations and identify any systems that may need modification or discontinuation to meet the Act’s standards. Data protection is a cornerstone of AI compliance. The AI Act mandates that data used in AI systems be high quality, representative, and free from bias. This is especially crucial for high-risk systems, which must undergo continuous risk assessments to protect fundamental rights. GDPR compliance is also essential for any AI system that processes personal data, and companies must ensure their data governance strategies focus on transparency, accountability, and safeguarding individual rights. Contracts are a critical component of AI implementation. Organisations must revisit and amend contracts to address how AI impacts their legal and operational frameworks. These amendments should explicitly cover liability for AI-generated decisions, intellectual property ownership of AI-generated outputs, and data protection compliance. Contracts must minimise legal exposure. Additionally, intellectual property issues around AI, such as ownership of outputs or the use of third-party data, should be clearly defined in these agreements. Following the AI inventory, companies must conduct an AI impact assessment. This assessment includes both a Data Protection Impact Assessment (DPIA) and a Fundamental Rights Impact Assessment (FRIA). The extraterritorial scope of the AI Act means that even non-EU companies must comply if their AI systems impact the EU market. Non-compliance can result in significant fines, making early compliance essential. 15 weeks left to comply.

"With recent advancements in artificial intelligence—particularly, powerful generative models—private and public sector actors have heralded the benefits of incorporating AI more prominently into our daily lives. Frequently cited benefits include increased productivity, efficiency, and personalization. However, the harm caused by AI remains to be more fully understood. As a result of wider AI deployment and use, the number of AI harm incidents has surged in recent years, suggesting that current approaches to harm prevention may be falling short. This report argues that this is due to a limited understanding of how AI risks materialize in practice. Leveraging AI incident reports from the AI Incident Database, it analyzes how AI deployment results in harm and identifies six key mechanisms that describe this process Intentional Harm ● Harm by design ● AI misuse ● Attacks on AI systems Unintentional Harm ● AI failures ● Failures of human oversight ● Integration harm A review of AI incidents associated with these mechanisms leads to several key takeaways that should inform AI governance approaches in the future. A one-size-fits-all approach to harm prevention will fall short. This report illustrates the diverse pathways to AI harm and the wide range of actors involved. Effective mitigation requires an equally diverse response strategy that includes sociotechnical approaches. Adopting model-based approaches alone could especially neglect integration harms and failures of human oversight. To date, risk of harm correlates only weakly with model capabilities. This report illustrates many instances of harm that implicate single-purpose AI systems. Yet many policy approaches use broad model capabilities, often proxied by computing power, as a predictor for the propensity to do harm. This fails to mitigate the significant risk associated with the irresponsible design, development, and deployment of less powerful AI systems. Tracking AI incidents offers invaluable insights into real AI risks and helps build response capacity. Technical innovation, experimentation with new use cases, and novel attack strategies will result in new AI harm incidents in the future. Keeping pace with these developments requires rapid adaptation and agile responses. Comprehensive AI incident reporting allows for learning and adaptation at an accelerated pace, enabling improved mitigation strategies and identification of novel AI risks as they emerge. Incident reporting must be recognized as a critical policy tool to address AI risks." By Mia Hoffmann at Center for Security and Emerging Technology (CSET)

AI programs don't fail because of the technology. They die in the org chart, and the pattern is remarkably consistent. The four failure modes I keep seeing: 1 - Fragmented ownership. A CAIO, a CTO, a CIO, and a COO all have a stake, and nobody has accountability. AI becomes a political football rather than a business capability. 2 - Strategy follows spend. Licenses get bought, pilots get launched, and months later someone finally asks what measurable problem this was supposed to solve. Nobody has a good answer. 3- Data blindness. Every GenAI use case hits the same quality, access, and governance wall. The people who know how to fix the data are usually the last ones invited to the strategy room. 4 - Shadow execution. The most valuable AI work in the building is often a solo side project living in an Excel file. No sponsor, no budget, no path to scale. What is interesting is that the organizations actually getting returns are not using better models. They are fixing the operating model, and the fixes map almost exactly onto the failures: 1 - Clear ownership. One person with budget, mandate, and accountability for outcomes. Not a committee, not a council, one owner. 2 - Business-first use cases. Every initiative tied to a measurable revenue, cost, or risk number before any license gets bought. If you cannot name the metric, you do not have a use case yet. 3 - Embedded governance. Data quality and access treated as a design principle from day one, with the data people in the room when the strategy is written, not after it fails. 4 - Proper resourcing. The Excel-file experiments get found, funded, and given a path to scale. Execution teams treated as core work rather than a hobby. AI maturity, as far as I can tell, has very little to do with technology. If this org chart looks familiar, the problem is probably not your AI strategy. It is the operating model underneath it. P.S.: I write about patterns like this every week und how to get unstuck in my newsletter, Human in the Loop: https://lnkd.in/dbf74Y9E