The risks boards should know about AI… but don’t

Artificial Intelligence is no longer an emerging or experimental technology operating at the margins of enterprise environments. It is embedded across cloud platforms, productivity tools, security tooling, data analytics, customer engagement systems, and decision-making workflows. Despite this ubiquity, many organisations state that they "use AI" without a shared or precise understanding of what systems qualify as AI, where those systems operate, or what risks they actually introduce.

This lack of clarity leads organisations to treat AI as a single, monolithic risk category. As a result, conversations about AI risk often collapse into discussions about chatbots or large language models, overlooking the wider ecosystem of analytical, predictive, generative, and increasingly autonomous systems already embedded across business workflows. This confusion drives misaligned risk management controls, inappropriate governance responses, and either excessive caution or false confidence, depending on the technology being considered. This all stems from a lack of understanding.

In practice, AI systems differ significantly in behaviour, autonomy, dependency chains, data exposure, and failure modes. These differences fundamentally affect how risk manifests and how it should be assessed. Effective AI risk management therefore depends on understanding what AI is and is not, recognising that risks are unevenly distributed across systems, and assessing those risks in context rather than applying generic or one size fits all controls.

This session explores how boards and executives should think about AI risk management and data governance frameworks considering any regulatory obligations e.g. Privacy Act.