AI risk management: How to adopt AI securely

Your organization is implementing AI. But are you doing it securely, and in a way that doesn’t expose you to unnecessary, avoidable risk?

If your answer isn’t a confident yes, then you will almost certainly benefit from implementing an AI risk management strategy. Managing AI risk helps businesses control costs, avoid massive data privacy issues, mitigate shadow AI and use AI tools more effectively.

Keep reading to learn more about what AI risk management is, why it matters and put a risk strategy into place.

What is AI risk management?

AI risk management involves implementing policies, governance and controls to limit your organization’s AI risk exposure. The purpose is to become more secure, boost your AI readiness, manage costs and avoid financial, reputational and operational damages.

Although it is a pillar of enterprise risk management and overlaps with other risk areas like cybersecurity, technology or operational risk, AI risk management is different because AI itself is evolving so fast. Nothing about AI is static, which means what is true today may be radically different tomorrow.

Traditional risk management principles like vendor management, data security and thoughtful governance are as useful with AI as in other areas. But business leaders must also face new complexities. For example, just because AI always gives you an answer doesn’t mean you can trust it is the right one, as AI models with access to bad data will use that to produce their outputs.

Think of AI risk management as a fundamentally new area of risk — one that will only grow more important as AI becomes more deeply integrated into businesses.

What is the difference between AI risk management and AI governance?

AI risk management is a high-level, strategic effort that fits into your overall enterprise risk management strategy. Governance is the day-to-day process of how you turn an AI risk management strategy into action and results.

Your governance committee will take your strategic AI risk management goals and implement them by creating policies, establishing controls and providing training for your team.

Why AI risk management matters for business leaders

Using AI without first setting up guardrails like governance exposes your organization to major new risks. Without an AI risk management strategy in place, you face financial, operational, reputational or regulatory costs that interfere with the overall success of your business.  

• Financial risk exposure: Ungoverned AI use can create direct financial risks. These can include investing in ineffective AI tools, overspending on AI credits, regulatory fines and other costs associated with putting time and capital into implementing a technology without understanding how to use it correctly.
• Operational risk exposure: AI can dramatically speed up some aspects of your business — but only if you implement it correctly. Haphazard AI use may not only slow you down but also actively deliver bad information to decision-makers or customers.
• Reputational risk exposure: Likewise, behaviors like sharing private customer data with the wrong AI model could provide that data to other users, creating major reputational risks. Your organization’s reputation can also falter if you expose customers to inaccurate AI-generated outputs.
• Regulatory risk exposure: Regulators are still wrapping their heads around AI, but any use that violates applicable rules or guidance could result in fines or corrective action.

However, also consider that AI risk management leads to business wins. Identifying AI risks, establishing governance and training your team on AI use are all openings to make AI a stronger organizational asset as well as mitigate risk exposure.

In other words, promoting responsible AI use not only helps you avoid trouble but create opportunity.

Common AI risks organizations face

Any organization that implements AI without a risk management strategy or governance faces certain risks. Key risk areas include data privacy, security, bias, hallucinations, regulatory challenges, third-party vendors and shadow AI.

Data privacy and security

If your AI tools aren’t containerized (which means non-public, enterprise models), then any data you share will likely end up as part of that model’s available resources for learning and insight, making it accessible to users outside of your organization. If your team doesn’t know to do this, then you may be exposed to massive (and potentially hugely expensive) data privacy issues.

AI is also creating new cybersecurity threats. LLMs make it simpler to conduct phishing scams, allowing bad actors to quickly generate thousands of believable phishing emails to flood your organization and look for cracks.

And AI also raises new access control issues. If you don’t know who has access to your AI tools or how that access is secured, you could be exposed to unauthorized use.

AI bias and model reliability

AI answers depend on the data it has available, which creates major bias and reliability risks. A model given inaccurate or incomplete data will create outputs based on that data.

This can lead to obviously wrong answers. But it can also create more subtle biases, like a lender that uses an AI tool with access to a dataset containing only affluent borrowers, then asks that tool to help make lending decisions on less affluent ones.

The AI may recommend rejecting those borrowers simply because they fall outside the parameters of its available data.

Hallucinations

Hallucinations — where an AI model simply makes up an answer that isn’t true — are a credible risk. However, the risk level depends heavily on the quality of your data, with models having access to relevant, high-quality data less likely to hallucinate when answering questions related to that data.

Prompting also plays a role here, with more careful, accurate prompts typically producing fewer hallucinated responses.

Regulatory and compliance risk

AI regulations are only just getting off the ground. Key provisions of the European Union’s major regulatory effort, the Artificial Intelligence Act, have only recently taken effect, while similar efforts in the U.S. remain in the planning stages.

But businesses in regulated industries need to be careful here. The E.U. law will likely serve as a template for California and other U.S. states to establish AI oversight on a state level sooner rather than later, with a federal bill almost certain to follow. This will be a lot to keep up with, and it’s only going to get more complicated.

AI is also shifting certain compliance frameworks. ISO and HITRUST have both added AI standards to their requirements; SOC and other frameworks will likely soon do the same. New AI HIPAA rules are a matter of when, not if.

Shadow AI and unauthorized AI use

Shadow AI occurs when your employees use unauthorized AI tools at work. This is happening in virtually every organization that doesn’t have strict AI governance in place, creating major risks around data privacy, as shadow AI can easily lead to private data getting shared with public AI models.

Shadow AI also exposes you to uncertainty around compute spending, regulatory issues and inaccurate information flowing up to decision-makers.

Third-party AI vendor risk

As with traditional SaaS products, AI can also expose you to third-party vendor risk. Any data you share with an AI tool — even an enterprise model that’s set up to protect your private data — will likely end up stored in a vendor’s systems, leaving it at risk of exposure during a data breach.

You also have to know whether your vendors are meeting regulatory and compliance requirements for your industry, whether the vendor takes appropriate security measures and if its products are at particular risk for bias or hallucinations.

Overspending on AI compute

Finally, be aware that AI companies like Microsoft, OpenAI and Anthropic have begun raising prices or shifting to new token-based pricing models that charge for actual usage rather than a flat monthly fee. If you don’t know exactly which models your team is using, their pricing structures and how much compute your team is likely to use, you can inadvertently spend more on AI use than you planned to — sometimes much more.

Assess your organization’s AI readiness and risks

Assessing your organization’s AI readiness and risk levels is a key first step to implementing an effective AI risk management strategy. You can break your assessment down into a handful of buckets:

• Governance: Do you have an official policy on acceptable AI use? If not, you need one. Also consider vendor onboarding, as you need a process in place to evaluate and onboard any new approved AI tools. Creating an AI ideas center where employees can bring AI ideas or request new AI tools is a good step too.
• Business use cases: You should use AI to solve specific problems within your business, not because it’s cool. Creating a roster of business use case ideas for how you should implement AI will help you avoid wasting money and get better results. If you’re unclear on your most valuable use cases, engage an advisor to help you find them.
• Data security: You need to know where your data is. This could be as simple as moving your data to a central location, like a cloud server, but for more mature organizations, it typically means creating a data lakehouse.
• Key risks: Evaluate your key risks, like data privacy, shadow AI use, regulations, bias and third-party vendors to understand where you need to implement stronger governance and more effective controls. You may benefit from working with a risk advisor here, as an advisor can help you prioritize risks based on likelihood and impact and then help you mitigate the most important ones.

Build an AI governance framework

Establishing an effective governance framework is essential to managing your AI risk and avoiding unnecessary costs. AI governance involves creating a governance committee to develop policies and structures that cover areas like customer data privacy, reliability, vendor management, compliance and fairness.

To do this, your committee can review sample AI policies and then use those to write one that fits your specific business needs.

A governance committee should include C-suite input, typically from your CFO, COO and/or CIO, as well as other stakeholders and individuals who will champion AI use inside your organization.

Implement AI controls to reduce business risk

Governance itself is the most critical AI control and should be an ongoing effort. Once you have a governance structure in place, you can implement additional controls to reduce your AI risks.

You can’t control everything your employees do, but you can establish some measure of institutional control to prevent employees from sharing data with public AI models or granting systems access to unauthorized AI tools.

Effective controls include:

• Ongoing governance
• Regular AI training for employees
• Processes for suggesting, assessing and adding new AI tools
• Regular policy reviews and updates
• Tracking AI spending
• Evaluating ROI on specific AI tools
• Monitoring AI use

Think of a three-legged stool here: AI policies to guide use, an AI governance committee to enforce and update them and AI monitoring to track how that work is actually going.

Conduct an AI risk assessment before deployment

Never invest in a new AI tool without conducting a risk assessment. Before you spend money or share your data with an AI model, you need to understand what it does, how it uses data and whether it fits into your business objectives.

Doing a risk assessment can help you avoid security and data privacy problems. As with any new technology, an AI tool should also serve a clear, specific business objective, so taking a measured pause to consider risks is also an opportunity to evaluate if a particular AI tool actually makes sense from an ROI perspective.

AI risk management best practices

Implementing AI risk management best practices can help your business manage your exposure to AI risks. Beyond establishing governance and a clear AI use policy, here a several specific practices to consider:

• Maintain a list of authorized AI tools: You should feel confident about how these tools use your data and have an agreement with their vendors that sets clear data protection boundaries that keep your data private.
• Know how your SaaS platforms are integrating AI: If your ERP or your CRM now includes built-in AI features, learn how those features work and what they do with your data.
• Ongoing AI use training: People are the biggest risk in cybersecurity and AI is no different. Once you have an AI policy in place, you need to constantly train your team on acceptable AI use to limit your shadow AI risks and keep your policy top of mind.

How AI risk management supports enterprise risk management

AI risk management is a pillar of a broader enterprise risk management strategy. AI risks create operational, reputational, cybersecurity and financial risks that are not remotely siloed but can bleed into any aspect of your business.

For example, consider the story of a major consulting company that published a major report that was full of AI hallucinations. Before catching the errors, the company shared this report widely with customers and its audience, which led to reputational damage once people began to realize the report was not credible.

To be most effective, consider AI risks as part of a holistic effort to assess and manage your enterprise risk. You can’t fully separate AI risks from other risk areas, so addressing them through one cohesive strategic push will deliver stronger overall outcomes.

How Wipfli can help

We advise businesses and organizations on how to successfully manage AI risk. This includes conducting AI risk and readiness assessments, establishing governance, defining use cases and even providing a fractional chief AI officer to lead everything AI for your organization. Start a conversation.

Let’s talk AI risk management

Read more

• AI ROI: How to get more business value from your AI spending
• AI governance checklist: A basic framework for your business
• Shadow AI: How business leaders can avoid this growing risk