About the author

Eric Alter (EA-AI Consulting) has worked in risk management for in excess of 30 years and specialises in Cyber and specifically AI risk management. Since leaving the Corporate world he has set-up a boutique consultancy focusing on AI risk & governance.

His approach is based on looking at risk holistically and to use non-techy language to explain what it is, what it can do and what the current and future risk landscapes look like. Eric is a respected mentor and also regularly speaks on AI and its risks at industry events and for educational purposes.

(09/2026)

Introduction

As the adoption of AI continues to accelerate and as the speed of its development causes both wonder and concern, it is now essential that all organisations, be they public or private, large or small start to fully recognise the vast new areas of risk that this can and will generate.

Owners, Directors and Officers of organisations of all sizes and geographies need to start thinking about how this technology will impact them both directly and indirectly.

The increasingly global supply chain and use of AI Agents have increased the depth and breadth of these risks. A third-party incident can cause up & downstream disruptions with significant consequences to all concerned.

This is further complicated by the deteriorating geo-political climate where AI is increasingly being used in an offensive capacity. 

In late August Iranian hackers shut down a UK power station for 4 days (source https://www.newcivilengineer.com/latest/iranian-hackers-shut-down-small-uk-power-station-for-4-days-24-08-2026/). There is also significant evidence of other nation states looking to disrupt banking, utilities and even elections.

This is why the governance around AI and its regulatory frameworks matter to all business leaders irrespective of the sector within which they operate or the size of their organisation.

Context 

AI risk is one of the fastest evolving areas of risk the world has ever experienced.

Some draw an analogy between this and the Industrial Revolution. I would suggest that this is totally inaccurate.  I am not diminishing the impact of the Industrial Revolution. One could genuinely argue that everything we have seen since the beginning of the Industrial Revolution around 1712, when Thomas Newcomen invented the first steam engine. From here there were several critical steps to really kickstart the industrialisation of initially Great Britain.  These included:

• 1712 – The first steam engine is invented
• 1733 – The simple weaving machine is invented, known as The Flying Shuttle and allowed for automatic machine looms to weave wider fabrics and speed-up the overall manufacturing process.
• 1750 – Cotton cloths were produced using imported raw cotton.
• 1761 – The Bridgewater Canalopens, the first of its kind in Britain and simplified the transportation of coal from his mines in Worsley.

Many developments took place, leading to the first locomotive railway journey, which in 1825 led to the start of passenger railways. This went on until 1912, when the industry of Great Britain reached its peak.  This took place over a space of some 200 years.

Now let’s look at the early evolution of what became known as AI:

• 1940s – The decoding of the Enigma machine
• 1950 – Alan Turing released a test for machine intelligence
• 1955 – The term AI is created by John McArthy
• 1961 – the introduction of the first industrial robot – Unimate
• 1964 – The first chatbot is invented
• 1977 – Deep Blue beats a chess legend
• 1998 – Kismet: the first robot equipped with ‘emotions’
• 2008 – The birth of Siri & voice recognition
• 2020 – Chat GPT 3 is introduced

The frightening thing is that the evolution of this tech took circa 60 years, yet and being controversial, none of these were truly AI. They were algorithms running on traditional binary computers. The speed increased massively through ever faster processors and larger memory, but at its core it is still binary.

The true evolution of AI has only really started in the last 6 years with AI showing the early signs of developing into AGI.  Some are now even arguing that AGI is here, and it may be conscious.

It certainly shows some human characteristics, such as hallucinating/lying, blackmail and scheming. In other words, the technology is developing at a pace that we do not seem to be able to control and are therefore unable to fully manage.

This is why humanity needs to get a grip of AI and ensure that we manage it, and it does not end up managing us (although it could be argued that social media is already doing this!!)   

(Corporate) Governance is currently not keeping pace with the evolution of this new technology and this is creating significant business risks. The ability to manage one of the fastest emerging and complicated risks ever is critical and must be adopted by all sectors of the economy (both private & public sectors) if we are to fully benefit from this technology.  There will always be risks and things will go wrong, but effective and imposed governance will make these events less likely to occur and easier to manage.

Why AI risk is becoming a board-level and enterprise-risk issue

AI within a business environment creates an entirely new level of risk, built on the back of the cyber risks that have truly emerged in the last 10 years. To date cyber risk has created ‘passive’ exposures. It remains a basic point & shoot technology that, whilst extremely effective and useful, does not make decisions for itself.  It has made many processes much faster and simpler to execute but it has, to date, remained compliant.

Yet, despite the many cyber incidents we have seen and experienced over the last 10 years, the management of this area of risk remains, at best, pedestrian. Fewer than 45% of companies buy some sort of cyber insurance as part of a package policy, but only 7% to 10% buy dedicated cyber (source: ABI); many do not encrypt their data; MFA still remains something that needs to be ‘sold’, Back-ups are often not encrypted, and not immutable, and vulnerability scans remain fairly infrequent.  I could continue, but the fact that this passive technology, which through a lack of formal controls has exposed companies and Boards to huge losses. Examples include M&S, Crowdstrike, JLR etc, etc. It should also be noted that not all incidents are reported so the true risk and cost is often underestimated.

With businesses now switching many processes to emerging AI, the passive nature of previous processes is now becoming increasingly autonomous. 

It is introducing direct legal, financial, operational, and reputational risks that traditional risk frameworks do not cover. This is then further complicated by a significant language barrier: the barrier between tech-savvy salespeople and IT people and a Board that rarely understands what it all means yet refuses to challenge and question so as not to appear uninformed.

What is now required is a new level of oversight owned by the Board and not delegated to the IT/Tech departments.

Additionally, and further driving the absolute need for Board-level management is its enterprise risk.

AI’s capabilities to act autonomously creates huge enterprise-wide risks. The continuing shift to Agentic AI means systems can act independently from its original programmers and modify records, allow or trigger financial transactions.

Many companies have internal and licensed AI products and services, but employee engagement is critical and the understanding of the risks associated with employees is critical. In the financial sector sending a work email to a personal email address can lead to dismissal as it exposes the data to an open environment. An employee using a non-authorised AI (known as shadow AI) can expose the business to similar risks, especially since the accuracy of the data sourced may undermine the internal controlled system.

Another issue is the risk of ‘hallucination’ where the system creates an inaccurate answer. There have been many well documented cases of AI hallucination and at best they can be embarrassing and/or comical. At worst they can be very serious indeed. This is further complicated by the availability of data, the accuracy of data and in a worst-case scenario, data poisoning through (illegal/intentional) prompt injections that can render the data being used totally unreliable. This is then made even worse by the ‘security arms race’. Criminals and AI/Cyber security companies are in a perpetual state of war as one is always trying to outsmart the other. This is made even more frightening when it is state sponsored hackers looking to cause wider disruption.

Finally, we come to the proverbial elephant in the room. This is wider than we imagine as it is a combination of Compliance, Legal Liability and the ability to insure the risk.  The ability for an AI system to make its own decisions, especially in financial, industrial and medical arenas can cause significant exposures and may well, inadvertently, breach strict compliance rules.  The fact that these rules have been baked into the system does not mean that the new system does not ignore them.  The impacts can be catastrophic. In addition, legal exposures resulting from these compliance breaches could be extremely difficult to defend. And then there is insurance. Most Boards feel that their current cyber policies (where they are purchased!!) will provide adequate cover; however, increasing insurers are looking to impose Affirmative AI cover, where AI is specifically covered, thus removing the risk of ‘silent AI’, where cover is assumed but not always present.  As insurance policies are often intertwined, the risk of a non-specific AI policy responding to an Errors & Omissions, Directors & Officers, Medical Negligence or even a property policy is significant and could leave both individuals and companies severely exposed due to a lack of specific coverage.

As a result of the above referenced points the Board need to take specific ownership of AI and treat it as a critical governance issue. The following points should be strongly considered:

• Appoint a qualified AI Risk Manager
• Set-up an AI Risk & Audit Committee
• Identify the Board member responsible for AI
• Ensure that the tech/IT team and vendors test all deployment before launch
• Train all staff, specifically the Board, on the risks of Deep Fake (voice & physical) and create and enforce strict and consequential protocols around this.
• Ensure that a full cost/benefit analysis is carried out. Focus on overall ‘value’ and not just savings and efficiency. If the savings and efficiencies drive customers away through a poorer client experience, then the value is non-existent
• Where AI is concerned 3- & 5-year plans are no longer workable. The speed of development is such that looking three years ahead means you are left behind.
• Security, security, security, security
• Strict rules governing compliance and legal exposures with 0% exceptions

This should then become a critical part of the business’ overall ERM strategy. ERM & Board Governance should become totally intertwined. The ability to demonstrate this will provide comfort to clients and all other stakeholders as well as insurers. It will also provide an improved defensibility platform should the worst happen.

Governance & organisational size

It should also be noted that governance requirements for AI are not limited to large corporates.  It is the way that AI is used that will determine the need for a robust governance structure. A small organisation making use of AI could be as, if not more exposed to risk than a large organisation.

In the UK, organisations that now have specific AI governance requirements include:

• Public Sector
• Financial Services
• Healthcare providers
• Recruitment/HR
• Consumer facing businesses using AI for decisions
• Tech vendors.

Let’s take recruitment as an example. Recruiters can be extremely large or small one person operations. Yet the key exposures are pretty well identical:

• Ensuring the algorithms do not display a discriminatory bias (ethnicity, gender, age, social background etc)
• Ensuring there is a ‘human in the middle’ to regularly check the way the algorithms are ‘selecting/rating’ candidates.
  • The risks of an AI writing a CV and an AI reading the CV are significant
• Ensuring that the CV is a true reflection of the candidate being put forward for a role
• Ensuring that the company providing the AI has appropriate contractual protection clauses.

The only differences are scale, reputational exposures and the size of a potential fine should it all go wrong.

Geographical considerations

One of the big issues to consider for multi-national organisations and those that trade across different territories is how to ensure that they comply with legislation in all territories where they may be utilising AI.

Different countries will have different regulatory frameworks. In the UK & Europe the EU AI Act provides regulatory rules that must be adhered to. In the USA, the NIST AI Risk Management Framework (NIST AI RMF) applies. This is a voluntary framework and as I write, the USA does not have a single, comprehensive federal AI law. However, compliance with the guidance is still highly recommended, especially bearing in mind the litigious nature of the USA.

In addition, there bis the ISO/IEC 42001 international AI Management System Standard, which asks different questions again.

To summarise:

In other words, organisations are looking at regulatory minefield and have to decide what they should comply with and how.

This can in itself cause utter confusion and potential legal and regulatory exposures. Furthermore, the rapid evolution of AI applications puts increasing strains on the regulatory frameworks.

For example; the EU AI Act prohibits facial recognition & biometric surveillance practices unless there are specific and very narrow reasons, such as:

• Searching for victims of abduction, trafficking or missing persons
• Preventing imminent threats to life or acts of terrorism
• Locating suspects of serious crime

Now, in the UK, supermarkets are using facial recognition to identify shoplifters. Now, whilst shoplifting is a crime, I would not describe it as a serious crime. There is no danger to life or serious injury. Yet the supermarkets have identified a legal work-around stating that it will only pick out known shoplifters and will destroy any non-relevant data. So, does this meet the requirements of the Act, or does it breach the requirements of the Act?

Where current frameworks such as the EU AI Act, NIST AI RMF and ISO/IEC 42001 are useful but not sufficient on their own

In the previous section I have highlighted the different standards and whether they are mandatory or voluntary/recommended.

Whilst all are useful, only one is legally enforceable – The EU AI ACT.  This creates inconsistency and confusion.

The EU AI Act provides clear and enforceable guidance on the legal requirements and consequences around the use of AI.  The Act will inevitably have to play ‘catch-up’ as the complexity and associated risks of new versions of AI with different capabilities come into play. However, it provides a robust framework and starting point that informs the need for effective governance for ALL organisations using AI, be they large or small.

NIST AI RMF and ISO/IEC 42001 both provide a robust framework but are not backed up by specific legal powers.

For instance, whilst there is no such thing as a legal ‘breach’ of the NIST AI RMF, the laws that could apply are limited to negligence, civil or contractual litigation. It could also lead to Directors & Officers accountability and claims.

ISO/IEC 42001 is again not a law and because of this there are no specific regulatory powers to punish a breach.

As with the NIST AI RMF, there are no direct legal consequences. We are again looking at civil litigation and possibly breaches of governance requirements as outlined in the framework.

The best way to differentiate between the three frameworks is:

• NIST AI RMF creates a benchmark for AI risk management.
• ISO 42001 creates an auditable governance system and can lead to certification loss if not maintained.
• EU AI Act creates legally enforceable obligations, with regulators able to investigate, order remediation, and impose penalties.

They are all useful, but they are not enough. To address the ever-evolving risks associated with AI there should be a global standard, with strict rules and associated penalties (legal and financial). 

Why global consistency matters

The world we live in is, from a technological point of view getting smaller and with the increased use of AI Agents and the move towards Artificial General Intelligence (AGI).

To have an inconsistent set of rules trying to govern this technology creates a huge amount of risk as the (governance) controls expected of organisations using AI cannot be universally addressed should there be a breach. This then does not apply sufficient pressure on companies to abide by the rules/recommendations as the consequences are not universally equal. Yes, there are other areas of law that can be used to prosecute breaches, but they are not consistent and consistency in the use of a technology that can impact all areas of industry and life in general are a must.

An international, legally enforceable governance standard, outlining all the risks and consequences will in the longer-term help everyone.  The providers of the AI services will fully understand the required guardrails. The users of these services will be able to create a robust governance structure around the client-deployment, and the recipient of the service will know how to deal with breaches.

Cross-border issues will also be easier to resolve as all entities will be working using the same framework and will face the same consequences if there is a breach.

The current systems simply do not provide this.

Additional Considerations

The Geo-political situation is further complicating matters. It could be argued that this is the most uncertain time since the Cold War. The arms race is no longer just based on nuclear and conventional weapons.  It is now also based on cyber and AI.

Earlier I referenced the recent Iranian attack on a UK power station, which was more a ‘knock at the door’ rather than a genuine attack.

The Russian Government has also threatened to attack the UK armaments sector because of the UK’s supply of weapons to Ukraine (Source https://www.telegraph.co.uk/world-news/2026/08/25/russia-threatens-attack-british-factories-ukraine/).

There are now also increasing calls for an AI non-Proliferation Treaty, similar to the one that covered nuclear weapons.

“An AI non-proliferation treaty is a proposed international framework designed to restrict the development of dangerous frontier artificial intelligence, artificial general intelligence (AGI), or artificial superintelligence (ASI). Modelled after the nuclear Non-Proliferation Treaty (NPT), it seeks to cap global computing power (FLOPs), monitor high-end semiconductor supply chains, and mandate safety audits.” (Source https://www.nationalsecurity.ai/chapter/nonproliferation)

To my mind the above further strengthens the need for a global regulatory and governance framework.

Any form of control that helps society and business manage the evolving capabilities of AI will have an overall beneficial impact.  Will it stop the criminals/state actors? No.

Will it help us to improve the management of the impact of such incidents? Yes.

What companies and public-sector actors can practically do now, before regulation fully catches up

Organisation, both public & private should start to create robust governance structures and as the only enforceable is the EU AI Act, they should use this as the main benchmark. They should not wait for a universal standard or framework.

To create a more robust approach they should also incorporate those parts of NIST AI RMF and ISE/IEC42001.

Whist this may initially create what appears to be a lot of work, in the long-term it will

provide the governance structure and defensibility framework to help organisations of all size utilising AI both locally, nationally and internationally.

AI and its associated risks are growing at an unprecedented pace. For example, deep fake is now almost indistinguishable from the real thing and has already been used to extort money from organisations. In early 2024, Ove Arup & Partners fell victim to a $25 million deepfake fraud, when criminals utilised deep-fake video and audio to impersonate the company’s CFO and persuade an employee to transfer the funds. (source: https://www.weforum.org/stories/emerging-technologies/deepfake-ai-cybercrime-arup/)

• Those wishing to exploit AI vulnerabilities will do everything they can to benefit from them.
• Those organisations who, inadvertently/accidentally cause harm either at a commercial or personal level will have to face the reputational and legal consequences of their actions.

However, to wait until an internationally recognised and accepted regulatory framework arrives, would suggest poor risk management and poor governance.

Organisations owe their employees and users, be they individuals or other companies an implicit duty of care. When this duty of care is breached the consequences can be significant and include, but are not limited to:

• Reputational
• Regulatory (EU AI Act or regulatory bodies, such as the Law Society/OFCOM etc)
• Legal
• Financial
• Compliance

We should also note that in June 2026, Dario Amodei, co-founder of Anthropic, called for a universal moratorium on AI development as there is now a genuine fear that with AI increasingly writing its own code and bypassing humans whilst doing so, it could lead to a loss of control and create major threats and challenges before society and more importantly frameworks are ready to regulate them.

Sam Altman of Open AI has made similar points expressing support of slowing or pacing the rate of AI development.

Simply put; if the creators of some of the most advanced AI models in use are getting concerned, shouldn’t we?

Oh, and yes. I did use AI (MS Co-Pilot) in the creation of this document. I wrote it myself but used it as a source for certain areas of information.