In the Era of Generative AI, Establish a ‘Risk Mindset’

Generative AI changes the management problem as much as the technology problem. The central issue is no longer whether risk teams can spot a threat, but whether leaders have clear decision rights for when an AI use case is approved, paused, or withdrawn. CIOs and risk leaders need a visible operating model that defines who owns model selection, data use, monitoring, escalation, and sign-off across business and technology functions.

The trade-off is speed versus control. If every use case is slowed by central review, adoption will move to shadow channels; if controls are too loose, the business inherits hidden exposure from data leakage, prompt abuse, third-party dependencies, and poor auditability. The practical answer is to tier use cases by risk, with lighter approval for low-impact experimentation and stricter governance for customer-facing, regulated, or decision-making applications. That makes risk appetite an operating constraint, not a slogan.

This also has portfolio implications. Organizations should not fund generative AI as a generic innovation wave. The better question is which initiatives materially improve resilience, compliance, detection, or recovery, and which simply add novelty. Leaders should ask for metrics that connect investment to outcomes: fewer policy exceptions, faster control testing, reduced manual review, improved incident response, and clearer accountability for vendor and model risk.

The workforce challenge is equally important. A risk mindset only works if product teams, engineers, procurement, legal, and operations know what “good” looks like in practice. The next questions for executives are: where will decision rights sit, what thresholds trigger escalation, which skills are missing, and how will the organization prove that controls are actually operating at the pace of AI adoption?

While the advent of generative AI brings countless opportunities for innovation, it also comes with significant potential for increased risks, particularly for software and platforms companies responsible for securing data for both B2B customers and millions of consumers around the world. From AI-enabled deep fakes and sophisticated social engineering to evolving data risks, the stakes are higher than ever. As part of Accenture’s latest global risk study, over eight in 10 risk professionals say complex, interconnected risks are emerging more quickly, mentioning that operational risks, financial risks, and disruptive technology risks have grown in the past couple years. To keep up with evolving threats, software and platforms companies must establish a “risk mindset” across their entire organization so that every function and employee has the tools and capabilities to detect and mitigate threats.

Make the Right Bets on Emerging Tech

Businesses need to accelerate the adoption of emerging technologies that can improve their ability to quickly identify, assess, and mitigate risks across the business. Technologies like generative AI, advanced data processing, and analytics will be critical to the next generation of risk management. Overall stronger capabilities in data collection and analysis help support enterprise reinvention while helping the business push the envelope on growth and innovation by understanding their risk profiles more deeply and designing compensating systems to manage it. Related:Generative AI, the Digital Divide, and the Tremendous Opportunity
  • 49% of software and platforms respondents say the impact of disruptive tech risks rose most since 2021
  • 57% of risk leaders say that investing in new technology for the risk team is a top-three priority
  • 96% of the top performing risk leaders are urgently improving their ability to collect enterprise-wide data, compared with 59% of the ones lagging.

Maximize Agility

Because risks are emerging faster than ever, risk teams must be able to move more quickly. This means they need the tools, data, people, business relationships and partnerships that enable a rapid response. Maximizing agility for the risk function means pivoting it to the role of business enabler by providing data-backed insights into the real risks (or lack thereof) associated with a particular strategy. By accelerating the automation of controls and decision-making, using advanced analytics to drive finer insights or building more robust ways to measure and report on new and emerging risks, the risk function paves the way for a more efficient and forward-looking business. Related:Is Innovation Outpacing Responsible AI? Decommissioning legacy applications is another way in which risk management provides added benefits by improving the interoperability of a company’s modeling estate while reducing costs. Our research found that organizations that prioritize risk management are far more agile than their peers. They are nearly 4X more likely to say they are very agile when it comes to using cloud platforms, tools, and services to rapidly executive risk processes when compared to companies that are lagging in modernizing their risk function.

Make Risk Everyone’s Business

It is imperative that risk leadership works with the C-suite to build a risk culture and mindset across functions. Risk mitigation is almost always about the weakest link and all employees need to understand that they are all responsible for managing risk and that risk is part of everyone’s role. Function-wide collaboration across risks topics helps manage the company’s risk appetite and focus, turning risk management into a critical enabler of business resilience and growth rather than an obstacle. The most advanced software and tech companies place risk ownership and management as close to value-creation as possible. This means that risk management is better informed by on-the-ground insights about what is needed for the business to grow. Related:How CEOs and IT Leaders Can Take the Wheel on Responsible AI Adoption To achieve this pivot, it is critical that risk leaders be equipped with the right sets of skills. From understanding the business and its intricacies to being trained on the latest technologies and data management capabilities, risk leadership needs an extended knowledge base that will empower them to assess threats, educate employees, and drive change.
  • 57% of risk leaders are “very satisfied” with their business’s ability to develop the skills needed to detect and mitigate risk, compared with only 27% of the less mature group.
  • 51% of risk leaders say bringing new skills into the function is a top priority, compared with 24% of the less mature group.

Risk Is Everywhere

Across geographies and industries alike, businesses are facing an unprecedented range of varied business threats, yet most are not prepared to address them properly. Their lack of focus on risk across the business opens vulnerabilities and stems their growth. To get ahead of such threats, it is imperative to establish capable risk leaders and empower them with the knowledge, capabilities and authority to lead and turn potential disruption into opportunities for improved resilience and growth.
Original Post

Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.