Artificial Intelligence (AI)

This piece looks at the questions Australian business and risk leaders should be asking before their own AI model drifts

AI failures can disrupt critical operations and amplify risks. Boards and executives must move beyond compliance to embed AI resilience as a strategic priority, focusing on clear ownership, continuous monitoring, and agile response capabilities.

Deloitte's 2026 State of AI in the Enterprise research and KPMG's Global AI Pulse survey show a widening gap between AI governance intent and board-level readiness, while the EU AI Act's August 2026 self-assessment requirement turns internal best practice into a filed, auditable record. This post asks whether your organisation's AI risk self-assessment is a live decision tool or just a document that says one exists.

APRA's April 2026 letter named third-party AI risk as the biggest gap in bank and insurer oversight — and weeks later, a compromised account at AI tooling vendor Context.ai gave attackers a path into Vercel's infrastructure. This piece uses both to show why vendor assurance paperwork isn't AI risk management, and what to ask instead.

Generic vendor privacy assessments couldn't have flagged what happened at MediSecure or Latitude Financial — and that's the problem. This piece uses real breach and enforcement outcomes to show why a signed-off checklist isn't AI privacy control, and sets out the questions every organisation should be asking its AI vendors now.

When Air Canada's chatbot invented a bereavement discount, a Canadian tribunal made the airline pay $812.02 for it. New data from the Cyber Risk Institute's Treasury-backed AI framework and Ncontracts' 2026 Third-Party Risk Management Survey show why every organisation using vendor AI needs the same accountability before the mistake is theirs.