Retail AI security is not a specialist model-risk problem or an IT problem, it is a business problem.
Organisations must consider AI security governance as an access, supplier and operational-control problem that boards and management need to govern before tools reach pricing, checkout and customer data.
The 30-second take
A RiverSafe-commissioned Censuswide survey of 200 senior cyber and information-security leaders at large UK retailers reported that nearly 60% had experienced an AI-related security incident with real-world impact in the previous year.
The useful response is not to freeze AI adoption, but to require an inventory, documented review, least-privilege access, supplier evidence, monitoring and tested incident response.
What the retail survey found
The August 2026 survey covered UK retailers with at least 500 employees and turnover of £250 million or more.
It reported that 99% of respondents faced pressure to adopt AI faster than governance and risk processes could keep pace, while 48% said that speed was already creating gaps.
99% of respondents faced pressure to adopt AI faster than governance and risk processes could keep pace
The control findings are more useful than the headline incident figure.
RiverSafe reported that 88% did not put every AI use case through a documented security review before launch, respondents estimated an average of about 10 AI tools operating without formal security approval, and only 52% said they had full control over what AI tools and agents could access without human sign-off.
This is supplier-commissioned survey research, so boards should treat the percentages as a risk signal rather than a census of the retail sector. Even so, the pattern is specific enough to test: unknown tools, broad access, incomplete reviews and supplier pathways are all matters an organisation can evidence internally.
The wider cyber baseline supports the warning
The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses had identified a cyber breach or attack in the previous 12 months, rising to 69% among large businesses.
That survey is not AI-specific, but it shows why AI should be integrated into established cyber governance rather than managed as a separate policy exercise.
The UK National Cyber Security Centre’s secure-AI guidance provides the control bridge.
It calls for security ownership, supply-chain assessment, asset tracking, access controls, incident procedures, logging and monitoring throughout the AI lifecycle.
This is not just a learning for retailers. For all organisations, that means every AI tool needs a named business owner and security owner, a clear record of the systems and data it can reach, and a decision on what happens when behaviour changes or a supplier fails.
What effective board oversight looks like
A board does not need a catalogue of technical model attacks. It needs evidence that management knows where AI is operating, has constrained privileges, can detect abnormal behaviour and can contain an incident without losing critical retail services.
Reporting should distinguish approved tools from discovered or unapproved use and show whether access has expanded since the original review.
Questions for boards and executives
- Can we identify every AI tool and agent operating across customer, pricing, checkout and workforce processes?
- What can each AI system access or change without human approval?
- Which use cases went live without a documented security and supplier review?
- How would we detect abnormal AI behaviour, data extraction or privilege expansion?
- Has our incident-response exercise tested the loss or compromise of an AI-enabled service?
Visit the Innovation of Risk Reading Room for practical board questions, readiness snapshots and governance tools that help turn AI-security concern into evidence-based action.