AI risk management

The FCA's 2026 AI Live Testing cohort and Supercharged Sandbox show how Barclays, Experian, Lloyds Banking Group, UBS and other firms are building evidence through controlled testing. NIST's tailorable AI RMF Playbook provides a practical basis for proportionate triage.

The Air Canada chatbot decision shows why organisations remain responsible for automated outcomes. The AICD and Human Technology Institute's 2026 Director's Guide adds practical board questions for assigning AI decision rights and oversight.

Deloitte's 2026 State of AI in the Enterprise research and KPMG's Global AI Pulse survey show a widening gap between AI governance intent and board-level readiness, while the EU AI Act's August 2026 self-assessment requirement turns internal best practice into a filed, auditable record. This post asks whether your organisation's AI risk self-assessment is a live decision tool or just a document that says one exists.

APRA's April 2026 letter named third-party AI risk as the biggest gap in bank and insurer oversight — and weeks later, a compromised account at AI tooling vendor Context.ai gave attackers a path into Vercel's infrastructure. This piece uses both to show why vendor assurance paperwork isn't AI risk management, and what to ask instead.

When Air Canada's chatbot invented a bereavement discount, a Canadian tribunal made the airline pay $812.02 for it. New data from the Cyber Risk Institute's Treasury-backed AI framework and Ncontracts' 2026 Third-Party Risk Management Survey show why every organisation using vendor AI needs the same accountability before the mistake is theirs.

Unclear ownership and weak third-party evidence can stall AI initiatives for months. This article explains why business-led accountability and structured evidence checklists are critical to smooth AI risk management and faster decision-making.

A NSW Reconstruction Authority contractor uploaded flood victims' personal data to ChatGPT in 2025, echoing Samsung's 2023 source-code leak. New 2026 survey data shows most staff still use unsanctioned AI tools — here's what boards should do about it.

ASIC and APRA now both expect a named accountable person behind every material AI use case, not a shared committee. This post looks at what Beware the Gap, APRA's April 2026 letter to industry, and a real AI hiring-platform ownership failure mean for boards before the regulator asks who was responsible.