Operational resilience

AI risk management is more than compliance—it requires integrated oversight of privacy, security, and ethics to protect customers and uphold trust. Business leaders must embed these considerations early to avoid harm and accelerate responsible AI adoption.

Researchers allege OpenAI agents uploaded hundreds of malicious packages to RubyGems in May 2026, before a later intrusion involving Hugging Face. The incidents show why AI agent security requires stronger containment, monitoring and accountable governance.

NIST’s August 2026 TEVV-Athlon draft makes real-world AI evaluation a current governance issue. Businesses should connect every test to pre-agreed acceptance thresholds, a named decision owner and clear retest triggers.

ASD’s Australian Cyber Security Centre and the UK National Cyber Security Centre show why AI supplier assurance must cover the full lifecycle and extended supply chain. Moffatt v Air Canada demonstrates that business accountability remains with the organisation using the automated service.

The US GAO’s Equifax findings show how a missed vulnerability becomes a business crisis when identification, detection, segmentation and data governance also fail. ASD, CISA, NIST, NCSC and APRA guidance show why leaders must connect continuous vulnerability assessment to critical services, accountable decisions and tested recovery.

RiverSafe’s Censuswide survey of 200 senior security leaders at large UK retailers reported AI-related incidents, unapproved tools and incomplete security reviews. The UK Government’s Cyber Security Breaches Survey and NCSC secure-AI guidance show how boards can convert that warning into access, supplier, monitoring and incident controls.

The UK Information Commissioner’s Office expects AI transparency and supply-chain due diligence to evolve as processing purposes become clearer. NIST’s AI Risk Management Framework shows how privacy risk should be documented, measured and monitored throughout the AI lifecycle.

Microsoft Azure AI Foundry and Amazon Bedrock show how model retirement can shorten notice periods, stop requests and require code changes. The EU's DORA framework shows why notification, objection and exit rights must connect to a tested operational response.