Operational resilience

Unclear ownership and weak third-party evidence can stall AI initiatives for months. This article explains why business-led accountability and structured evidence checklists are critical to smooth AI risk management and faster decision-making.

Germany's data regulator fined Vodafone €45 million partly for failing to vet a third-party partner, a 2026 DataGrail report found 64% of AI vendors hide their subprocessors, and a German court has ruled companies — not their AI vendors — are liable when the tool gets it wrong. Three real 2026 examples show why vendor assurances can't substitute for your own verification.

The UK's new Critical Third Parties regime — covering AWS, Microsoft, Google Cloud and Oracle — signals that strong AI vendor oversight is becoming the new baseline for trust. Organisations that build this capability now, ahead of the curve, stand to gain faster vendor decisions, stronger customer confidence and far fewer surprises.

New Diligent Institute / Governance Institute of Australia data shows 61% of Australian boards restrict employee AI use while only 13% have an AI-literate director — proof that restriction and real governance are pulling apart. NIST's expanding AI Risk Management Framework and the EU AI Act's 2 August 2026 third-party accountability deadline show how structured, evidence-based workflows are what actually let AI adoption move faster, safely.

APRA has released final targeted amendments to CPS 230 Operational Risk Management. The item is current and sits within APRA’s prudential framework, so boards and risk teams should treat it as a live governance and…

Grant Thornton's 2026 AI Impact Survey, the AICD/HTI Director's Guide to AI Governance, and a March 2026 Meta AI agent incident all point the same way: organisations scaling AI without a standardised, risk-based assessment framework can't explain or defend their decisions when it matters.

Traditional model risk management falls short for AI. Executives and risk managers must recognise AI model risk as a distinct challenge requiring tailored governance, deeper vendor scrutiny, and proactive controls to protect value and trust.

HM Treasury's move to designate AI providers as UK critical third parties, a German court ruling that made a chatbot's words the company's legal liability, and the Character.AI/Google settlement all show the same pattern: vendor AI risk is now the deploying organisation's problem, not the vendor's. Here's what boards and risk teams need to check before the next case names them instead.