Beyond the Algorithm: AI Risk, Regulation and (Re)invention
AI has rapidly evolved from a technical issue to a board-level governance priority that is fundamentally reshaping enterprise risk oversight and leaving boards facing a central tension: While AI-driven innovation is potentially transformative, it can also introduce novel vulnerability and expose existing weaknesses.
Meta Director of Public Policy, Molly Montgomery, framed AI not as a standalone risk, but as force multiplier across existing risk categories. She cautioned that attempts to “check the AI box” through static approaches to governance and risk management or generic best practices may create false confidence instead of meaningful oversight.
The discussion highlighted the growing collision between technology and geopolitics. AI development, semiconductor supply chains, cloud infrastructure, export controls, and data governance are increasingly intertwined with geopolitical competition and national security concerns.
Cybersecurity was identified as an immediate AI-related risk. AI is accelerating both offensive and defensive cyber capabilities, lowering barriers for malicious actors while increasing pressure on organizations to continuously strengthen monitoring, testing and response capabilities.
Regulation alone will not provide clarity or protection in the near term. Effective governance in an AI-enabled world depends less on having perfect information and more on cultivating continuous learning, asking better questions, challenging assumptions, and integrating AI oversight into broader enterprise risk management. This requires boards to demonstrate discipline, continuous assessment, openness to external expertise, structured prioritization and persistent curiosity.
The challenge facing boards today is not whether AI will transform organizations, it is whether governance structures can evolve quickly enough to identify risks early, challenge assumptions effectively, and guide organizations strategically through uncertainty.
THE GOLDILOCKS PROBLEM
AI is both the greatest risk and greatest opportunity facing organizations today. Some refer to this as a “Goldilocks problem” because it is challenging for organizations to get it just right. Moving too quickly may expose organizations to significant vulnerabilities, while moving too slowly risks competitive irrelevance.
This dichotomy reflects a broader AI governance paradox. Organizations are under pressure to innovate, adopt AI tools and demonstrate measurable progress, yet governance structures often struggle to keep pace with the speed of technological change. As a result, boards increasingly find themselves balancing innovation oversight with risk mitigation in real time.
FROM BUZZWORD TO ENTERPRISE RISK
AI has risen from buzzword to board priority seemingly overnight. It is embedded across nearly every enterprise function and risk category, simultaneously and fundamentally reshaping enterprise risks and opportunities.
The following interconnected dimensions are particularly relevant:
- Strategic risk—falling behind competitors or misaligning AI investments with enterprise strategy
- Operational risk—deployment failures, flawed models, poor integration or process disruption
- Human capital risk—talent gaps, workforce readiness and change management challenges
Claims that an organization has “adopted best practices” may signal overconfidence rather than preparedness. Treating AI-related risk management as a “check-the-box” exercise can lead to a fragmented or overly simplified approach. Participants were instead encouraged to integrate AI oversight into broader enterprise risk management processes.
Given the accelerated pace of technology disruption, even when integrated into enterprise risk management processes, traditional frameworks and static models that silo AI as a technology risk or an isolated line in a risk matrix are insufficient to identify and manage interconnected and enterprise-wide AI-related risks and opportunities.
Effective AI governance and oversight requires boards and risk management teams to shift toward more adaptive, interdisciplinary and forward-looking approaches.
REGULATION WITHOUT CLARITY
The current patchwork of overlapping regimes, outdated frameworks and geopolitical competition has created an AI regulatory environment defined by operational complexity and strategic uncertainty. More than 1,000 AI-related state bills are under consideration in the U.S. and comprehensive federal AI regulation is unlikely in the near term.
A mix of international approaches creates further complexities. The EU’s regulatory frameworks were largely designed before generative AI advances and may not align with current technological realities. China maintains state-controlled AI models and approval systems shaped by censorship and national security priorities.
Critically, participants agreed that regulation will not provide timely or sufficient clarity. Boards must act in its absence by designing governance processes capable of adapting continuously as technology and regulatory dynamics evolve.
WHEN MEGAFORCES COLLIDE
Technologies emerge and evolve within geopolitical context, making the two increasingly inseparable as companies navigate the complexities of AI adoption and boards grapple with its oversight.
It is essential for boards to understand the impacts of geopolitics and other megaforces shaping AI’s evolution and their potential impacts including:
- Increased regulatory and reputational risks created by fragmented global policies on cybersecurity and data privacy
- Financial and economic risks arising from policies that affect energy prices and trade costs
- Supply chain, financial and business continuity risks resulting from sovereign competition for essential inputs such as computing power, data, energy, water and talent
- Strategic and operational risks emerging from shifting geopolitical tensions
- Compliance risks associated with third-party providers and open-source models
Boards were encouraged to integrate geopolitical analysis into board discussions and leverage internal or external expertise capable of monitoring and evaluating emerging dynamics. Geopolitical risks can materialize rapidly and often with little warning, however, they are knowable, increasingly material, and should be viewed as core to enterprise risk oversight and strategic planning.
TAIL RISKS AND NORMALCY BIAS
The convergence of technological disruption and geopolitics is expanding the range and severity of low-probability, high-impact events or “tail risks” including:
- AI-enabled warfare including quantum cryptography breakthroughs that threaten existing encryption systems
- Data security and infrastructure vulnerabilities
- Bioterrorism risks
- Misuse of open-source AI models by foreign actors
- Cascading supply chain failures triggered by geopolitical instability
Normalcy bias—the tendency to discount unlikely but catastrophic scenarios—can create dangerous governance blind spots including underestimating how geopolitical tensions could escalate across business operations.
For example, conflict between China and Taiwan could simultaneously disrupt semiconductor supply chains, cyber infrastructure, manufacturing capacity, shipping, connectivity and global economic stability. Although a China-Taiwan conflict is a known risk, participants acknowledged that few companies are sufficiently prepared for its reality.
The conversation emphasized the need for boards to confront normalcy bias, think seriously about tail risks, and actively challenge management assumptions, especially about risks that cut across silos and have the potential to compound and amplify one another.
FROM OVERSIGHT TO INQUIRY
The pace and complexity of AI-related disruption requires that boards shift focus from oversight to inquiry and increasingly depend on directors’ mindsets rather than their skill sets. While directors are not expected to have all the answers, they should be willing and able to ask informed, strategic questions such as:
- How is AI embedded across operations and enterprise risk?
- What guardrails govern data access, open-source model use and third-party risk?
- How are geopolitical and cybersecurity risks incorporated into strategic decision making?
- What assumptions are we relying on that may no longer be relevant or true?
AI-ENABLED CYBERSECURITY
Few areas illustrate AI’s dual nature more clearly than cybersecurity, where AI is transforming both offensive and defensive capabilities. Offensively, AI lowers the barrier to entry for bad actors, automates vulnerability detection, and enables increasingly sophisticated phishing and deepfakes. At the same time, AI can be used defensively to strengthen monitoring, automate threat detection, and scale cybersecurity operations.
The challenge is asymmetrical; attackers only need to succeed once while defenders must succeed every time. This puts constant pressure on organizations to stay ahead of new vulnerabilities, and to actively invest in and deploy defensive systems.
As AI continues to accelerate the pace at which cybersecurity vulnerabilities emerge and evolve, oversight cannot rely on static controls or annual reviews. Boards are encouraged to increase the frequency of audits, penetration testing and risk assessments.
To ensure management remains proactive rather than reactive, boards should ask questions such as:
- Are cybersecurity teams implementing and leveraging the latest technologies as effectively as adversaries?
- Are AI-enabled vulnerabilities being tested continuously?
- Are teams continuously testing for and patching AI-detected vulnerabilities?
- What public-private information sharing and reporting mechanisms exist for escalating emerging threats?
- How will the organization manage AI-enabled vulnerabilities that evolve faster than traditional controls?
- Are compliance standards and audits for third-party vendors and models adequate?
No organization can predict every scenario; however, boards must ensure that processes exist to continuously evaluate geopolitical risks, reassess assumptions and identify vulnerabilities before they become crises. Scenario planning, tabletop simulations and readiness assessments can build resilience and prepare organizations for systemic disruption.
THE MORE YOU KNOW
Several suggestions emerged for ways to empower directors to ask better questions and foster more meaningful boardroom dialogue around AI governance and the convergence of technology and geopolitics including:
- Expand board expertise by recruiting non-traditional candidates with subject matter expertise and emphasize relevant board education and training for all directors. Participants stressed the utility of hands-on learning, especially joint board-management experiences.
- Incorporate geopolitical analysis into risk oversight and monitor continuously rather than periodically. Empower internal subject matter experts and risk functions to conduct more frequent audits and vulnerability testing without relying on static risk frameworks or compliance checklists.
- Leverage external advisors and subject matter experts to help monitor and interpret emerging developments and constructively challenge management assumptions. Few organizations possess all necessary experience and knowledge internally. Even those who do would benefit from incorporating an outside-in perspective.
- Focus board meetings on emerging rather than routine risks. Include AI and geopolitics as standing board agenda items and ask informed, strategic questions.
Participants were encouraged to reject static complacency in favor of curiosity and continuous learning. One participant observed, “Boards that think they already have all the answers are often the most vulnerable.
KEY TAKEAWAYS
- There is no steady state for AI governance. Effective oversight requires boards to embrace continuous learning, heightened oversight, iterative risk assessment and external expertise.
- AI amplifies existing risks across the enterprise risk landscape. Effective governance requires it to be integrated into broader risk management processes.
- AI adoption is a “Goldilocks problem.” Moving too quickly may expose organizations to significant vulnerabilities, while moving too slowly risks competitive irrelevance.
- Cybersecurity risk has become increasingly asymmetrical as AI strengthens both offensive capabilities and defensive monitoring tools.
- Technology and geopolitics are now inseparable, reshaping supply chains, cybersecurity, infrastructure, and strategic planning simultaneously.
- Normalcy bias causes organizations to underestimate tail risks and can create dangerous governance blindspots.
Additional Resources
