Putting AI into your risk management
Jun 25th, 2025 by Jesper Kråkhede
After EchoLeak, a question for management: does your risk management cover AI?
In many organisations, AI arrived through the back door. A feature in a product you already used, a pilot in a department, a tool someone bought with a credit card. It never went through the normal risk assessment.
AI brings some new risks, and some old ones in a new form. Data leakage, when sensitive information ends up in the wrong place or is used to train someone else´s model. Wrong answers that look right and are used for decisions. Prompt injection and manipulation, where the AI is tricked into doing something harmful. Bias and discrimination in decisions about people. Dependency on a few suppliers whose models you can´t inspect. And regulatory risk under the AI Act and GDPR.
The good news is that you don´t need a separate process. Use the risk management you already have. Make an inventory of where AI is used. For each use, assess what data it touches, what decisions it influences and what happens if it is wrong or manipulated. Decide on controls and owners. Review it regularly.
Frameworks can help. ISO 42001 is a management system standard for AI, and the NIST AI Risk Management Framework gives a structure for the assessment.
AI isn´t a special case outside your risk management. It is just another system that can fail in new ways.