AI is now built into the systems boards are accountable for, including tools they may not know exist. Each part of it – data, models, agents and the technology that links them – opens up a different cyber risk.
This board briefing sets out what recent incidents reveal, what regulators expect, and how one seemingly harmless AI incident can quickly escalate into a firmwide crisis. The aim is practical: to help directors ask the right questions and show they have appropriate control.
Inside the briefing:
- Mapping the Risk: Understand the four layers of an AI system and why each one needs its own owner and controls.
- Real-World Incidents: Learn what the cases at Samsung, GitHub Copilot, Replit and Arup tell boards about AI risk.
- Agents and Regulators: Review what the NIST AI Risk Management Framework and the EU AI Act expect, including penalties of up to 7% of global turnover.
- Scenario – The Poisoned Agent: Follow a fictional AI incident from a subsidiary’s HR help desk all the way to the parent company’s boardroom.
- ISO/IEC 42001 Gap Analysis: See how the scenario measures up against the nine control areas of the international AI management standard.
- Questions for the Board: Take away practical questions to put on the agenda for your next board meeting.
