Is AI a new source of risk or a new way to manage it? In a recent survey of risk managers produced by the Federation of European Risk Management Associations (FERMA) and PwC, the answer to both questions is yes.

The survey, which drew responses from more than 1,300 risk managers across 79 countries, found that AI use is a top-five risk across the next 12 months, three years, and ten years. No other risk appears in the top five across all three periods. Nearly half of respondents (46%) point to AI as an inadequately managed risk, ten points more than any other risk.

These findings highlight that AI risks are now viewed as enterprise-wide threats, rather than purely technology risks. Concerns include, for example, governance, accountability, cyber security, data privacy and sovereignty, ethics and compliance, misinformation, regulatory compliance, and decision-making.

Yet AI is also a growing means of addressing many organizational risks and managing the cost of control. Among respondents, 46% are already using AI at scale, widely, partially, or in a pilot phase, and another 21% plan to. The most common applications are in operational and data-intensive areas, notably to automate risk processes and to detect anomalies (‘risk sensing’).

To help organizations improve their overall risk management capabilities—including addressing AI risks and using AI more effectively within the risk function—the report points to four priorities:

Mind the gap regarding data. Understand what risk data is available in your organisation’s ecosystem, including how it gets collated, who validates it, who receives it, and what decisions it supports. As organisations become increasingly connected, consistent, transparent risk data is important in helping to avoid blind spots.

Strengthen collaboration. Assess how the teams in your organisation work together, including risk, control, compliance, investor relations, insurance, and internal control functions. Are they all pulling in the same direction? Can risk managers improve cross-functional engagement and coordination?

Connect strategy and resilience. Strategic risk and operational resilience are sometimes addressed separately, but they're two sides of the same coin: operational resilience is a key strategic priority. Ensure that resilience is built into strategy, with processes to stress test it and mechanisms for crisis management. These include ‘what if’ simulations to assess the organisation’s ability to absorb shocks or deal with unintended outcomes arising from new technologies.

Encourage innovation. Review your risk appetite and innovation culture, particularly around AI and tech adoption. Are there opportunities to pilot new ways of analysing, quantifying, or reporting risk data with AI, or to automate (or remove) manual processes? Risk managers should foster a culture that supports controlled experimentation and learning.