The application of artificial intelligence to risk management functions has expanded rapidly, accelerated by the public availability of large language models and the integration of AI capabilities into enterprise platforms. Risk professionals are using AI tools — in some cases without organisational policy, in some cases without full understanding of their capabilities and limitations. The question of what AI can and cannot do in risk management, and what that means for accountability, is one that practitioners and their organisations need to address explicitly rather than by default.
What AI Can Do Well in Risk Management
AI is genuinely useful for certain risk management functions. Information processing and synthesis — reviewing large volumes of text, extracting relevant information, identifying patterns across datasets — is an area where AI tools provide significant efficiency gains. A practitioner who previously spent four hours reviewing regulatory developments, incident reports, and news feeds can accomplish the same information gathering in a fraction of the time with well-configured AI assistance.
AI can also assist with documentation tasks — drafting risk assessments from templates, generating structured reports from unstructured inputs, producing consistent formatting across large document sets. These are productivity gains that are real and material for risk teams that are resource-constrained.
Anomaly detection in structured data — identifying unusual patterns in access logs, transaction data, or operational metrics — is an area where machine learning models have demonstrated genuine capability, particularly in cybersecurity and financial crime risk management. The pattern recognition capability of well-trained models in these domains exceeds human capacity for large-scale continuous monitoring.
What AI Cannot Do
AI cannot make judgements that require contextual wisdom — the accumulated understanding of how organisations, humans, and risk environments actually behave that comes from long experience in complex situations. A large language model can produce a plausible-sounding risk assessment. It cannot draw on a felt sense of when a situation is genuinely dangerous versus when it only appears so. It cannot weigh the political dynamics of an organisation's internal environment against a risk communication challenge. It cannot tell you when a risk manager is being managed rather than informing.
AI cannot be accountable. This is perhaps the most important limitation for risk professionals. When an AI-assisted risk assessment contributes to a decision that results in harm, the question of accountability returns to the human — the practitioner who used the tool, the organisation that adopted it, the decision-maker who relied on it. AI tools do not sign off on expert reports. They do not testify in court. They do not bear the professional consequences of poor judgement. The accountability remains human, regardless of how much of the process has been automated.
AI hallucination — the generation of plausible-sounding but factually incorrect information — is a material risk in any risk management application. An AI tool that confidently cites a regulatory requirement that does not exist, or attributes a statistic to a source that does not contain it, creates the risk of decisions made on false foundations. Practitioners who do not verify AI-generated content against primary sources are not managing this risk. They are accepting it without understanding it.
The Accountability Framework
The emergence of AI in professional practice creates an accountability question that regulators, courts, and professional bodies are beginning to address. The current position in most jurisdictions is clear: the professional who uses an AI tool is accountable for the outputs of that tool as if they were their own work product. Using AI assistance does not reduce the professional standard expected. It does not transfer accountability to the AI provider. It does not excuse errors that a competent practitioner reviewing the output should have caught.
This accountability framework has significant implications for risk practitioners. It means that AI assistance must be accompanied by genuine professional review — not a rubber stamp that the AI's output looks plausible, but substantive engagement with the content sufficient to identify errors, gaps, and inappropriate conclusions. For practitioners who lack the depth to review the AI's output in a specialist area, using AI assistance in that area is professionally risky.
Organisational Policy
Many organisations have lagged the actual use of AI tools by their staff. Practitioners are using publicly available AI tools for risk management work — sometimes with organisational-confidential information — without clear guidance on appropriate use, data handling, and quality standards. This gap between actual practice and organisational policy is itself a risk management failure.
Organisations that have not developed clear AI use policies for their risk management functions are accepting risks they probably have not assessed. What information is being shared with external AI platforms? What quality assurance process applies to AI-assisted outputs? What disclosure standards apply when AI has contributed to a risk assessment or a professional opinion?
These are not hypothetical future concerns. They are operational risks that are active now. The pace at which AI capability is being integrated into professional practice significantly exceeds the pace at which governance frameworks are being developed. That gap is, itself, a risk management problem.
Tony Ridley provides advisory on AI risk governance, risk management programme design, and practitioner capability development. Contact us to discuss your requirements.