Summary
AI can accelerate work, but people remain accountable for the decisions and outcomes it influences. To manage AI risk, leaders should identify consequential uses, establish clear ownership and human oversight, and align governance, vendor contracts, and insurance coverage. Cross-functional collaboration among risk, compliance, legal, HR, IT, and business teams helps prevent gaps as companies grow.
Over the past month, I joined two panels on risk and compliance at Sequoia’s Grove Conference, first in New York alongside my colleague Joanna Castillo, VP of Compliance at Sequoia, and Stacy Barrow, Partner at Barrow & Lent LLP, and later in San Francisco with Joanna and Sheldon Blumling, Partner at Fisher Phillips. Across both conversations, Joanna brought the compliance lens, our legal partners added their perspectives on evolving requirements and risk, and my focus was on how those inputs fit into a broader risk-management strategy.
We covered AI, workforce change, fiduciary responsibility, expansion, and the many ways risk shows up inside a growing organization.
But across those conversations, one idea kept resurfacing. Companies are moving faster because they have to. They’re adopting new tools, entering new markets, supporting distributed teams, and using more data to make decisions than ever before.
That speed can be a strength. The trouble starts when it’s no longer clear who owns the decision or the risk that comes with it.
During the panel, I joked that I don’t want risk to be seen as the “Department of No.” I want it to be the “Department of Know.” As in, know what decision we’re trying to make. Know who owns it. Know what could happen if we get it wrong.
That mindset is becoming more important as AI becomes part of everyday business operations.
The Risk and Compliance Partnership
Risk and compliance are closely connected, but they serve different purposes.
Compliance helps answer the question, “Are we meeting our regulatory obligations?” Companies need to understand the rules that apply to their business, workforce, vendors, and benefit plans.
Risk management looks at the broader picture. What could go wrong? Who would be affected? How would the company respond? Would insurance apply? Could the issue create financial, operational, legal, or reputational exposure?
A company can meet a technical requirement and still face meaningful risk. That’s why risk and compliance need to work together. Compliance provides the foundation. Risk management helps leaders understand what needs to be protected as the company grows, adopts new tools, and changes how decisions are made.
AI Changes the Scale of Mistakes
AI can be incredibly useful. I use it myself. For example, it can help me build the first version of a PowerPoint deck so I’m not starting from a blank page. But I still review it, edit it, and decide what stays.
The risk changes when AI moves from helping with the work to influencing decisions at scale.
In the past, a process error might have affected one employee, claim, or transaction. When AI is applied across a larger population, that same error can reach hundreds or thousands of people before anyone realizes there’s a problem.
The stakes rise when AI touches hiring, performance management, compensation, benefits administration, claims review, eligibility determinations, or other processes that affect people directly. These decisions can influence access, trust, money, and sometimes the company’s legal obligations.
AI may help teams work faster, but the company still owns the outcome.
Human Judgement Must Stay in the Process
The more an AI-enabled process affects people, access, money, or obligations, the more important it is to have a human checkpoint, clear ownership, and documentation.
That doesn’t mean AI can’t be used in consequential areas. Leaders need a clear governance framework around it.
Companies should know where AI is being used, what data is going into the tool, who reviews the output, when to involve compliance or legal, and who owns the final decision.
That may sound simple, but those answers often aren’t documented in one place. That’s where exposure builds.
Insurance Programs Need to Keep Pace
Companies shouldn’t assume their existing policies automatically cover every AI-driven risk. Depending on how AI is being used, leaders may need to review cyber, errors and omissions, employment practices liability, fiduciary liability, directors and officers liability, and general liability coverage.
Some policies may include endorsements, limitations, or exclusions related to AI. Others may not clearly address it yet. That ambiguity is important to watch.
If an AI-enabled process contributes to a benefits eligibility error, a hiring-related allegation, or a customer-facing mistake, leaders should understand who’s responsible and whether coverage may apply. The time to answer that question is before there’s a claim.
Contracts need the same attention. If a vendor is using AI in a process that affects employees, customers, data, or operations, the contract should help clarify how the technology is being used and where responsibility sits.
Risk Builds in the Handoff
Most companies don’t create risk because people are careless. Risk often appears in the handoff, when one team’s decision creates exposure for another team that wasn’t involved early enough.
For example, a business team may roll out a new AI-enabled HR tool to improve efficiency, only to realize later that no one confirmed what employee data the vendor can access or whether the tool affects employment-related decisions.
Everyone is moving quickly and focused on solving their part of the problem. When no one owns the full picture, gaps appear.
I see the same pattern outside of AI. A company may expand into a new state or country before confirming whether its benefits, workers’ compensation, payroll, or insurance programs still align with the way the business now operates.
These aren’t always dramatic failures. They’re often small disconnects that become expensive when they affect employees, claims, coverage, compliance, or trust.
That’s why modern risk management has to be cross-functional. Risk, compliance, legal, HR, IT, finance, and business leaders each see a different part of the picture. Risk is a team sport, and everyone needs to understand the role they play.
What Leaders Should Do Now
If you can only focus on a few things this year, here’s where I’d start.
First, map consequential AI use. Identify where AI touches people, money, access, sensitive data, or business-critical decisions. Include informal uses as well as approved enterprise tools.
Second, clarify ownership. Every AI-enabled process that affects people, money, access, or obligations should have a clear business owner. That owner doesn’t need to do everything alone, but they should know when to involve legal, compliance, IT, security, HR, finance, procurement, or risk.
Third, review governance, contracts, and insurance together. AI policies, vendor agreements, data controls, and insurance coverage should tell the same story about ownership and response. That alignment is where risk and compliance can work most effectively together.
The goal isn’t to slow the business down. It’s to help leaders make informed decisions about the risks they choose to take.
AI can automate work, accelerate analysis, and make teams more efficient. But accountability still belongs to people. Risk management helps leaders move faster without losing sight of what they’re responsible for protecting.
FAQs
What is the difference between risk management and compliance?
Compliance focuses on meeting regulatory obligations. Risk management considers broader financial, operational, legal, and reputational exposure, including what could go wrong, who could be affected, and how the company would respond.
Who is accountable for AI-driven business decisions?
The company remains accountable for outcomes, even when AI helps make or inform a decision. AI-enabled processes that affect people, money, access, or obligations should have a clear business owner and appropriate human oversight.
What should an AI governance framework include?
Companies should document where AI is used, what data goes into each tool, who reviews its output, and who owns the final decision. The framework should also establish when to involve compliance, legal, and other relevant teams.
Does existing business insurance cover AI-related risks?
Companies should not assume their existing insurance covers every AI-related risk. Coverage depends on how AI is used and the policy’s terms, including any relevant endorsements, limitations, or exclusions. Leaders should review coverage before a claim occurs.
How can cross-functional handoffs create risk?
Risk can arise when one team’s decision creates exposure for another team that was not involved early enough. For example, introducing an AI-enabled HR tool without reviewing employee data access or expanding into a new market without checking benefits and insurance requirements can leave gaps in responsibility and protection.
What steps should leaders take to manage AI risk?
Start by identifying consequential AI uses, including informal tools, and assigning clear business ownership. Then review AI governance, vendor contracts, data controls, and insurance coverage together so they align on responsibility and response.
Last Updated:
