By Fabio Accardi
Governance, Risk & Compliance Advisor | Adjunct Professor
Risk Management is undergoing a profound transformation. Markets, organizational models and value chains are becoming increasingly complex, and artificial intelligence is now adding another factor that is set to reshape, at a structural level, the way organizations identify, assess and manage risk.
AI is more than just another technology available to risk managers. Its ability to process large volumes of data, identify correlations, detect anomalies, make predictions and generate content can affect the entire risk management process. At the same time, AI introduces new vulnerabilities and responsibilities, including data quality and provenance, model reliability, transparency in decision-making, cybersecurity, the protection of rights and the adequacy of governance arrangements.
The key issue, therefore, is not whether artificial intelligence will become part of Risk Management, but how organizations will integrate it while maintaining accountability, control and sound judgment.
Opportunities offered by AI: from a static approach to dynamic and integrated risk management
Traditionally, many Risk Management activities rely on historical information, periodic assessments, risk-impact matrices, indicators and professional judgment. These tools remain essential, but they may be less effective in environments characterized by rapid change and highly interconnected risks.
Artificial intelligence can help make the process more continuous, predictive and adaptive. It can analyze structured and unstructured data, detect weak signals, support risk quantification, identify correlations that are difficult to capture with traditional tools, and improve the timeliness and quality of reporting.
The following table summarizes how this change may affect the main stages of the Risk Management process.
| Risk Management Process | Traditional approach | AI-enhanced approach | Main benefits |
| 1. Risk identification | Historical analysis, expert judgment and manual reporting. | Automated analysis of structured and unstructured data, including text, images, social media and IoT data, using machine learning and NLP. | Earlier identification of emerging risks and weak signals. |
| 2. Risk assessment and quantification | Statistical methods and predominantly static Monte Carlo simulations. | Predictive models and machine learning/deep learning techniques to estimate probabilities and impacts. | Greater ability to refine risk quantification and loss forecasting. |
| 3. Risk prioritization | Risk-impact matrices and periodically defined assessments. | Classification and clustering algorithms to analyze materiality, correlations and risk concentrations. | Priorities for action supported by a broader and more dynamic information base. |
| 4. Risk mitigation and response | Predefined procedures, policies and response plans. | Decision-support systems and scenario analysis to assess possible mitigation actions. | Faster decision-making and more adaptive strategies. |
| 5. Monitoring and control | Periodic KPI reviews and predominantly manual controls. | Continuous monitoring, anomaly detection and automated alerts. | Faster detection of deviations and anomalous events. |
| 6. Reporting and compliance | Static and often retrospective reports. | Dynamic dashboards, generative AI for summarization and adaptive reporting, supported by explainability tools. | Faster, more traceable and more accessible information for management, audit and oversight bodies. |
| 7. Review and learning | Post-event analysis and human feedback. | Systems that update models based on new data, subject to validation and oversight. | More continuous learning and progressive refinement of risk management strategies. |
The other side of the coin: AI as a source of risk
The same characteristics that make AI a powerful tool can also generate new risks. Artificial intelligence systems can be used to amplify fraud, manipulation, cyberattacks and other unlawful activities. They may also produce inaccurate or distorted outputs, particularly when they operate on incomplete, unrepresentative or poor-quality data.
Risk Management therefore faces a dual challenge: using AI to improve the organization’s ability to manage risk while also treating AI itself as a source of risk that needs to be properly managed and controlled.
The scientific debate offers useful insights. Stuart J. Russell has placed the alignment between the objectives of AI systems and human values at the center of the discussion, highlighting the risks arising from poorly specified objectives. Dan Hendrycks and other researchers have worked on measuring and mitigating risk associated with AI models, proposing benchmarks and safety protocols. Paolo Giudici has developed quantitative, data-driven approaches to risk management, emphasizing the importance of model validation, interpretability and model auditing.
Although these contributions start from different perspectives, they converge on one point: technological innovation does not remove the need for governance. On the contrary, as systems become more powerful and autonomous, accountability, controls, validation and transparency become increasingly important.
Risk-based AI governance
Institutional responses are also moving toward a risk-based approach. European AI regulation classifies AI uses according to their level of risk and sets different obligations accordingly, reinforcing the principle that innovation and control need to progress together.
At international level, there is also growing demand for shared taxonomies and frameworks. One significant example is the AI Risk Repository developed by MIT FutureTech, designed as a dynamic database for collecting and classifying risks associated with artificial intelligence. Tools of this kind can help researchers, companies, policy-makers, auditors and control functions build a common language and adopt a more systematic approach to assessing emerging risks.
What needs to change in practice
For the Risk Management function, this transformation cannot be limited to the acquisition of new tools. The first priority is to strengthen capabilities. Risk managers will need to understand the logic, potential and limitations of AI models without necessarily becoming data scientists. They will need to ask the right questions, assess the quality of information, recognize when an output requires further investigation and maintain the ability to challenge automated solutions.
Second, Risk Management will need to work in an even more integrated way with Internal Audit, Compliance, IT, Cybersecurity, Legal, Data Governance and business functions. AI-related risks cut across traditional organizational boundaries and require clear accountabilities, consistent information flows and coordinated controls. Within Governance, Risk & Compliance systems, including safeguards relating to the liability of legal entities, it becomes particularly important to ensure decision traceability, control adequacy and consistency between technological innovation and the organizational framework.
Finally, organizations will need to avoid two opposite mistakes: treating AI as an automatic solution to complex problems or, because of concerns about new risks, giving up the opportunities it offers. The value of artificial intelligence will depend on the quality of the governance organizations build around it.
Conclusion
The future of Risk Management will not be determined by a choice between people and technology, but by the ability to combine their respective strengths effectively. AI can increase speed, depth of analysis and predictive capability; professional judgment remains essential for interpreting context, assessing consequences, taking responsibility and guiding decisions.
In my view, the key evolution required of the Risk Management function is to move from a predominantly methodological and control-oriented role toward one that is increasingly integrated into decision-making processes. This means using AI not to replace judgment, but to make it better informed; and not to automate accountability, but to strengthen the organization’s ability to anticipate risks and make informed choices.
Ultimately, the challenge is not simply to make Risk Management more technology-driven. It is to make it more timely, more integrated and better able to understand change, while keeping people, accountability and the sustainability of decisions at the center.
Key References
Accardi, F., & Regoliosi, C. (2026). Manuale operativo di risk management. Lefebvre Giuffrè.
Barrett, A. M., Hendrycks, D., Newman, J., & Nonnecke, B. (2022). Actionable guidance for high-consequence AI risk management: Towards standards addressing AI catastrophic risks. arXiv:2206.08966.
Bussmann, N., Giudici, P., Marinelli, D., & Papenbrock, J. (2021). Explainable machine learning in credit risk management. Computational Economics, 57, 203–216. Springer.
European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act). Official Journal of the European Union.
Russell, S. J. (2019). Human Compatible: Artificial Intelligence and the Problem of Control. Viking Press.
Slattery, P., Saeri, A. K., Grundy, E. A. C., et al. (2024). The AI Risk Repository: A Comprehensive Meta-Review, Database, and Taxonomy of Risks From Artificial Intelligence. MIT FutureTech, arXiv:2408.12622.
About the Author
Fabio Accardi is a senior risk management, governance and compliance professional with extensive executive experience in multinational groups, including publicly listed companies, where he has held leadership roles in internal audit, risk management and corporate finance. He advises major industrial groups and institutions and serves as Chair or Member of Supervisory Bodies under Italian Legislative Decree 231/2001. He also contributes to academic teaching and research in risk management, compliance and internal control systems, including as an Adjunct Professor at Roma Tre University.
Author’s Note
This article independently develops some of the reflections included in F. Accardi and C. Regoliosi (2026), “Manuale Operativo di Risk Management”, Lefebvre Giuffrè Editore.