Artificial Intelligence & Business Risk

Artificial intelligence (AI) tools promise speed, efficiency, and insight at a scale that would have been unimaginable just a few years ago. What was once viewed as experimental or cutting-edge is now embedded in everyday operations from drafting emails and analyzing contracts to forecasting financial performance and managing customer interactions.

But as organizations rush to adopt these technologies, many are doing so without fully understanding how they work or the risks they introduce. That gap between adoption and understanding is where problems start. AI systems can produce outputs that look polished and authoritative, yet are incomplete, biased, or simply wrong. They can ingest sensitive information in ways that create confidentiality concerns. They can also introduce new forms of legal exposure, particularly as regulators begin to focus more closely on how AI is developed and used.

What Is AI?

It is important to note that large language models and generative AI represent only one of many flavors of AI.  Under US federal law, AI is defined capaciously to refer to systems that process data, make predictions or recommendations, and influence outcomes based on those inputs. As Neil Peretz of Enumero Law points out, based on this definition, essentially all software, even an Excel spreadsheet macro, could be deemed “AI.” This matters because companies often assume AI is something new or separate from their existing technology stack when in reality, the line between traditional software and AI is increasingly blurred, meaning:

• More business systems may be subject to regulation than expected when AI-related regulations are promulgated.
• More business processes likely carry AI-related risk than expected.
• More tech-enabled business decisions may need oversight and governance

How AI Works

Many people assume AI tools know facts or retrieve information like a database. In reality, most modern AI systems, and all large language models (LLMs) by definition, generate outputs based on probability.

These systems are trained on vast amounts of data, including websites, books, articles, and user-generated content. They analyze patterns in that data to predict what words or ideas are likely to come next in a sequence.

This predictive approach enables AI to produce fluent, human-like responses. But it also means that accuracy is not guaranteed. As Sean Griffin of Longman & Van Grack notes, an LLM doesn’t know whether something’s accurate or inaccurate.

Because AI systems rely on probability rather than verified knowledge, they sometimes produce incorrect or entirely fabricated information. These errors, often called ‘hallucinations, ’can be difficult to detect because the output often sounds confident and authoritative.

For businesses, this creates real risk. Consider a lawyer relying on AI-generated research or a financial analyst using AI-generated projections. If those outputs are wrong, the consequences can include financial loss, reputational damage, or even legal liability.

The key takeaway is simple: AI outputs should never be accepted at face value. Human review remains essential.

Consumer vs. Enterprise AI

Consumer tools, such as publicly available chatbots, are designed for general use. They are trained on broad, publicly available data and are optimized for flexibility and accessibility. This is what Jonathan Friedland of Much Shelist, P.C., refers to as the ‘open forest.’ These tools inherently carry higher risks, particularly in terms of accuracy and data security.

Enterprise AI systems, on the other hand, are far more structured and ‘fit for purpose,’ as Alex Sharpe of Sharpe Management Consulting LLC observes. They typically use curated datasets, incorporate stronger safeguards, and are built with compliance and reliability in mind. Friedland refers to this as the ‘walled garden.’ For businesses, especially those handling sensitive or proprietary information, operating within that ‘walled garden’ is often essential to maintaining confidentiality and reliability.

Core Categories of AI Risk

AI creates a layered set of challenges that cut across legal, operational, financial, and technological areas. Understanding these categories is critical because many of them overlap and can compound one another. That’s why businesses need to approach AI as a comprehensive risk management challenge.

Operational Risk

AI systems can produce outputs that are inconsistent, incomplete, or misleading. Because they are probabilistic rather than deterministic, the same input can produce different results at different times. That unpredictability can create real operational issues, especially when AI is embedded into workflows.

For example:

• Automated customer service tools may give incorrect information, but at intermittent intervals
• AI-assisted drafting tools may introduce subtle errors into contracts
• Internal decision-support systems may produce flawed recommendations

The bigger risk is overreliance. When employees begin to trust AI outputs without verification, small errors can scale quickly into larger business problems.

Legal and Regulatory Risk

The legal landscape around AI is evolving rapidly, and uncertainty itself is a risk.

Organizations face questions such as:

• Who is liable when an AI system produces incorrect or harmful outputs?
• How do existing laws (e.g., negligence, consumer protection, professional responsibility) apply to AI-assisted decisions?
• What new regulations will govern AI use in the future?

There are also intellectual property concerns. Many AI systems are trained on large datasets that may include copyrighted material, raising questions about ownership and permissible use.

For regulated industries, such as law, finance, and healthcare, the stakes are even higher. Using AI improperly can lead to:

• Compliance violations
• Professional discipline
• Litigation exposure

Data Privacy and Confidentiality Risk

Many AI systems are data-hungry by design as they try to gather feedback data for the purpose of self-improvement. That creates significant privacy concerns.

When users input information into AI tools, especially public or consumer-grade systems, that data may be:

• Stored by the provider
• Used to improve the model
• Potentially exposed through future outputs

This is particularly problematic for businesses handling sensitive information, such as:

• Client data
• Financial records
• Trade secrets
• Privileged communications

Without proper safeguards, organizations risk unintentionally disclosing confidential information or violating privacy laws.

Bias and Ethical Risk

AI systems learn from data, and data often contains bias.

If those biases are not identified and addressed, AI can reinforce or even amplify them. This can lead to outcomes that are discriminatory, unfair, and/or difficult to explain or justify.

Examples include:

• Hiring tools that favor certain demographics
• Lending models that disadvantage particular groups
• Decision systems that reflect historical inequalities

Beyond legal exposure, these issues can create reputational damage and erode trust with customers and stakeholders.

Cybersecurity Risk

AI introduces new cybersecurity vulnerabilities and new tools for attackers.

On the defensive side, AI systems can be targeted through:

• Data poisoning (manipulating training data)
• Prompt injection attacks
• Unauthorized access to proprietary models

On the offensive side, malicious actors can use AI to:

• Generate more convincing phishing emails
• Automate fraud schemes
• Scale cyberattacks more efficiently

This dual-use nature of AI makes cybersecurity more complex and dynamic.

Reputational Risk

AI-related failures can quickly become public and damaging. If an AI system produces offensive, biased, or incorrect outputs, the resulting backlash can harm a company’s brand, leading to:

• Loss of customer trust
• Negative media attention
• Reduced market value

Practical Steps for Businesses

Clear rules about how AI is used, monitored, and controlled are becoming a critical component of overall corporate governance. Organizations that adopt AI without clear policies, oversight, or alignment with business objectives face serious risks. Given these risks, businesses should take a proactive approach to AI governance.

• Start by using the right tools. Consumer-grade AI may be appropriate for low-risk tasks, but critical business functions should rely on enterprise-grade systems.
• Maintain human oversight. AI should support decision-making, not replace it. Employees should be trained to review and validate AI outputs.
• Protect sensitive data. Avoid entering confidential information into public AI tools, and ensure that enterprise systems have appropriate safeguards in place.
• Develop clear policies. Organizations should establish guidelines for how AI can be used, including data handling, approval processes, and accountability.
• Stay informed. AI regulation is evolving rapidly, and businesses should monitor developments to ensure compliance.

To learn more about this topic, view Remembering HAL 9000 Thinking about the Risks of Artificial Intelligence to an Enterprise. The quoted remarks referenced in this article were made either during this webinar or shortly thereafter during post-webinar interviews with the panelists. Readers may also be interested to read other articles about cybersecurity.

This article was originally published on May 6, 2026.

©2026. DailyDAC^TM, LLC d/b/a/ Financial Poise^TM. This article is subject to the disclaimers found here.