The pace of adoption of Generative and Agentic AI tools (with non-deterministic LLMs at the core) has continued to increase in regulated industries, specifically financial services. The Bank of England’s 2026 survey on Artificial Intelligence in UK financial services reported [1]:
“86% of respondents reported using artificial intelligence (AI), up from 75% in 2024”
Furthermore, it highlighted that:
“Generative AI accounted for 56% of all reported AI systems, compared with 17% for foundation models in 2024”
This is against the backdrop of increasing incidents related to the adoption and deployment of these tools, as they continue to be captured in the AI Incidents Database [2] and OECD’s AI Incidents Monitor [3], and highlighted by news headlines in mainstream media [4] [5].
In this gap between the decisions to rapidly adopt and deploy Generative and Agentic AI tools (with non-deterministic LLMs at the core), and the reality of incidents, lies the unmanaged risks inherent in these tools and the consequences of choices made.
The Boards and decision-makers who have been pushing for the adoption and deployment on the basis of FOMO and/or promised benefits have likely not been fully aware of, understood and appreciated the inherent risks.
Continued adoption and deployment by stakeholders in the value chains across industry sectors without appropriate risk treatments will only increase their organisation’s or institution’s exposure to the risks inherent in these tools, which can consequently coalesce into systemic risks.
Was critical thinking exercised?
At the end of last year, I wrote about the need to return to the fundamentals. It is easy to be lured by the convenience, accessibility and promises of these technologies. I have met many startup founders over the past few years embracing Generative and Agentic AI tools (with non-deterministic LLMs at the core) to create their product or service offering without first conducting robust due diligence, especially when there was no apparent regulatory or business reason to do so.
Consequently, the risks inherent in these tools are onboarded and embedded in their products or services, and operationally within their organisation.
Assessed Intelligence has devised a simple AI Readiness Assessment, which you and anyone in your organisation or institution can undertake, especially its Board members and leadership.
There are 31 simple questions across 6 categories [ARISE Framework Pillar(s)]:
Establishing your organisation context:
- Where are you in your transformation journey?
- What is your organisation’s risk appetite?
- Do you handle and process personal, sensitive or confidential data, and is it exposed to your AI tools?
- How will your AI tools operate, and how much control do you have over them?
- Are you aware of and concerned about the risks inherent in AI tools?
- Which regulatory regimes apply to your organisation?
Understanding your organisation’s adoption rationale and strategic intent: [Govern]
- Does your organisation have a documented reason for adopting AI that is tied to a specific business outcome?
- Is there an accountable person in your organisation who owns the decision to adopt AI?
- Is AI necessary to achieve the desired outcome?
- Has your organisation evaluated its readiness to absorb the operational and governance workload expected from the adoption of AI?
- When cost, capability, or regulatory assumptions change, will you revisit your organisation’s adoption rationale and strategic intent?
Understanding your organisation’s risk tolerance and constraints: [Identify | Manage]
- Has your organisation’s leadership or the Board defined the level of AI-related risk it is willing to accept?
- Is your organisation’s AI risk tolerance documented and endorsed by leadership or the Board?
- Has your organisation’s leadership or the Board set explicit constraints on data use, model autonomy, and decision authority?
- Can your organisation detect when an AI system approaches or crosses a risk threshold?
- Are your organisation’s risk limits enforced even when there is pressure to move faster?
Understanding your organisation’s governance programme and oversight: [Govern | Validate | Respond]
- Is there a specific role or committee accountable for AI governance with authority to act?
- Is the function of AI oversight continuous instead of limited to periodic or annual review?
- Can your organisation evidence that AI controls are operating effectively, not just documented?
- Can your organisation demonstrate its AI governance to an auditor or regulator on request?
- Can your organisation’s governance programme adapt as its AI footprint and regulations evolve?
Understanding your organisation’s acceptable use tenets: [Protect | Detect]
- Does your organisation’s leadership or the Board have a clear principle that defines which uses of AI are acceptable?
- Do your organisation’s employees know which AI uses are permitted, prohibited, or require approval?
- Is your organisation’s leadership or the Board aware that high-consequence uses (autonomous action, sensitive data, external decisions) carry additional controls?
- Does your organisation provide guidance or training so staff apply the acceptable-use rules in practice?
- Is unapproved or “shadow” AI use across the organisation monitored?
Understanding your organisation’s vendor & third-party controls: [Protect | Manage]
- Does your organisation review independently validated evidence of each AI vendor’s security and governance posture before adoption?
- Do your organisation’s contracts address data use, model behaviour, and liability for the AI services that it relies on?
- Does your organisation maintain visibility into how vendor AI models behave and change over time?
- Does your organisation have a documented path to substitute or exit an AI vendor without major disruption?
- Does your organisation re-assess vendors when they change their model, terms, or subprocessors?
When you undertake the AI Readiness Assessment, your responses are benchmarked against the ARISE Framework, which measures your readiness across five domains.
Would you like to know what you didn’t know? Once completed, you will receive a report with a tailored roadmap which spells out what you can do next.
Inherent Risks
Risks typically need to be identified before they can be assessed, treated and monitored. A robust due diligence conducted on Generative and Agentic AI tools (with non-deterministic LLMs at the core) will have identified inherent risks, which then need to be assessed along with their potential impacts under relevant scenarios.
Risk Treatments
If you were not previously fully aware of the risks inherent in Generative and Agentic AI tools (with non-deterministic LLMs at the core), you will not have assessed, let alone treated, those risks that were onboarded when you adopted these tools and embedded when applications (resulting products or services) were deployed.
There are basically four risk treatment options. Each presents a way for the organisation or institution to react to any specific risk, after the assessments and taking into consideration its risk appetite:
Avoid
This is where the risk (post-assessment) is deemed to be greater than the organisation’s (or institution’s) capacity or cost (appetite) to deal with the consequences (untenable).
Risk avoidance or rejection is typically by design since this decision is made after careful consideration, and entails removing the source(s) of that risk from the organisation or institution.
Accept
This is when the organisation or institution has conducted the necessary risk and impact assessments, is fully aware of, accepts the risk in the context of their risk appetite, and consciously decides to do nothing.
Risk acceptance is typically undertaken by and linked to an accountable person within that organisation or institution. The accountable person who decided to accept any specific risk should be clear about the consequences of their decisions, since accepting a risk does not mean that the risk no longer exists.
I asked the question in a previous article: Where does accountability for ‘AI’ lie?
Mitigate
This is when the organisation or institution actively takes steps to manage the risk. Mitigations can be in the form of actions, controls and/or plans implemented to take effect in the event of the risk being encountered.
A mitigation may be implemented to maintain a risk at its current level of assessment (if the risk is currently deemed to be at an acceptable level), or implemented to reduce the level of risk to a level that is more acceptable within the context of its risk appetite. Mitigations can change the impact and/or likelihood of a risk, resulting in residual risk.
Transfer
This is when residual risks are transferred to a third party to provide some level of protection to the organisation or institution. The most common form of risk transfer is through insurance, in return for a fee (policy premium).
Six months ago, I asked in an article, Is your organisation insured for AI risks?
Around the same time, many insurers decided to exempt AI workloads from cybersecurity and E&O (Errors and Omissions) coverage, citing that their outputs are too unpredictable to write policies around. Some insurers have also withdrawn from providing cybersecurity and other insurance to companies using AI to run internal processes. Other insurers have increased the prices of their premiums to cover AI-related claims that are subjected to predetermined limits. [6]
It’s not too late
For the Board and leadership of organisations or institutions which have not prioritised risk management alongside the adoption and deployment of Generative and Agentic AI tools (with non-deterministic LLMs at the core), it’s only a matter of time before inherent risks manifest into adverse incidents that could have consequential financial, legal, regulatory, operational, reputational, societal, environmental and ethical impacts.
How did your organisation or institution fare in the AI Readiness Assessment?
If you completed the assessment, the report you received will provide a starting point from which risks inherent in your organisation or institution’s adoption and deployment of Generative and Agentic AI tools (with non-deterministic LLMs at the core) can be identified, assessed, treated and monitored. All of which is necessary when you choose to rely on technologies that are unpredictable, unexplainable and you don’t control.
[1] https://www.bankofengland.co.uk/report/2026/artificial-intelligence-in-uk-financial-services-2026
[2] https://incidentdatabase.ai/
[3] https://oecd.ai/en/incidents
[4] https://naturalandartificiallaw.com/100-uk-ai-hallucination-cases/
[5] https://www.sas.com/en_sg/news/press-releases/2026/october/ft-longitude-ai-risk-report.html
