Artificial intelligence is being presented as the next great solution to risk management. Vendors promise earlier detection, better prediction, continuous monitoring, and objective insight. Boards are told that AI can see patterns humans miss, process information at scale, and reduce reliance on judgement.
These claims are not entirely wrong. They are also dangerously incomplete.
AI does not introduce a new kind of intelligence into organisations. It amplifies the intelligence that is already there. Where governance is coherent and challenge is tolerated, AI can sharpen perception. Where governance is fragmented and reassurance is rewarded, AI will industrialise dysfunction.
The difference matters.
AI systems learn from data, models, and feedback loops that are created by human organisations. They inherit assumptions about what matters, what counts as signal, and what constitutes success. If those assumptions are flawed, AI will not correct them. It will entrench them.
This is why AI should not be thought of primarily as a risk tool, but as a governance stress test.
In organisations where uncomfortable information travels freely, AI can help surface weak signals earlier. It can connect disparate data points, identify emerging patterns, and challenge complacent narratives. Used well, it can extend human sensemaking rather than replace it.
In organisations where challenge is muted, AI will do the opposite. It will optimise for what is measured, rewarded, and historically validated. It will smooth uncertainty, reinforce dominant stories, and increase confidence in precisely the areas where doubt is most warranted.
The danger is subtle. AI systems produce outputs that appear objective, probabilistic, and rigorous. They speak in numbers. They generate charts. They invite trust. But their authority rests entirely on the integrity of the data and assumptions beneath them.
If an organisation has already lost the ability to hear inconvenient truth, AI will not restore it. It will make that loss harder to detect.
Consider how AI is likely to be deployed in practice. Early use cases focus on monitoring, anomaly detection, and predictive analytics. These are attractive because they fit neatly into existing control frameworks. They promise automation of reassurance.
What they do not do, on their own, is change how decisions are made when signals conflict or uncertainty persists.
In fact, AI can reduce tolerance for ambiguity. When a system produces a score, a probability, or a ranking, pressure builds to treat it as definitive. Human judgement becomes secondary. Dissent becomes harder to justify. The organisation converges more quickly around a single interpretation.
This is particularly risky in environments characterised by novelty and structural change. Historical data is least reliable precisely where judgement matters most. AI systems trained on the past are poorly equipped to warn about futures that do not resemble it.
This does not make AI useless. It makes it conditional.
The value of AI in risk management depends on whether the organisation can hold its outputs lightly. Can the model be questioned? Can its assumptions be challenged? Can human unease override algorithmic confidence? These are governance questions, not technical ones.
Boards that treat AI as a substitute for judgement are likely to be disappointed. Boards that treat it as a participant in sensemaking, subject to scrutiny and context, may gain real advantage.
The most important question is therefore not what AI can do, but what it will be allowed to say. Will it be permitted to surface uncomfortable patterns, or only those that align with existing narratives? Will it expand the range of questions asked, or simply answer them faster?
AI will not fix risk management. It will reveal it.
In organisations with strong internal truth-flows, that revelation may be uncomfortable but valuable. In organisations already drifting towards ritual and reassurance, it will accelerate confidence without comprehension.
The technology is neutral. The outcome is not.
AI will either deepen organisational self-awareness or hasten surprise. The choice lies not in the model, but in the governance that surrounds it.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 26 January 2026 on my Substack.