TL;DR. The fear is regulator action and front-page lawsuits. The reality is your VP of Sales pasted a deal sheet into a free chat tool last Tuesday and you have no record of it. There are five failure modes that actually land in enterprises right now: data leakage, wrong answers, over-reliance, shadow AI, and ungoverned automation, the scheduled agent running on a clock that nobody in IT approved. Each has a small set of boring controls that work. On the regulatory side, the high-risk regime slipped to 2027 and the disclosure rules are what bind you now. The rest is theater.

Somebody on your leadership team has been emailed a slide deck about AI risk. It probably has a 4x4 matrix. It enumerates seventeen risk categories with red, yellow, and green dots. It mentions the EU AI Act. It includes a recommendation to establish an AI ethics committee. It is on the agenda for next month’s risk review.

In the same week, three things happened that the deck did not catch. A junior analyst pasted a draft client roster into a free chat tool to clean up the formatting. A customer service bot quoted a refund policy that the company does not have. And the VP whose seat sat idle for nine months started a personal Claude account because the approved tool was worse than the consumer version.

None of those will appear on the risk register. All of them are the actual risk.

Why the risk register misses

The default executive playbook for AI risk is the playbook for every other emerging risk. Convene a working group. Inventory the categories. Score each one on likelihood and impact. Color-code. Present quarterly. Track movement.

This catches nothing because risk registers operate at the wrong layer. Registers track categories. Incidents happen at surfaces. A category like “data privacy violation” tells you nothing about whether your people are pasting customer records into ChatGPT today. A category like “model bias” tells you nothing about whether the chatbot you deployed last quarter is making refund commitments you cannot honor. The register is at the altitude of an ethics committee. The incident is at the altitude of a browser tab.

The deeper problem is that the register lets the executive feel governed without doing anything operational. The slide is the artifact. The artifact substitutes for the control. Six quarters later there is a thick binder of governance documents and a security team that still has no idea which AI tools their employees opened this morning.

Risk that gets managed has telemetry, an owner, and a kill switch. Risk that gets registered has a color.

The five failure modes

The number your board has already seen is the attacker-side one. IBM’s 2026 breach study found that one in four malicious breaches was AI-enabled, up 56 percent in a year, and that those breaches cost an average of $6 million against a global average of $4.99 million.¹ That number is real and it is not yours to manage. It describes what is being done to you by people using AI well. What you control is the other side: what your own organization does with these tools, unsupervised, on a Tuesday.

Almost every real AI incident at a normal enterprise falls into one of five categories. Four of them are old news. The fifth arrived this year, when agents learned to run on a schedule. None of them are exotic. All of them have a control that costs less than the AI program.

Data leakage

Your people put things into AI tools that should not be there. Source code. Customer rosters. Salary spreadsheets. Draft contracts. Acquisition targets. Sometimes they use the consumer tier of a tool whose data terms permit training on inputs. Sometimes they use the enterprise tier but exfiltrate to a personal account on a weekend. Either way, the data is now somewhere it was not yesterday, and you cannot get it back.

Samsung remains the canonical version of this failure. In 2023, engineers pasted source code and internal meeting notes into a public chat tool to debug and summarize, the leak surfaced, and the company banned generative AI on company devices.² The reflex response was a perimeter ban. The actual lesson was that no approved equivalent existed when the work showed up.

The control is paired and unglamorous. First, an enterprise tier of an approved chat tool with a signed data agreement that prohibits training on your inputs. Second, an endpoint or browser-level data loss prevention tool that flags paste events into known AI domains, including the long tail. The first removes the reason to use a consumer tool. The second tells you when somebody used one anyway. You need both. Neither alone is a control. The breach data is blunt on the point. More than 20 percent of organizations now report a breach that targeted their AI models or applications, up from 13 percent a year earlier, and 92 percent of those organizations had no proper access controls on the systems that were breached.¹

If you have neither, your data leakage program is a wish.

Wrong answers

Models confabulate. They produce text that looks correct, in a confident register, with no marker that anything is invented. In a workflow with a competent human reviewer this is annoying. In a workflow without one it is a lawsuit.

The two cases worth remembering are public. In Mata v. Avianca, lawyers submitted a brief citing six judicial decisions that did not exist. ChatGPT had fabricated them and the lawyers had not checked. The court sanctioned them.³ In Moffatt v. Air Canada, a customer service chatbot invented a bereavement fare policy. A small claims tribunal held the airline to it.⁴ The pattern is the same: a model produced confident output, no human verified it, the output bound the institution, the institution paid.

Hallucination rates have fallen, but they have not gone to zero, and they will not. The useful split is between two jobs that look identical to a non-technical reader. Hand a model the source document and ask it to summarize what is in it, and the best models invent something in roughly two to four percent of outputs. Ask the same models an open factual question with nothing handed to them, and the best hallucination rates across a field of 154 models run between fourteen and twenty-five percent.⁵ The same tool is a reliable summarizer and an unreliable expert, and most workflows that go wrong went wrong by treating it as the second while budgeting for the first. Treat any quoted “hallucination is solved” claim as marketing. The control is not a better model. It is a discipline rule about which workflows are allowed to ship model output without a verifying human. The underlying reason these workflows fail without a check is that nothing in the environment is capable of saying “no” when the model is wrong, which is the same bottleneck that decides where AI compresses work and where it doesn’t.

The rule is binary. If model output reaches a customer, a court, a regulator, a counterparty, or a system of record without a human in the loop, the workflow is high-risk. High-risk workflows get a named reviewer, a logged sign-off, and a pre-mortem on what happens when the model is wrong. Everything else is low-risk and can ship faster. This is a one-page document, not a framework. Most orgs have neither.

Over-reliance

The third failure is slower and costs more. Your people get good at producing AI output and worse at producing the underlying judgment. The senior analyst who used to spot the discrepancy in a model now accepts the chatbot’s summary. The associate who used to write the memo now edits the draft. The engineer who used to read the code now reviews the diff. After a year, the muscle is softer. After three, the team cannot operate unaided.

The 2025 Microsoft and Carnegie Mellon study on knowledge workers using generative AI found a measurable shift away from independent critical evaluation toward verifying AI output, with the largest reduction in critical thinking exactly in the workers most confident in the model.⁶ That is the shape of the problem. Confidence rises faster than competence falls, so the decay is invisible until the moment you need the unaided skill and it is gone.

The control is cultural and small. Two practices catch most of it. First, a standing rule that any junior team member presenting AI-assisted work must be able to defend the underlying reasoning without the tool open. Not always. Periodically, in normal review. Second, at least one recurring task per role that is done unaided, by policy, because the skill is load-bearing for the rest of the work. A lawyer who cannot draft an argument from scratch is not a lawyer with leverage. A lawyer who cannot draft an argument from scratch is a paralegal with a subscription.

You will not see this risk on a dashboard. You will see it the first time a leveraged person leaves and the team behind them cannot reproduce the work.

Shadow AI

Building an AI Policy treats shadow AI as a procurement failure: people use unapproved tools because the approved tool does not exist, is worse, or was never communicated. That framing is still right and it is still where most of the prevention work lives. But there is a residual risk after policy that is worth naming as its own failure mode.

Even with a good policy, an approved tool, and a two-week request SLA, some fraction of your people will continue to use consumer accounts. Some because the consumer model is genuinely better at their task. Some because they have a personal habit. Some because they are working from a phone and the enterprise tool is not installed. The share of security incidents involving shadow AI more than doubled in a year, to 43 percent, and more than two thirds of breached organizations had no governance process in place to limit it.¹ Even at the organizations that did, residual use was non-zero.

The control is detection plus disclosure. Detection is the same DLP and endpoint stack that catches data leakage, configured to alert on traffic to consumer AI domains, not just enterprise ones. Disclosure is a written rule that a fast self-report of an incident is met with documentation and no penalty, while a hidden one is treated as a security incident. The point of the disclosure rule is not forgiveness. It is incentive design. You cannot fix what you cannot see, and you cannot see what your people are punished for showing you. This is the same logic every mature security organization applies to phishing-click rates and vulnerability disclosure. It is not new. It is just newly applied to a surface most companies are still pretending does not exist.

The consumer chat account was the whole of shadow AI when this guide was first written. It is not anymore. The same tools now run on a schedule, which turns a moment into a standing job and makes it its own failure mode.

Ungoverned automation

The first four failure modes are things your people do. The fifth is something your tools now do on their own, on a clock, after everyone has gone home. Shadow AI used to mean a single risky action: a paste into a consumer tab, a moment you could in principle recover from. A scheduled agent is different in kind. Someone writes a prompt once, picks a cadence, and the agent runs unattended against real systems, producing output other people come to depend on, and it keeps running after that person changes teams or leaves.

This is not a hypothetical capability. Scheduled and recurring tasks shipped in February, the desktop tool went generally available in April, web and mobile arrived in July, and remote sessions that keep running with the laptop closed are in beta now.⁷ A year ago a scheduled job needed somebody’s machine to be awake. It doesn’t anymore, and it runs on a twenty-dollar personal plan just as happily as on yours.

You are accumulating a second workforce that is not on any org chart, and the survey data says you cannot see it. Eighty-eight percent of organizations have confirmed or suspect an AI-agent security incident in the past year. Roughly a quarter can see which of their agents talk to each other, and about one in five have complete visibility into what permissions those agents hold. About one in seven send agents into production with full security or IT sign-off, and under half of running agents are monitored or secured at all.⁸ Gartner’s headline prediction for this year is that “death by AI” claims will pass two thousand on the back of insufficient risk guardrails.⁹ Read that one narrowly. Those are wrongful-death claims, not AI litigation generally, which cleared two thousand some time ago. If you do not build products that can kill someone, the Gartner number is not your exposure. The maintenance backlog and the missing audit trail are.

The control is an agent inventory plus a kill switch. The inventory is a list of every scheduled task, routine, and standing agent running against your systems: what each one touches, on what cadence, and who owns it. The kill switch is the set of admin controls most companies pay for and never turn on. On Team and Enterprise alike, an administrator can disable the agent tool org-wide, disable cloud sessions, turn off blanket “always allow” for connector tools, and turn off routines entirely. Enterprise adds groups and custom roles instead of one org-wide switch, defaults cloud sessions to off rather than on, and is the only tier eligible for the compliance API that streams activity into your SIEM. Lock the configuration through managed device settings so it cannot be loosened on an individual machine.

Three things about how these agents actually work deserve to be said out loud, because none of them are obvious from the marketing. Routines run with no permission prompts, with connectors enabled by default, which is the design goal and also the exposure. Routines are personal rather than org-owned, so anything a routine does through a person’s connected identity appears in your logs as that person. And if your security team enforces IP allowlisting, cloud sessions and code review and routines break; if you are a zero-data-retention organization, the cloud features are simply unavailable to you.

The sharpest constraint is the one nobody puts on a slide. Conversation history for the desktop agent is stored locally, on the user’s own computer. It falls outside the vendor’s standard retention policy, and it cannot be centrally managed or exported by an administrator on any plan, including Enterprise. Only the cloud sessions reach the compliance API. So the honest version of your audit trail is that you can see what ran in the cloud and you cannot see what ran on the laptop, and the seat upgrade does not change that. Move load-bearing automation onto a governed plan and into cloud sessions, because that is the combination that produces a record. The seat-versus-consumption argument in Evaluating Spend reaches the same conclusion from the budget side: a job the company depends on should not live on a personal subscription. And the verifier constraint decides which jobs may run unattended in the first place. Schedule the work two people can mechanically agree is correct. Do not schedule the work that needs a careful read before anyone trusts it.

What is actually binding, as of 1 August 2026

The deck mentions the EU AI Act. Almost every deck does, and almost none of them have current dates on them. Here is the state of play, and it is worth knowing precisely, because the gap between what binds you and what a vendor tells you binds you is where compliance budgets go to die.

The high-risk obligations everyone spent a year preparing for did not arrive this month. The Digital Omnibus on AI, published in the Official Journal on 24 July and in force since 27 July, moved the stand-alone high-risk rules to 2 December 2027 and the product-embedded ones to 2 August 2028.¹⁰ If your program was built around an August 2026 deadline, that deadline no longer exists. What did land on 2 August 2026 is transparency, and transparency is the part that reaches an ordinary company. Tell people when they are dealing with an AI system. Mark synthetic audio, image, video, and text so a machine can detect it. Disclose emotion recognition and biometric categorisation. Label deepfakes, and label AI-generated text you publish on matters of public interest. Systems already on the market get until 2 December 2026, and only for the machine-readable marking. Fining powers over general-purpose model providers also switch on, up to 3 percent of worldwide turnover or fifteen million euro, which is a model provider’s problem and not yours unless you are one.

In the United States, nothing federal binds you. There is an executive order directing the Justice Department to challenge state AI laws, a litigation task force that has filed no affirmative suit, and a proposed FTC policy statement, which creates no obligation. Federal employment guidance on AI was rescinded last year, which changed the guidance and not the law: Title VII and the ADA apply to an automated hiring decision exactly as they apply to a human one. The rules with teeth are state rules. If you employ five or more people in California, the FEHA regulations on automated decision systems have bound you since October 2025 and require four years of retention on that data, and it is the one most likely to catch a reader of this guide. Illinois bars ZIP code as a proxy and requires notice when AI is used in employment decisions. Texas prohibits a short list of intentional harms with a sixty-day cure period. New York City’s bias-audit rule is old news except that enforcement is turning proactive this year. Colorado is the trap: the law you were told to build for is stayed in court and has already been repealed and replaced, effective January 2027, so build to the replacement and not the headline.¹¹

The honest summary for a mid-market deployer is that the disclosure rules bind you now, the employment rules probably already did, and the rest is a 2027 problem you should watch rather than staff. None of that argues for the ethics committee or the seventeen-category register. A named owner who can tell you which of your systems talk to customers, which touch a hiring or lending decision, and which produce synthetic media, is the entire compliance posture most companies need this year. Everything above sits on top of that inventory. Nothing substitutes for it.

The heuristic

If you remember nothing else.

Five failure modes, in order: data leakage, wrong answers, over-reliance, shadow AI, ungoverned automation. If your AI risk program names other categories before these five, it is not your AI risk program. It is somebody’s slide.
Each failure mode has a paired control. Approved tier plus DLP. High-risk-workflow rule plus named reviewer. Unaided-work practice plus defend-the-reasoning culture. Detection plus rewarded disclosure. Agent inventory plus kill switch. One half of any pair is not a control.
Telemetry beats policy. A control you cannot measure is a wish. The minimum telemetry is who is using which AI tool, on what surface, against which data class, and which agents run unattended, on what schedule, with which connectors and permissions.
Reward fast disclosure. Treat concealment as the incident. This is the only sentence on culture you need.
Kill switches matter more than approval gates. You will deploy AI things that fail. You need to be able to turn them off in an afternoon. For the agents, the off ramp already exists and is mostly unused: admin toggles that disable unattended agents, cloud sessions, and connector auto-approval org-wide, a compliance log streamed to your SIEM on the enterprise tier, and managed device settings that keep anyone from loosening it locally. Team plans have the toggles too. Most companies on either tier have never turned them on. Procurement contracts should include the same off ramp for the tools you build on.
Disclosure is the regulation that binds you today. Not the risk-classification regime, which slipped to 2027 and 2028, and not a federal framework, which does not exist. Tell people when they are talking to a machine, mark synthetic media, and get straight which of your systems touch an employment or lending decision, because that is where the rules already applied before anyone wrote an AI statute.
The risk you can name is not the risk that is coming. Reserve a small budget and a standing meeting for the failure mode you have not seen yet. The agentic-workflow incident is no longer that risk. It arrived this year, and it has a control, the one above. The model-update regression and the vendor that disappears mid-quarter are still ahead of you. Something on this list will happen this year, and the only question is whether it is already in your register.
No ethics committee. A named risk owner with a quarterly review and the authority to pull a tool off the approved list does the entire job an ethics committee was supposed to do, and actually does it.

Something to carry

Pull the last thirty days of endpoint or DLP logs filtered for traffic to known AI domains. The list is short and well-published. Every major chat tool, every major coding tool, plus the long tail of consumer wrappers your security team has probably already enumerated. Count distinct users.

That number is the only honest denominator you have. Compare it to the number of approved AI seats you’re paying for. The gap is your shadow AI footprint. Pull the prompt or paste content where your stack captures it, sample twenty events, and read them. You’ll find one of three things. You’ll find people doing routine work in the wrong tool, which is a procurement problem you can fix in two weeks. You’ll find people moving sensitive data into a consumer tool, which is a control problem you can fix in a quarter. Or you’ll find nothing concerning, which means your detection is misconfigured and you have no controls at all.

In any of the three cases, you now have a real starting point. The risk register didn’t give you one. It was never going to.

IBM and Ponemon Institute, Cost of a Data Breach Report 2026, published 29 July 2026. Based on breaches at 602 organizations globally between March 2025 and February 2026. The AI-enabled breach share (one in four, up 56 percent), the $6 million average for those breaches against a $4.99 million global average, and the share of organizations reporting a breach targeting AI models or applications (more than 20 percent, against 13 percent in the 2025 edition) are from IBM’s release. The 92 percent access-controls figure, the 43 percent shadow-AI incident share, and the “more than two thirds” governance gap are from the report body as reported in trade coverage of it. The widely recycled $670,000 shadow-AI cost adder and the one-in-five figure are from the 2025 edition and are not repeated in the 2026 report. Last verified 2026-08-01. ↩ ↩² ↩³
Mark Gurman, “Samsung Bans Staff’s AI Use After Spotting ChatGPT Data Leak,” Bloomberg, May 2023. ↩
Mata v. Avianca, Inc., No. 22-cv-1461 (S.D.N.Y. 2023). Sanctions order issued June 2023. ↩
Moffatt v. Air Canada, 2024 BCCRT 149 (Civil Resolution Tribunal of British Columbia). Decision issued February 2024. ↩
Grounded-summarization rates from the Vectara Hughes Hallucination Evaluation Model leaderboard, updated 11 May 2026, where the best models fall between 1.8 and 4.1 percent. Open-domain rates from Artificial Analysis AA-Omniscience, where the best hallucination rates across 154 evaluated models run between 14 and 25 percent. Both move; check the current leaderboards before quoting a number in a board deck. Last verified 2026-08-01. ↩
Hao-Ping (Hank) Lee et al., “The Impact of Generative AI on Critical Thinking,” Microsoft Research and Carnegie Mellon University, CHI 2025. The finding most often cited is the negative correlation between confidence in the AI tool and engagement in independent critical evaluation among knowledge workers. ↩
Anthropic’s Claude Cowork shipped scheduled and recurring tasks on 25 February 2026, reached general availability on macOS and Windows desktop on 9 April 2026, and arrived on web and mobile on 7 July 2026. Scheduled tasks are available on Pro, Max, Team, and Enterprise and run remotely, so they keep their cadence with the computer asleep or the app closed. Cloud sessions remain in beta, rolling out to Max first. Admin controls, retention behaviour, and the Enterprise-only compliance API are documented in Anthropic’s help centre and platform docs. Last verified 2026-08-01. ↩
Gravitee, The State of AI Agent Security 2026, published 4 February 2026, n=919. 88 percent confirmed or suspected an AI-agent security incident in the prior year; 24.4 percent have visibility into which agents communicate with each other and 21 percent have complete visibility into agent permissions; 14.4 percent run agents in production with full security approval; 47.1 percent of running agents are monitored or secured. Last verified 2026-08-01. ↩
Gartner, “Top Strategic Predictions for 2026 and Beyond,” 21 October 2025: “By the end of 2026, ‘death by AI’ legal claims will exceed 2,000 due to insufficient AI risk guardrails.” The prediction covers wrongful-death claims specifically, not AI-related litigation generally. One outlet reported the same prediction as 1,000. Last verified 2026-08-01. ↩
Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 2026/1744, 24 July 2026, in force 27 July 2026. It replaces the AI Act’s Article 113 third paragraph point (c): Chapter III high-risk obligations apply from 2 December 2027 for Annex III stand-alone systems and 2 August 2028 for Annex I product-embedded systems. Article 50 transparency is untouched and applies from 2 August 2026; new Article 111(4) gives providers whose synthetic-content systems were on the market before that date until 2 December 2026 to comply with Article 50(2), the machine-readable marking obligation, only. Commission fining powers over general-purpose model providers under Article 101 begin 2 August 2026 (investigatory powers have applied since August 2025). Last verified 2026-08-01. ↩
California: FEHA automated-decision-system regulations effective 1 October 2025, binding employers with five or more employees, with four-year retention of ADS data; SB 53 and AB 2013 effective 1 January 2026; SB 243 (companion chatbots) with a private right of action; SB 942 as amended by AB 853 operative 2 August 2026 for generative AI providers over one million monthly users. Illinois HB 3773 amending the Human Rights Act, effective 1 January 2026. Texas HB 149 (TRAIGA), effective 1 January 2026, intent-based, enforced by the Attorney General with a 60-day cure period. NYC Local Law 144 bias audits, with DCWP moving to proactive investigation in 2026 after the state comptroller found enforcement weak. Colorado SB 24-205 took effect 30 June 2026 but its enforcement is stayed by stipulated order in xAI v. Weiser (27 April 2026); it has been repealed and replaced by SB 26-189, effective 1 January 2027. CPPA automated decision-making technology duties begin 1 January 2027. Federally: Executive Order 14365 (11 December 2025) directs DOJ to challenge state AI laws and preempts nothing by itself; the FTC’s AI-accuracy policy statement was proposed 7 July 2026; the TAKE IT DOWN Act’s 48-hour removal requirement has been enforceable since 19 May 2026; EEOC and DOL AI guidance was rescinded in 2025 while Title VII and the ADA continue to apply. Last verified 2026-08-01. ↩

Managing Risk