AI Risk

It already happened to organisations that were never the target. On 12 June 2026 a national-security directive forced a provider to switch off two deployed frontier models for every customer, and those cut off lost the capability as collateral of someone else’s compliance. Model availability is a third-party continuity risk that belongs on the risk register with a named owner, and the test is one line: if this model disappeared tomorrow morning, what would stop working by lunchtime? I set out the full argument in the Trilemma made real.

Because visible activity bears little correlation to capability. 89% of enterprises have adopted AI tools, yet only 23% can measure the return on that investment (Larridin 2025), and the gap is produced by three reinforcing patterns: counting tools as capability, mistaking pilot wins for systemic readiness, and hype-driven metrics that reward short-term ROI over capability. The AI Maturity Mirage sets out a diagnostic for finding the organisation’s true position before further investment widens the gap.

The evidence suggests the opposite. Senior developers capture roughly twice the productivity gains of juniors (McKinsey 2023), and a randomised controlled trial found experienced developers were actually 19% slower with AI tools once verification and correction costs landed (METR 2025). Expertise is not what AI coding replaces; it is what determines whether AI-generated code creates value or debt. The Board question is not whether AI can write code cheaper but whether the organisation holds the verification capability to know. I explore this in The Verification Premium.

Not necessarily. The safest model is the one that fits the work, judged across strategic value, risk, organisational readiness, and operational sustainability, and different use cases will justify different models. The choice is made per deployment, not once for the organisation, and it now carries a jurisdictional dimension: two providers in the same jurisdiction, subject to the same directive, are one exposure wearing two names. Start with Selecting Your Enterprise LLM and read it alongside the Trilemma made real.

Enforcement fails on the numbers: 54% of employees say they would use AI tools even if unauthorised (BCG 2025), and 57% conceal their usage (Gigster 2025), so prohibition simply drives the risk underground. A time-limited AI amnesty converts the blind spot into governance visibility and captures the innovation employees have already validated. And the approved estate deserves the same scrutiny: many Boards have signed off automated decision systems that cannot yet deliver the safeguards UK law now requires, the exposure I call the Reasoning Gap.

In my experience few Boards can answer this from the chair, because the dependency was assembled by default, through procurement choices each defensible on its own and never examined together as a position. The credible answer is a per-deployment map: which processes rely on one model, which of those are customer-facing or regulated, and whether the fallback would survive the specific event. The map is only honest if it counts jurisdiction as well as vendor, since a second provider under the same directive is no fallback at all. The AI Sovereignty Trilemma model frames the trade, and the Trilemma made real shows the bill once it is presented.

Often nobody, because model availability has been filed under IT as an operational setting rather than carried as a third-party continuity risk with a named owner. Continuity planning was built for outages, degradation, cyber incidents, and supplier failure, events the provider is working to reverse. A compelled withdrawal sits outside all of them: the provider stays up, the infrastructure stays up, and the capability goes anyway. The Board’s task is not to choose the vendor or the architecture but to require that the exposure is known, owned, and priced, which is the Minimum Lovable Governance principle applied where it matters. The Trilemma made real sets out the argument.

Almost never, in my experience. Business cases count the hours AI saves and seldom the hours it adds: the reviewing, correcting, and supervising that outputs demand before anyone can rely on them. That labour lands on existing people on top of existing jobs. A survey of 1,488 US workers found 14% of those using AI reporting mental fatigue, the strain attaching to oversight load rather than to AI use itself (BCG Henderson Institute 2026). A control asserted but not resourced exists on paper only, so every proposal should state who performs the oversight, what share of their capacity it consumes, and what that costs fully loaded. The Balancing Item prices the line the business case left out.