EY refers to the global organisation, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can help
AI is introducing new risks
AI deployment is outpacing governance. Many firms still treat AI as conventional IT, leaving gaps in AI lifecycle management that overlook unique-to-AI risks like adaptive models, bias or privacy. Oversight cadence is no longer fit for purpose. Board cycles and point-in-time assurance are ill-suited for dynamic, self-learning AI systems. Few organisations have continuous monitoring in place, leaving risks such as model drift or bias undetected and boards without timely insight.
Worryingly, institutions increasingly depend on a small number of AI providers, often without credible exit or fallback plans. At the same time, limited visibility into upstream models and data heightens systemic risk. The nightmare scenario is that failures in opaque third-party AI could cascade into critical operations.
At the same time, AI is also reshaping the cyber threat landscape, expanding increasing attack pathways and compressing response times. Frontier AI models in the hands of attackers will enable accelerated identification and exploitation of vulnerabilities. In this evolving threat environment, entities must continually uplift their security capabilities. Legacy cyber controls are struggling to keep pace, requiring faster, more adaptive defence and response capabilities.
Immediate actions for boards and senior executives
The combination of accelerating AI capability, growing operational dependence and rapidly evolving threat environments means boards require clearer visibility, faster oversight cycles and stronger enterprise-wide coordination now – even where AI adoption remains cautious.