What risk leaders need to do now about agentic AI

Agentic AI empowers risk management, but only leaders who adapt operating models, evolve the CRO role and upskill teams will unlock its value.

In brief

• Agentic AI is poised to revolutionize risk management, offering unprecedented efficiency and strategic advantages for organizations willing to adapt.
• To harness AI's full potential, risk leaders must rethink operating models and adopt new roles and processes that integrate human and machine collaboration.
• Organizations that upskill and develop frameworks to embed AI into operations can accelerate progress, build trust and help ensure responsible AI use.

The challenges faced by chief risk officers (CROs) have never been sharper. CROs are expected to harness artificial intelligence (AI) to capture risks more comprehensively, automate processes and boost efficiency, yet at the same time, to safeguard the human judgment that underpins sound decision-making.

As one CRO recently admitted, her excitement about AI’s potential was matched only by unease about its implications for her team: Would these tools elevate their expertise or quietly erode it?

Her dilemma captures the inflection point the profession now faces. The question is no longer if AI will transform risk management, but how to shape that transformation – preserving the judgment, accountability and foresight that define true risk leadership.

This tension lies at the center of every conversation we’re having with risk leaders. The real issue isn’t man versus machine, but how to redesign the risk function so AI amplifies human insight – reshaping team dynamics, decision-making and the skills that define the next generation of risk professionals.

Our view is clear: AI offers a once-in-a-generation opportunity to transform risk management. When embedded into redesigned processes, it can dramatically expand risk coverage, elevate the experience of managing risk and enable faster, better-informed decisions.

Risk Strategist mindset

The 2025 EY Global Risk Transformation Study identifies two archetypes: Risk Strategists and Risk Traditionalists. Risk Strategists are organizations that have embraced strategic, tech-enabled approaches to risk, making them 48% more likely to reduce unexpected risks and 35% more likely to improve incident response times.

Agentic AI represents the next evolution of this mindset: it requires the cultural readiness, structural agility and innovation orientation that Risk Strategists have begun to cultivate. By leveraging AI, these organizations can strengthen their risk management capabilities – broadening coverage, improving data quality to generate faster insights, enabling better decision-making and ultimately building a more proactive risk posture.

In contrast, Risk Traditionalists – those still operating in siloed, compliance-driven models – will struggle to realize the benefits of agentic AI unless they transform their foundations.

As organizations navigate this transition, risk leaders must foster an environment that encourages experimentation and learning, improving both human and AI capabilities for optimal outcomes.

The latest EY/Institute of International Finance (IIF) global bank risk management survey highlights the challenges facing today’s CROs:

• The risk landscape is broadening. Data risks (privacy, governance and control) and the use of AI within organizations are moving rapidly up CROs’ risk agendas.
  
  
• 57% of banks recognize that increased AI adoption will be a key initiative to help manage this expanding risk profile.
  
  
• 12% of respondents report not using AI at all, while most of those that do are applying it primarily to anomaly detection and automation of operational tasks, i.e. the lower end of the value spectrum.
  

Barriers to adoption

As the EY/IIF survey shows, the path to adopting agentic AI isn’t without its challenges. Risk leaders face mounting pressures from various fronts – rising productivity demands, the need to grapple with geostrategic impacts, regulatory scrutiny and acute talent shortages. Although pilot programs indicate that AI can deliver productivity gains of up to tenfold, many organizations struggle with the necessary cultural and organizational shifts for successful adoption.

Agentic AI requires a transformation that goes beyond simply implementing generative AI (GenAI); it demands a rethinking of how risk professionals develop their skills and judgment. The EY risk transformation study shows only 32% of organizations globally qualify as Risk Strategists. The rest are held back by risk-averse cultures, siloed structures and an inability to quantify the ROI of advanced risk management – barriers that will inhibit agentic AI adoption.

Closing the skills and trust gap

Compounding these challenges is a significant skills gap in AI fluency. According to the Financial Services Skills Commission report¹, 81% of firms experience a lack of specialist talent as a barrier to adopting AI. Organizations should ensure their workforce combines AI knowledge with deep business understanding and essential human skills such as judgment, adaptability and ethical decision-making. Embedding AI ethics into operational frameworks is non-negotiable for a profession built on safeguarding trust.