Northern lights, stones and silhouette of alone girl on mountain trail
Northern lights, stones and silhouette of alone girl on mountain trail

GLOBAL RISK TRANSFORMATION SERIES

How will AI redefine resilience for risks not yet imagined?

AI’s speed, scale and insight are game changers for driving resilient growth in today’s complex risk environment.


In brief

  • Many Risk functions are in wait-and-see mode on AI adoption, but its fast-improving capabilities make that stance increasingly untenable.
  • Realizing value requires moving from using AI to automate existing processes to fundamentally redesigning processes around the strengths of AI.
  • Despite uncertainty about the speed and timing of AI’s evolution, companies can move ahead with AI that is “built-in” and future-ready.

This article is the third installment in our Risk Transformation Series. For the first two articles, see How can reimagining risk prepare you for an unpredictable world? and When the world shifts overnight, can you operate at the speed of trust?

As we write this article, Risk leaders everywhere are grappling with two external shocks: the conflict in middle east and subsequent closure of the Strait of Hormuz, as well as the unprecedented capabilities of frontier AI models to identify cyber vulnerabilities at massive scale. 

This piece offers no advice on responses to either crisis. Because how you react to these challenges is not the issue — the issue is whether you are still reacting, and how much longer you plan to remain in reactive mode. The question is not just these disruptions; it’s disruptions like these. By the time you read this, these crises may well have faded, but they will almost certainly have been supplanted by other systemic shocks. 

These two disruptions highlight a central tension confronting Risk, Strategy, and Technology leaders. The Hormuz Crisis exemplifies a shift EY calls the NAVI world — a post-pandemic environment in which risks are increasingly nonlinear, accelerated, volatile and interconnected. Surviving and thriving in this climate requires a fundamentally different approach to risk management, which is all but impossible without the speed, scale, and insight of AI. Yet, as illustrated by frontier AI’s cyber breakthroughs, the evolution of AI is itself NAVI. New frontier models and capabilities can emerge unexpectedly, upending companies’ AI adoption plans and the assumptions on which they were based — uncertainty that can make leaders hesitant to fully embrace AI. 

2026 EY Global Risk Transformation Study - AI and Resilience PDF

The way around this quandary is through an adoption strategy in which AI is both built-in and future-ready. We discuss the path to developing such an approach in the rest of this article: 

  • Chapter 1 discusses why AI is indispensable for risk management in the NAVI era, and how a “built-in,” AI-native approach is critical for realizing the full value opportunity

  • Chapter 2 uses survey data to highlight that “wait-and-see” is no longer good enough when leading companies are already deploying AI to transform risk management

  • Chapter 3 identifies how AI’s nonlinear evolution creates the corollary challenge of adopting AI in future-ready ways

  • Chapter 4 provides the path forward to address these challenges: built-in, future-ready AI adoption using the Value Blueprints framework to scale rapidly and improve value 

How you react to these challenges is not the issue — the issue is whether you are still reacting, and how much longer you plan to remain in reactive mode.

Aurora Borealis (Northern Lights) over Scandinavia from the International Space Statio (ISS). Elements of this immage supplied by NASA.
1

Chapter 1

Reimagining the risk function for the AI era

Realizing value from AI’s speed, scale and insight requires rethinking risk with an AI-native, built-in approach.

“The post-pandemic risk environment has become increasingly complex,” says Bill Diaz, CEO, Archer. “Risks now show up everywhere, at any time, often triggering chain reactions. The pace is faster, the effects larger. AI is vital for managing risk in this environment; it’s critical for handling today’s increased volume and complexity, as well as for responding to risks in real time.”

 

As companies have been buffeted by the volatility of recent years, resilience has become a mantra. But the NAVI risk environment didn’t just bring more risks; it also fundamentally reshaped the nature of risk itself. By the same token, companies need not just more resilience, but different resilience — they need to rethink and reframe what resilience means in a new world of risk.

 

If the traditional approach to resilience was reactive and limited to safeguarding business continuity, the new approach is equally about being proactive and driving strategic growth. Like any good game plan, this includes both offense and defense. Offense ensures your strategic planning is built on a comprehensive understanding of emerging risks and their strategic impacts. Defense ensures you can maintain fundamental promises in the face of NAVI’s disruptions. The end result? A symbiotic relationship in which strategy becomes resilient, and resilience drives strategic growth.

 

To achieve this vision, risk management needs to change in three critical ways:

  1. Companies need the ability to sense and respond to rapidly changing developments in real time.
  2. Risk functions need to model vast numbers of assessments and scenarios at massive scale as the number of risks, and interconnections between risks, proliferate — and as tail risks once considered low-probability merit more serious consideration.
  3. Firms need to make failures of imagination a thing of the past at a time when companies are repeatedly caught unawares by external shocks and nonlinear tipping points — as well as the unexpected downstream impacts of interconnected, cascading risks. 

These shifts require moving beyond the limitations of human capability; achieving a NAVI-ready Risk function with manual processes alone is all but impossible. So, emerging technologies, and especially AI, become indispensable. AI can reinvent risk management with three game-changing capabilities:

  1. Speed replaces slow-and-periodic manual processes with rapid-response, real-time automated ones.
  2. Scale analyzes variables and scenarios in quantities many orders of magnitude beyond human capacity.
  3. Insight meets the complexity of the NAVI risk environment with advanced analytical capabilities, as well as the potential for overcoming human behavioral biases and blind spots — from confirmation bias and desensitization to cognitive overload and decision paralysis. 

But realizing value from the full potential of these capabilities is not a given. Instead, the value you realize depends on how you deploy AI. 

Leading companies are moving away from making AI accretive to a process, and are instead looking at using AI to fundamentally reinvent processes.

Initially, many companies have pursued the proverbial low-hanging fruit of automating their existing processes for efficiency gains — such as by adopting governance, risk and compliance (GRC) platforms. This can deliver tangible and near-term results, from standardizing taxonomies and automating manual processes to increasing coordination. Leading GRC platforms are increasingly embedding agentic capabilities to evolve static workflows into more adaptive, AI-enabled execution.

AI is the indispensable game changer — but only if you use it to build the future of risk management; not automate its past.

The incremental approach of automating existing processes has been a good starting point. It can demonstrate proof-of-concept and deliver near-term return on investment. It is also the least disruptive to legacy operating structures and the easiest lift in terms of implementation. 

But it’s not where the biggest gains lie. “Most companies have felt compelled to adopt AI,” says Raul Villar Jr., CEO, Optro. “Every board and C-suite has been focused on how they can leverage this technology to their benefit. And so everyone’s invested in AI, but most have yet to see the return they were expecting on those investments. Our acquisition of Midship, an agentic AI platform, was driven by a desire to accelerate value realization and a conviction that the future of GRC isn't faster audits, it's fundamentally different ones.”

Indeed, realizing the full value of AI comes from structural transformation: not automating existing processes, but reimagining them from the ground up in an AI-native way. 

“Leading companies are moving away from making AI accretive to a process, and are instead looking at using AI to fundamentally reinvent processes,” says Dan Diasio, EY Global Consulting AI Leader. “They are transforming ways of working. This means challenging whether a particular process is still needed, and what the future, AI-native process should instead be. The real value realization opportunity is not from using AI as a bolt-on but making AI built-in to processes and functions.” 

This “built-in” approach to AI opens the door to fundamentally rethink existing processes and functions. Examples of such shifts are provided in the accompanying table. 

Bolt-on AI

Built-in AI

Risk Appetite

AI supports existing risk appetite processes 
(e.g., summarizes exposures, drafts committee materials, compares appetite statements to recent incidents)

AI dynamically reassesses risk appetite, in alignment with strategic goals 
(e.g., continuously synthesizes internal + market data and aligns with strategic goals to adjust risk appetite in real time)

Risk Identification and Assessment 

AI automates manual processes 
(e.g., implements surveys and interprets free-text responses, edits/standardizes risk descriptions, calculates assessments based on traditional likelihood x impact metrics)

Scenario-generation engine identifies and assesses risks at massive scale, eliminating failures of imagination
(e.g., simulates thousands of scenarios to surface tail risks and cascading impacts, assesses risks based on future impact on strategic goals, moves from sampling to population analysis)

Risk Mitigation

AI makes existing mitigation workflows more efficient 
(e.g., recommends controls, reviews mitigation responses, standardizes remediation actions inside GRC platforms)

AI predefines strategic mitigation at scale  
(e.g., ownership/escalation are pre‑wired and embedded into agentic workflows, scenario generation at scale enables mitigation of huge universe of risks)

Monitoring and Detection

AI assists episodic, calendar-driven approach 
(e.g., writes/edits periodic reports and audits focused on compliance metrics and driven by audit/reporting calendar)

Multimodal scanning agents monitor risks in real time across the enterprise
(e.g., agents embedded in the first line monitor diverse data streams to continuously reassess probabilities of emerging risks, world model of company operations continually assesses impact on operations and strategic goals)

Risk Response

AI assists after-the-fact response to enable business continuity
(e.g., automated alerts require humans-in-the-loop to review, deliberate and implement the response)

Agents and humans-on-the-loop use predefined playbooks for agile, real-time response 
(e.g., dynamic dashboards update human managers about emerging risks, crossed thresholds trigger protocols by agents and notification of humans-on-the-loop at relevant decision points, protocols can adapt as needed to changing circumstances)

Unrecognizable person in red jacket walking through snowy terrain under a vibrant aurora borealis on a clear winter night, leaving footprints behind.
2

Chapter 2

“Wait and see” is no longer good enough

The future is already here — are you ready for it?

AI adoption — and particularly, using a built-in AI approach to drive risk transformation — is essential for resilience in the NAVI risk environment. Yet, much of the Risk world has been slow to adopt AI and other emerging technologies, all the more so when it comes to deploying tech in truly transformative ways. 

 

Large majorities of Risk Strategists — which frame their Risk functions as enablers of strategic growth — see the disruptive potential of emerging technology:

  • Seven in ten (70%) of Risk Strategists agree that AI will fundamentally transform the operating model of their Risk function, compared to only 40% of Risk Traditionalists.

  • Similarly, 67% of Strategists say that emerging technologies have the potential to fundamentally change how they approach risk management to be better aligned with the NAVI risk climate, compared to only 41% of Traditionalists.


But while robust majorities of Risk Strategists see the potential, adoption numbers are considerably lower, and the gaps between Strategists and Traditionalists are smaller still. Action lags ambition. 

The two technologies with the greatest adoption are traditional AI and natural language processing. These are also the oldest technologies covered in the survey, both pre-dating the mainstream emergence of generative AI. For the other technologies in our survey — which have greater potential for driving risk transformation — adoption rates, even by Strategists, are much lower. 


Risk functions are applying emerging technologies across both incremental and transformative use cases to a similar extent. However, Traditionalists lag Strategists by almost twice as much in transformative use cases (8.2 percentage point gap) than for incremental use cases (4.5 percentage point gap). 


The top AI adoption barrier cited by survey respondents (45%) is low prioritization of risk versus other use cases. This raises a corollary question: why is AI adoption for risk transformation not being prioritized? From our interviews with risk leaders, including at many Risk Strategist organizations, an oft-cited sentiment was that they were in “wait-and-see” mode until the technology is more proven to justify wide-scale adoption. 


In future crises, companies that are using built-in AI to transform their Risk functions may be better prepared for unfolding impacts ahead of time and, consequently, well before their competitors... The game will be over before it's started.

What’s left unsaid is that assuming a “wait-and-see” approach to technology adoption also means that a company remains in wait-and-see mode on its ability to respond to emerging risks. So far, the crises of the NAVI operating environment have seen most companies caught unprepared, leaving them to scramble after the fact to respond. So far, this hasn’t been a source of competitive disadvantage, since everyone was in the same predicament. 

But that’s changing. The accompanying guest perspective, by the Global Chief Risk Officer of a leading European automotive manufacturer, illustrates how one company is using AI and embedding AI agents in its first line to transform its approach to risk management. The company has already achieved proof of concept, and says its agentic system gave it advance warning about the impact of helium shortages arising from the Strait of Hormuz closure. 

In future crises, companies that are using built-in AI to transform their Risk functions may be prepared for unfolding impacts ahead of time and, consequently, well before their competitors. At this point, “wait-and-see” will no longer be good enough. If you’re waiting until after a crisis to figure out the knock-on implications that could impact your business, it’s already too late. You will be competing against organizations that have identified the scenario, mapped out cascading risks and impacts on their business, prepared response plans, and assigned ownership and oversight — all ahead of time. The game will be over before it’s started. 

[Our AI-based system] identified the potential impact of a Strait of Hormuz closure on the supply of helium and its impact on our manufacturing processes — well before this topic was being explored in the media.
Red and rose valley, fairy chimneys, Zelve, Goreme,  Devrent Valley
3

Chapter 3

AI is accelerating, with unexpected pivot points

Is your tech strategy future-ready for the next frontier model disruption?

In recent months, the approach to GRC implementation has been complicated by breakthrough capabilities in autonomous/agentic AI and “vibe coding,” which are disrupting the software-as-a-service (SaaS) model and reframing the traditional build-vs-buy decision. There are perceived benefits from either approach — such as leveraging higher levels of support and expertise from a SaaS provider, versus increased control over enterprise data and customizability from going it alone. But, in this fast-changing space, even those assumptions aren’t standing still. Even as some organizations are bringing development in-house to gain tighter control, major GRC and SaaS providers are accelerating their own AI-native architectures — offering a “buy” option that delivers similar customizable, agentic capabilities without the heavy internal engineering burden. (For an example of a company that is going the “build” route, see the accompanying guest perspective from Adam Frank and Ramesh Raju of Uber). 

Rather than simply accelerating existing manual processes, we use AI to fundamentally change how information is consumed, interpreted, and applied across the compliance lifecycle.

The decision about where, and to what extent, to build vs buy will depend on the circumstances and goals of individual companies. But the fact that these decisions are being reconsidered at all illustrates a larger truth. Emerging technologies aren’t just a solution to managing risk in a NAVI world — their evolution is itself nonlinear, accelerating, volatile and interconnected. 

Consider how AI models have been developing new capabilities at an accelerating pace. Or consider how frontier models achieve breakthrough capabilities in a nonlinear manner, creating volatility and repeatedly catching the business world by surprise. The initial 2022 launch of ChatGPT was itself a nonlinear moment, for which most of the business world was unprepared. Most recently, new frontier models with the capability to expose software vulnerabilities at unprecedented scale have blindsided the cybersecurity world, challenging long-standing assumptions about threats, capabilities, and cybersecurity approaches. 


The nonlinear evolution of AI creates a quandary for risk leaders. For companies looking to adopt AI in transformative and built-in ways, how do you ensure your adoption is future-ready? Before you embark on a months-long journey of tech-driven risk transformation, how do you safeguard against the possibility that, partway through the process, the next frontier model could upend your assumptions about cost, benefit and capabilities? 

The answer is through making Value Blueprints the foundation of your risk transformation — which we explore in the next chapter. 

Red and rose valley, fairy chimneys, Zelve, Goreme,  Devrent Valley
4

Chapter 4

Building an AI-native, future-ready risk function

How can you address multiple adoption barriers to move ahead with confidence?

The accompanying chart shows the barriers Risk functions face in adopting AI. These include the low prioritization of risk use cases, integration challenges, data constraints, security concerns, and issues related to talent, budget and cost.


By now, this is a familiar list. Numerous surveys have surfaced similar concerns with respect to AI adoption. The question is what you can do to overcome them, particularly when you simultaneously face several, or all, of these constraints — as many organizations do. 

The nub of the matter is that these constraints are not independent variables. Instead, they are deeply interconnected, exacerbating and compounding each other. Low prioritization hampers investment, which intensifies budget and talent constraints. Talent and data gaps deepen integration challenges, which in turn delay data readiness. Such linkages create a self-reinforcing vicious cycle that undermines the thesis for AI adoption.  

To break out of this doom loop, Risk functions need to address adoption constraints with a cohesive and interconnected approach that tackles all of them. This is exactly what the EY.ai Value Blueprints framework (via EY.com US) provides, and why it should be the foundation of your approach to AI adoption. The seven layers of framework are interlinked; they feed off each other, creating value that grows exponentially instead of plateauing quickly. (For more, see the accompanying perspective by Dan Diasio). 

When organizations add AI use case-by-use case, value rises incrementally, then plateaus. When they instead shift to a blueprint-by-blueprint approach... effort decreases with each subsequent blueprint, while value compounds exponentially.

Use the Value Blueprints framework to address your constraints — data, governance, talent, etc. — in an interconnected way, so they build on each other to create a multiplier effect. Approach every step of the process with a focus that is both AI-native and future-ready: 

  • Being AI-native: Think boldly to fully leverage the capabilities of today’s frontier models. Instead of carrying forward legacy processes and seeking to automate them, reimagine what processes would be best suited for an AI-native Risk function. 

  • Becoming future-ready: Anticipate and prepare for future inflection points. This is feasible, despite the seeming unpredictability of nonlinear change. While we may not know when the next nonlinear shifts will arrive, it’s much easier to see what they are likely to be — they are being worked on, discussed, and even incorporated in some newer models. Think through how emerging capabilities would fit into your approach, and be ready to pivot when the next inflection point arrives. Reframe adoption barriers, transforming them from justifications for remaining in wait-and-see mode, to potentially temporary challenges that may resolve with AI’s continuing evolution. 

1. Define your ambition and value opportunity

Start with defining the vision and ambition for your Risk function. What does the AI-native, built-in version of your Risk function look like? This includes exploring several questions with respect to both today’s AI and the likely capabilities of future frontier models. 

Being AI-native: 

  • Starting from a blank sheet (i.e., not limited by legacy processes) what is your AI-native vision for your risk processes and operating model? 

  • Which risk management practices will become obsolete, and which new ones will need to emerge, for this vision to be realized? 

  • Where do the biggest value pools lie? What will become commoditized and plentiful in this future state, and what will become the new drivers of value? 

Becoming future-ready:

  • How will potential inflection points and relevant emerging capabilities (e.g., agentic and autonomous AI, on-device/edge AI, small language models, multimodal AI, reasoning AI, world models/spatial intelligence, persistent memory) shift the frontier of capabilities for risk management in your organization?

  • What limitations today are temporary barriers that might be overcome in the near future as capabilities improve? For instance, might synthetic data generation help address data availability, small language models lower high compute costs, and no-code/low-code AI mitigate talent shortages?

  • How can you layer different models/capabilities based on where they are most suited? For instance, small language models may be ideally suited for developing domain-specific AI agents embedded in the first line, while Reasoning AI and World Models could take a scenario generation engine to the next level.

2. Reimagine your processes and workforce

Next, reimagine your processes and workforce. These are inextricably linked in any AI-native risk transformation; they should be reimagined together as a single design problem, rather than as separate transformation tracks.

Processes

Reimagine processes to leverage the core capabilities and strengths of your AI and human workers. This could include creating continuous flows so AI can conduct real-time monitoring and response, or develop scenarios and simulations at massive scale. The goal should be to design workflows that can adapt and optimize in real time, while humans direct strategic outcomes.

Challenge legacy structures and silos. For instance, the traditional approach of classifying risks into discrete categories — financial risk, operational risk, regulatory/compliance risk, cyber risk, and so on—may no longer be optimal in an AI-native organization optimized for the NAVI risk environment. Instead of discrete risk types, how should you restructure your processes and organizational structure based on interconnected and systemic risks? Where should you intentionally blur boundaries within the risk operating model — such as in the three lines model?

Workforce

Realizing value from redesigned processes requires developing skills and redefining roles to empower human employees to work effectively alongside AI. 

Rethink job definitions and categories. Every job is a bundle of skills, responsibilities, and tasks. Do the ways in which these have been bundled in the past still make sense? If not, how should they be unbundled and repackaged? Which parts of these legacy bundles can be done best by AI and other technologies, and which ones should humans specialize in? 

With the arrival of agentic systems increasingly capable of operating autonomously, a future-ready approach also requires preparing the workforce for the transition from human-in-the-loop to human-on-the-loop oversight. 

“As AI matures and takes on more of our work, it will increasingly look to humans to make decisions requiring judgment,” says Sinclair Schuller, EY Americas Responsible AI Leader. “A model might perform vast amounts of work, then turn to a human to decide between Option A and Option B. Both options are valid and correct, so human judgment is required to pick between them. This is an example of human-on-the-loop oversight — as opposed to a human-in-the-loop approach, in which people directly intervene at a much finer grain and smaller scope. Keeping humans in the loop is certainly appropriate in some situations, but as technology matures, we will increasingly move to human-on-the-loop.”

Keeping humans in the loop is certainly appropriate in some situations, but as technology matures, we will increasingly move to human-on-the-loop.

Risk functions, in particular, may have a natural instinct to retain humans in the loop, especially if this is assumed to be the lower risk option. But, to maximize value from agentic AI and autonomous systems, risk leaders should carefully assess where an on-the-loop approach might be feasible. They should also be willing to challenge the assumption that in-the-loop necessarily carries lower risk. Being involved in every detailed decision can lead to a numbing effect for workers; an approach that selectively escalates decisions for human oversight only when appropriate might well provide more effective governance. 

Anticipating and preparing for the shift to human-on-the-loop systems requires deliberate action and investment. This includes investing in training and upskilling to empower your workforce to function effectively in this new capacity. It includes quantifying and articulating thresholds that trigger human oversight, escalation pathways to route decisions to appropriate individuals, and dashboards to enable monitoring by human overseers. 

3. Develop the supporting foundation of data, governance, and technology

The third step is to focus on technology, data, and governance. AI cannot effectively scale unless these are designed together as a unified and integrated supporting foundation. 

Data

Data forms the basis for decision making in the AI-native Risk function. Unify and connect disparate data streams, and embed data directly into workflows. Agentic AI, in particular, requires investing in semantic and structured data, so agents can accurately interpret meaning and relationships in context. Developing real-time risk monitoring and decision-making systems requires investing in and integrating continuous data feeds from within and outside the organization. 

To be future-ready, identify and anticipate the data readiness requirements of emerging AI capabilities — for instance, edge AI and small language models will require a decentralized data strategy, while multimodal AI requires diverse signal integration. 

Governance

Robust governance is a scaling enabler — creating the trust essential for AI to gain adoption. Agentic AI systems need governance embedded in execution — such as real-time controls, guardrail agents, and kill switches. As discussed above, it also requires assessing where governance can effectively move from a human-in-the-loop to a human-on-the-loop approach. 

Technology

Technology is the core of the AI-native Risk function. As discussed above, harnessing its transformative power requires building AI-native infrastructure, not bolt-on tools. A cohesive approach, using the Value Blueprints framework to develop a vision for your AI-powered Risk function — while simultaneously transforming your processes, workforce, data, governance, and technology — will enable agentic execution at scale across the Risk function and enterprise

Kyle Lawless, Senior Manager – Risk Consulting, Ernst & Young LLP; Arun V. Tom, Assistant Director, EYGBS (India) LLP; AnnMarie Pino, Associate Director, Ernst & Young LLP; Joe Morecroft, Associate Director, EYGS LLP; and William Reid, Assistant Director, Ernst & Young LLP, contributed to this article.

Summary

A new world of risk needs new ways of managing risk. Manual processes and failures of imagination will no longer suffice. AI is the indispensable game changer — but only if you use it to build the future of risk management; not automate its past. Implement AI that’s built-in and future-ready. Use Value Blueprints to ease adoption constraints, find a faster and accelerating path to value — and, ultimately, shape an organization that’s resilient in the turbulence of the NAVI world.

Related articles

How can you redefine resilience for the next frontier of vulnerabilities?

An EY study found that 36% of assets in organizations are vulnerable to cybersecurity threats. Explore your sector’s strengths and weaknesses.

When the world shifts overnight, can you operate at the speed of trust?

Risk operating models must become strategy-first, trigger-based and governance-forward. Learn how Risk Strategists are leading the way.

How can reimagining risk prepare you for an unpredictable world?

The 2025 EY Global Risk Transformation Study explores how Risk Strategists see disruption earlier, adapt faster and respond with more precision.

Contact us
Like what you’ve seen? Get in touch to learn more.

About this article

Authors