Redefining ERM in the Age of Shadow AI and Third-Party Risk

Enterprise risk management (ERM) once moved at the speed of business. Today, it moves at the speed of a single click.

As organizations race to capture the competitive advantages of artificial intelligence, a widening gap is emerging between AI adoption and risk oversight. For chief risk officers, internal audit leaders, and board members, the challenge is no longer limited to governing the technology an organization develops internally. It now includes governing the intelligence embedded within third-party solutions, and Shadow AI is already being used across the enterprise, often without leadership's knowledge.

One of the most consequential misconceptions in today's C-suite is the belief that AI risk does not exist simply because no formal AI initiative or budget has been approved. In reality, building a resilient enterprise requires risk leaders to address two distinct but interconnected AI frontiers: internal AI use and the rapidly expanding third-party AI ecosystem.

The Internal Frontier: Confronting Shadow AI

The reality of the modern workplace is simple: even when an organization has not officially deployed AI tools, employees often have.

Marketing teams use large public language models to improve content and communications. Developers rely on AI-powered coding assistants. Business users turn to generative AI tools to accelerate research, analysis, and decision-making. As a result, Shadow AI is already active in most organizations, whether leadership has sanctioned it or not.

Without structured governance, these activities can create significant risks. Proprietary or sensitive information entered into public AI platforms may be retained or used to train future models, depending on the provider's terms of service. At the same time, employees may make decisions based on inaccurate or unverified AI-generated content. These errors, often referred to as "hallucinations," can lead to compliance, legal, financial, and reputational consequences that are difficult and costly to correct.

Traditional annual risk assessments were not built to keep pace with technology that employees can adopt in a matter of seconds. To stay effective, ERM frameworks must move beyond periodic reviews and provide ongoing visibility into AI use across the organization. This includes establishing clear acceptable-use policies, educating employees on AI-related risks, and implementing controls specifically designed to manage the risks associated with AI-driven decision making.

The External Frontier: Managing Third-Party AI Risk

Even organizations with strong governance over internal AI use face a growing challenge: their risk exposure now extends far beyond their own walls.

Today's businesses rely on a broad ecosystem of software providers, vendors, contractors, and service partners. Many of these third parties are rapidly embedding AI capabilities into the tools and platforms organizations use every day. As AI adoption accelerates across the supply chain, companies often inherit AI-related risks without actively selecting or deploying the technology themselves.

When a vendor integrates AI into applications used for financial reporting, human resources, customer service, or operational decision-making, the customer effectively assumes some of the associated risk. Yet many organizations have limited visibility into how those systems operate, the data they rely on, or the controls used to validate their outputs.

Rethinking Third-Party Risk Assessments

As AI becomes increasingly embedded in business applications, third-party risk management must evolve beyond traditional due diligence and standard SOC reports.

Risk leaders should examine not only whether a vendor uses AI, but also how that AI is governed. Key questions include: How is data protected? Is there a formal AI governance framework? What controls are in place to monitor model performance, accuracy, and bias? And if an AI-driven error leads to financial, operational, or reputational harm, where does the vendor's responsibility end and the organization’s responsibility begin?

By incorporating AI risk into third-party risk management, organizations can accelerate innovation with greater confidence, improve regulatory readiness, and minimize the potential for costly business disruptions.

AI Governance Is a Business Imperative

Many organizations still view AI as a technology issue, but its impact extends far beyond IT. AI increasingly influences how employees work, how decisions are made, and how critical business processes operate. Whether introduced internally or through third-party vendors, AI-related risks can affect compliance, operations, customer trust, and business performance.

As a result, AI oversight cannot be delegated to a single function. Executive leadership, risk management, compliance, cybersecurity, internal audit, and the board all play a role in understanding where AI is being used and how associated risks are being managed.

The challenge for many organizations is visibility. Employees may be experimenting with AI tools while vendors quietly embed AI capabilities into the platforms the business relies on every day. Without a coordinated governance strategy, leaders may lack a complete understanding of their organization’s AI risk exposure.

Effective governance begins with clear accountability, cross-functional oversight, and ongoing visibility into both internal and third-party AI use.

Turning Governance into a Competitive Advantage

For executive leadership teams, risk committees, and boards of directors, the key question is not whether AI is being used, but whether the organization has the governance, controls, and oversight necessary to manage it effectively.

Organizations that balance innovation with effective risk management will be better positioned to meet regulatory expectations, earn stakeholder trust, and make informed business decisions. Strengthening governance, enhancing internal controls, and increasing visibility into AI use across the organization and its third-party ecosystem can help reduce uncertainty and protect enterprise value.

As AI adoption continues to accelerate, organizations should regularly assess whether their risk management frameworks are keeping pace with evolving risks. A proactive approach to AI governance can support responsible adoption, strengthen resilience, and create a lasting competitive advantage. Organizations looking to evaluate their current approach can benefit from working with experienced risk advisory specialists to identify governance gaps, enhance oversight, and develop practical strategies for managing AI risk across the enterprise.