Risk

No AI Exemption: Why the U.S. Doesn’t Need a New AI Law

by
US AI law image

Every few months someone in Washington says America needs a new law to regulate artificial intelligence. Some proposals target today’s chatbots and hiring tools. Others talk about “superintelligence,” systems that might one day outthink us.

I’ve worked in governance, risk and compliance for a long time, and I’ll be honest with you. I don’t think we need a new AI statute. Not because AI is harmless, but because the harms people worry about are already against the law.

Fraud is illegal. Discrimination is illegal. Misusing personal data is illegal. Hiding a breach from investors is illegal. None of that changes because a computer model made the decision instead of a person.

Regulate the conduct, not the tool

American law has a long habit of going after what people do, not the tools they use. We didn’t pass a “spreadsheet act” when businesses moved their books onto computers. Wire fraud was already wire fraud.

AI is the same. A misleading claim is deceptive whether a marketing team wrote it or a model did. A lending decision that shuts out a protected group is discriminatory whether a loan officer made it or an algorithm did.

The Federal Trade Commission has used Section 5 of the FTC Act against companies that overstated their AI, used biased facial recognition, and trained models on data they had no right to use. In some cases it ordered the models deleted. When the FTC announced a sweep of AI cases in September 2024, then Chair Lina Khan said:

Read more

Agentic AI: Risk and governance questions every business should be asking

by

Most businesses are now comfortable with AI that answers questions. You type a prompt, you get some text back, and a person decides what to do with it. Agentic AI works differently, and that difference matters for how you manage risk.

What makes agentic AI different

An AI agent is given a goal and a set of tools, and it works out the steps on its own. It can read your inbox, update a customer record, approve a refund or call another company’s systems, often without anyone checking each step.

That is where the value is. It is also where the risk is. When software can act on your behalf, the question is no longer only “is the answer correct?” It becomes “what did it do, who allowed it, and can we undo it?”

If you are deploying agents, or your staff already use them, here is what you need to know.

Read more

How Agentic AI Is Changing Cybersecurity Threats

by

For years the question was whether AI would help attackers or defenders more. In 2026 we got a clearer answer: it helps both, and it is changing how attacks actually happen.

The big shift is agentic AI. These are AI systems that don’t just answer questions. They plan tasks, use tools, log in to systems and carry out multi-step jobs on their own. It also means attackers now have tireless assistants, and every agent your own business deploys is a new account holding keys to your systems.

Let me walk you through what has changed, what the new risks look like and what you can do about them. Most of this comes from three recent research notes by the Cloud Security Alliance (CSA), plus guidance from NIST, Google and MITRE.

Read more

AI agents are doing real work now. Is anyone watching them?

by

A couple of years ago, most business AI was a chatbot. You asked it a question and it gave you an answer. That has changed. AI agents now read email, query databases, update records and run code, often with the same access as the person who set them up.

That makes them far more useful. It also makes them far riskier, and most companies haven’t caught up yet. I’ve been reading recent research from the Cloud Security Alliance (CSA) on this topic, and here’s what stood out, what you can do about it, and which standards can help.

The challenges businesses are facing:

Agents have too much access

Tools like Microsoft 365 Copilot inherit every permission the user already has. If a file was overshared five years ago and forgotten, an AI assistant can now find it and quote it in an answer. Varonis estimates that over 15% of business-critical files are at risk from oversharing.

There’s a second problem. When an agent acts, access is often checked against the agent’s identity, not the person who asked. So a user can get an agent to do something they aren’t allowed to do themselves, and no alarm goes off.

Read more

The Strategy – Risk Connection 75% of Boards Are Missing

by

Why are most Boards are failing at their number one job?

Many Boards spend two hours reviewing last quarter’s financials.

Fifteen minutes are allocated to “strategic discussion.”

This is not Strategy. This is planning theatre.

And according to McKinsey’s research, it’s happening everywhere. While 100% of corporations have formal strategic planning processes, fewer than 25% report these processes as key to making their most important decisions.

Let that sink in for a moment.

Read more

Your Board is Failing (And You Don’t Even Know It)

by

The uncomfortable truth about corporate governance in 2026.

I sat through yet another board meeting last month. Same agenda. Same discussions. Same decisions that could have been made six months ago.

Sound familiar?

While directors debated last quarter’s financials, the world outside moved at warp speed. AI disrupted entire industries overnight. Geopolitical shocks redrew supply chains. Stakeholders demanded transparency on everything from carbon footprints to executive compensation.

Meanwhile, your board? Still operating like it’s 2010.

Here’s the hard truth: most boards aren’t equipped for the challenges they’re facing today, let alone tomorrow.

Read more