Between critical issues and opportunities, AI redefines enterprise risk management

Is there a difference between large and medium-sized enterprises?

Large companies, especially in regulated industries, can benefit more from the use of AI because they have adequate data volumes, resources to invest and governance that is more ready to integrate new innovative tools. However, we observe that many medium-sized companies are also rapidly bridging the gap, thanks to access to cloud platforms, pre-trained models and partnerships with tech providers. The point of the question is not so much 'whether' artificial intelligence works, but how quickly and deeply organisations are able to integrate it into key processes. Those who do, not only gain efficiency, but change the way they manage risk: more predictive, more responsive and more integrated with the business.

Why are companies in healthcare and finance further ahead in the adoption of AI and GenAI?

For a combination of structural and contextual factors. In both sectors, regulatory pressure is high, operational and reputational risk is significant and data availability is extensive. These conditions have created the ideal ground for the integration of smart technologies, initially to improve efficiency and today to enable new business models. In the financial sector, AI is a strategic ally for risk management, fraud prevention, continuous customer monitoring and optimisation of anti-money laundering processes. In the health sector, algorithms support the analysis of medical records, claims management, assisted diagnosis and the prediction of health risks, contributing to more timely and personalised decisions. In both contexts, the distinguishing element is that technology is not just an efficiency driver, but a value accelerator that enables action to be taken sooner, better and with greater precision. For this reason, return on investment is no longer a long-term promise, but a tangible benefit in the short to medium term.

Your report tells us that enabling risk-based decision-making can generate significant impacts on total shareholder return: what exactly does this mean?

Risk-based decision making means bringing risk variables - operational, financial, reputational, regulatory - to the centre of strategic decision-making processes. Companies that adopt this approach do not simply manage risk, but integrate it systematically into the planning and evaluation of growth options, building scenarios and simulating impacts before taking action. In other words, more 'risk-aware' organisations make faster, more focused and resilient decisions and in complex situations - such as market shocks, geopolitical crises or 'disruptive' events in the supply chain - they are able to limit losses, adapt more quickly and, in some cases, capitalise on the difficulties of others. It is not just a matter of defending oneself better, but of using risk as a lever to compete: in a scenario of uncertainty, the competitive advantage shifts to those who know how to read the context in real time and react with lucidity even under pressure.

AI is drastically changing the role of the risk & compliance function: are we sure it is doing so for the better?

Yes, artificial intelligence is profoundly changing the role of this function and it can definitely do so for the better. Traditionally engaged in manual activities and ex-post controls, control figures have the opportunity to evolve towards a strategic role made up of predictive analysis, proactive support to the business, and control of emerging risks such as the protection of intellectual property. However, this change is neither automatic nor risk-free. It needs solid governance, based on frameworks such as 'Responsible AI' or AI-specific risk management models. And, nonetheless, new skills are needed: data science, advanced analytics, knowledge of models and their vulnerabilities.

Is management able to manage this transformation?

Management has a key role to play and must avoid two mistakes: underestimating risks such as cognitive bias, security and data quality, and not investing in upskilling skills and innovative tools. In both cases, the risk is to stop in the middle of the transformation. If managed correctly, AI does not replace the role of Risk & Compliance functions but amplifies it. And from being a control barrier, it can become an enabler of innovation, making a real contribution to developing resilience, decision-making speed and competitiveness.

How much is the problem of skills shortages really perceived (or underestimated) and how much can AI actually contribute to the training process?

The skills gap is one of the real critical nodes of the ongoing transformation. Top management is increasingly aware of the gap, but the speed at which technology evolves makes it difficult to estimate today which skills will be truly strategic tomorrow. It is not just a question of data scientists, as we need profiles capable of managing models and validating their results, governing ethical risks, data security and quality, and data engineering. Paradoxically, it is precisely AI that can help bridge this gap, as GenAI tools enable new approaches to training that are more personalised, interactive and also more adaptive. Indeed, we move from static programmes to dynamic paths that include simulations, virtual tutors and generative scenarios, allowing Risk & Compliance functions to rapidly train a much larger number of people, accelerating their learning and reducing their complexity. The real challenge is not only to acquire skills, but to do so in a scalable, continuous and future-proof manner. In this sense, AI is part of the problem, but also part of the solution.