Boards and executive committees are giving increasing attention to AI risk. Much of that attention is drawn to prominent external threats: deepfakes, macroeconomic workforce disruptions, rogue models and speculation about increasingly autonomous AI systems. These issues warrant consideration, but they can crowd out a more immediate category of risks arising from decisions the organisation itself can control.

Executive attention is finite. On AI risk, too much of it is being spent in the wrong places. The risks that attract the most discussion are too often not those most likely to undermine an organisation's investment, operations, or public trust. While perhaps less dramatic, risks associated with weak procurement, ineffective human oversight, declining workforce capability, untested production systems, and unrealised benefits, are arguably more immediate and more susceptible to controllable action.

In this article, we look at eight under-discussed AI risks that are both significant and controllable at an organisational level.

Eight blind spots

1. Deskilling of workforce weakens the ability to verify AI output. In a 2025 study of knowledge workers by Microsoft Research and Carnegie Mellon, the more a worker trusted the AI, the less critical thinking was applied. Further, a significant proportion of respondents reported materially less effort on comprehension, synthesis and analysis. This indicates that while the efficiency benefits offered by AI may be real, there is a material risk of workforce atrophy beneath it. Timing is the challenge here since the costs of a workforce that can no longer check the work it depends on arrive years after the efficiency gains.
2. Human oversight may be nominal rather than effective. Use of a “human in the loop” as an AI-related risk mitigation assumes the relevant human is acting consistently and responsibly. In a large online exercise in which more than 40,000 people played as a human approving an AI agent’s commands, the average participant missed an enormous one in three threats. The most dangerous commands, the ones quietly exfiltrating security credentials in the exercise, were incorrectly approved most of all. The failure patterns of human oversight on autonomous systems have long been proven across aviation, health, and industrial safety. AI oversight should build on those lessons rather than relearn them the hard way.
3. Weak specification and evaluation create procurement exposure. Government and enterprises are procuring services with AI built into them, often as a feature of something bought for another purpose and never separately assessed. Even when AI is given attention, the people and processes are often insufficient given the task. The United States Government Accountability Office recently reviewed 13 AI acquisitions and found insufficient requirements definition and testing as consistent core failures, with involved stakeholders noted as lacking the expertise to evaluate what they were buying. When procurement specifications and evaluation methods are weak, the likelihood of both adoption issues and unsuccessful vendor challenges to probity increase rapidly.
4. Copyright in context is different from model training. Debate about AI and copyright has centred on model training, but copying or directing a system to copy, protected works at the point of use raises a more direct problem in Australia. Copying a work into a prompt, index or retrieval database is arguably reproduction, which the Copyright Act 1968 (Cth) reserves to the copyright owner. Despite this, the behaviour is extremely common in Australian government and corporate use of AI. Australia has no general fair use defence and our alternative, fair dealing, is confined to specified purposes such as research or study, criticism or review, parody or satire, and reporting news. The retrieval-augmented generation (RAG) pattern which is popular in Australian corporate and government AI agents can result in protected material being copied on behalf of a user without their explicit action at the point-of-use too. The result is a real copyright infringement risk that is currently under-discussed.
5. Production inputs expose weaknesses hidden by demonstrations. McKinsey’s 2025 global survey found inaccuracy to be the single most common negative consequence that organisations had already experienced regarding AI. A system that performs well on curated test cases can still fall short once it meets the full variety of real-world inputs, and the gap usually shows only when the system is being relied on. While accuracy and risk testing can be performed, too few organisations have invested in developing or procuring such a capability.
6. Benefits remain theoretical unless legacy costs are removed. MIT’s 2025 State of AI in Business found that roughly 95% of enterprise generative-AI pilots delivered no measurable return, and that the divide was approach, not technology. Real-world efficiency benefits frequently depend on decommissioning a legacy system, exiting a contract or reducing headcount. This means that even when AI adoption is going well we see too often that savings realisation becomes an afterthought: the technology lands, but the old system keeps running beside it, and the organisational change that was supposed to pay for the investment is never made.
7. Low entry costs can obscure rising operating expenditure. The entry price is trivial: a per-seat licence, or a fraction of a cent per token. Amid the excitement around AI, cost forecasts rarely get scrutinised. Then usage compounds. Vendor lock-in begins, retrieval inflates every prompt, agents call a model many times for a single task, tokenisers change, and vendors reprice unilaterally every quarter. Addressing costs requires understanding risk, architecture, and potential change management. Managing AI costs well is critical for any organisation with serious AI ambitions, yet few have built teams, or found people, with the knowledge across technology, finance and strategy to do so successfully.
8. Standard capabilities rarely create durable differentiation. When competitors deploy the same copilots wired the same way, adoption dashboards look healthy while nothing differentiating is built. Given the rapid speed that some sectors are moving, standing still is itself a decision. In many instances, investment in AI simply for the purpose of competitor parity is a legitimate strategy, but the frequency of assumed differentiation weakly backed by what is really market-standard behaviour is already leading to confusion around where the return from AI investment is leaking.

Existing laws remain relevant

Existing laws already apply – and new AI use cases can trip over them. Before any AI-specific statute arrives, an AI use case must still satisfy the laws that already apply to the organisation: privacy and cyber, consumer, intellectual property, corporations, anti-discrimination, administrative, and increasingly, workplace and health and safety. The risk is greatest when an organisation requires its people to rely on a tool it has not properly tested or governed. Every Australian jurisdiction now has enforceable duties to manage psychosocial hazards at work, and in February 2026 NSW passed the Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW), (with the substantive provisions to commence following publication of supporting guidance) making AI and other “digital work systems” an explicit work-health-and-safety duty for the businesses that use them to allocate or manage work, the first such duty in Australia. In parallel, the ACTU is pressing for enforceable AI Implementation Agreements and genuine consultation before AI is introduced where it changes how people work. APRA, ASIC, and the CISC have made it very clear that existing laws apply to AI. In each case, AI is becoming relevant to risk categories that the board and executive may not necessarily connect to “AI risk”.

What boards should do

Govern for materiality, not visibility. Boards should ensure organisational attention is directed towards the AI risks that create the greatest potential exposure, not simply those attracting the most public attention. This includes setting risk appetite, scrutinising management's risk treatment approach and seeking assurance that key controls are operating effectively.

For each material AI use case, boards should seek assurance that management can answer five questions:

1. Business dependency: Which critical decisions, services or processes now depend on the system?
2. Operational performance: What assurance exists that the system performs reliably under real-world and adverse conditions?
3. Control effectiveness: How does management know that material failures can be identified, escalated and addressed in practice?
4. Benefit dependency: What organisational changes are required for the anticipated benefits to be realised?
5. Accountability: Who is accountable for performance, risk, compliance and benefits realisation?

What accountable officers and executives should do

Manage the risks within your control. Executives should continue monitoring external developments, but not at the expense of addressing operational risks that already exist within the organisation. For each material AI use case, accountable officers should be able to demonstrate who is responsible, what evidence supports performance and control effectiveness, and how benefits will be realised in practice. Existing risk management disciplines remain highly relevant: assign ownership, implement controls, monitor effectiveness and address gaps before they result in compliance, security, financial or reputational consequences. External uncertainty calls for monitoring, preparedness and clearly defined response triggers. Internal exposure calls for ownership, investment and action.

The response should reflect the nature of the exposure. External uncertainty calls for monitoring, preparedness and defined response triggers. Internal exposure calls for ownership, investment and action. For most organisations, the greatest AI risks are not the ones making headlines. They are the ones embedded in procurement decisions, workforce capability, operational controls and unrealised benefits. Governance should follow materiality, not visibility.

If an organisation's AI risk conversation is spending most of its energy on what is popular rather than what is important, it risks mistaking performance for governance.

Is your organisation focused on the AI risks that matter most? Assess where your greatest exposures lie, whether existing controls are effective and where action is required.