DerpGRC

    Topics in this domain

    AI and Machine Learning Risk

    Emerging technology · 1 min read

    What can go wrong

    AI risks: data leakage, prompt injection, unreliable output, model and data poisoning, third-party and IP, shadow AI.

    Governing AI

    Policy and ownership, inventory, assess risk, approve with controls, monitor and review.

    Banning AI outright tends to push use underground. Approved tools with clear data rules work better.

    Risks and controls

    AI risks mapped to controls: data leakage, inaccurate output, bias, prompt injection, model drift, legal and IP.

    Example. A lender’s AI model began rejecting more applicants from certain postcodes. Monitoring of outcomes across groups caught it within a month; the model was retrained, and decisions above a threshold now get human review.

    How the exam asks about it

    If the question asks…The answer is usually…
    FIRST step in governing AI useInventory AI uses and assign owners
    Staff using public AI tools with company dataAssess the risk; provide approved options
    Risk specific to machine learningBias, drift, poisoned training data
    High-impact AI decisionsHuman oversight and outcome testing

    In short

    • AI brings familiar risks (data leakage, third parties) and new ones (unreliable output, bias, prompt injection, model drift).
    • Govern AI with a policy, an inventory of uses, risk assessment, approval with controls and monitoring.
    • High-impact AI decisions need human oversight and testing for accuracy and fairness.
    • Shadow AI, staff using unapproved tools with company data, is a common early risk.
    • Regulation such as the EU AI Act sets obligations by risk level.

    Exam traps

    • Banning AI outright, which pushes use underground.
    • Approving AI tools without checking what happens to the data entered.
    • Assuming AI output is accurate without testing or review.
    • Treating AI as purely a technology issue rather than a business, legal and ethical one.

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 4 · Emerging technology

    AI and Machine Learning Risk

    The risks of using and building artificial intelligence, from data leakage and inaccurate output to bias, misuse and regulation, and how to govern AI like any other risk.

    1 / 7