Fourth Annual Risk Conference 2026
What it is about
María Luisa Ochoa González, Corporate Director of Non-Financial Risks at Grupo Cibest, presented at the Fourth Annual Risk Conference (September 18, 2026) whether the risk function is ready to enable a safe and scalable adoption of artificial intelligence.
The 14 slides define AI and its types, from automation to agentic AI, show that AI advances faster than organizations manage to govern it, and review the available frameworks: NIST AI RMF, ISO/IEC 42001, the European AI act, the OECD principles and the Singapore and United Kingdom guidance. They detail the seven AI risks according to NIST, a ten-element baseline to manage it, the use of AI for oversight and as a double-edged sword, and its interdependence with other risks.
Objectives
- Explain the speed of AI adoption and why it amplifies risk.
- Present the standards and regulations available to manage AI risk.
- Propose a baseline to prepare the risk function.
Key takeaways
- When the system stops merely processing and starts executing decisions, it gains value but requires more governance and control: more autonomy, more risk.
- The seven AI risks according to NIST are validity and reliability, safety, security and resilience, accountability and transparency, explainability, privacy, and fairness and bias management.
- The management baseline includes clear governance, an inventory of use cases and models, classification by criticality, policies and controls, information quality, talent and culture, independent validation, automation of the risk function, human in the loop and cross-functional work.
- AI watches signals and the human decides: oversight can be delegated to AI, but responsibility is always human.
- AI is not just one more risk but the thread that connects and amplifies several risks; there is also a risk in not adopting it.
Connect with our networks