Issue 2 The Risk Issue

AI is no longer experimental. It is operational. And with operations comes risk.

The second issue of AI Works is dedicated entirely to the question of risk — not abstract, theoretical risk, but the concrete, operational risks that keep enterprise leaders awake at night.

The New Risk Landscape

In 2024 and 2025, the conversation about AI risk was dominated by existential questions. Would AI destroy humanity? Would it take all our jobs? These questions have their place, but they are not the questions keeping CIOs and Chief AI Officers up at night.

The real questions are more immediate:

• What happens when our autonomous agent makes a decision that harms a customer?

• How do we assure our board that our AI systems are compliant with emerging regulation?

• Who is liable when an AI-driven process fails?

• How do we detect and respond to adversarial attacks on our models?

• What is our incident response plan when something goes wrong?

Threat Modelling for AI Systems

This issue introduces a practical framework for threat modelling AI systems — not as a theoretical exercise, but as a structured, repeatable process that every enterprise should adopt.

We break down the threat landscape into six categories:

1. Data Threats — Poisoning, bias, leakage

2. Model Threats — Adversarial attacks, drift, collapse

3. Infrastructure Threats — Security of the platform, supply chain vulnerabilities

4. Operational Threats — Human error, process failure, integration risk

5. Regulatory Threats — Compliance, enforcement, reputational damage

6. Strategic Threats — Misalignment with business goals, overinvestment, underperformance

Assurance: The New Imperative

Boards are no longer asking “Should we use AI?” They are asking “How do we know it’s safe?”

This issue examines the emerging practice of AI assurance — the independent assessment of AI systems against standards of safety, fairness, and reliability. We look at the frameworks being developed by regulators, the tools being built by vendors, and the practices being adopted by leading enterprises.

When Things Go Wrong

We also examine real-world incidents — not to sensationalise, but to learn. What happens when an autonomous system gets it wrong? What were the root causes? What could have been done differently?

This is not a comfortable issue. It is a necessary one.