Library
White paperMichael Clark
Buying AI Risk
In our experience, most organisations carry AI exposure they cannot yet measure, and the cost is already being paid as retained loss and administrative cost: the internal hours spent assembling answers. Because exposure can differ by orders of magnitude between systems and the law binds system by system, eight definitions and a nine-stage programme measure exposure per system from evidence produced when decisions are made. Existing cover should be mapped before anything is bought, and any insurance return treated as an option rather than a projected saving.
Key findings
- Of the four components of total cost of risk, only control spend is visible for AI: premium cannot be attributed, and retained loss and administrative cost sit in internal hours, never a claim.
- Two AI systems on the same infrastructure can carry exposure differing by orders of magnitude, so an organisation-level maturity score can improve while the exposure worsens.
- Investigation and defence are in the authors' view often a larger cost than penalties, and the penalty itself may not be insurable, which raises the value of the controls and their evidence.
In the paper
- The cost is in the answering
- Three of the four components are dark
- Six questions, four positions
- One score cannot describe an estate
- What the cyber market suggests
- Ask the coverage question first
- What the method does not promise
Michael Clark
Chief Executive Officer, Standard Intelligence