AI has become a top-tier institutional risk. In the 2026 Allianz Risk Barometer, a survey of risk management experts, artificial intelligence rose from tenth place to second, the biggest jump in that year's ranking. For risk owners the useful questions are how large the exposure is, where it sits, and where governance money reduces it.
The exposure sits in ungoverned systems. We treat an AI system as ungoverned when one or more of five conditions applies: it operates without documented risk ownership; it lacks version control, audit trails or explainability mechanisms; it was deployed without formal risk assessment; it operates outside data governance or privacy policy; or it was adopted at user level without institutional approval, the pattern commonly called shadow AI.
Each condition is a property of a particular system. Applying the definition therefore needs a view of the organisation's AI one system at a time, including AI embedded in purchased platforms and tools adopted without approval.
Much of the risk arises after deployment. The Second International AI Safety Report, published in February 2026, finds that performance on pre-deployment tests does not reliably predict real-world utility or risk, and that AI agents act autonomously, making it harder for humans to intervene. Those findings point to how organisations connect AI to their processes, data and decisions, which is where governance operates.
Our model sizes thirteen categories: data breaches, algorithmic bias, hallucination, regulatory non-compliance, intellectual property, agentic AI, fraud and deepfakes, misinformation, shadow AI, supply chain, workforce liability, critical infrastructure and reputational damage. Each has a per-event cost range, an annual aggregate and a probability-weighted expected value under three scenarios.
On our model the annual exposure surface is £1.6 trillion to £4.4 trillion worldwide in 2026. That figure is the scale of loss ungoverned AI puts at risk across institutions in a year, not a forecast of realised loss. The largest single contributor to the upper bound is the tail risk of an AI-facilitated attack on critical infrastructure, an event of low probability and extreme severity.
The inputs combine published surveys with structured expert judgement where data is sparse, particularly for agentic AI and critical infrastructure tail risk. The shadow AI expected values also exceed that category's own annual aggregate, so the results are indicative rather than precise. The headline should not be used to allocate governance spend.
Probability-weighting changes the order. In the base case the largest expected losses are in shadow AI, AI-enabled fraud and deepfakes, data breaches, reputational damage and regulatory non-compliance. Agentic AI is smaller today, at £68 billion, but on our model it is the fastest-growing category, at 52% a year.
Governance leverage is the proportional reduction in expected loss that an institution's own investment can achieve. It differs sharply by category, so the largest exposures are not always where investment reduces loss the most. Of the thirteen categories, eight show very high or high leverage, four moderate and one low to moderate.
Leverage is very high for regulatory non-compliance, agentic AI and critical infrastructure. It is moderate for fraud and deepfakes and for data breaches, which external adversaries drive: an institution can reduce the chance that each attempt succeeds, but it cannot reduce the volume of attempts. It is low to moderate for shadow AI, which employee behaviour drives.
For agentic AI the first increments matter most. On our model the first ten points of governance maturity produce the largest absolute reduction, because they address the failure modes that are easiest to remediate: action logging, approval gates and sandboxed execution.
Regulatory exposure is also partly positional. We expect enforcement attention to fall first on organisations with visible gaps, so an organisation's exposure depends on its governance relative to its peers as well as on the requirements themselves. As at 11 October 2026, no fine under the AI Act had been confirmed by any regulator or official source.
On our model, moving from 30% to 70% governance maturity cuts aggregate expected annual loss by roughly 38% to 52%, and each £1 invested in structured governance returns an estimated £8 to £22 in avoided loss. These are modelled ranges, not observed outcomes. We estimate the cost of reaching a basic governance baseline at around 0.8% to 1.4% of annual AI-related spend.
The profile differs by sector, scale and institution type. Financial services, healthcare, technology vendors, governments and non-profits each face a different mix of dominant categories, so no single governance template suits them all.
First, find the ungoverned systems and the dominant categories. Apply the five conditions to each AI system the organisation runs, and identify which of the thirteen categories dominate the portfolio.
Next, put the cheap, high-leverage controls in place. For agents, that means action logging, human approval gates for high-stakes operations and sandboxed execution. For material commitments, it means deepfake-resistant authentication: out-of-band verification, callback procedures on independently held contact details, and multi-party authorisation.
For shadow AI, it means approved tooling capable and accessible enough that employees stop looking elsewhere, paired with detection.
Then, for as long as the systems run, keep AI Act documentation and supplier evidence current. Article 11(1) requires the technical documentation to be kept up to date, and a deployer obtains a supplier's Annex IV documentation only by contract.
Most of this exposure does not wait for the AI Act's high-risk dates. Breaches, fraud, litigation, employment claims and reputational damage arise under rules that already apply.
The full paper, Ungoverned AI Systems, sets out what the figures measure, the expected-value table and the leverage ratings for each category, the profiles by sector, scale and institution type, and the staged path with its costs.
