Uncertainty has become the defining characteristic of the modern business environment, and artificial intelligence represents perhaps the most significant amplifier of that uncertainty today.
Unlike previous technological shifts that unfolded over decades, AI’s capacity to transform entire value chains can render established business models obsolete in a matter of years. At the same time, the failure of an AI initiative can wipe hundreds of millions off the value of a company.
Defensive restructuring in the face of this uncertainty is already underway at many Fortune 500 companies, often framed in terms of efficiency initiatives. Organizations now face a dual imperative that traditional risk frameworks were never designed to address: they must harness AI’s potential through their own initiatives while simultaneously defending against AI-driven disruption from both established competitors and new entrants.
The organizations that harness AI effectively will define the next era of business, while those that mismanage its risks may not survive it. In this piece, drawing on research from our recent book Transcend, we explore a critical distinction that every leader must understand to manage AI risk effectively: the difference between project risks (the challenges arising from your own AI initiatives) and enterprise risks (the threats to the enterprise from the broader evolution of AI). After sketching this distinction, we go on to provide practical guidance for managing both types of AI risk effectively.
Understanding the distinction between project risk and enterprise risk is fundamental to effective AI risk management. Project risk refers to the negative consequences that can arise from an organization’s own AI initiatives. These are risks the organization creates through its own implementation of AI, such as technical failures, integration challenges, user rejection, or ROI shortfalls.
Enterprise risk, on the other hand, refers to the threats posed to the business as a whole by the broader evolution and deployment of AI across industries and societies. Enterprise risks are those that emerge from what others are doing with AI, such as the development of new AI models, competitor breakthroughs, industry disruptions, regulatory shifts, or fundamental changes in how value is created and captured in your sector.
Consider the implementation of AI assistants to take drive-thru orders by the American fast-food chain Wendy’s. This kind of project comes with a host of risks for the company implementing it. For example, the Wendy’s assistant might have accuracy issues, leading to incorrect orders and frustrated customers; the system might break during peak hours, creating operational chaos; or customers might reject the assistant, and the associated brand, because they desire more human interaction.
These are all important risks and must be identified and managed as part of Wendy’s AI innovation program. But in addition to managing the risks arising from its new drive-thru AI, Wendy’s must also identify and respond to AI risks coming from external sources.
Germany’s Mangal kebab chain, for instance, plans to launch fully autonomous restaurants in which robotic arms will prepare and plate food without the intervention of human workers. If this model succeeds and spreads, Wendy’s incremental automation of order-taking may begin to look like the company is rearranging deck chairs on the Titanic.
If Mangal’s fully autonomous model achieves dramatically lower operating costs, Wendy’s entire pricing structure and business model could become uncompetitive overnight, forcing them to either attempt a rushed, expensive pivot to full automation or risk being priced out of the market entirely. Even before this point, a Mangal-style full automation could reset customer expectations for speed and consistency across the whole fast-food sector, making Wendy’s hybrid human-AI model appear outdated and inefficient – no matter how well their drive-thru AI works.
“Taking a holistic approach to AI innovation makes it possible to deliberately calibrate the organization’s overall risk exposure while maintaining the innovation velocity necessary to compete in an AI-driven economy.”
So, how can leaders manage these two different kinds of AI risks effectively and in parallel?
Managing AI project risk effectively requires a fundamental shift in how many organizations approach AI innovation. Treating AI initiatives in isolation often leads to their risks being conceptualized as a series of disconnected ‘go/no-go’ decisions. This approach can stifle innovation because it separates the innovation process into a series of disconnected projects. By adopting portfolio management principles that approach AI investments as a unified innovation pipeline, leaders can instead balance risk and reward profiles across the entire portfolio. This approach recognizes that some AI projects should be high-risk moonshots that could transform the business, while others should be reliable workhorses that deliver steady added value with tightly circumscribed risk levels.
Taking a holistic approach to AI innovation makes it possible to deliberately calibrate the organization’s overall risk exposure while maintaining the innovation velocity necessary to compete in an AI-driven economy. The portfolio lens transforms risk from a constraint to be minimized into a strategic variable to be optimized, enabling leaders to adopt organization-wide risk profiles that are appropriate for their specific enterprise. A startup, for instance, might aim for 70% high-risk, high-reward projects to maximize breakthrough potential. An established enterprise, on the other hand, might include fewer high-impact projects and a much greater proportion of low-risk implementations of proven solutions.
A portfolio approach can also help to set and manage risk levels across functions within a business, creating nuanced risk profiles that are both industry– specific and reflect the company’s unique position. For instance, a pharmaceutical business could ring-fence its product development and testing process to ensure that regulatory compliance acts as a go/no go gate for moving an initiative from planning to prototyping. Such a business might also decide that it has an ethical duty not to concentrate resources on initiatives that may increase the risk of product failures, even if the initiative passes regulatory muster. Yet at the same time, its leaders may decide that, once these conditions are met, the company is in a robust enough position to pursue a moderate-to-high risk strategy overall, concentrating that risk in areas such as IT Ops, fundamental research, or staff management and strategy tools. By contrast, a fast fashion company could allow initiatives to pass through the portfolio without highly rigorous regulatory gate checks while also opting for an extremely low overall risk profile to insulate its low– margin product lines from the failure of new AI systems.
The key is that a portfolio management approach allows these decisions to become conscious, strategic choices rather than accidental outcomes.
Define your desired mix of risk levels across the portfolio.
While you are carefully managing your AI innovation portfolio, other companies may be building new AI capabilities that have the potential to render your entire business model obsolete. The speed of AI-driven disruption means the next existential threat to your organization could come from a traditional competitor that suddenly leapfrogs you with AI-powered innovation, or from an AI-native challenger three industries away that discovers how to serve your customers better, faster, and cheaper. This is enterprise risk in the AI era: not gradual erosion of market share, but the danger of sudden strategic irrelevance akin to falling off a cliff. Organizations that fail to scan for and respond to these external AI threats will not get a second chance.
Managing AI enterprise risk effectively requires systematic environmental scanning that goes beyond tracking immediate competitors and extends instead to monitoring AI developments both in adjacent industries and across multiple dimensions. This includes paying attention to technological breakthroughs that might enable new business models, regulatory changes that could reshape competitive dynamics, shifts in consumer expectations driven by AI experiences in other industries, and the emergence of AI-native startups that bypass traditional industry barriers and disrupt the entire market.
Identifying enterprise risk early is a critical first step, but it is not enough to just spot potential dangers in advance. Businesses must also develop the tools needed to respond effectively to emerging threats.
Meeting these dual challenges requires governance structures that are designed specifically for the severity of the enterprise threats that AI may pose. For example, many organizations would benefit from establishing dedicated AI risk committees that report directly to the board, ensuring enterprise risks receive appropriate senior attention. These committees should have the authority to trigger strategic reviews when emerging threats are identified. To work effectively, they need clear escalation protocols that can rapidly mobilize resources when a potential threat moves from possibility to probability.
Finally, organizations must develop what we might call strategic optionality – keeping open multiple paths forward to support rapid pivots if severe enterprise threats materialize. This could mean experimenting with AI-enabled business models even while your traditional model remains profitable. It might involve building partnerships with potential disruptors rather than ignoring them, or developing internal AI capabilities that could become the foundation for business model transformation if needed. The goal here is not to predict exactly which enterprise risks will materialize, but rather to develop the organizational agility and capability needed to respond to an uncertain future.
Experiment with AI-enabled business models, partner with potential disruptors, and build internal AI capabilities that could enable rapid pivots when needed.
The window for developing these capabilities is narrowing rapidly, and the cost of inaction grows steeper with each passing quarter.
The distinction between project risk and enterprise risk in AI is not merely an academic exercise in categorization – it represents a fundamental shift in how organizations must approach strategic risk management. Companies that focus solely on managing their internal AI initiatives while ignoring the broader transformation of their competitive landscape will find themselves perfecting their execution of an obsolete strategy. Conversely, those that become paralyzed by external threats while failing to build their own AI capabilities will lack the organizational competence to respond when disruption arrives.
The path forward requires the simultaneous pursuit of disciplined portfolio management for internal initiatives and the development of robust structures for not only identifying, but also rapidly and decisively responding to external threats. This dual capability will increasingly separate organizations that thrive in the AI era from those that become its casualties. The window for developing these capabilities is narrowing rapidly, and the cost of inaction grows steeper with each passing quarter.
While humor boosts likability and success with human recruiters, it risks backfiring with AI interviewers. Candidates must adopt a ‘bilingual’ strategy to avoid being penalized, say Jamie Gloor, Cecily Cooper, T Bradford...
Audio available
Michael Wade and Massimo Marcolivio offer eight ways for healthcare companies to deliver better outcomes for patients and providers. ...
How CHROs can help the workforce navigate AI-driven change by building trust, improving the employee experience, and leading cultural change in HR and talent management. ...
Companies seeking to automate middle management risk eliminating capabilities that algorithms cannot replace. Leaders must identify tasks requiring practical and ethical judgment....
Explore first person business intelligence from top minds curated for a global executive audience