Securing & Governing AI · Chapter 9 of 13
What is old wearing new clothes
Most of the AI risk register is your existing risk register. Knowing which is which saves enormous effort.
Vendors have an incentive to make every AI risk sound unprecedented, because unprecedented risks need new products. In practice most of what appears on an AI risk register is a familiar risk arriving through a new door, disposable with controls you already own.
| Presented as a new AI risk | What it actually is | Control you already have |
|---|---|---|
| “The AI leaked confidential data” | A search index without access control | Data classification, access review |
| “The AI made an unauthorised change” | An over-privileged service account | Least privilege, change management |
| “Staff pasted secrets into a chatbot” | Shadow IT and data loss prevention | Acceptable use, DLP (Data Loss Prevention), egress monitoring |
| “The vendor might train on our data” | A contract and third-party risk question | TPRM, contractual terms, DPA |
| “The model could be backdoored” | Software supply chain | Provenance, signing, approved sources |
| “Outputs are biased” | Model risk management | Validation, monitoring, challenge (chapter 11) |
| “We cannot explain a decision” | Auditability and record-keeping | Logging, evidence retention (chapter 12) |
The genuinely new short list
- Prompt injection — no channel separation, therefore no parameterised fix.
- Non-determinism as a control problem — the same input can produce different output, so “we tested it” means something weaker and testing must become statistical.
- Un-deletable training data — fine-tuned weights cannot be selectively un-learned, colliding with erasure rights.
- Scale and speed of plausible content — not new in kind, but the change in volume defeats controls that assumed a human bottleneck, which is real for fraud, phishing and identity proofing.
Use this to earn the right to be heard
When you tell a delivery team that five of their seven AI concerns are already covered, two things happen: they save real time, and they start believing you about the two that are not. A function that flags everything gets ignored on everything.
This is the practical mechanism by which security stops being the department of no.
The risks that are not new, and why that is good news
| Presented as a novel AI risk | Actually |
|---|---|
| "The model leaked confidential data" | An access control problem. It was retrieved and shown to someone not entitled to it. Filter inside the retrieval query, not after |
| "The agent did something destructive" | Excessive privilege. The credential permitted it. This is the same finding as any over-permissioned service account |
| "We can't explain the decision" | An audit and record-keeping problem, largely solved by logging inputs, outputs and the version that produced them |
| "The vendor changed the model" | Third-party and change management. Version pinning, regression tests, contractual notice — all standard supplier controls |
| "It gave wrong advice and someone acted on it" | The same failure as any decision-support tool, and the same control: scope, documented limitations, and oversight proportionate to consequence |
Why this matters practically: an organisation with mature access control, supplier management, change control and logging is most of the way there already, and framing AI risk as entirely novel discards that. It also produces a parallel governance structure with its own committee and its own policy, disconnected from the controls that actually operate.
The genuinely new items are a short list, and being able to name it precisely is what distinguishes a credible assessment: instructions and data sharing one channel, so retrieved content can steer behaviour; confident fluency uncoupled from correctness, so the usual human signal for uncertainty is absent; non-determinism, so the same input may not produce the same output; and training data that cannot be un-learned on request.
Everything else is an old risk wearing new clothes — and treating it as old is faster, cheaper and considerably more likely to work.
Check yourself