Securing & Governing AI · Chapter 9
What is old wearing new clothes
Most of the AI risk register is your existing risk register. Knowing which is which saves enormous effort.
Vendors have an incentive to make every AI risk sound unprecedented, because unprecedented risks need new products. In practice most of what appears on an AI risk register is a familiar risk arriving through a new door, disposable with controls you already own.
| Presented as a new AI risk | What it actually is | Control you already have |
|---|---|---|
| “The AI leaked confidential data” | A search index without access control | Data classification, access review |
| “The AI made an unauthorised change” | An over-privileged service account | Least privilege, change management |
| “Staff pasted secrets into a chatbot” | Shadow IT and DLP | Acceptable use, DLP, egress monitoring |
| “The vendor might train on our data” | A contract and third-party risk question | TPRM, contractual terms, DPA |
| “The model could be backdoored” | Software supply chain | Provenance, signing, approved sources |
| “Outputs are biased” | Model risk management | Validation, monitoring, challenge (chapter 11) |
| “We cannot explain a decision” | Auditability and record-keeping | Logging, evidence retention (chapter 12) |
The genuinely new short list
- Prompt injection — no channel separation, therefore no parameterised fix.
- Non-determinism as a control problem — the same input can produce different output, so “we tested it” means something weaker and testing must become statistical.
- Un-deletable training data — fine-tuned weights cannot be selectively un-learned, colliding with erasure rights.
- Scale and speed of plausible content — not new in kind, but the change in volume defeats controls that assumed a human bottleneck, which is real for fraud, phishing and identity proofing.
Use this to earn the right to be heard
When you tell a delivery team that five of their seven AI concerns are already covered, two things happen: they save real time, and they start believing you about the two that are not. A function that flags everything gets ignored on everything.
This is the practical mechanism by which security stops being the department of no.