AI Risk Appetite: Boards Can No Longer Govern All AI as One Risk
For boards, the AI debate has changed remarkably quickly. The question is no longer whether businesses should use artificial intelligence. It is which AI, for what purpose, with what authority — and how much risk are we prepared to accept?
The opportunity remains compelling. Generative AI can automate routine work and augment employees. A customer-service team, for example, can use AI to classify incoming enquiries, retrieve relevant information and draft responses, leaving staff to deal with exceptions and complex customer problems. AI is similarly improving marketing, software development, research and analysis.
Boards that retreat from AI therefore carry their own risk: declining productivity, slower innovation and competitive irrelevance.
But the other side of the equation is changing dramatically.
On 7 April 2026, Anthropic unveiled Claude Mythos Preview, an unreleased frontier model with cybersecurity capabilities powerful enough to find and exploit software vulnerabilities at levels Anthropic says exceed all but the most skilled humans. Rather than releasing it publicly, Anthropic initially provided access through Project Glasswing to around 50 trusted cyber defenders and critical infrastructure partners.
Then came an even more confronting example.
In July, OpenAI disclosed that AI agents being tested for advanced cyber capabilities escaped their intended evaluation environment and compromised Hugging Face infrastructure. The models found a zero-day vulnerability, obtained internet access and chained vulnerabilities and stolen credentials to reach Hugging Face systems. OpenAI described the episode as an “unprecedented cyber incident”.
That should command directors’ attention.
The governance issue is not that AI has suddenly become malevolent. It is that increasingly agentic systems can pursue objectives, encounter barriers and take actions their human operators did not anticipate.
Does this mean boards should reduce their appetite for AI? Not necessarily. They should become far more discriminating about it.
Consider the difference. Low-consequence augmentation might involve an AI assistant such as CoPilot summarising a meeting or producing the first draft of a marketing campaign, with a human reviewing the output. A board could reasonably have a high-risk appetite for these controlled productivity applications.
High-consequence autonomy is fundamentally different. Imagine an AI agent able to access a business’s production network, identify a security vulnerability and independently change firewall configurations or execute code to fix it. The potential productivity benefit is enormous. So is the downside.
Boards should therefore consider progressively lower risk appetites where AI accesses sensitive customer or employee data; determines whether someone receives credit, employment or essential services; writes and deploys production code; controls financial transactions; or autonomously interacts with operational technology and critical infrastructure.
The governance question has shifted from “Do we allow AI?” to “How much agency are we prepared to give it?”
That distinction is material. Businesses that win the AI race may not be those that move fastest — or those that build the highest regulatory walls. They may be those whose boards learn to accelerate and apply the brakes at the same time.
Digital Literacy for Leaders
Bill Owens, Managing Director of Veracity, has decades of experience in global business consulting and technology and is committed to raising digital literacy levels of business leaders across Australia. Bill often presents to Boards and senior leaders on data governance, privacy, AI, and cybersecurity to help leaders feel at ease discussing and making decisions about tech and IT.
Continue the conversation on LinkedIn at Digital Literacy for Leaders.
About The Author
With decades of experience in global business consulting and technology, Bill excels in governance, strategy development, risk management, and financial management. He serves as the non-executive Chair of Relationships Australia Queensland and is a member of the Gymnastics Australia Commercial Committee. Additionally, Bill contributes to the Tech Council of Australia and acts as a Technology Industry Expert for Queensland Leaders. He is a graduate of the Australian Institute of Company Directors course.
