Gains:
- Ability to recognize AI-specific risks such as hallucination, bias, data leakage, model drift, dependency, and inexplicability with business impact
- Scoring risks in probability and impact dimensions and keeping them within the risk appetite of the institution with mitigation measures
- Ability to adjust surveillance according to risk level rather than uniformity, ensuring human final say and continuous monitoring in high-risk decisions
Value and risk are two sides of the same coin. AI opens up new sources of value, but it also introduces new types of risks that traditional software does not carry. For a senior manager, the issue is not to avoid risk, but to consciously manage risk (risk management; the discipline of recognizing, measuring, reducing risks and keeping them at acceptable limits). In this unit, you will learn about risks specific to AI, their business impact, and practical mitigation methods. The aim is not to "do not do it because there is a risk" or "to act as if there is no risk"; It is to carry out every initiative with a conscious risk appetite; the level of risk that the institution is willing to take.
AI-specific risks
Traditional IT risks (vulnerability, outage) still apply; But artificial intelligence adds its own risks:
Risk type
What do you mean?
Example business impact
hallucination
It was made up but it turned out believable
Incorrect information to the customer, legal liability
prejudice
The reflection of injustice in the data on the output
Discriminatory hiring/credit decision
data leak
Confidential data leaking into the vehicle
KVKK violation, loss of reputation
Model drift
Performance degradation over time
Quiet overturning of decisions
addiction
Locked into a single supplier
Price/access shock
inexplicability
Not knowing the reason for the decision
Audit and objection difficulty
Two terms are important here: bias is when artificial intelligence learns unfair patterns in training data and reflects them in its decisions; For example, if historical hiring data favors one group, the model does too. Model drift is when the model becomes obsolete and its performance silently declines as the world changes (new products, new behaviors).
Tip: Think of risk not in terms of "may/won't happen" but in two dimensions: probability (how likely) and impact (how much harm if it happens). Those with high impact + high probability are addressed first; those with low+low values are accepted and monitored.
Surveillance according to risk level
Not every usage area carries the same risk. The smart approach is to tailor surveillance to the level of risk:
- Low risk (inset draft, brainstorming): light oversight, speed priority.
- Medium risk (content to customer, decision support): human approval, sampling control.
- High risk (credit, recruitment, health, legal): mandatory human judgment, full registration, regular audit.
This “risk-based” approach is also the backbone of the EU AI Law (Unit 9).
Step by step: risk management cycle
1. Recognize the risks. List AI-specific risks for each initiative.
2. Score likelihood and impact. Evaluate and prioritize each risk in two dimensions.
3. Define mitigation measure. Such as human approval, data anonymization, tracking, supplier diversification.
4. Accept or stop remaining risk. The risk remaining after the reduction is accepted if it is within the appetite; If not, the attempt stops.
5. Watch and review. Risks are not static; Constant monitoring for drift and new threats is essential.
three mini cases
Case 1 — The cost of hallucination. An airline's customer chatbot "made up" a non-existent refund policy for a passenger; The customer trusted this and made the transaction. The court held the company responsible for its own bot's declaration. Lesson: AI output to customer is medium/high risk; verification and limitation were essential. The bot was then restricted to only respond from approved policy texts.
Case 2 — Silent bias. One company's hiring screening model systematically favored recruits from certain schools because of an imbalance in historical data. The difference was revealed in an audit; There was a reputational and legal risk. The model was decoupled from protected characteristics and linked to regular justice monitoring. If the bias test had been done from the beginning, this would not have happened.
Case 3 — Drift's capture. A bank's fraud detection model was quietly weakened when a new fraud pattern emerged; The miss rate increased from 8% to 19% in 3 months. Good news: the agency had implemented monthly performance monitoring, the drift was detected early, and the model was retrained. Without monitoring, the loss would have multiplied.
Four copyable templates
1) Risk inventory:
Your role: AI risk manager. List AI-specific risks for the following use case: hallucination, bias, data leakage, drift, dependency, inexplicability. For each risk, write in one sentence its possible manifestation and business impact in this scenario. Usage area: [text]
2) Probability/impact scoring:
Prioritize the following risks by scoring and multiplying them as probability (1-5) and impact (1-5). Explain why you prioritize the top three risks.Risks: [list]
3) Mitigation plan:
Propose practical mitigation measures for the following priority risks: [risks]. For each measure: what to do, who is responsible, at what level of risk is mandatory. Use human surveillance, data anonymization, monitoring and supplier diversification where appropriate.
4) Risk-based surveillance matrix:
Assign the following areas of use to the risk level (low/medium/high) and determine the oversight required for each level: is human approval required, will records be kept, what is the inspection frequency? Uses: [list]
Weak prompt / Strong prompt
Weak: “What are the risks of this AI project?”
Conclusion: A general list of risks; probability, impact and no mitigation, you can't decide.
Güçlü: "We will use AI in the preliminary evaluation of a loan application at a bank (the human will make the final decision). List the risks specific to this scenario (bias, inexplicability, hallucination, data privacy); score each by likelihood and impact; suggest concrete mitigation and oversight requirements for the three most critical. Also state what it means for compliance that this is considered high risk."
The result: a scenario-specific, scored, mitigating and compliance-related risk analysis.
Common mistakes
- Applying the same oversight to all initiatives. Slowing down low-risk work is just as harmful as neglecting high-risk work; Surveillance should be based on risk level.
- Mistaking the hallucination as a "little mistake". Incorrect output to the customer may result in legal liability.
- Not testing for bias. The model deployed without fairness testing can produce silent discrimination.
- Not watching Drift. A model that works well once does not work well forever; Constant monitoring is required.
- Locking in a single supplier. Without an exit plan, addiction leaves you open to price and access shock.
Caution: Risk management is not once and for all; Artificial intelligence systems are living systems. Just because a model is safe today does not guarantee that it will be safe tomorrow. Continuous monitoring, regular inspection and a clear kill switch should be part of every high-risk system.
In summary
On top of traditional IT risks, AI adds unique risks such as hallucination, bias, data leakage, drift, dependency, and inexplicability. These risks should be evaluated and prioritized in terms of probability and impact, and should be kept within the risk appetite of the institution with mitigation measures. Surveillance is not uniform but should be tailored to the level of risk; In high-risk decisions, people should have the final say. Risk management is a continuous cycle; is not complete without monitoring and control. In the next unit, we will establish the governance and policy structure that makes this risk discipline permanent.
Application task
Choose an AI use case and list its specific risks with template 1. Score each risk by likelihood and impact, identifying the three most critical. Write concrete mitigation measures and the level of oversight required for these three risks. Finally, classify the use as low/medium/high risk and note how this changes oversight requirements.
checklist
- [ ] I have listed the risks specific to artificial intelligence scenario-specific.
- [ ] I scored each risk by likelihood and impact.
- [ ] I have defined mitigation measures for the most critical risks.
- [ ] I have classified the usage area according to the risk level.
- [ ] I adjusted the surveillance according to the risk level.
- [ ] I planned testing/monitoring for bias and drift.
- [ ] I have set stopping authority for the high risk system.