AI Strategy for Operational & Non-Financial Risk Management

Key findings

1. AI is beginning to deliver tangible value in ONFR management

Building on proof-of-concept activity started in 2025, multiple risk leaders report strong early returns from using AI to support ONFR activity. The evidence remains largely anecdotal, but examples include material reductions in process cycle times and FTE hours, alongside broader productivity gains in areas such as reporting, research and meeting outputs.

2. A common adoption pattern is emerging across firms

The first stage is focused on efficiency, using AI to reduce manual effort, shorten cycle times and remove low-value process activity. The second stage moves beyond speed to capability, using AI to improve the quality, consistency and usefulness of outputs. A third stage, innovation, is visible in the discussion but not yet evident in practice. This would involve using productivity gains to move higher up the value chain and address challenges that were previously too slow, expensive or difficult to pursue. Most firms appear to sit between stage one and stage two.  

3. A “go broad, go deep and go big” strategy is taking shape

Firms are enabling broad experimentation by giving teams access to tools, training and opportunities to solve local problems. At the same time, some are going deeper on a small number of high-value ONFR priorities, such as change risk, third-party risk, regulatory compliance and control assurance. The next challenge is to go big by scaling successful pilots into coherent enterprise capabilities, supported by shared infrastructure, standards and methods. 

4. AI is changing the economics of risk management

The ONFR vision itself has not changed. Risk leaders have long wanted to automate frameworks, embed risk management into business processes, strengthen first line ownership and focus risk teams on higher-value activity. What appears to be changing is the cost and speed of delivery. AI may allow smaller internal teams to build, test, scale or abandon solutions more rapidly and with lower sunk cost, potentially making experimentation and continuous improvement more practical than before. 

5. The optimism is balanced by material concerns

Risk leaders highlighted several areas requiring attention now, including uncontrolled proliferation of AI tools, reliability and performance issues, the risk of poor-quality or inconsistent data and analysis, and the possibility that AI may generate more findings than firms can validate or remediate. There is also concern that AI could erode the human expertise needed to challenge outputs, interpret ambiguity and exercise judgement. 

6. Firms will need a strategy for value

The objective is not the adoption of AI for its own sake, but the use of AI to help ONFR functions manage risk at the speed and scale of the business, connect information more effectively, support better decision-making and increase the overall value risk management delivers to the organisation.  

7. Enterprise coherence will be critical to scaling success

As experimentation accelerates, firms will need to connect local innovation into a broader enterprise approach. This will require shared platforms, standards, governance and data foundations that prevent fragmentation and allow individual use cases to compound into a coherent ONFR capability. 

8. Operating models will need to evolve alongside the technology

As AI becomes embedded into risk processes and business activities, firms will need to rethink governance, accountability, ownership and the future roles of first and second line risk teams. The challenge is not only adopting new technology but redesigning how ONFR management operates in an increasingly AI-enabled environment. 

9. AI transformation is ultimately a people and skills challenge

Throughout the discussions, leaders consistently highlighted the need for stronger digital and AI capabilities, while reinforcing the continued importance of judgement, business understanding and critical thinking. Sustaining long-term value will require a deliberate people and skills strategy that develops the capabilities needed to work effectively alongside AI.

Concluding thoughts

AI is already helping ONFR teams improve efficiency and, in some cases, capability. The more strategic question is whether firms can use these gains to build a more connected, continuous and business-relevant model of ONFR management. The firms most likely to succeed will not simply be those that move fastest, but those that use AI to create coherent enterprise capability, strengthen decision-making and redesign ONFR around speed, scale and strategic value. 

Our members can log in to read the full report. If you're not a member, but would like to know more about our research or how you can join our community, then please get in touch with us.