AI BCM Newsletter
Weekly resilience signals on AI · 2-3 min read
This week: treat AI as part of cyber resilience, not a side project.
AI is moving into the same control room as cyber resilience and continuity. The practical question is no longer whether to use it, but where it can fail, who checks it, and what happens when it touches critical workflows. This issue pulls out a few concrete signals on cyber risk, oversight, and agent control.
GOVERNANCE
New York’s Department of Financial Services is treating frontier AI as a cyber and operational risk, not just a new tool. It wants firms to review cyber posture, speed up vulnerability management, work closely with third parties, and tighten secure development. BCM teams should ask whether AI tools, vendors, and AI-enabled security controls are in scope for testing and recovery plans.
GOVERNANCE
Australia’s cyber agency is giving a simple message: do not paste sensitive data into AI tools, keep human oversight in the loop, and document each approved use case against business goals and risk tolerance. That maps directly to incident support, crisis drafting, and security analysis. If staff can use public AI tools during an event, data leakage becomes a continuity issue.
RESEARCH
Anthropic says its AI helped surface more than 10,000 high- or critical-severity vulnerabilities in a month, with partners using the findings to fix issues and one bank using it to spot a fraudulent wire. The BCM value is real: faster finding and triage can shorten recovery. The governance question is whether humans still validate findings before patching, blocking, or escalating.
The common thread is simple: AI is becoming part of critical work, so resilience teams need the same discipline they already use for other important dependencies. That means knowing where AI is used, what data it sees, what it can change, who approves it, and how it fails safely. If AI supports incident response, recovery, fraud checks, or reporting, it belongs in your control map, your testing plan, and your supplier review.
Use this before any AI tool is approved for a BCM, cyber, or crisis workflow: 1) What task is it allowed to do? 2) What data must never be entered? 3) Who reviews its output before action? 4) What is the manual fallback if it fails? 5) What logs prove what it did? 6) What changes if it is wrong during an incident?
Reusable asset (control question): Control question for leadership: If this AI tool disappeared tomorrow, or produced a wrong answer at the worst possible time, which recovery step, decision, or report would fail first?
Watch for AI tools being added through the side door: incident support chats, coding assistants, ticket triage, fraud checks, and supplier portals. The governance test is not only accuracy. It is identity, access, auditability, human override, and whether the tool can widen outage impact when stress is high.
This week's action
Pick one AI tool in your business. Run the control question on it. Reply with the answer.
