Insights

The first day of Risk-!n Zurich featured discussions on business continuity, enterprise risk management, internal controls, cybersecurity, climate resilience, artificial intelligence and quantum computing. On paper, it looked like a conference agenda built around a broad collection of risk disciplines. In practice, many of the presentations were wrestling with the same question. How do organizations maintain visibility into risks that are moving faster than the governance structures designed to oversee them?

Beneficial ownership is one of the most established concepts in anti-money laundering compliance. It is also one of the most persistently misunderstood in practice. At onboarding, most financial institutions collect beneficial ownership declarations, identify individuals with controlling interests, and document ownership percentages as part of standard due diligence. On the surface, this appears to satisfy regulatory expectations.

It takes about a second. An analyst pastes a contract into a chat box and requests a summary. A recruiter drops a stack of résumés into a tool to rank them. A finance manager uploads a draft board deck and asks for a tighter narrative. The cursor blinks, the answer appears, and everyone moves on. Nothing felt risky. Nothing broke. Yet in that one second, something important happened that almost no one in the building noticed. Information left the organization and went somewhere it had never been.

There is a peculiar imbalance taking shape inside many organizations. Over the past two years, companies have assembled AI governance committees, drafted acceptable-use policies, updated risk registers, and launched internal working groups dedicated to understanding the implications of artificial intelligence. Compliance teams have studied emerging regulations. Privacy officers have debated data-sharing restrictions. Boards have asked increasingly pointed questions about oversight, accountability, and risk.

Synthetic media, popularly known as deepfakes, has evolved from an internet curiosity into a material operational and security risk. Generative AI now enables adversaries to fabricate videos, voices, and imagery that mimic reality with alarming precision. The implications extend beyond misinformation: deepfakes can erode trust, distort markets, and destabilize democratic institutions.

In this article, Norman Marks examines the findings from Gartner’s latest emerging risk survey, arguing that the growing prominence of AI-related concerns signals a meaningful shift in how enterprise leaders are thinking about operational risk, decision-making, and organizational preparedness.

A ship arrives at port during the plague years. The crew does not disembark. Nobody unloads cargo. Nobody asks for a heat map. They wait forty days. That, as Swiss GRC Day moderator Nikolai Tsenov reminded attendees in Zurich, was one of humanity’s earliest systematic attempts at risk management—quarantine.