In this Global Insight episode of the On Aon podcast, leaders from Aon’s public affairs, cyber and risk advisory teams discuss why some organizations are realizing value from AI while others struggle to keep pace. As AI becomes increasingly embedded in business operations, governance can no longer be viewed as a constraint on innovation. Instead, effective governance, cyber resilience and risk management frameworks provide the foundation for organizations to scale AI adoption with confidence.
The conversation explores how leaders can navigate an evolving regulatory landscape, apply existing risk management disciplines to emerging AI challenges and prepare for the next wave of development, including agentic AI. The result is a practical discussion on how organizations can stay ahead, make better decisions and unlock AI's potential while managing risk with greater certainty.
Key Takeaways:
Experts in this episode:
Key Moments:
(3:15) Why regulatory uncertainty should not slow AI adoption and how leaders can make informed decisions amid changing requirements.
(7:05) Building governance frameworks that support innovation by leveraging existing risk management disciplines, stakeholder alignment and workforce readiness.
(11:20) Understanding predictive, generative and agentic AI and what the next generation of AI means for governance, cyber risk and accountability.
Soundbites:
Daniel Serota:
“But the challenge for organizations isn't whether to embrace AI. It's how to harness its potential while managing the governance, the cyber, the regulatory and operational risk that comes with it.”
Kevin Kalinich:
“Insurance can be a force for the good to benefit artificial intelligence development and both increase the return on investment for artificial intelligence and decrease the total cost of risk at the same time if implemented properly.”
Stephen Vina:
“Those organizations that really adopt those governance frameworks and those risk management practices and thinking holistically about AI across their organization will really be best positioned to move forward with confidence and I think move faster safely.”
Kevin Kalinich
Insurance can be a force for the good to benefit artificial intelligence development and both increase the return on investment for artificial intelligence and decrease the total cost of risk at the same time if implemented properly.
Intro:
Hello and welcome to this week’s episode of On Aon. We’ve got a great episode this week exploring the issues for business leaders surrounding AI governance.
We’ve got three amazing Aon experts to discuss this topic. Coming up are Kevin Kalinich, Aon’s Intangible Assets Global Collaboration Leader, and Stephen Vina, who’s Senior Vice President on Aon’s Cyber Solutions Product & Claims Team. But first here’s Dan Serota to kick things off...
Daniel Serota (00:00)
Welcome to this month's Global Insight Conversation on AI governance and cyber risk. I'm Daniel Serota and I lead government affairs for Aon across North America.
Around the world, leaders are navigating a period of extraordinary change. The midterm elections are reshaping policy priorities. Regulators are racing to keep pace with technology. Cyber threats continue to evolve, and new risks from AI to biosecurity are rapidly climbing boardroom agendas across the globe.
As the center of many of these conversations is around artificial intelligence. AI is transforming industries, redefining risk, and creating opportunities that were unimaginable just a few years ago. But the challenge for organizations isn't whether to embrace AI. It's how to harness its potential while managing the governance, the cyber, the regulatory and operational risk that comes with it.
As October marks an important month of cyber security awareness. There is no better time to explore this intersection of innovation and resilience.
And to unpack this topic, I'm bringing in two of the smartest at Aon: Kevin Kalinich, who sees this from a risk perspective in AI and is helping clients navigate this across the globe. And Stephen Vina, who is an ex-White House cybersecurity office staffer, and somebody that understands public policy in this space better than anyone.
And as the pace of change is accelerating, the risks are evolving. And the decisions organizations make today are gonna reshape their competitive advantage tomorrow. And Kevin and Stephen, from AI to cyber risks to evolving regulations and geopolitical uncertainty, as you know, organizations are facing one of the most dynamic risk environments in decades.
As you guys see it from across the global landscape, where do you see what is keeping leaders up at night? And where should they be focusing their attention right now?
Kevin Kalinich (02:06)
Thank you, Daniel, for that introduction. The developments in Washington DC, with respect to government affairs that you're working with are moving fast and fluid. Similarly, artificial intelligence opportunities, perils and risk management are dynamic and fluid. Therefore, the organizations need to be nimble and keep track of the most up-to-date information.
With respect to what's keeping them up at night, the level of AI deployment between different companies varies dramatically. So, what keeps one company up at night might not be the same thing for another company. If a company is using AI for back-office deployment, for instance, that wouldn't be client-facing or make a material mistake, there's much less concern in efficiency.
Whereas the companies that are using AI agents to actually have interactive conversations and actions with their clients, there's a much greater degree of concern.
Stephen Vina (03:14)
Totally agree, Kevin. Those are all really great points. I think the regulatory uncertainty is certainly something that I think organizations are struggling with, really trying to understand whether it's in Europe or the United States or at the state level, really understanding all the different dynamics of regulation and different rules and guidelines coming out really quickly overnight in some cases. And trying to build governance strategies around the regulatory uncertainties can be a quite a challenge, right? And so I think for a lot of organizations, they're really trying to keep pace, keep up with the regulatory dynamics that you mentioned.
Another issue that I've seen is a lot of discussion about threat adversaries, threat actors using AI faster and finding exposures and exploits in our software faster than we can actually build defenses.
And so I think for a lot of organizations, they're really trying to keep pace and try and making sure that their software across their organization is patched and secure and in many cases deploying AI for their cyber defenses and trying to just to keep up so that the scales are actually tipped in the favor of the defenders.
Kevin Kalinich (04:23)
But Stephen, I think that all the experts would agree that the speed of the artificial intelligence products and services is greatly outpacing the regulation and greatly outpacing risk management and insurance.
However, take Project Glasswing that is intended to identify some of those vulnerabilities that you're raising, Stephen. And there could be some vulnerabilities that could be exploited because of artificial intelligence. I would posit that those vulnerabilities were already apparent. Those vulnerabilities were already there for each one of these companies. And some of the AI developments that are happening so fast are actually a good benefit in the long run because we're helping identify those vulnerabilities so they could get fixed.
Project Glasswing, for instance, is a tremendous joint effort between Anthropic and deployers of AI to find those vulnerabilities and fix them before the bad guys can take advantage of those vulnerabilities. So that's not all errors and making things worse. There's a lot of things that AI can do to decrease the total cost of risk.
Stephen Vina (05:39)
No, absolutely. Totally agree. AI can definitely benefit on the defence side. But I think it's a matter of getting those deployments out, making sure that those partnerships exist between public and private as well, and trying to execute on that across organizations. Which I think really brings us to some governance issues and governance questions, really looking at how can organizations can adopt AI responsibly without really slowing that innovation.
Some thoughts that I've I think back to in security sense, there's thoughts of like security by design, privacy by design, right? Really trying to bake in, in that case, security, but trying to bake in governance early on in the process instead of bolting it on, trying to really create those guardrails so everyone understands the rules of engagement, the rules of the road as we're implementing AI across an organization.
Another thought that comes to mind is to the extent we can do risk assessments, really understanding where AI is being deployed across our organization, mapping that inventory. So we know to the extent that AI is used maybe perhaps for a more administrative task and where it's being used for consequential decisions, things that really require human oversight and human and more accountability across the decision-making tree.
So really trying to understand that tiering of risk and really try to create those efficiencies when deploying AI.
But welcome your thoughts on that as well.
Kevin Kalinich (07:05)
Yeah, let's dig into AI governance. So what we're doing at Aon is we've aggregated from different sources all of the litigation that has to do with AI. So that brings artificial intelligence into the allegations of litigation. And then we map those cases versus potential insurance coverage, existing insurance coverage or new insurance coverage.
And it turns out from the AI governance standpoint that many of the AI perils were already existing perils. So for instance, let's use examples you used for privacy or security or hacking. If there was a privacy or security hack before AI, then the policy should respond and should have the trigger to the extent that it was intended to be covered.
If the same hack happened, privacy or security incident after AI, because of AI or with AI, the same triggers should apply, the same coverage should apply, the same analysis should apply. So many of the exposures from AI are borrowing or leveraging our existing AI governance, enterprise risk management that you need to take into account. And that would include collaboration of stakeholders. And the collaboration of stakeholders means IT security needs to be talking to legal, needs to be talking to business development for that AI deployment: How is this going to raise a new risk? Or is this a similar risk that we had before? And do we already have that? Do we already have allocational liability?
You mentioned that there's a dearth of regulatory action, for instance, but there are other legal mechanisms to protect organization. In the B2B context, business to business, when entities use new software before AI, there's lengthy negotiations between the software provider and the deployer of what the allocation of liability should be: What should the service level agreement do? What does that software guarantee? What if something goes wrong? Who's responsible and liable for that?
The same governance can be used to borrow for AI governance for that allocation liability contractually and to hold responsible the actors that should be held responsible with respect to contracts.
The second aspect of AI governance besides borrowing is the training of employees. So training of employees of what you should be using AI for and what you shouldn't be using AI for. The sandbox, which means only use the AI that has been approved by your company that's been on your computers as opposed to some other AI frontier model. The sandboxing can keep your data within the confines. That's good governance right there.
And there are a number of other good AI governance practices from the enterprise risk management that we can borrow and leverage to use for AI.
Stephen Vina (10:06)
Yeah, and that that kind of raises a question that a point is of as AI becomes more embedded across organizations, what are those new risk considerations that are emerging? You hit on several of those, sandboxing and others. In my mind, I was thinking, yeah, just like any other type of software that we're rolling out across an enterprise, particularly those large enterprise solutions, right? It increases your attack surface potentially. It becomes potentially harder to manage, right? When you move it from one part of your organization to the larger part. You have more people that are now touching the system. AI raises other issues, of course, with like what is the AI touching? What does it see? What decisions are being made? Right. And particularly as we move into agentic AI. So those are a variety of different considerations about just managing the software and the system itself.
Again, and to what extent that brings cyber and privacy considerations. And then finally, as we move into agentic, I would love your thoughts on this, is thinking about those maybe unintended consequences of AI moving throughout your network. And perhaps it is because there's certain guardrails that were not in place and when we get to that governance structure, or maybe it's just something that was truly not anticipated.
Kevin Kalinich (11:21)
Let's talk about some of the differences between the legacy software that we already have best practices for and then some of the new exposures then that are created by AI that are different than that we had before.
So let's break it down into three different categories and call the first category predictive AI. So predictive AI has been around for a long time. If you use your credit card in a foreign country in somewhere you're not supposed to be, and it gets red-flagged. Should this credit card be authorized? That's artificial intelligence. Artificial intelligence aggregates all the data and it knows where you have been and where you haven't been and what you've been using something for, and it can red-flag whether you can use that or not.
The first artificial intelligence policy was placed in 2013 for predictive AI, and it was on behalf of IBM Watson. Watson was a software program. It took into account large language models for symptoms to predict what a disease was, predict the diagnosis, or predict what treatment should be for a patient. So it was a very innovative and ahead of its time. But again, it was predictive. Predictive means that if you take the sentence, “the cat was chasing the blank. The cat was chasing the blank.” Predictive AI knew from looking at the sentences what the next word would be: “the cat was chasing the mouse.”
So the second category that we move into is generative AI. And generative AI, what that did was instead of just taking one word at a time, the cat was chasing the blank, it actually converts all the words into tokens and then makes some mathematical vectors and weighs the different relationships between the words to generate a new output, saying “the cat was chasing the blank.” So 99% of the time, the answer would still be it generates a new answer. “The cat was chasing the mouse.” However, it's not a hundred percent of the time. If you run that on generative AI, it actually comes back with the cat was chasing the mouse because it was on GLP-1s, because the cat was on weight loss diet, because the cat had hair balls. It will generate a new answer a hundred percent of the time, even though that answer is sometimes accurate and sometimes could be different.
The last part you brought up, agentic AI. What's the difference there? Agentic AI, it no longer is giving you the answer. “The cat was chasing the blank, the cat was chasing the mouse.” Agentic AI actually takes action. And so it will actually search the room or try and find the mouse. And so agentic AI, if you say “the cat was chasing the blank” and agentic AI, and it's not a human in the loop, agentic AI running simulations will actually knock down the wall to go try and find the mouse. The cat will actually knock down the wall to find what the cat was chasing so it can prove it. Agentic AI without a human in the loop takes action.
Let's give you a real-life example instead of the hypothetical cat chasing the mouse example. A gentleman in Australia wanted to sign up for Pilates class. So he had an agentic AI that took the action on behalf of him. It didn't just give him the information of the Pilates classes. It actually would sign him up. What they didn't count on was that the class was full. So what did agentic AI do? Did it give him good information like the generative AI and come back and say the class is full? Here are your options. Here are the times. No. The agentic AI went into the program and it deleted everybody else that had signed up for the class and put him in number one sign-up for the class and then sign him up for the next six months, which overrode every program parameter.
Agentic AI without a human in the loop takes actions without the human checking to see whether the action was accurate. So agentic AI is very different and it's much harder to underwrite than generative AI, we can underwrite. Predictive AI, we can underwrite. Agentic AI with human in the loop, we can underwrite because we can check to see the check and balance of the human loop. But agentic AI without a human in the loop is something that is a quote unquote unknown.
Stephen Vina (15:46)
Yeah, certainly a lot to think about there for any organization. You know, as we approach kind of the end of the calendar year and organizations are planning out for 2027, what should organizations be thinking about as they're trying to map out the next twelve to twenty-four months as they start thinking about their AI implementation? What are some kind of key points there for you?
Kevin Kalinich (16:06)
Yeah, so it's going a lot faster. Our typical insurance, we base things on 24 months because we like actuarial data and we like to say, all right, we're both in a room, Stephen. We know how to underwrite this room. Do you have fire detectors? Do you have fire sprinklers? Do you have locks in the doors? Do you have doors that block where the fire would spread? Do you have windows? We know what the risk is if you implement these best practices for that actuarial modeling.
We won't have that for AI because of how fast the developments are becoming. So what we do is we take the best quantifiable objective fact-based data and we use that to put ourselves in the best position to build a process that can evolve, a process that can change risk management. And so risk management can no longer be static, Stephen. Risk management now has to take those best practices that you've implemented for your old software, for your old hardware too, because it's not just a software issue. When we get into the internet of things and appliances and autonomous vehicles, you need to take those things into account.
And so what you'd have to do is have a collaboration of stakeholders. It requires the people that are looking at deployment of AI to work with legal, to work with IT, to work with finance, to determine what are the range of possibilities that could happen here. What are the best risk mitigation techniques that we can implement to mitigate these exposures? And then let's map that against our existing insurance to see where we have coverage, where there might be gaps, and how can we fill those gaps?
Stephen Vina (17:43)
Yeah, that's a great point. Really trying to build out your team or your working group that can really have accountability and management over the deployment and adoption of AI across an organization. And I guess ultimately that gets back to those governance structures that we were talking about earlier. I also think, you know, as to the extent that organizations are not already using AI for cyber defense, is that's something to strongly consider as well. Getting back to the earlier points of we know that our threat actors are using it and then leverage there is responding accordingly.
But to the extent we can get keep making sure that the scales are tipped in the defensive favor is key as well while building out those governance strategies.
I think, moving to some key takeaways for me from our conversation, I think AI adoption and risk management, which you just hit on, they can and they should move together. They can and they should work together. And I think those organizations that really adopt those governance frameworks and those risk management practices and thinking holistically about AI across their organization, you mentioned building out that team that's thinking about these issues more holistically, will really be best positioned to move forward with confidence and I think move faster safely. But welcome your thoughts on the final key takeaways for organizations.
Kevin Kalinich (19:03)
I'll begin their final thoughts by asking you a question, Stephen. Who knows everything about AI?
Stephen Vina (19:10)
Nobody.
Kevin Kalinich (19:11)
Nobody is the correct answer. If anybody tells you they know everything about artificial intelligence, turn around and run away. So, since nobody knows everything about artificial intelligence, what should you do? What you should do is aggregate the best-in-context, up-to-date, quantifiable, objective, fact based information and use that to make a process for a decision moving forward and be nimble to be able to have to change that.
You've already mentioned that there's a dearth of federal statutory regulation, but there are other risk management techniques. Amazingly, insurance is a tremendous force to enable and facilitate innovative artificial intelligence because insurance will require both the artificial intelligence frontier models and the deployers and the users to implement best practices in order to get insurance.
In order for organizations to get a big contract with a third party, they need to evidence insurance. And increasingly, those third parties are requiring evidence of artificial intelligence insurance. In order to get artificial intelligence insurance, you have to demonstrate in evidence and show that you are implementing best practices.
Are you training your employees about what they should be doing or what they shouldn't be doing with respect to artificial intelligence? Are you monitoring that? Are you keeping up to date with the latest case law and litigation? Do you have contractual best practices to allocate liability? Insurance can be a force for the good to benefit artificial intelligence development and both increase the return on investment for artificial intelligence and decrease the total cost of risk at the same time if implemented properly.
Daniel Serota (21:06)
Well, that's our show for today. Thank you to Kevin and Stephen for sharing their insights. As AI continues to evolve, organizations face a critical challenge, capturing the opportunities AI presents while putting the right governance, cyber security and risk management practices in place. The organizations that can successfully balance both will be well positioned to unlock AI's full potential. Thanks for joining and listening to the On Aon Global Insight episode.
We'll be back soon with another conversation on trends shaping business, risk, and opportunities around the world. Until next time.
Outro:
Thanks for getting all the way to the end of this week’s episode. Don’t forget to like, subscribe and share On Aon wherever you get your podcasts — and visit Aon.com to find out more about us.
We’ll be back next week with our Risk Capital Insight, which will be a further look at the issues surrounding digital infrastructure.