Managing AI Tool Risk: A Human-Centred Approach

Managing AI Tool Risk: A Human-Centred Approach

The rapid proliferation of artificial intelligence (AI) tools offers both managers and employees the chance to reassess their operational efficiency. If you are a business leader, you may be considering adopting AI tools—and may already have the technical advice needed to evaluate issues such as bias, error rates, accuracy, cybersecurity, and energy efficiency.

It is also likely that your organisation has already implemented a set of policies, processes, and controls to ensure compliance with applicable obligations and standards. From this experience, you will be aware that, directly or indirectly, risk always originates in human behaviour.

Therefore, you will soon conclude that a technical analysis alone is insufficient to assess the risks associated with AI tools. Modern corporate risk management must include AI-related risks—and do so from a human perspective, not solely a technical one. A thorough risk analysis should account for the possibility that employees, on their own initiative and without notifying management, may be using such tools to boost productivity—with potentially serious consequences.

What kind of legal risks are we talking about? These can be difficult to predict, as a single action may breach multiple legal norms. Examples include: unauthorised processing of personal data; unlawful use of third-party databases; the use of AI to detect employees’ emotions (prohibited since February 2025 under EU Regulation 2024/1689); or neglecting high-risk obligations, such as using AI in safety-critical radio equipment.

A comprehensive risk assessment must quantify the potential impact—not only regulatory fines, but reputational damage as well. The person in charge must be equipped with the right tools to make informed decisions based on their risk appetite and available resources.

There are several established methods (e.g., COSO, ISO 31000:2018, ISO/UNE 31010:2011), and for AI, ISO 42001 is emerging. However, no method alone is fully sufficient. An effective approach must assess both the likelihood of occurrence and the potential severity. Multiplying these produces inherent risk, to which existing controls are applied, resulting in the residual risk. If this exceeds the acceptable threshold, new controls must be implemented.

In conclusion, managing the corporate risk of integrating AI into business processes requires more than a technical outlook. A human-centred approach—one that recognises the legal and economic consequences of human behaviour—is essential. Only with updated, human-oriented risk governance can organisations make sound decisions aligned with their risk appetite and resources.

by César José Fernández Pérez and Inés Cano Gozalo

act legal Spain