# AI for Strategy: Where It Creates Value (and Where It Creates Risk)

Date: 2026-06-22

AI is a strategy lever—but it’s also a risk multiplier when deployed without guardrails. Boards don’t need to pick between “AI optimism” and “AI fear.” They need a **portfolio view**: where AI creates value, where it creates new exposures, and what proof of control looks like.

<!--more-->

## Three Strategic Value Buckets (Board-Friendly)

### 1) Automation of knowledge work
Examples: drafting communications, summarizing documents, generating first-pass analyses, translating content.

**Value mechanism:** faster cycle time and reduced cost per unit of work.
**Typical risk:** confidentiality leaks, unverified outputs quietly propagating.

### 2) Decision support (not decision replacement)
Examples: triaging alerts, surfacing options, explaining trade-offs, improving search over internal knowledge.

**Value mechanism:** better coverage and consistency.
**Typical risk:** over-reliance (“automation bias”), hidden failure modes when context shifts.

### 3) Product and service innovation
Examples: copilots in SaaS products, customer support assistants, embedded “smart” features.

**Value mechanism:** differentiation and retention.
**Typical risk:** brand damage and regulatory exposure when the AI says the wrong thing at scale.

## Risk Multipliers Boards Should Treat as “Always On”

These show up repeatedly across industries:

- **Data risk**: sensitive data in prompts, training, logs, vendor retention, cross-border processing.
- **Security risk**: prompt injection, tool misuse, over-privileged agents, supplier vulnerabilities.
- **Operational risk**: non-deterministic behavior; quality drift; failures that only appear at scale.
- **Regulatory risk**: GDPR obligations for personal data; sector rules; EU AI Act duties depending on role and risk tier.
- **Reputational risk**: public-facing mistakes spread quickly, even when no “real harm” occurred.

If you want a single organizing tool, the NIST AI RMF provides a usable board narrative: **Govern → Map → Measure → Manage** ([NIST AI RMF](https://www.nist.gov/itl/ai-risk-management-framework)).

## How Boards Should Frame “AI Strategy”

Ask management to present AI as a portfolio with explicit trade-offs:

### A) A prioritized use-case register
For each use case: owner, value hypothesis, affected processes, data touched, failure impact.

### B) A “risk-to-control” mapping
Not “we have a policy,” but “here is the control that prevents/limits this failure.”

### C) A measurement plan
What will be measured and how often:

- **Quality**: accuracy/defect rates, human review outcomes
- **Safety**: incident rate, escalation time, “near misses”
- **Security**: abuse attempts, prompt injection trends, tool access anomalies
- **Cost**: usage, unit economics, “unbounded consumption” risk

### D) A third-party posture
What is built vs bought, what the vendor discloses, what is contractual, and what is monitored.

## Where AI Is Often Overused

Boards should be suspicious when AI is proposed for:

- **Hard accountability decisions** without transparent criteria (hiring/firing, coverage/claims, credit decisions) unless safeguards are explicit
- **High-consequence customer promises** (pricing, legal commitments) without verification gates
- **Autonomous actions** (agents executing changes) without least privilege and a kill switch

The point isn’t “never.” It’s: **show the control design and the evidence plan.**

---

**I help boards translate AI ambition into a governed portfolio.** My board courses cover AI fundamentals, strategy patterns, and governance. I also consult with boards and executives on AI adoption, vendor risk, and regulatory alignment. [Contact me](https://goldmanmalka.com/about).

---

### Relevant Sources

1. **The 2026 AI Index Report** — Stanford HAI — [https://hai.stanford.edu/ai-index/2026-ai-index-report](https://hai.stanford.edu/ai-index/2026-ai-index-report)
2. **AI Risk Management Framework (overview)** — NIST — [https://www.nist.gov/itl/ai-risk-management-framework](https://www.nist.gov/itl/ai-risk-management-framework)
3. **AI RMF 1.0 (NIST AI 100-1)** — NIST — [https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10)
4. **OWASP Top 10 for LLM Applications 2025** — OWASP — [https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/](https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/)
5. **ISO/IEC 42001 explained (AI management systems)** — ISO — [https://www.iso.org/cms/%20render/live/en/sites/isoorg/home/insights-news/resources/iso-42001-explained-what-it-is.html](https://www.iso.org/cms/%20render/live/en/sites/isoorg/home/insights-news/resources/iso-42001-explained-what-it-is.html)