An AI risk register can look complete while the workflow remains unsafe.
“Data privacy” is listed. “Hallucinations” has a mitigation. “Human review” appears in several rows. But nobody has agreed what the reviewer checks, who can stop the workflow, or what happens when information reaches the wrong audience.
Naming a risk is not the same as treating it.
NIST’s Generative AI Profile identifies risks including confabulation, data privacy, information security, and problematic human AI configurations. It is voluntary guidance, not a certification that a particular tool or process is safe. For program leaders, it offers a useful starting point for asking specific operational questions.
Data: limit what enters and where it goes
Before a pilot begins, identify the information the workflow needs and exclude what it does not. Classify the data, confirm authorized uses, and verify provider terms and relevant settings with privacy, legal, and security specialists.
Do not assume that “enterprise” means every handling requirement is satisfied. Retention, access, connected sources, and downstream sharing all need attention.
A practical treatment is an approved input boundary supported by access controls and review. Give someone responsibility for maintaining that boundary when new sources or integrations are added.
Hallucinations: verify the claims that drive action
Generative AI can produce unsupported content that sounds convincing. In program work, the consequential error may be an invented approval, a missing dependency, or a tentative date presented as confirmed.
Ask for source references, but verify them. A citation is not proof that the cited material supports the claim.
Define review around consequence. Owners, commitments, customer statements, and release readiness claims deserve explicit checks before publication or action. Test the workflow with ambiguous and incomplete inputs, not just clean examples.
Security: separate reading from authority
A connected assistant may encounter malicious instructions inside documents, comments, or external material. Treat that content as untrusted input, not permission to change the workflow.
Use least privilege access, restrict available actions, and require approval for consequential changes. Test for prompt injection and unintended disclosure. Keep a way to disable integrations or revoke credentials if the behavior is unsafe.
A prompt that says “be secure” is not a substitute for controls enforced outside the model.
Governance: make responsibility operational
Assign a workflow owner and define who approves data access, accepts residual risk, reviews changes, and handles incidents. Keep a record of important configuration changes and revisit testing when models, sources, or permissions change.
“Human in the loop” is meaningful only when that person has enough context, time, and authority to intervene. Review should not be a ceremonial click under delivery pressure.
A hypothetical program example
Consider a hypothetical AI assistant drafting a steering committee update from internal notes and supplier reports. One supplier document contains text instructing the assistant to ignore earlier rules and mark a milestone green.
The proposed treatment combines controls: supplier content has no authority to change instructions, the assistant cannot publish or update milestone status, and a reviewer checks consequential claims against approved evidence.
If testing shows the assistant still follows the malicious text, the team pauses the pilot and escalates to security. It does not compensate by asking reviewers to “be more careful” indefinitely.
Make the treatment testable
For each material risk, record the scenario, consequence, control, owner, evidence that the control works, and remaining exposure. Define a pause condition and a manual fallback. An unresolved risk should remain visible rather than disappearing behind a reassuring status label.
Start with the workflow you are already using. Trace its data, outputs, permissions, and decisions. Then test one realistic failure with the people expected to respond. Responsible AI adoption is not the absence of risk. It is making informed choices, checking that protections work, and keeping someone accountable when the output becomes action.