In the Chair

Marketing shipped an agentic customer-service chatbot on Friday. It has live access to your CRM and order system. Monday morning a customer tweets a screenshot: the bot disclosed another customer’s address and order history. It is still live.

A product manager mentions in passing that her team has been pasting customer support transcripts into a consumer AI writing tool for two months to draft replies. It was never reviewed. The transcripts contain names, emails, and account details.

The CEO just promised the board a customer-facing GenAI assistant live in four weeks. There is no risk assessment, no guardrails, and no plan for what the model can access. In the room, the CEO asks you whether security is on board.

A regulator sends a formal request for your AI risk documentation, model inventory, and impact assessments under the EU AI Act. Your model inventory is six months stale and no impact assessments are complete. The response is due in ten business days.