Artificial Intelligence (AI) in risk management - IBM, 4th-IR, Microsoft & Google

Executive summary

The panel’s central message is that AI and machine learning can make risk management more predictive, efficient, and useful to the business—but only when organizations combine good data, suitable technology, domain expertise, and human judgment. AI can also introduce new risks, including biased outcomes, opaque decisions, privacy concerns, and misplaced confidence in automated predictions.

Business and operational takeaways

• Treat AI as a business capability, not a standalone technology project. Speakers urged organizations to connect data, models, processes, and subject-matter expertise. Focus on solving practical problems rather than deploying complex systems for their own sake.
• Use AI to augment people. Microsoft’s framing was “augmented intelligence”: systems can help people see, understand, and act on more information rather than simply replace them. Humans should retain responsibility for consequential decisions.
• Start improving data readiness now. IBM and 4th-IR described data as abundant but often unstructured, incomplete, or difficult to use. Establishing data infrastructure and improving data quality today can make future AI applications more effective.
• Make risk management part of business operations. Risk and compliance teams should help enable customer service and commercial activity—not be seen only as a policing function. Automating routine searches and control tasks can reduce friction for employees.
• Build for transparency and accountability. AI-driven decisions can affect people differently, and black-box models may obscure why. Organizations need to understand model behavior, monitor outcomes, and decide where human review is required.

Frameworks, processes, and playbooks

Risk and compliance workflow automation

• Improve KYC/customer onboarding and risk evaluation.
• Use AI to monitor transactions and classify alerts for AML investigations.
• Reduce false positives and prioritize cases for human review.
• Help assemble documentation for suspicious activity reports.
• Connect policies, procedures, controls, reviews, and tests to regulatory changes.

Human-plus-machine operating model

• Use machine learning to search, identify patterns, and surface anomalies at scale.
• Have specialists investigate and interpret the results.
• Keep decisions and accountability with people where the stakes are high.

Data-to-model implementation

• Collect and organize relevant data, including unstructured material such as emails, documents, and reports.
• Apply appropriate techniques, such as machine learning, natural-language processing, and predictive analytics.
• Integrate outputs into existing workflows and systems.
• Measure whether the change improves speed, cost, accuracy, customer experience, or risk outcomes.

Adoption strategy

• Invest early in practical capabilities; the 4th-IR speaker warned that late adoption may be more expensive.
• Use accessible tools and platforms where appropriate. Google described making machine-learning tools and models available to developers, including through TensorFlow and APIs.
• Work across technology providers and business teams rather than expecting one organization or tool to solve the problem alone.

Risks and governance issues

• Bias and unequal effects: A credit-scoring example showed how a new machine-learning model could reclassify some people—particularly members of minority groups—as higher risk, even when older methods did not. Model performance should therefore be assessed across relevant groups, not just in aggregate.
• Explainability and accountability: Organizations must decide who is responsible when an AI-supported decision causes harm and whether the reasoning can be examined.
• Privacy and employee monitoring: Email, chat, and behavioral data may help identify risks, but their use raises privacy and trust concerns. The panel emphasized using data to support informed investigation, not simply to monitor or penalize employees.
• Model and data quality: Incomplete or biased data can produce misleading results. Scaling an unreliable model can magnify the problem.
• Cybersecurity: Speakers noted that companies should not assume they can be 100% secure. AI-enabled controls can help identify unusual behavior but need to sit within broader security and risk-management practices.

Examples and speaker-cited metrics

Figures below are claims made by speakers in the video; some numbers or units may be affected by auto-caption errors.

• IBM / Memorial Sloan Kettering oncology: Watson analyzed medical research, imaging, and diagnostic material. In about 30% of cases, its findings differed from those of cancer experts; the speaker said it surfaced relevant research the experts had missed. The example illustrated information retrieval at scale, not proof that the system independently improved patient outcomes.
• IBM / data growth: The IBM speaker said about 90% of the world’s data had been created in the prior two years, with roughly 80% unstructured, and cited financial-services data growth of around 70% annually. In her framing, the business challenge is turning available data into usable information.
• Google / data-center cooling: Google said machine learning optimized data-center cooling across hundreds of variables. The speaker cited about a 40% reduction in cooling use and millions of dollars in monthly savings. The system was said to optimize more frequently than human operators could.
• Google / email suggestions: Suggested replies were reportedly used in about 10% of emails within months of launch.
• Google / agriculture: A project forecasting U.S. maize production reportedly achieved results within about 2% of the official figures, with forecasts available five months in advance.
• Google / insurance claims: A machine-learning model was described as identifying whether certain claims should be paid with roughly 80% precision, helping reduce claims-processing costs.
• Google / vehicle damage: With USAA, image-analysis tools were used to assess vehicle damage and support near-real-time claims estimates. The speaker described the service as costing a few hundred dollars per month, with substantial operational savings.
• Google / illegal fishing: Machine learning and vessel data helped identify fishing activity in a small island nation’s maritime territory, supporting enforcement where authorities had struggled to monitor a large area.
• Microsoft / fraud detection: Machine learning was used to find fraud patterns in large data volumes; the speaker said diagnosis time had been reduced from minutes to seconds.
• Microsoft / behavioral biometrics: Device-use patterns, such as how a person interacts with a laptop trackpad, were presented as a way to flag behavior that may indicate a bot or compromised account.
• Microsoft / health application: The speaker described a wrist-worn device developed with a woman with Parkinson’s that used brain-signal feedback to help reduce tremors—an example of AI-related technology supporting an individual beyond banking or finance.
• 4th-IR / healthcare: Examples included interpreting biopsy slides and supporting infection prevention and post-surgical care. The speaker also cited hospital-acquired infections as a significant source of deaths and argued that even modest improvements could matter.
• Risk and compliance workload: IBM’s speaker said around 98% of AML alerts were false positives. She also cited estimates of 20,000–40,000 regulatory changes a year and a large volume of regulatory documentation, illustrating the potential value of automated monitoring and classification. These figures should be treated as speaker-reported estimates.

Presenters and sources

Presenters and organizations represented: Bernhard Janischowsky (Trestle Group), Tarun Ramadorai (Imperial College), Nicola Crawford (IRM), Raza Sadiq (IRM), Grace Brasington (IBM), Frank Luijckx (4th-IR), Martin Moeller (Microsoft), and Matt McNeill (Google). Examples also referenced Memorial Sloan Kettering, USAA, AXA, and Google DeepMind.