The RiskTech Journal
The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.
Stop Deploying AI Agents You Cannot Monitor
Three researchers fired by OpenAI have written to the company's board and safety committees with a warning that reaches well beyond one lab. According to The Wall Street Journal, which reviewed the letter, the former employees fear AI companies will lose the ability to monitor how their most capable systems reason, and they want OpenAI to work with outside safety auditors before that happens.
The concern centers on what researchers call chain of thought. It is the written record a model produces as it works through a problem, and labs read it to see how a system arrived at an answer or an action. The letter's authors, Jasmine Wang, Tomek Korbak, and Mikita Balesni, argue that the industry does not know how to safely build and release models it cannot monitor, and that frontier labs should not pursue advances that weaken that ability.
OpenAI's reply is the part risk leaders should read twice. The company says the three were dismissed for misconduct that included sharing confidential information with an outside AI safety group, and that the decisions had nothing to do with raising safety concerns. The former employees dispute that account. On the substance of the letter, the company did not push back. A staff memo shared by an OpenAI spokesperson said the ability to monitor its models is of the utmost importance and that third-party assessors are an important part of the safety ecosystem.
The lab and its critics disagree about the firings and agree on the principle. An AI system that cannot be monitored should not be deployed.
IRM Market Brief: September 22 to 29, 2026
Anthropic is preparing what could be the largest initial public offering on record, and its prospectus tells investors the company may be liable when one of its agents deletes a customer’s data or moves a customer’s money.
Stop Treating Embedded AI Agents Like Shadow AI
An embedded agent issued an unapproved credit while every dashboard stayed green. Shadow AI needed visibility and the market built it. Embedded agents need understanding, and nobody delivers it across platforms. IRM was defined for both.
IRM Market Brief: September 15 to 21, 2026
Archer put digital employees to work inside the GRC system of record last Monday. By Tuesday, Workiva had handed its customers a no-code studio to build their own. That is the week the core IRM platforms stopped describing agents as assistants and started shipping them as workers. Archer says dozens of its AI Operators are already running in customer environments across audit, third-party risk, IT risk and operational risk. Workiva's Agent Studio lets finance, audit and compliance teams create, customize and schedule agents on their own workflows, and it arrives with an agentic internal-control testing solution that runs evidence collection, sample selection and attribute testing end to end. Neither vendor named a customer with a measured result.
Almost Everyone Has AI Governance. Almost No One Is Ready.
Seventy percent of large companies have stood up an AI risk committee. Fourteen percent say they are ready to deploy AI. Both numbers come from the same Sedgwick survey of 300 Fortune 500 leaders, published this year, and the distance between them is the most important measurement in enterprise risk right now.
Read that gap carefully, because it is not a governance gap. The governance exists. The committees meet, the policies are filed, the approval gates are documented. What the executives inside that 70 percent are admitting, five out of six of them, is that none of it has made their organization ready to run AI. A policy on file is not the same as showing a control works once the model is live. The gap between the two has a name, and it is exposure.
WEF Claims AI Governance is a Growth Strategy
The recent World Economic Forum argument that “effective AI governance” is now a growth strategy is directionally correct, and also incomplete in a way that will matter for buyers in 2026. The claim is correct because governance reduces friction, clarifies accountability, and increases repeatability as AI moves from pilots to enterprise scale. The claim is incomplete because many organizations are calling the entire operating model “AI governance,” when the value is realized only when governance is translated into management execution.
The Real AI Test: How to Tell a Platform from a Chat Overlay
Most vendors now claim to have “AI platforms,” but many are just chat interfaces placed on top of disconnected systems. The difference is more than marketing. Without the right controls, these overlays can leak data, bypass policies, and mislead buyers into thinking they are getting enterprise-grade AI governance when they are not.
Executive Comparison of AI Governance Frameworks for Risk & Compliance
Artificial Intelligence (AI) is becoming integral to enterprise operations and risk management, including emerging Autonomous IRM (Integrated Risk Management) initiatives where AI agents autonomously assist in identifying and managing risks. Executives and boards need to ensure such AI deployments are trustworthy, compliant, and aligned with business objectives. Several frameworks have emerged to govern AI risk and compliance. Below is a comparison of three key frameworks – ISO/IEC 42001 (the new AI Management System standard), the EU AI Act (forthcoming European regulation), and the NIST AI Risk Management Framework (RMF) (a U.S. voluntary guideline) – focusing on what executives should understand, monitor, and prioritize in each.