Five Emerging AI Risks Your Governance Policy May Be Missing

Way back in May of 2026, a legal department approved ChatGPT for employee use. The team did its homework. It reviewed the vendor's security and privacy practices, evaluated the technology's capabilities and limitations, established rules for handling confidential information, and trained employees on appropriate uses. Employees began using the approved platform for drafting, research, summarization, and other routine tasks.

Fast forward to today, a mere 6 months later. The familiar chat interface is still there, but ChatGPT has evolved considerably. Its underlying language models have become more capable, and ChatGPT Work has expanded what users can ask the system to do. Beyond generating information for a person to review, Work can undertake multistep projects, interact with connected applications through plugins, navigate websites, and, through supported tools, help create functional applications for particular tasks.

Employees may still think they're using the same approved product. But the organization may now be dealing with capabilities that didn't exist when it made the original decision.

When a vendor introduces a capability, it doesn't necessarily mean an organization has enabled it or that employees are using it. Those are different events with different implications for risk. But they all raise a question worth asking: Does our original approval still cover what this system can now do?

This is the novel challenge of contemporary AI implementation risk. Some risks are genuinely new or poorly understood. Others are familiar concerns, such as confidentiality or unauthorized access, but they take on new dimensions when AI systems can retain information, interact with other technologies, or act with greater independence. In either case, the risks may not have been reasonably anticipated when the technology was originally evaluated.

The larger issue is that an approved AI system's risk profile is no longer necessarily stable. New capabilities, changing behaviors, and system interactions can introduce risks that existing governance wasn't designed to address. Organizations need a way to recognize when those changes matter and determine whether their safeguards still make sense.

One practical step is to add event-triggered reassessment to the AI governance process. Instead of waiting for an annual policy review, reassess when a system undergoes a material change in its underlying model, capabilities, permissions, integrations, autonomy, or access to sensitive information.

That doesn't mean every update requires a lengthy approval process. A routine change may have little effect on the organization's risk. Enabling an agent to act across connected applications may have considerably more. The challenge is knowing the difference.

Five Areas to Revisit in Your AI Governance

You probably don't need to start over. Existing policies on confidentiality, acceptable use, vendor security, and human review still matter. The question is whether those policies adequately account for systems that can retain information, connect to other applications, and act with increasing independence.

Here are five areas to examine and governance additions to consider.

1. Changing Capabilities and Unanticipated Behavior

What's changing: An approved AI platform is no longer necessarily a stable collection of features. Vendors can replace underlying models, introduce new capabilities, or combine existing functions in ways that materially change how a system behaves. The interface may look familiar even when the underlying technology has changed substantially.

The implications aren't always apparent when you examine individual features. A more capable model that can reason through complex tasks, access connected tools, and execute multistep workflows may introduce risks that weren't evident when those capabilities were considered separately.

What might be missing: A process for reassessing approved AI systems when their capabilities materially change. Annual policy reviews and periodic vendor assessments may not capture changes that affect how employees actually use the technology.

What to add: Establish event-triggered reassessment and assign responsibility for monitoring material changes, including new permissions, integrations, and features enabled within the organization's environment.

A practical reassessment can begin with four questions:

• What can the system do now that it couldn't do before?
• What new information, applications, or systems can it access?
• Can it take actions, delegate tasks, or operate with less human involvement?
• Do our existing safeguards still address the resulting risks?

The answers should determine the response. A routine update may require little more than documentation. A new capability that allows AI to execute tasks across connected applications may warrant targeted testing or additional controls.

The important distinction is between reassessing a change and restarting the entire approval process. They shouldn't automatically be the same thing.

2. Information Access, Confidentiality, and Trust Boundaries

What's changing: AI systems can retrieve information from connected applications, retain context across interactions, and use outside materials to complete tasks. This raises questions about what information they can access, what they remember, and which instructions they should trust.

Persistent memory is one example. Information shared during one task may be retained and influence future work. For legal teams, that raises concerns about confidential client information, matter separation, and the unintended reuse of sensitive or outdated context.

A less familiar risk is prompt injection. Imagine a litigation team using an AI agent to analyze documents produced by opposing counsel. One document contains hidden instructions directing the agent to search the firm's connected document repository for confidential information and send it to an external destination. The attorney never authorized that action. The instructions came from the material the agent was supposed to analyze.

Whether such an attack succeeds depends on the system and its safeguards. But the scenario illustrates a fundamental change in risk: outside content isn't merely information the AI might misunderstand. It can also be an attempt to influence the AI's actions.

What might be missing: Policies that address what employees may enter into an AI system, but not what the system can retrieve, retain, or do in response to instructions embedded in outside materials.

What to add: Extend data governance requirements to cover persistent memory, connected information sources, and untrusted content. Determine when memory is appropriate, how sensitive information is separated, and what retention and deletion controls are available.

Limit access to connected systems based on the task, and test higher-risk workflows to determine whether outside content can redirect an agent or trigger unauthorized actions.

These safeguards should be proportionate. Remembering an employee's formatting preferences is different from retaining confidential client strategy. Summarizing a document is different from analyzing it while holding permission to search internal repositories and transmit information externally.

3. Agent Autonomy, Delegation, and Control

What's changing: AI systems are moving beyond generating information and recommendations. Agents can execute tasks, interact with applications, delegate work, and continue operating with less direct human involvement.

Consider the difference between asking an AI assistant to draft an email and authorizing an agent to send one. The first produces content for review. The second can create an external communication before a person has examined it. Similar distinctions arise when agents modify matter records, share documents, initiate transactions, or coordinate with other agents.

Autonomy also raises questions about duration and scope. An agent may repeat unsuccessful actions, continue operating beyond its intended task, or retain permissions after a project ends.

What might be missing: Clear boundaries on what agents are authorized to do, when they can delegate work, how long they may operate, and who is accountable for their activity. A general requirement for human oversight may not be enough when a system can take multiple actions between review opportunities.

What to add: Define authority according to the actions involved. Distinguish between reading, drafting, recommending, modifying, sending, deleting, and executing. Establish approval requirements for consequential actions, limits on delegation, and boundaries for persistent workflows.

Tie agent permissions to a specific purpose and duration rather than granting broad standing access. Assign an accountable owner to agents operating beyond a single interaction, maintain an inventory of persistent automations, and ensure someone can pause or terminate them when necessary.

Not every action needs human approval. Routine activity within established boundaries should proceed without unnecessary intervention. The question is whether the organization deliberately set those boundaries or simply accepted whatever permissions the technology offers.

4. Human Judgment, Oversight, and Authenticity

What's changing: AI can produce increasingly polished work and complete more of the underlying process before a person sees the result. That can make human review more difficult, even as the consequences of inadequate review increase.

As AI performs more of the underlying work, human reviewers may have less firsthand knowledge of the information, assumptions, and decisions that shaped the result. That can make it harder to recognize errors, even when a review is required.

An attorney examining an AI-generated research memorandum may see a coherent analysis without knowing whether the system overlooked contrary authority or relied on unreliable sources. A legal operations professional asked to approve an agent's proposed action may have little visibility into how the recommendation was developed.

There's also a related concern about authenticity. AI-generated or altered documents, images, audio, and other materials can be difficult to distinguish from genuine records, particularly when their origins aren't clear.

What might be missing: A meaningful definition of human oversight and clear expectations for verifying important information. Many policies require review of AI output but don't explain what that review should involve or what information a reviewer needs to make an informed decision.

What to add: Define review expectations based on the significance of the task. For consequential work, reviewers should have access to the information needed to verify material facts, sources, and proposed actions. Establish independent verification where appropriate.

Where the authenticity of a document, recording, or other material matters, establish procedures for checking its origin and preserving relevant source information and metadata.

The objective isn't to make someone redo every task the AI performed. It's to ensure that human review can identify consequential errors and that responsibility for important decisions remains with the appropriate person.

5. Monitoring, Incidents, and Operational Response

What's changing: AI systems can cause problems that don't fit neatly into conventional cybersecurity or technology incident categories. An agent might send an unauthorized communication, incorrectly alter a matter record, act on misleading information, or continue operating outside its intended scope without any security breach.

These events may be difficult to detect or investigate if the organization isn't monitoring agent activity or preserving sufficient records to understand what happened.

What might be missing: AI-specific incident definitions, reporting channels, and procedures for investigating unexpected behavior. Existing incident processes may focus on compromised accounts, data breaches, or outages while overlooking other consequential AI failures.

What to add: Expand incident response procedures to cover unauthorized AI actions, unexpected autonomous behavior, material errors, failures of oversight, and near misses. Identify who receives reports, what information should be preserved, and who can suspend a problematic workflow.

For higher-risk or persistent agents, establish proportionate monitoring, activity records, and procedures for intervention and recovery. Employees should know how to report concerning behavior without assuming that every unexpected result is a major incident.

The purpose isn't to scrutinize every AI interaction. It's to identify meaningful problems early, learn from them, and respond before they become more serious.

Governance That Can Keep Up

These five areas don't require five new policies, five new committees, or an elaborate approval structure. Many of the safeguards can be incorporated into existing AI policies, technology approval processes, information governance practices, and incident response procedures.

What matters is whether someone is paying attention to how the technology is changing and has the knowledge and authority to respond.

That might be a designated AI governance lead or a small group that understands both the technology and the organization's business needs. Give them authority to make routine decisions quickly, establish clear escalation criteria, and provide employees with a practical way to ask questions or propose new uses.

Organizations should be able to approve low-risk uses quickly, apply established safeguards without repeatedly revisiting the same questions, and reserve more intensive review for changes that genuinely alter the risk. Employees need clear boundaries, but they also need room to experiment with technology that can improve their work.

The question isn't simply whether your organization has an AI policy but whether that policy can keep up with the technology it's supposed to govern. And if every new capability requires months of review, the governance process may need updating just as urgently as the policy itself.

“The question isn't simply whether your organization has an AI policy but whether that policy can keep up with the technology it's supposed to govern.”