Quantifying AI Risk: Turning uncertainty into better business decisions

Artificial intelligence is rapidly changing how organisations operate, innovate and compete. Boards are under pressure to accelerate adoption, while security, risk and compliance teams are working to establish the safeguards needed to protect data, people and operations. This creates a central question for business leaders: how much risk are we accepting in pursuit of AI-enabled value?

Traditional heat maps provide a useful starting point, but a red or amber rating is difficult to compare with a productivity gain, a new revenue opportunity or the cost of delaying adoption. Expressing AI risk in financial terms gives boards a clearer basis for deciding where to invest, which use cases to prioritise and which controls will provide the greatest reduction in exposure.

Why AI challenges traditional risk registers

Many risk registers were designed for technology environments that changed in relatively predictable ways. AI introduces a faster and more interconnected risk landscape:

• Adoption can outpace governance. Employees can access public AI tools, browser extensions and embedded SaaS capabilities before policies and assurance processes have caught up.
• Outcomes can be probabilistic. The same instruction can produce different responses, while techniques such as prompt injection can influence how a model or connected agent behaves.
• Access can be inherited at scale. An enterprise assistant connected to email, document repositories and business systems may expose weaknesses in existing permissions and data governance.
• Accountability can be distributed. AI services often depend on models, platforms, data sources and suppliers that sit across several organisational and contractual boundaries.

A single qualitative rating can hide these differences. Quantification forces a more useful discussion: how frequently could a defined event occur, what would the resulting loss look like and how much would a proposed control change that exposure?

A practical model: frequency and impact

Frameworks such as FAIR provide a structured way to translate technical uncertainty into financial terms. The approach models two core components:

• Loss event frequency. The estimated number or probability of harmful events within a defined period.
• Loss magnitude. The potential cost of each event, including investigation and response, business interruption, legal and contractual impacts, regulatory action, customer remediation and reputational damage.

Rather than relying on a single point estimate, organisations can use credible ranges and probabilistic modelling to describe uncertainty honestly. The result is a decision-focused statement that executives can compare with the cost and expected benefit of a control investment.

Four AI risk scenarios worth modelling

Building credible estimates from the data you already hold

Perfect data is not required to begin. Most organisations already hold useful evidence that can be combined to form defensible ranges:

• Internal telemetry. SASE, CASB, endpoint and identity platforms can help reveal which AI services are being used, by whom and how information is moving.
• Incident and service records. Previous data-loss events, investigations and recovery activity provide evidence of response effort, disruption and cost.
• Calibrated expert judgement. Security, legal, privacy and business specialists can provide bounded estimates when direct historical evidence is limited.
• External loss and enforcement information. Sector reports, insurer data and regulatory outcomes can be used as reference points, provided their relevance and limitations are understood.

Turning quantified risk into investment decisions

Once a baseline has been established, proposed controls can be assessed against the amount of risk they are expected to reduce. If a shadow AI scenario has an expected annual loss of £1.5 million, and a combination of application control, AI-aware DLP and user coaching is expected to reduce event frequency by 70%, the organisation can compare the avoided exposure with implementation and operating costs. These figures are illustrative, but the decision method is what matters.

The same approach also helps prevent over-control. Where a use case has low potential impact and strong existing safeguards, the organisation can apply proportionate governance rather than introducing friction that outweighs the risk reduction.

Connecting risk quantification to AI governance

Financial quantification complements recognised governance approaches. The NIST AI Risk Management Framework structures activity around governing, mapping, measuring and managing AI risk. ISO/IEC 42001 provides a management-system approach for establishing, operating and improving AI governance. The EU AI Act introduces legal obligations based on the role of the organisation and the risk classification of the AI system.

Together, these approaches reinforce a consistent principle: organisations need evidence that AI risks are understood, ownership is clear, controls are proportionate and performance is monitored throughout the lifecycle.

From AI visibility to AI governance

Understanding exposure is the first step. The organisations positioned to gain sustainable value from AI are those that connect risk visibility, governance and security to business priorities rather than treating them as separate programmes.

Telefónica Tech helps organisations identify AI usage, assess risk, define practical governance and implement proportionate security controls. By bringing together advisory expertise, data and AI capability, cybersecurity services and ongoing operational support, we help customers move from experimentation to secure, responsible adoption.