Module 10: AI for Leaders & Professionals
10.2What Can Go Wrong
Name the AI risks that touch your real work and pair each with a control you will actually run.
- 30 min to fill in
- You leave with: Your marked risk list, three controls with the moment you run them, an escalation line, and one control tested.
- Good for: Early career, Specialist, Own business, Leading change, Leading people
Map the realistic ways your own AI use can go wrong, and pair each risk with a concrete check you run at a set moment, so you do not need a compliance department to use the tools well.
The risk categories follow the NIST AI Risk Management Framework and its generative AI profile (standard, not research: NIST AI 100-1, 2023; NIST AI 600-1, 2024). The overreliance evidence is mixed research from one field experiment (Dell'Acqua et al., 2026). Data protection points follow IMY and EDPB guidance (official guidance). The control table is practice, not research.
When to use it
Use it when:
- You are about to rely on AI for something that matters: a client deliverable, a decision, a public text.
- Someone asks "what is the risk?" and you want a better answer than "be careful".
- You are preparing the risk input for a team policy (10.10 Team AI Policy).
Skip it when:
- You are still unsure what the tools are and do: start with 10.1 AI Concepts Map.
- You need to check one specific output before it goes out: use 10.9 AI Output Verification Checklist.
The idea
Risk work on AI does not need a new theory. The NIST framework (NIST, 2023) sorts it into four plain functions: govern, map, measure and manage. Its generative AI profile (NIST, 2024) then lists the risks that are specific to content-producing systems, among them invented facts, leaks of personal or confidential data, biased output, security holes and unclear intellectual property. This page is the individual-sized version: Step 1 maps, Steps 2 and 4 manage, 10.12 measures, and a team policy governs.
The risk people underrate most is overreliance. In a preregistered experiment, consultants who used AI on a task just outside its capability did worse than those who worked without it (Dell'Acqua et al., 2026), and nothing in the output warned them. On data, European regulators apply ordinary GDPR rules to personal data in AI tools (IMY; EDPB, 2024). The limit of this page is that a control only counts when it names an action and a moment. "Be careful" is not a control, so Step 2 asks for both.
First step: Mark the Risks That Apply
Read each row and tick the ones that match how you use AI today, not how you might use it.
Strong answer: ticks on hallucination, accountability and privacy for anyone who drafts client text with AI. A blank column means you have not yet looked at your real use.
| Risk | What it looks like in practice | The matching control | Applies to me |
|---|---|---|---|
| Hallucination | Confident false facts, invented citations, wrong numbers, references that do not exist | Check before use, matched to the stakes (10.9). Ask for sources, then check that they exist and say what is claimed. | ☐ |
| Privacy and confidentiality | Personal data, client information or business secrets pasted into a tool that stores or trains on inputs | Know each tool's data terms before you paste. Keep a do-not-share list (10.4 for private life, 10.10 for the team). | ☐ |
| Bias and unfair output | Output that skews by gender, age or other traits, for example in job ads, screening or assessments | AI never makes or visibly shapes decisions about people without human review. Check output for skew when the subject is people. | ☐ |
| Security | Hidden instructions in documents or pages the AI reads (prompt injection), unsafe generated code, fake links | Treat external content the AI reads as untrusted. Review code before running it. Give tools no more access than the task needs. | ☐ |
| Overreliance | Accepting output on tasks beyond the tool's capability; losing a skill you never practice | Test capability task by task before trusting it (10.7). | ☐ |
| Intellectual property | Output that reproduces protected material; unclear rights to generated content | Do not present generated content as your own analysis where origin matters. Follow your organization's line; ask before publishing when unsure. | ☐ |
| Accountability gaps | "The AI said so" as a defense; nobody reviewed what went out | The sender owns the output, always. Disclosure rules belong in team policy (10.10). | ☐ |
Example
Illustrative example: the roles and the firm are made up.
A junior analyst at an engineering consultancy in Norway drafts a market overview with AI help. The draft cites two industry reports.
Step 1: he ticks hallucination, privacy and accountability.
Step 2: hallucination: open every cited source before the draft goes to his manager. Privacy: client figures go only into the firm's approved tool. Accountability: his name on the document means he checks every number.
Step 3: he stops and asks when a prompt would include client data the approved tool is not cleared for. Who he asks: the data protection officer.
Step 4: the source check finds that one report does not exist. He also realizes he pasted a client's volume figures into a free consumer tool the week before. He switches to the approved tool and reports the slip, as the firm's policy asks. The invented citation would have reached the client; a short check caught it.
Fill it in and keep your answers
This page shows the first step. The whole template is in the MGMT AC app for iPhone, which opens soon. Your answers stay on your own device.
- 2. Write Your Controls
- 3. Draw Your Escalation Line
- 4. Test One Control