For the CRISAM® team, AI governance was the number one topic at #RISK Expo Europe 2026, held on 10 and 11 November 2026 at ExCeL London. On the BFSI Stage, in the statement by GRC analyst Michael Rasmussen and in the answers at CRISAM® Stand 13, the same question came up: how do you govern AI that makes decisions at machine speed? CRISAM® answers it with governed autonomy, an AI governance framework in which people set purpose, boundaries and the right to intervene, and AI acts within them.
We went to #RISK 2026 in London with a stand, a panel seat and one question for everyone we met. We came home with the same answer from almost every direction: AI is already making decisions in the business, and AI governance has to keep up with it.
Why was AI governance our number one topic at #RISK 2026?
Because AI has moved from pilot projects into decisions that matter: credit, fraud, pricing, claims, complaints. At #RISK 2026 the question was no longer whether organisations use AI. It was how much they let AI decide on its own, within which boundaries, and who can stop it. That is AI governance, and it was on the BFSI Stage, in the exhibition hall and in nearly every conversation we had. The organiser, GRC World Forums, gave the second day its own PrivSec AI Governance conference.
We were not the only ones to see it that way. GRC World Forums opened its announcement of #RISK Expo Europe 2026 with agentic AI and geopolitical instability as the two forces reshaping the threat landscape, and added AI-focused workshops to the programme. Third-party risk, operational resilience and regulation such as the Digital Operational Resilience Act (DORA) were on the programme as well. AI was the topic that cut across the stages.
Three things kept coming back:
- SpeedAI decides in milliseconds. Most oversight still reports once a quarter.
- OwnershipFew organisations can name an owner for every decision their AI makes.
- ProofBoards and regulators ask for evidence that AI was under control, yesterday and today.
What is machine speed governance?
Machine speed governance means governing AI-enabled decisions at the speed they are made. Every material AI-enabled decision is identified, given an approved purpose and boundaries, watched as it happens and recorded, with an authorised human always able to step in. Governance runs continuously instead of once a quarter.
The term describes the gap that shaped the two days in London. AI decides in milliseconds, and thousands of decisions happen between two board meetings. The accountability stays with the board.
What did Michael Rasmussen say about governing at machine speed?
Michael Rasmussen, GRC analyst at GRC 20/20 Research, gave the morning keynote at #RISK 2026 and hosted the GRC Theatre and the Risk Theatre. It was his fifth year at the event. He stopped at the CRISAM® stand and summed up the two days in about a minute: AI amplifies the risks organisations already manage, and the open question is how to govern a business that runs at machine speed.
His starting point is risk and resilience management. Geopolitical risk, operational risk and the risk in decisions and strategy all arrive at once, and organisations have to stay resilient through it. Then he names what changes the picture: in his words, what “exponentially impacts” all of it is AI.
“How do you govern risk, and how do you govern a business that’s running at machine speed?“Michael Rasmussen, GRC 20/20 Research, at #RISK 2026
He also names what organisations need from their governance, risk and compliance (GRC) providers: help to make better decisions, reliably achieve objectives, address the uncertainty in those decisions and act with integrity, as organisations run at machine speed.
What did the Beyond Basel panel show about AI governance?
Most organisations use AI to make decisions, but very few could tell their board within minutes if one of those decisions went wrong. That was the result of a live test on the panel “Beyond Basel: next-generation risk management for BFSI leaders” on 10 November 2026. Andrew McIntyre of CRISAM® joined Oliver Greenslade, Chief Risk Officer at Channel Capital Advisors, on the stage for banking, financial services and insurance (BFSI). Chris Brown of Capgemini Invent moderated. Halfway through, Andrew asked the room to stand up, and to sit down as soon as the honest answer was “no”:
- Q 01Your organisation uses AI or models to make or support decisions.
- Q 02You could list every decision AI or models make in your organisation today.
- Q 03Every one of those decisions has a named owner who knows they own it.
- Q 04Those decisions are checked against your risk appetite before they are made, not after.
- Q 05If a model breached appetite at 9am today, your board would know by 9.15.
Almost the whole room stood for the first question. By the fifth, very few were still on their feet. That is not a lack of governance. It is governance built for periodic, human decision making, now facing decisions made at machine speed.
Andrew’s comparison is aviation. It did not respond to busier skies by making aircraft slower. It built air traffic control, so every flight is visible, kept within approved boundaries and can be interrupted by a person with the authority to act.
Read the full panel review: Beyond Basel at #RISK London: governing AI at machine speed
Which risks worry risk leaders most right now?
AI. That was the answer we heard most at Stand 13 and on the show floor, where we asked as many people as we could one question: what is the biggest emerging risk you are worried about today? Andrew McIntyre took the question through the hall with a microphone.
Some put cyber security first and then named AI as the reason: attacks speed up faster than defences can follow. Others started with geopolitical instability or climate and added AI in the same breath. One visitor told us that two years ago AI was a low priority, and that regulation has since turned it into an area everyone has to cover.
One point stayed with us. Many organisations adopt AI because everyone else does, a visitor said, without first naming the problem it is meant to solve. Start with the problem statement, then look for the solution.
Many GRC tools now advertise AI features. The people we met were asking a different question, and it is the core question of AI governance: can we show that the AI already running across our business, and in our vendors’ products, is under control?
What is governed autonomy?
Governed autonomy is an approach to AI governance in which people set the purpose, the boundaries and who can stop a system. Within those boundaries, AI works at its own speed, and the evidence builds up as it runs. The principle is human authority, not human approval.
CRISAM® AI Governed Autonomy is the AI governance framework built on this approach, for organisations that let AI make material decisions. It keeps them in control of AI without slowing it down to human speed. The difference shows in three everyday situations:
| Situation | Without a framework | With governed autonomy |
|---|---|---|
| Before a board meeting or an audit | Evidence is pieced together from screenshots, emails and spreadsheets. | The evidence has built up while the AI ran. It is ready to show. |
| A model is updated | Last quarter’s test no longer describes the model that is live today. | The change is linked to its risks and controls, and fresh evidence follows. |
| A threshold is crossed | Nobody is sure who is allowed to stop the system. | A named owner holds it, within boundaries agreed in advance. |
The framework has four building blocks:
-
Human authority
The AI may make the decision. A person owns the authority under which it is made.
-
Proportionate oversight
Close oversight where a lot is at stake, speed where it is safe.
-
Connected control
Every material AI decision is linked to its risks, obligations, controls and evidence.
-
Continuous assurance
Evidence is produced in operation, not only at the reporting date.
The framework is set out in three board level papers, the Machine Speed Governance series:
- Paper One: The Control Question Facing Every Board
- Paper Two: Governed Autonomy
- Paper Three: Continuous Assurance for the Machine Speed Enterprise
Key takeaways from #RISK 2026
- For CRISAM®, AI governance was the number one topic at #RISK Expo Europe 2026, on stage and on the show floor.
- The gap is speed: AI decides in milliseconds, while most governance still reports once a quarter.
- In the panel’s live test, almost everyone used AI for decisions, and very few could say their board would know within 15 minutes of a breach of risk appetite.
- Asked for their biggest risk, visitors at CRISAM® Stand 13 named AI most often, alongside cyber security and geopolitics.
- Governed autonomy closes the gap with human authority over each AI system instead of human approval of each decision.
Accountable for AI, but no longer in control? Lessons from #RISK London
In 45 minutes you hear what risk leaders at #RISK London told us they are worried about, and what it takes to stay in control when AI decides faster than any committee meets.
- Date
- Thursday 26 November 2026
- Time
- 10:00 UK time (11:00 CET)
- Format
- Live, 30 minutes of content, 15 minutes of questions
- Hosts
- Andrew McIntyre and James Gray
Could you show today that your AI is under control? Read the three papers or talk it through with our team.
Frequently asked questions about #RISK 2026 and AI governance
-
#RISK Expo Europe 2026 took place on 10 and 11 November 2026 at ExCeL London, organised by GRC World Forums. It brings together risk, GRC, compliance, security, resilience and audit leaders. CRISAM® exhibited at Stand 13 and joined the Beyond Basel panel on the BFSI Stage.
-
From where CRISAM® stood, it was AI governance. It came up on the Beyond Basel panel, in the interview with GRC analyst Michael Rasmussen and in most of the answers at the CRISAM® stand. The organiser also dedicated the second day to a PrivSec AI Governance conference.
-
Machine speed governance means governing AI-enabled decisions at the speed they are made. Every material AI-enabled decision is identified, given an approved purpose and boundaries, watched as it happens and recorded, with an authorised human always able to step in. Governance runs continuously instead of once a quarter.
-
Governed autonomy is an approach to AI governance in which people set the purpose, the boundaries and who can stop a system. Within those boundaries, AI works at its own speed, and the evidence builds up as it runs. CRISAM® AI Governed Autonomy is the AI governance framework built on this approach.
-
The panel “Beyond Basel: next-generation risk management for BFSI leaders” took place on 10 November 2026 on the BFSI Stage. Chris Brown of Capgemini Invent moderated. Oliver Greenslade, Chief Risk Officer at Channel Capital Advisors, and Andrew McIntyre of CRISAM® were on the panel.
-
No. CRISAM® does not replace a firm’s models, data platforms or monitoring. It connects them to the risks, controls and owners that make each decision defensible.
-
Yes. On Thursday 26 November 2026 at 10:00 UK time, Andrew McIntyre and James Gray of CRISAM® host a 45 minute live webinar with the lessons from #RISK London.
Would you like to get to know us?
