Introduction

Artificial Intelligence (AI) presents significant opportunities for businesses, with recent uptake in generative technologies accelerating this trend. In 2024, 72% of companies had adopted AI in at least one business function. However, as adoption increases, so do associated risks. A recent survey identified that over 60% of S&P companies believe they face material risks related to AI. AI incidents have grown twentyfold since 2013, with 123 reported in 2023 alone. While 93% of companies anticipate significant threats from generative AI (GenAI), only 9% feel prepared to manage them.

Investors play a crucial role in ensuring responsible AI use by filling the regulatory gap and encouraging effective governance. This report provides an AI Governance Framework (AIGF) to help companies and investors address current risks while preparing for long-term uncertainties. The framework aims to translate responsible AI principles into actionable practices for both developers and deployers of the technology.

Why should investors be paying attention to AI?

It is essential to define AI branches to understand their material impact. These include machine learning (ML), deep learning (DL), generative AI (GenAI), natural language processing (NLP), perception, and robotics. AI systems share characteristics that generate risks, such as large data and energy requirements, uncritical interpretation of inputs, and a lack of verifiability and explainability. These can manifest as systemic risks affecting the entire financial system.

Specific material risks include accountability and oversight, as seen in the 2019 case where a pedestrian was killed by a self-driving Uber vehicle. Impact on natural resources is significant; Google’s carbon footprint increased by 48% since 2019 due to GenAI development. Racial, gender, and other cultural biases occur because models reflect societal biases; for example, Amazon scrapped a recruitment tool that disadvantaged women. Other risks include cyberattacks, physical safety malfunctions (such as Cruise LLC’s vehicle recall), and adverse generated content like hallucinations or deepfakes used in financial fraud.

Data privacy and security risks increase with AI’s vast data requirements, leading to sanctions under GDPR. Intellectual property infringement is a growing concern, with news publishers and book authors taking legal action against developers like Microsoft and OpenAI. Transparency and explainability issues arise when ‘black box’ models inform decisions, as seen in class action lawsuits against US health insurance providers for using algorithms to deny care. Finally, labour and employment risks involve job replacement or poor working conditions for data labellers.

How can investors assess the significance of AI to their portfolio companies?

Investors must distinguish between AI developers, who design and test models, and deployers, who use them professionally. The level of AI significance at a company level can be categorised as low, medium, or high. Low significance involves off-the-shelf systems in ancillary functions. Medium significance involves some customisation in multiple ancillary functions. High significance involves developing AI systems or integrating them into core business functions and high-risk processes.

Sector-level usage also varies. High significance sectors include IT, Healthcare, and Financial services due to the use of sensitive data and the high impact of decisions. For instance, AI in healthcare includes diagnostic imaging and automated surgery, while financial services use AI for fraud detection and mortgage pricing. Other sectors like Industrials, Consumer staples, and Energy use AI for predictive maintenance and supply chain forecasting.

What can investors do to manage AI risks?

Investors can manage risks through four main activities: publishing expectations, engaging with companies, voting on shareholder resolutions, and participating in collaborative initiatives. Railpen, for instance, introduced AI as a dedicated focus in its 2025 Global Voting Policy and participates in the Cybersecurity Coalition and the Big Tech and Human Rights investor initiative. Collaborative action is necessary because the pace of AI adoption outstrips regulatory development.

The report proposes an AI Governance Framework (AIGF) structured across four pillars: Governance, Strategy, Risk management, and Performance reporting. For companies with medium and high significance, core expectations include senior-level oversight, implementation of training, and maintaining a standalone AI policy. Companies with high AI significance face additional expectations, such as having an individual on the board with AI expertise and allocating a dedicated budget to AI risk management. Strategy reviews should be informed by AI expertise, and risk management should include centralised systems to monitor usage and regular audits.

Good practice disclosures from companies like SAP, Siemens Healthineers, and Sony provide models for transparent reporting. SAP’s policy includes a glossary and explains principle implementation, while Sony uses AI ethics assessments in its product development life cycle. Investors are encouraged to use specific engagement questions across the four pillars to better understand company practices and encourage transparency.

Conclusions and recommendations

The rapid adoption of AI brings considerable risks that require robust governance frameworks. There is currently a clear gap between the recognition of AI threats and company preparedness. Investors are pivotal in bridging this gap by encouraging responsible AI use. The report recommends that investors conduct high-level portfolio risk assessments, engage with priority companies using the AIGF, and consider participating in policy advocacy to help close the gap between regulation and technological evolution. Collective efforts from investors, companies, and policymakers are required to harness AI’s opportunities while mitigating its most significant risks.