Survey findings
3. AI and analytics in risk management
This section examines the extent to which AI and advanced analytics are deployed across organisations’ risk management processes to generate timely assessments and insights.
Key takeaway:
AI adoption in risk management remains limited, with most organisations still at an early stage of implementation.
A significant share of respondents (39%) report that they do not use AI or analytics tools in risk management. Another 32% say these tools are used in selected areas, with additional pilots underway. As in other areas of analysis, adoption differs between listed and non-listed companies, with listed firms reporting higher deployment rates (52% versus 26%).
To what extent is AI or advanced analytics deployed across your organisation’s risk management processes to generate timely assessments and insights?
Similarly, in terms of size, large organisations with revenues above €5 billion show higher levels of pilot implementation in selected risk processes.
In terms of sector evidence in the sample, aside from the financial services and logistics sectors, other sectors show high percentages above 50% of no use of AI or analytics in risk management. Financial services generate large volumes of structured transaction, market, and customer data. Logistics produces continuous operational data (tracking, routes, scans, telematics, IoT). AI performs best where there is abundant, reliable data. Many key risks in these two sectors can be quantified with clear signals and outcomes (for example, credit default, fraud, claims, delays, damage, and estimated time of arrival (ETA) variance). That makes it easier to train models and demonstrate value.
Overall, the analysis reinforces one of the clearest messages of the survey: to date, the gap between ambition and capability in AI-enabled risk management is considerable. This is consistent with findings from the 2026 Marsh European AI Opportunities and Risk Survey, with highlights in the box below.
AI without blind spots
The 2026 Marsh European AI Opportunities and Risk Survey examined the implications of AI across stakeholder groups and industries, focusing on adoption, key use cases, and risk and regulatory perspectives.
The survey indicated that organisational maturity remains at an early stage, with 20% of respondents reporting no AI tools deployed and 16% still at the pilot or proof-of-concept stage.
Risk management is not currently among the top functions using AI. However, its use is expected to grow at a moderate pace over the next two years, compared with areas such as supply chain, product development, customer service, and HR. The AI technologies expected to have the greatest impact include generative AI for content insights, document-processing automation and AI OCR (optical character recognition), autonomous and agentic AI assistants, predictive analytics and forecasting, and fraud and anomaly monitoring.
Organisational maturity remains at an early stage, with 20% of respondents reporting no AI tools deployed.
As for AI related risks, the survey paints a fragmented picture. While 28% of respondents assess AI risks through their broader enterprise risk management processes, 23% use a formal AI-specific risk assessment framework. Meanwhile, 20% report having no formal risk assessment in place, and 17% rely on ad hoc reviews led by project teams. Among organisations not currently using AI, 57% have not conducted a formal risk assessment. This suggests that readiness and control design often lag even before adoption begins.
Accountability for AI risk remains concentrated in IT and security, even though it extends beyond technical issues to include regulatory compliance, ethics, workforce impacts, and reputational exposure. While some mitigation measures are emerging, such as employee training on AI risks, fewer organisations report implementing more robust controls, including regular AI system audits and testing, bias and fairness monitoring, or external third-party reviews. Overall, the findings point to a clear opportunity for risk management functions to play a stronger integrative role: moving beyond monitoring to help establish consistent governance, embed AI risk assessment within ERM, and connect AI-enabled insights to practical action and resilience-building decisions.