Cindy Tu

How to evolve from ad hoc reviews into an embedded, repeatable framework integrating the existing risk assessment in SDLC, Model Risk Management, and Third-Party Risk Management and beyond. This session examines how acceptable-use gates and structured triage enable consistent risk decisions across diverse AI use cases, including internally developed and agentic systems that fall outside traditional MRM assumptions. It explores how acceptable risk is operationalized and recalibrated as conditions change.

AI agents blur the boundary between technology and workforce: they operate within rules, yet exercise discretion in execution. This panel debates whether agentic systems should be governed like software, like employees, or through a new hybrid accountability model. Panellists examine how organizations define risk ownership and prioritize privacy when outcomes are unpredictable and failures carry operational, reputational, and regulatory consequences.