The rapid advancement of digital technologies and artificial intelligence (AI) is creating significant opportunities to improve operational efficiency and transform business models. However, alongside these benefits come risks related to cybersecurity, data protection, business disruption, and accountability in the use of AI.
A cyberattack can disrupt business operations for days. An AI system producing inaccurate or biased outputs can affect credit approval, recruitment, or investment decisions. Such risks can result not only in financial losses but also in damage to corporate reputation and stakeholder trust.
Against this backdrop, cybersecurity and AI risk governance can no longer be considered solely the responsibility of the Information Technology (IT) department. Instead, it must become an integral part of the oversight agenda of the Board of Directors (BoD)/Members’ Council and senior management.
Why are Cybersecurity and AI risks becoming Critical Corporate Governance Issues?
As businesses become increasingly dependent on technology systems, data, and AI, incidents involving these systems can directly affect their ability to execute strategies and maintain business continuity.
According to Principle V.D.2 of the G20/OECD Principles of Corporate Governance 2023, digital security risks should be integrated into an enterprise’s overall risk management framework. The Board is responsible for overseeing risk management policies and procedures, as well as internal control systems, including the establishment of risk appetite.
This requires a shift in approach. Rather than focusing solely on which technological solutions the company has invested in, the Board should assess how technology-related risks may affect business objectives, the level of risk the company is willing to accept, and its ability to respond effectively when incidents occur.
For AI, these considerations extend further to accuracy, fairness, transparency, and accountability for decisions supported or made by AI systems.
Key cybersecurity and AI risks facing businesses
Although closely interconnected, cybersecurity risks and AI-related risks are not identical. Businesses need to identify both the risks associated with technology systems and the potential impacts arising from the use of AI.
Cybersecurity and Business Disruption Risks
Cyberattacks, ransomware, unauthorized access, or infrastructure failures can prevent businesses from accessing critical systems, disrupt production and services, and cause financial losses.
For highly digitalized enterprises, effective governance involves more than preventing cyberattacks. It also requires ensuring business continuity, system recovery capabilities, and the ability to minimize damage when incidents occur.
Data Security and Third-Party Dependency Risks
Storing data on cloud platforms, sharing information with business partners, or using external AI tools can increase the risk of exposing customer data, sensitive business information, and intellectual property.
In addition, businesses may become significantly dependent on technology providers for service continuity, data protection, and incident recovery. These risks should be carefully considered when selecting, investing in, and managing critical technology vendors.
AI Accuracy, Bias, and Reliability Risks
AI can analyze data and support decision-making, but its outputs are not always accurate or appropriate for specific business contexts.
For example, an AI model used to support credit approval decisions may produce inaccurate or biased results if the underlying data and model development methods are inadequate. Similarly, generative AI may produce false information while presenting it in a convincing manner.
When AI is involved in decisions that significantly affect customers, employees, or financial outcomes, businesses must establish appropriate mechanisms for human oversight, verification, and validation.
Compliance and Accountability Risks
The use of AI raises important questions about accountability when AI systems produce inaccurate results or cause adverse impacts:
- Who is responsible for approving and overseeing AI applications?
- Can the company explain and verify AI-generated outputs?
- How are privacy, data protection, and stakeholder rights safeguarded?
According to the OECD Due Diligence Guidance for Responsible AI (2026), businesses should identify, assess, and address adverse impacts associated with AI, including those arising through business relationships.
Three case studies in cybersecurity and AI risk governance
The following cases illustrate how businesses can approach cybersecurity and AI risks from different perspectives: incident response, the establishment of control mechanisms, and the standardization of management systems.
Case 1. Jaguar Land Rover (United Kingdom): Prolonged production disruption following a cyberattack in 2025
In September 2025, automotive manufacturer Jaguar Land Rover (JLR) experienced a major cybersecurity incident, prompting the company to proactively shut down its IT systems to contain the impact. The incident disrupted production for five weeks before manufacturing gradually resumed on October 8, 2025, with operations returning to normal levels by mid-November 2025.
According to JLR’s FY25/26 Annual Report, the production shutdown and distribution disruptions significantly affected the company’s business performance during the final two quarters of 2025. The impact extended beyond the company itself, affecting its supplier network and distribution partners.
In response, JLR worked with cybersecurity experts and relevant authorities to gradually restore its systems based on operational priorities, including customer services, parts distribution, and vehicle sales transactions. The company also introduced financial support measures to help suppliers maintain cash flow during the recovery period.
Governance Lesson: The JLR case demonstrates how a cybersecurity incident can quickly escalate into a material business risk, affecting production, cash flow, and supply chains simultaneously. For Boards of Directors, oversight should extend beyond cyberattack prevention to include incident response readiness, recovery times for critical operations, and measures to minimize impacts on customers, partners, and suppliers.
Sources: JLR – Annual Report FY25/26; JLR – Press Release on Manufacturing Restart, October 7, 2025.
Case 2. DBS (Singapore): Establishing AI governance before scaling AI adoption
DBS Bank provides an example of how AI governance can be integrated into enterprise risk management and business operations.
DBS applies a Responsible Data Use Framework, structured around three fundamental questions regarding the use of data and AI:
- Can we use it? Assessing legality, privacy, data quality, and data security.
- Should we use it? Evaluating the purpose, appropriateness, and potential impacts of AI applications based on the PURE principles: Purposeful, Unsurprising, Respectful, and Explainable.
- How do we use it? Establishing risk-based AI model governance requirements, including assessment, testing, accountability, and oversight.
DBS has also established a Responsible AI Taskforce involving multiple functions, including cybersecurity, legal, compliance, risk management, and technology.
According to DBS’s disclosures, generative AI use cases must undergo appropriate assessment and approval processes before deployment. The bank also maintains mechanisms to keep senior management and the Board informed of significant developments.
Governance Lesson: AI governance does not necessarily restrict innovation. Businesses can scale AI adoption by implementing pre-deployment assessments, risk-based classification, clear approval processes, and continuous monitoring. Importantly, AI governance requires coordination among business, technology, risk management, and compliance functions rather than being assigned exclusively to the IT department.
Sources: DBS – Responsible and Ethical AI in Banking (2025) và DBS Annual Report 2025 – CRO Statement.
Case 3. Vinamilk (Vietnam): Integrating cybersecurity risks into Enterprise Risk Management (ERM)
As a major manufacturing company in Vietnam, Vinamilk has identified cybersecurity and data protection as material risks requiring effective management and oversight.
According to its 2025 Annual Report, Vinamilk assessed cybersecurity and data protection risks as high and identified emerging threats involving the use of AI in cyberattacks, including online scams, deepfakes, and account takeover attempts.
Notably, Vinamilk disclosed that its Board of Directors had established and overseen the implementation of a cybersecurity management policy as part of its overall risk management system. The Audit Committee, under the Board, is responsible for overseeing internal control and risk management systems through periodic meetings and reporting to the Board.
At the operational level, Vinamilk maintains an information security management system based on ISO 27001:2022, implements multi-layered security measures, data backup and recovery procedures, and cybersecurity testing. It also conducts employee training and phishing simulations to strengthen cybersecurity awareness.
Governance Lesson: The Vinamilk case illustrates that even businesses whose core operations are in manufacturing must recognize cybersecurity as a material enterprise risk. Clearly defining oversight responsibilities at the Board and Audit Committee levels, combined with appropriate policies, controls, and response procedures at the management level, helps embed cybersecurity governance into the broader corporate governance system rather than limiting it to the IT function.
Source: Vinamilk – Annual Report 2025.
What should Boards of Directors and Members’ Councils oversee?
Based on corporate governance principles and practical case studies, four key priorities can be identified to strengthen oversight of cybersecurity and AI risks.
Establishing risk appetite aligned with business strategy
The Board should oversee the identification of material technology-related risks and determine the level of risk the company is willing to accept in pursuing its business objectives.
For example, a business may allow AI experimentation in low-risk internal support functions while imposing stricter approval and control requirements on applications involving sensitive data or decisions with significant impacts on customers or employees.
Risk appetite should provide management with clear boundaries regarding acceptable risk levels and the conditions that must be met before implementing technology initiatives.
Clearly defining responsibilities across Governance and Management levels
The Board of Directors/Members’ Council performs oversight responsibilities in accordance with the company’s governance structure and applicable authority, while executive management is responsible for implementing, managing, and controlling risks in day-to-day operations.
Technology, risk management, legal, compliance, and internal audit functions contribute according to their assigned responsibilities.
For businesses with high exposure to technology risks, the Board may delegate certain oversight activities to the Audit Committee, Risk Management Committee, or another appropriate Board committee.
The key priority is not necessarily to establish a new committee, but to ensure that responsibilities are clearly defined and that no governance gaps remain.
Integrating cybersecurity and AI risks into Enterprise Risk Management (ERM)
Technology-related risks should be managed within the company’s Enterprise Risk Management (ERM) framework rather than treated as a separate IT function.
The Board should oversee management’s efforts to:
- Identify critical systems, data, technology providers, and AI applications that may materially affect business operations.
- Conduct risk assessments before deploying AI applications or making significant technology investments.
- Establish AI usage policies, including restrictions on data usage, approval principles, and human oversight mechanisms.
- Develop incident response, business continuity, and system recovery plans.
Control measures should be proportionate to the company’s risk exposure, size, and nature of operations.
Establishing risk reporting mechanisms to support Board oversight
Boards do not need excessive technical details. Instead, they require reports that clearly communicate the company’s risk exposure and its potential business implications.
Some illustrative indicators include:
| Oversight Area | Illustrative Indicators |
|---|---|
| Cybersecurity | Number of major cybersecurity incidents; number of risks exceeding acceptable thresholds |
| Operational resilience | System recovery time; results of incident response exercises |
| AI governance | Percentage of AI applications that have undergone risk assessment and approval |
| Data protection | Number of significant data breaches |
| Risk remediation | Percentage of corrective actions completed on schedule |
In addition to these indicators, the Board should receive reports on risks exceeding the company’s risk appetite, incidents with material impacts, and matters requiring Board-level direction or approval.
Five questions Boards should ask Executive Management
To translate risk awareness into effective governance action, Boards can begin by asking five key questions:
- Which technology systems and AI applications could materially affect the company’s operations, financial performance, or reputation if an incident occurs?
- Has the company clearly defined its risk appetite, data usage restrictions, and AI applications that require enhanced controls?
- Who is responsible for approving, managing, and reporting cybersecurity and AI risks? Are appropriate independent oversight mechanisms in place?
- Have critical AI applications and technology providers undergone risk assessments before deployment, and are they continuously monitored during operation?
- If a critical system is attacked or becomes unavailable, how quickly can the company restore operations, and have its recovery plans been tested in practice?
These questions can be incorporated into regular Board meetings, strategic reviews, or assessments of the effectiveness of enterprise risk management and internal control systems.
Conclusion
Cybersecurity and AI risks are becoming increasingly interconnected with corporate strategy, operational performance, and business resilience.
For Boards of Directors and Members’ Councils, the priority is not to manage technology directly, but to ensure that the company has appropriate governance mechanisms, clearly defined responsibilities, effective internal controls, and the capacity to respond to material risks.
Experiences from Jaguar Land Rover, DBS, and Vinamilk demonstrate that cybersecurity and AI governance can be approached in different ways, ranging from strengthening operational resilience and establishing AI approval and oversight mechanisms to standardizing management systems in accordance with international standards.
Integrating these considerations into enterprise risk management and Board oversight activities enables businesses to strike a balance between innovation, risk control, and sustainable development.
References:
- OECD (2023). G20/OECD Principles of Corporate Governance 2023. OECD Publishing, Paris.
- OECD (2022). OECD Policy Framework on Digital Security: Cybersecurity for Prosperity. OECD Publishing, Paris.
- OECD (2026). OECD Due Diligence Guidance for Responsible AI. OECD Publishing, Paris.
- Jaguar Land Rover (2026). Annual Report FY25/26.
- Jaguar Land Rover (07/10/2025). JLR Restarts Manufacturing and Introduces New Financing Solution to Pay JLR Suppliers Early.
- DBS Bank (06/10/2025). Responsible and Ethical AI in Banking and Finance.
- DBS Group Holdings (2025). Annual Report 2025 – CRO Statement.
- Vinamilk (2025). Annual Report 2025.
About CGS Vietnam
CGS Vietnam Consulting Joint Stock Company provides specialized advisory services in Corporate Governance, Sustainability (ESG), Risk Management, and Internal Audit. Backed by a team of experienced professionals with deep expertise in international best practices, CGS Vietnam partners with businesses to strengthen corporate governance, enhance management capabilities, meet investor expectations, and achieve long-term sustainable growth.
Contact CGS Vietnam:
Hotline: (+84) 363 581 520 | Email: [email protected] | Website: https://cgsvietnam.com/
LinkedIn: https://www.linkedin.com/company/cgs-vietnam | Facebook: https://www.facebook.com/CGSVietnamCompany/