Imran Aftab, CEO and Co-founder, 10Pearls—driving AI innovation and creating meaningful opportunities that make an impact.
Enterprises have poured tens of billions of dollars into generative AI, but only a small fraction of organizations report measurable impacts on profits. The vast majority of AI projects are stuck in pilots, proofs of concept or ungoverned experimentation that fails to earn the trust needed to scale across an organization.
This happens because AI is often deployed before it’s proven to be entirely ready and secure. Stanford University’s 2026 AI Index highlights findings from the AI Incident Database (AIID), which found that the number of AI incidents jumped by 55% between this year and last. Yes, there are more AI projects being deployed, but those accelerated rollouts also conflate “probably” with “definitely.”
Risk is not black and white across every AI system and model. It needs to be a score, built from named dimensions, that decides exactly how much autonomy a system earns. That score has to hold up in front of a board of directors, regulators, customers and, of course, engineers.
The Four Dimensions To Score AI Risk
Leaders must be able to confirm whether AI passes the following checkpoints before giving the green light. Ensuring AI is provably safe across these dimensions is at the base of a robust strategy that minimizes vulnerabilities, for business and tools alike.
1. Reversibility
Can a wrong decision be undone? A drafted email that’s human-reviewed before sending is fully reversible, but a recorded credit refusal already acted on is not. The less reversible the action, the further the use case moves away from autonomy and toward mandatory human oversight.
2. Real-World Impact
If AI makes an error, what is the real-world impact on people, profit, safety, reputation, privacy or compliance?
In my experience, this is the dimension boards are least prepared to weigh. For instance, research from Deloitte shows that 66% of boards still have limited-to-no knowledge of AI. Running blind on the real-world impact is a dangerous environment in which to make high-stakes calls.
3. Regulation
What is the regulatory exposure, and does every AI decision and action comply with all relevant regulations?
Regulatory demands are increasing. Under the EU AI Act, the Article 50 transparency obligations and the AI Office’s enforcement powers over general-purpose AI have been activated, with penalties potentially reaching up to the tens of millions. Stringent regulatory exposure is now a live liability.
4. Auditability
Finally, can the AI’s reasoning actually be produced, explained and defended on demand? Auditability is now a central pillar of any AI strategy, and board oversight is a leading indicator in this regard: 31% of organizations still report AI is not on the board agenda at all. That suggests there is no formal mechanism in place at a third of companies for anyone at the top to ask for evidence before something goes wrong.
These four dimensions should be combined into a composite score, which then guides the architecture and level of autonomy for the use case. Sometimes the risk score is high enough that the best answer is no AI at all. But that’s not a failure; it’s the process working precisely as it should.
What Proven Looks Like In Practice
The score routes every use case into a pattern that matches its risk. This ranges from full autonomy for low-risk, high-volume work to a blend of human oversight and AI outputs, to a human-only workflow for the most severe of risks. Testing depth follows the same score, scaling from lighter-weight functioning checks to independent audits and documented explainability for highest-risk systems.
It’s where scored governance starts paying for itself instead of just protecting against downside, particularly as the majority of organizations approach the strategic or embedded stage of AI. Reaching that stage and actually extracting repeatable commercial value, however, are two different achievements, and only a small chunk of organizations seem to be closing that gap.
Making Governance Credible, Not Just Compliant
Boards, regulators and customers trust decisions that are explained and defended. That trust cannot be won through decisions where “probably” was the default.
Fortunately, organizations are rising to meet that expectation. The share of organizations with no responsible-AI policy fell from 24% to 11% between 2024 and 2025, while AI-specific governance roles grew 17%, per that same Stanford University AI Index report.
What has not caught up is enforcement and accountability. Surprisingly, even as regulators are cracking down on any ambiguity around accountability, per a 2025 survey by McKinsey, only 28% of organizations give their CEO direct responsibility for AI governance, and 17% to the board. That gap is where we’re still seeing firms accept “probably fine” as the threshold for successful AI, and it is what scored and evidenced risk closes.
Final Thoughts
Winning with AI is not about aggressive adoption or being over-cautious, but being able to show exactly why each AI decision was made and who is accountable for it.
AI is taking on more consequential decisions across the enterprise. Regulators, boards, customers and incident data are all pointing in the same direction, and a tool that is “probably fine” is no longer an acceptable answer. Scored, evidenced risk to prove AI works before it’s rolled out should be the new baseline for every organization.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?