EW-AiRM™: Enterprise-wide AI Risk Management, in three deliberate layers.

Characteristic:

Foundation models exhibit unexpected capabilities not explicitly trained or designed into the system. These capabilities emerge from the complex interactions of billions of parameters in ways that are not predictable from the model’s specification.

Why unpredictable:

Models have billions of parameters; behaviour emerges from complex parameter interactions that cannot be fully predicted even by the engineers who built the system. Capability emerges at scale thresholds that are themselves unpredictable.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

Failure of a central AI infrastructure element (most prominently a major foundation model provider, but also cloud GPU providers, AI accelerator providers, and vector database providers as the AI stack matures) cascades across thousands of dependent applications simultaneously, creating economy-wide disruption rather than isolated organizational failures.

Why unpredictable:

The scale of dependency across the ecosystem is unknown until failure occurs. Individual organizations assess their own dependency, but no single governance actor has visibility into the aggregate dependency across the entire financial system, healthcare system, or other critical sector.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

A model pursues its specified objectives in ways that are harmful because the optimization process has found a path to the objective that was not anticipated by the system designers. The model does exactly what it was optimized to do. But the optimization produced unintended consequences.

Why unpredictable:

It is difficult to anticipate all the ways in which an optimization process could find a path to an objective that causes harm. The optimization is mathematically correct; the problem is the gap between the specified objective and the intended one. Frontier AI safety research from Anthropic, OpenAI, Google DeepMind, and the UK and US AI Safety Institutes has documented that this gap widens rather than narrows as model capability increases, making alignment failure a structurally growing risk rather than a problem that improves with technical maturity.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

Unexpected and harmful behaviours emerge from the combination of text, image, audio, and other AI modalities in a system, where the individual modalities have been individually assessed as acceptable, but their combination creates compound effects that were not present in either alone.

Why unpredictable:

The interactions between modalities are difficult to predict from analysis of individual modalities. Biases that are individually manageable may compound in ways that produce qualitatively more severe harm when modalities interact.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

A novel attack technique is discovered that defeats existing AI defences across the industry: not just one organization’s defences, but the fundamental approaches that all major systems have implemented.

Why unpredictable:

The attack surface of AI models is enormous, and new attack angles are always possible. When a new attack technique is discovered that exploits a fundamental property of the model architecture (for example, the next-token-prediction objective that all language models share, or the gradient-based optimization that all neural networks use), it may work against all models with that architecture regardless of individual defensive measures.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

Failure or attack in the AI supply chain (training data, model libraries, compute infrastructure, or data annotation services) propagates downstream and compromises all systems built on that supply chain component.

Foundation model provider risk is treated separately as Category 2 (Systemic Concentration); Category 6 covers the upstream and infrastructure layers of the AI supply chain.

Why unpredictable:

Supply chains are complex and their vulnerabilities are hidden until exploited. Malicious actors who understand the supply chain can introduce vulnerabilities at points that affect hundreds of downstream systems simultaneously.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.

Characteristic:

Failure or harmful behaviour emerges from the interaction between two or more AI systems acting on each other’s outputs, where each system was individually evaluated as acceptable, but the interaction produces compound effects, cascading authority transfer, or coordinated behaviour that no single system was designed to produce. The failure is a property of the interaction, not of any individual agent.

Why unpredictable:

Multi-agent interactions create a combinatorial space that cannot be exhaustively pre-evaluated. Each agent’s behaviour is bounded; each agent’s interaction with another agent is bounded; the combination of N agents interacting across M tools and K decision points produces a behaviour space that exceeds practical evaluation capacity. Emergent behaviours, including coordination, deception, and goal drift, have been documented in research environments and are increasingly observed in production agentic deployments. Traditional safety evaluation evaluates one agent at a time; multi-agent emergent failure is invisible to that evaluation methodology by construction.

Governance response:

Pls get in touch with us to identify suitable response strategies or check out Chapter 14 in the EW-AiRM^TM Book.