A second-line AI function does not own privacy and does not own security. It partners with the people who do. But a head of AI risk who cannot hold a credible conversation with a data protection officer or a chief information security officer will be excluded from decisions that carry AI riskand will have treated the discipline as though it were purely a model quality problem.
This article covers the adjacent terrain:enough privacy to be a competent partner, enough security to name the threat model, and a map of the frameworks and regulations that shape the whole field.
Privacy: The Concepts That Bite
Six privacy concepts recur in AI work, and each creates a specific obligation that AI deployment tends to strain.
Lawful basis.Processing personal data requires one. For training on personal data this is usually legitimate interests or consent, and legitimate interests requires a documented balancing assessment rather than an assertion.
Purpose limitation. Data collected for one purpose cannot be freely repurposed for model training. This is the most common privacy failure in AI programs:a dataset gathered lawfully for service delivery quietly becomes a training corpus.
Data minimization. It applies to prompts and logs, not only to databases. Prompt logs are a personal data store that most organizations have never classified as one, and they frequently retain far more, for far longer, than any policy contemplated.
Automated decision-making. Restrictions apply to solely automated decisions producing legal or similarly significant effects, with rights attaching for the individual. The word doing the work is solely, which is one reason a meaningful human checkpoint carries legal weight as well as operational value.
Data protection impact assessments. Required for high-risk processing, which describes most novel AI applied to personal data. The DPIA is also a useful forcing function, because it surfaces questions the project would otherwise defer.
Deletion and the memorization problem.A subject may request erasure. If their data is in the training set, deleting it from the source system does not remove it from the model. There is no clean technical answer, which is precisely why it must be a design-time consideration rather than a response to the first request.
The practical posture for the second line is to bring privacy in at tiering rather than at release. If a use case touches personal data, the data protection assessment should run in parallel with the AI risk assessment, not sequentially after it.
Security: Naming the Threat Model
AI security has an established threat taxonomy, and being able to name the categories and give an example of each is the minimum for a credible conversation with a security function.
Prompt injection:direct, and more dangerously indirect, arriving through retrieved content or tool output rather than from the user. This is the defining unsolved problem of agentic systems. There is no complete defense; there is layered mitigation and constrained blast radius. The point worth internalizing about indirect prompt injection is that it is not a bug awaiting a patch. As long as a system reads untrusted content and can act, the attack surface exists. The second line's contribution is therefore not to demand a solution but to insist that blast radius be constrained by permissions, which is a governance decision, not an engineering one.
Sensitive information disclosure: the model surfacing data the requesting user should not see. Almost always a retrieval permissions failure rather than a model failure, which means the fix belongs in access control rather than in prompting.
Insecure output handling: model output passed unvalidated into a downstream system that executes it.
Excessive agency: an agent holding more permissions than its task requires. The control is least privilege and human approval gates, not better prompting.
Supply chain:compromised models, datasets, libraries, or tool integrations.
AI Risk Management Without a Prudential Regulator
Why the Function Exists Without a Prudential Regulator
Much of the writing on AI governance implicitly assumes a supervised bank. Most organizations deploying AI have no prudential regulator, and the mandate must therefore rest on grounds that are commercial and legal rather than supervisory.Those grounds are not weaker.
Client contractual assurance. Enterprise clients increasingly require documented AI governance as a condition of doing business. The framework is what makes the representation true and the diligence questionnaire answerable.
Transparency obligations on AI-generated content, which are operational requirements demanding provenance tracking.
Accuracy as an existential brand risk. For any organization whose product is information, the accuracy of what goes out the door is the franchise itself.
Intellectual property and litigation exposure, arising from training data provenance, output similarity, and the scope of contractual indemnities.
Employment, privacy, and consumer-facing obligations that attach to AI-assisted decisions in any industry.
Taking Stock
Ten articles have now covered the first line that builds and owns, the second line that sets standards, challenges, measures, and designs controls into the architecture, the third line that tests whether any of it is true, the third-party estate that sits outside direct control, the mechanics that operate when a control fails, and the surrounding legal terrain.
One conclusion is worth restating before the final two articles: AI does not require an entirely new risk discipline so much as a serious rebuilding of the existing one for an object that is probabilistic, general-purpose, frequently third-party, and, in its agentic form, capable of acting rather than merely advising. Inventory, tiering, challenge, testing, escalation, remediation, and assurance all survive. Each must be re-derived rather than assumed.
What remains is the machinery that makes a framework into a function:who actually decides what, in which forum, and in what order a program should be built. Those are the subjects of the final two articles.
Explore more: Start Here · Topics · Archive · About