New AXA XL and S-RM report outlines five priorities for resilient AI adoption

September 23, 2026

AXA XL, the property and casualty and specialty risk division of AXA, and global intelligence and cyber security consultancy S-RM today published Building Resilient AI: Managing AI risk through governance, security and resilience.

The report warns that AI is becoming embedded in critical business processes faster than many organizations can adapt their governance, security and incident-response capabilities. It calls on business leaders to treat AI risk as an enterprise resilience issue rather than solely a technology or compliance concern.

The scale of the challenge is growing quickly. According to McKinsey & Company's 2026 State of AI survey, 88% of organizations now report using AI in at least one business function. The new report suggests AI is creating more potential entry points for cyber threats and introducing new forms of operational, regulatory and third-party risk.

As AI systems gain greater access to sensitive data, business applications and decision-making processes, the report identifies five priorities for business leaders:

• Establish clear accountability for AI across the enterprise, including formal deployments, embedded software features and shadow AI
• Protect sensitive data and strengthen identity and access controls as AI systems become more autonomous
• Manage AI risk throughout its lifecycle, from data collection and model development to deployment, monitoring and incident response
• Apply rigorous governance and due diligence to AI vendors and other critical third parties
• Prepare for AI-related loss scenarios that may cut across cyber, fraud, liability, business interruption and other areas of insurance coverage

"AI is moving from experimentation into the systems and processes organizations rely on every day, but governance is not always keeping pace," said Jonathan Salter, Head of Risk Consulting at AXA XL. "The organizations best placed to capture AI's value will be those that know where it is being used, understand the business consequences when it fails and build security and resilience into deployment from the outset."

"AI risk rarely emerges in isolation," said Rebiah Bardot-Girard, Head of Cyber Risk Consulting Services at AXA XL. "It amplifies existing weaknesses in identity management, data governance, supplier oversight and incident readiness. A practical inventory of where AI is used, what data it can access and where it can take or influence action is now a fundamental starting point for resilience."

The report examines risks including data leakage, model manipulation, prompt injection, unreliable outputs, shadow AI and overly autonomous agents. It sets out five foundations for secure AI by design strong data governance, secure models and applications, ecosystem resilience, robust access controls and continuous monitoring.

The findings also indicate that some organizations are strengthening their oversight: according to the World Economic Forum, 64% now assess the security of AI tools before deployment, up from 37% a year earlier. But pre-deployment assessment is not enough. As AI gains access to sensitive data, business applications and decision-making processes, organizations remain exposed unless oversight continues throughout deployment and operation.

AXA XL and S-RM combine risk consulting, cyber expertise and insurance insight to help organizations strengthen governance, test incident scenarios and make informed decisions about mitigation and risk transfer.

The full report, Building Resilient AI: Managing AI risk through governance, security and resilience, is available here.

Follow AXA XL on LinkedIn.

ABOUT AXA XL

AXA XL, the property & casualty and specialty risk division of AXA, provides insurance and risk management products and services for midsized companies through large multinationals, and reinsurance solutions to insurance companies globally. We partner with those who move the world forward. To learn more, visit www.axaxl.com.