AI Governance Must Be Rehearsed Before the Crisis

Institutions often treat an approved policy as evidence of readiness. The document identifies a responsible officer, requires human oversight, promises incident reporting and refers to continuity. Yet the first serious disruption may reveal that nobody knows who can disable the integration, the designated leader is unavailable, the vendor cannot be reached, the backup has never been restored and affected people receive contradictory messages.

Artificial intelligence increases this risk because it can accelerate ordinary cyber threats, produce persuasive false communication, act through connected accounts and obscure the boundary between a mistaken recommendation and an executed action. The relevant question is not whether the institution has a policy. It is whether people can carry out that policy when information is incomplete, time is short and normal systems are failing.

AI governance must be rehearsed before the crisis.

On 16 October, Reuters reported that G7 finance ministers and central-bank governors had agreed to hold tabletop exercises for AI-driven cyber attacks. According to a Japanese finance ministry official, the simulations will test existing response protocols and inform revisions to response manuals; private financial institutions may participate depending on the scenario. Reuters

The announcement followed warnings that an AI-enabled attack on a critical financial service could damage confidence. It also follows the Financial Stability Board's 15 October final guidance, which treats scenario exercises, safe stopping, recovery, third-party dependence and meaningful…