Presented at SECON, the 3rd Annual International ISC2 Chapter Conference, and Published in TechBullion in December 2024
Artificial Intelligence has quickly gone from a trending topic to a critical driver in every major industry. But as AI becomes more powerful, so do the risks it brings along. At this year’s SECON ISC2 Chapter Conference, Dr. Enzo Tolentino, a recognised specialist in AI governance and compliance, offered a standout keynote on how organisations can navigate the growing landscape of AI risk management.
To enhance his insights, AZ Big Media’s author sat down with Dr. Tolentino for an in-depth conversation covering everything from international regulatory frameworks to leadership blind spots. The goal? To bring you clear, practical insights you can actually use.
Inside AI Risk Management: An Interview with Dr. Enzo Tolentino
Q: Dr. Tolentino, you opened your talk by calling AI both a game-changer and a risk amplifier. Why start there?
Dr. Enzo Tolentino: Because that’s the honest starting point. AI offers speed, efficiency, and insights that would’ve been impossible just a decade ago. But here’s the thing—those gains come bundled with serious issues. We’re talking about privacy challenges, embedded bias, lack of accountability, and decisions being made by systems people can’t explain.
By highlighting both sides upfront, I wanted the audience to realise this isn’t science fiction—it’s the world we live in now. If you’re deploying AI without addressing the risks, you’re playing with fire. Responsible AI isn’t just about preventing harm; it’s about maintaining trust and credibility.
Q: Your breakdown of the NIST AI Risk Management Framework was very insightful. What makes it stand out?
It’s the approach. NIST doesn’t just give you a checklist to follow. It invites you to think holistically. Risks in AI aren’t always visible or measurable in the same way as other tech risks. Some are deeply technical, like model drift. Others are societal, like discrimination in automated decisions.
NIST’s “Govern, Map, Measure, Manage” structure gives flexibility. It’s not about rigid compliance it’s about building a mindset that keeps evolving as your systems and risks evolve. That adaptability is what makes NIST especially useful in fast-changing environments.
Q: Trust seems to be a theme across all the frameworks. How does NIST’s view on trust differ from ISO 42001?
Dr. Enzo Tolentino: Great question. NIST defines trust in very operational terms. It looks at seven core areas think fairness, privacy, resilience, and transparency. So, when you’re applying NIST, you’re actively assessing your AI on those qualities.
ISO 42001, on the other hand, takes a governance-heavy approach. It focuses more on how leadership embeds trust principles into culture, policies, and procedures. So instead of asking, “Is this AI model explainable?” it asks, “Do we have a system that ensures explainability across all models?” NIST is hands-on. ISO is top-down. Both are needed, just at different levels of the organisation.
Q: What’s the biggest blind spot organisations have when trying to adopt ISO 42001?
Leadership inertia. Too many leaders think AI governance is something the IT team or data scientists should figure out. But ISO 42001 is clear: top executives must take ownership. They’re the ones who set ethical direction, approve budgets for AI oversight, and assign accountability.
Without leadership buy-in, the whole framework becomes a paper exercise. It may look good on a compliance report, but it won’t guide real-world decisions when things get messy. Risk management, especially in AI, must be championed from the top.
Q: You mentioned “context is king” in your talk. Could you elaborate?
Absolutely. AI systems don’t operate in isolation they function in real-world environments filled with laws, norms, values, and expectations. What’s considered fair in a banking app might be entirely inappropriate in a healthcare setting.
ISO 42001 encourages organisations to scan their environment carefully. That includes understanding customer expectations, regional laws, public sentiment, and even media attention. Ignoring context is like using the same playbook in every sport it just doesn’t work.
Q: Let’s talk about the EU AI Act. How does it change the game?
The EU AI Act isn’t just a set of suggestions it’s the law. That’s a major shift. It brings consequences to the table. If your AI system falls into the “high-risk” category, you’re required to meet detailed obligations, from documentation to audits to human oversight.
One of the smartest elements? Regulatory sandboxes. These let developers test high-risk AI under supervision without breaking rules. And because the Act has an extraterritorial reach, companies outside the EU also have to comply if they touch EU markets. It’s setting a global benchmark.
Q: Is there a ‘best’ framework among the three? Or does it depend on the use case?
It’s all about the organisation’s context and goals. NIST is excellent for building internal awareness and early governance efforts, especially in U.S.-based companies. ISO 42001 is ideal if you’re scaling globally and need a certifiable standard. And the EU AI Act? That’s a must if you’re operating in Europe or serving European users.
In reality, many organisations are using a combination borrowing elements that match their operational maturity, market exposure, and risk tolerance.
Q: You closed with the idea of “Customisable Profiles.” Can you explain that in simple terms?
Sure. Think of profiles like a roadmap designed for your unique journey. A hospital deploying diagnostic AI needs different controls compared to a retail company using AI for customer segmentation.
NIST lets organisations build these “profiles” based on their use case, threat model, and goals. This way, you’re not applying irrelevant controls or missing important ones. It’s like choosing workout routines tailored to your health needs—you get better results with less waste.
Q: There’s often a trade-off between explainability and performance. How should high-risk systems balance this?
That’s the tough part. Some AI models, like deep neural networks, deliver high accuracy but are nearly impossible to explain. But if you’re using them in critical settings—like credit scoring or healthcare you can’t just say “trust the math.”
The EU AI Act enforces a right to explanation. If a model can’t justify itself in human terms, regulators and stakeholders may challenge its use. In practice, that means organisations may need to choose simpler, more transparent models or at least offer an interpretability layer that provides meaningful insights to non-technical users.
Q: ISO requires formal risk treatment plans. How should these integrate with existing data governance or cybersecurity systems?
Integration is key. Many companies already have systems for managing cybersecurity, data privacy, and compliance. The trick is not to reinvent the wheel but to expand it.
You can use your ISO 27001 controls as a starting point, then build additional layers specific to AI like monitoring model drift, labelling datasets, or verifying algorithmic fairness. This avoids duplication and ensures your governance framework remains coherent.
Q: ISO 42001 aligns with Annex SL. What’s the significance of that for integrated management systems?
Annex SL is the backbone of modern ISO standards. It ensures that all ISO management systems whether it’s for quality (9001), security (27001), or AI (42001)—share a common structure.
That means companies can integrate AI governance into their broader compliance strategy without juggling completely separate systems. Policies align. Audits become smoother. It simplifies both day-to-day management and long-term strategic planning.
Q12: Final question—what’s one thing organisations overlook when managing AI risk?
The human factor. It’s easy to focus on models, data, and algorithms. But none of that matters if people don’t trust the system—or worse, don’t understand it.
You need to train your teams on ethical decision-making, involve diverse voices during development, and create open feedback channels. AI should support people, not alienate them. Building that culture is just as important as building the code.
Takeaway
Dr. Enzo Tolentino brings a refreshingly grounded approach to AI risk management. Whether you’re exploring voluntary frameworks like NIST, pursuing ISO certification, or preparing for strict laws like the EU AI Act, one thing is clear: managing AI responsibly starts long before the system goes live. It starts with people, process, and purpose.
