Beyond the frontier: Pragmatic AI risk management for the rest of us

All the attention today is on frontier artificial intelligence models and building advanced large language models. There is no shortage of guidance for organizations building AI systems from the ground up — large companies and standards-setting organizations are releasing frameworks and regulators are introducing dozens of bills to address perceived risks. This article is an attempt to answer that question — not with theoretical frameworks or aspirational principles, but with concrete, actionable guidance for the businesses and in-house legal teams navigating AI adoption right now.

The reality is that 99% of businesses are not building their own AI models. They are mostly licensing off-the-shelf LLMs and other AI products at the mercy of commercial terms set by AI vendors. Many are limited in their ability to meaningfully address the AI risk management principles highlighted in the growing stack of governance frameworks, regulations and guidance materials.

Making matters worse, while businesses are under intense competitive pressure to adopt AI, they often lack in-house AI expertise, cannot vet constantly changing black box AI tools, and have no leverage to negotiate contractual protections from vendors who disclaim responsibility for AI-generated output.

The question, then, is a practical one: What realistic and pragmatic steps can an average business take to manage its AI risks?

The guidance gap

If you have read the major AI governance frameworks — the U.S. National Institute of Standards and Technology's AI Risk Management Framework, the EU AI Act, ISO 42001 or state-level AI legislation — you may have noticed that the primary audience appears to be AI developers and organizations deploying AI with substantial insight and control over how a model behaves.