Disparate privacy risks from medical AI: an AI risk management wake-up call

A recent headline — "Disparate privacy risks from medical AI - Nature" — is a useful lens on AI risk management.

The short version

Risk management answers a different question: what can go wrong, how likely is it, how bad would it be, and what control reduces it to an acceptable level? For AI that increasingly takes actions (not just produces text), the risk lives in the action path — payments, writes, messages, code changes.

Why it matters

As AI moves from assistive (it suggests) to agentic (it acts), small failures compound into operational, legal, financial and reputational harm. The organisations that win won't be the ones that adopt AI fastest — they'll be the ones that can scale it safely, reliably and accountably.

What good looks like

• A risk register with inherent vs. residual risk and named owners.
• Controls in the action path: human approval, least-privilege, logging, a kill switch.
• Continuous monitoring (drift, fairness, guardrail breaches) — not a one-time review.
• An incident-response runbook you've actually rehearsed.

The takeaway

• Name the AI system, classify its risk, and assign an owner this week.
• Put one real control in the action path (approval gate, redaction, or kill switch).
• Turn on one monitor (drift, fairness, or guardrail breaches).
• Write down your risk appetite so the team knows when to stop, escalate, or redesign.