Governing AI Before It Governs Us
By
Shri V. P. Nandakumar
Chairman and Managing Director, Manappuram Finance Limited
Why financial institutions must treat artificial intelligence risk as a boardroom priority, not a distant concern
Every wave of technology arrives with a promise and a price. Financial services have absorbed many such waves: core banking, digital KYC and, more recently, UPI. However, artificial intelligence is different. It does not merely speed up what we already do; it changes what can be done, by whom, and how quickly.
What the experts fear
A study by MIT FutureTech and the University of Queensland, reported by MIT Sloan in July, asked 272 experts worldwide to rate 24 AI risks over 2025–2030. Their top five by expected severity were dangerous AI capabilities, competitive pressure, AI-enabled weapons and cyberattacks, the concentration of power, and false information. If we carry on as we are, the experts judged that 18 of the 24 risks carry at least a one-in-ten chance of catastrophe within five years. The researchers stress that they are not predicting events, only pointing to what deserves attention now.
The MIT study is not alone. The International AI Safety Report 2026, led by Yoshua Bengio with more than 100 experts, found growing evidence of AI being used in real-world cyberattacks and warned that safety testing is not keeping pace. The World Economic Forum’s Global Risks Report 2026 recorded the steepest rise of any risk for the adverse outcomes of AI.
Finance in the front line
The MIT experts named finance among the three most vulnerable sectors, alongside information and national security. AI amplifies fraud, sharpens cyberattacks and makes old crimes easier to scale. According to Surfshark’s tracking of reported cases, recorded global losses from deepfake fraud have reached USD 3.7 billion, most of it in the past two years.
The experts have also identified a responsibility gap: developers and regulators hold the levers, while users bear the harm. India has begun to draw its own guardrails. The report of the RBI’s FREE-AI committee (August 2025) recommends board-approved AI policies, and the India AI Governance Guidelines followed in November.
Defences must keep pace
Competitive pressure, the experts warned, intensifies other risks, because firms racing for advantage tend to underinvest in safety. Indian financial services are fiercely competitive, and the pull to deploy AI in underwriting, collections and customer service is real. Speed without safeguards, however, is not innovation; it is exposure.
Cisco Chairman and CEO Mr Chuck Robbins argued in a PTI interview in October that AI cannot be slowed, so defences must keep up: “We have to move at the same pace or faster.” The more pressing risk, he added, is that AI exposes gaps in basic hygiene: weak passwords, unpatched systems and technology running past its support life.
Events have since underlined the point. On 21 October, the US National Security Agency, together with the FBI and the Cybersecurity and Infrastructure Security Agency, urged organisations to patch two critical flaws in PHP, the programming language behind a large share of the world’s websites, or to take their systems offline until they could. The flaws, discovered with the help of artificial intelligence, could let an attacker take control of a web server with a single crafted request, without any password or login. Details began circulating online before the planned disclosure, government websites in Europe and elsewhere went offline, and the PHP project rushed out fixes within a day.
The episode captures both faces of this technology. AI found the weaknesses before criminals could exploit them at scale, which is the defensive promise at work. Yet the same capability in hostile hands could find such flaws just as quickly, and the window between discovery and attack is shrinking to hours. Institutions that patch slowly, or that run systems they no longer fully understand, will find that window closing on them.
Lessons from the atom and the cell
I broadly agree with Mr Robbins, with one caveat. That AI cannot be slowed is no licence to stop governing it.
Humanity has tamed formidable technologies before. Nuclear science gave us cancer treatment, electricity and the atom bomb; its dangers were checked by the International Atomic Energy Agency, founded in 1957, by test-ban treaties and, after Chernobyl, by binding safety conventions. India placed its own programme under statute and created the Atomic Energy Regulatory Board in 1983. In medicine, the Nuremberg Code and the Declaration of Helsinki made consent and ethical review the norm, and in 1975 scientists at Asilomar, having voluntarily paused their own genetic research, agreed containment rules before resuming. The Bhopal gas tragedy of 1984 taught us, at grievous cost, what happens when hazardous technology outruns oversight.
The lessons are simple: test before release, place independent oversight beside the innovators, and cooperate across borders. One difference should sober us. Uranium could be locked away; AI is cheap and everywhere.
What leaders should do now
Boards should own AI risk, folding it into existing work on cybersecurity, privacy and business continuity. Every deployment should be tested before release, as a medicine is. Customers need fraud awareness in their own languages, through branches they trust. Vigilance must be continuous, beginning with basic cyber hygiene. And institutions must share threat intelligence with peers, regulators and law enforcement.
A matter of trust
Finance rests on a simple proposition: customers trust us, and we honour that trust. AI will bring faster credit, sharper risk assessment and better service, but it will also test our institutions as never before. We learnt to govern the atom and the cell, and we can do the same with AI, provided our judgement keeps pace with the machines.
