Enterprise adoption of artificial intelligence has reached a new inflection point as businesses grapple with growing questions about the technology's safety and reliability, according to Aisha Tahirkhelli, an AI leader at KPMG US.
Reports of unauthorized AI agents accessing bank accounts and cases of rogue behavior disclosed by AI developers are fueling calls for stronger safeguards.
For CFOs, the incidents raise the stakes of adoption, putting a sharper focus on the potential perils of deploying the technology without a full assessment of the risks.
“AI safety and governance should be built into the investment case from the start because they are part of the cost of operating AI responsibly at scale,” Tahirkhelli said.
In an email interview with CFO Dive, Tahirkhelli discussed the financial risks of AI failures, the costs of safeguards and the questions CFOs should ask before approving investments in the technology.
The following Q&A with Tahirkhelli has been edited for clarity and brevity.
CFO Dive: Do the growing concerns about AI safety and reliability mark a turning point for enterprise AI adoption? If so, what should CFOs be doing differently now?
Aisha Tahirkhelli: Yes. AI is no longer operating at the edges of the enterprise. It is being embedded into critical workflows with greater autonomy, deeper access to data and systems, and more influence over business outcomes.
For CFOs, that means safety and reliability must become part of the investment decision. Before scaling an AI capability, they should ask: What can it access? What actions can it take? What happens if it behaves unexpectedly? And what independently verified evidence shows that the controls work?
CFOs should also expect ongoing testing, continuous monitoring and human accountability because the technology and workflows around it will continue to change.
CFO Dive: How should CFOs think about the financial risks of deploying AI systems that may behave unpredictably or make costly mistakes? And what kinds of potential losses or exposures should they be considering?
Aisha Tahirkhelli: CFOs should treat AI the same way they think about other material business risks, while recognizing that its unpredictability, scale, and growing autonomy can change the nature and speed of the financial exposure.
The potential losses extend well beyond the cost of an incorrect output. They can include operational disruption, flawed decisions, compliance violations, litigation, cybersecurity or data incidents, reputational damage, and the cost of investigating, remediating and rebuilding trust when something goes wrong.
The conversation tends to anchor on the low-likelihood, high-impact risks, yet there are also more likely financial risks that finance organizations should also be focused on. For example, cost visibility matters. Organizations should have transparency and predictability to understand where AI consumption is happening, why, and what the outcome was. When you can answer these questions, you can make better investment decisions, more risk-informed bets and demonstrate value.
CFO Dive: How heavily should CFOs weigh safety and governance when planning AI investments?
Aisha Tahirkhelli: AI safety and governance should be built into the investment case from the start because they are part of the cost of operating AI responsibly at scale.
That includes testing and independent validation, but it also includes investing in internal red-teaming capabilities, runtime observability, security controls, incident response and ongoing human oversight. These are not one-time costs incurred before launch.
Models change, workflows evolve and systems may gain access to new data, tools, or decision-making authority. Organizations need the capabilities to identify vulnerabilities before deployment, detect unexpected behavior in production and respond quickly when something falls outside acceptable boundaries.
The level of investment should reflect the consequences of failure. An AI tool that summarizes meeting notes presents a very different risk profile from one involved in financial reporting, credit decisions, claims processing or financial forecasting. The more consequential the use case, and the greater the system’s autonomy and access, the stronger the testing, monitoring and control environment should be.
CFOs should therefore evaluate AI using its full cost of ownership. That means measuring expected returns after accounting for the cost of testing, monitoring, security, governance, remediation and the people needed to oversee the system throughout its lifecycle.
This does not mean organizations have to choose between speed and responsibility. At KPMG, we believe companies can be bold, fast and responsible at the same time. The right safeguards allow organizations to move with greater confidence, resolve issues earlier and scale the capabilities that demonstrate real value.
AI governance should not sit outside the investment as an added cost. It is part of what makes the investment durable and scalable.
CFO Dive: What questions should CFOs be asking their technology teams and AI vendors about safety before approving major AI investments or deploying AI in finance and other critical business functions?
Aisha Tahirkhelli: Before approving a major investment, CFOs should understand both the value the system is expected to create and the responsibility it will carry. What data and systems can it access? What decisions can it influence? What actions can it take without human approval? And what could the organization lose financially, operationally or reputationally if it behaves unexpectedly?
They should ask how the system has been challenged, not simply how it performs under ideal conditions. That includes realistic and adversarial testing, independent evaluation for consequential use cases and transparency about known limitations and failure modes.
CFOs should also expect visibility after deployment. Is the system producing the intended business outcome? What does it cost to operate, test, monitor, and secure? Is there sufficient runtime observability to detect when performance declines or behavior falls outside acceptable boundaries? Who can intervene, and can the system be restricted or stopped quickly?
For AI deployed in finance and other critical functions, traceability and accountability are essential. The organization should be able to reconstruct what the system did, what data and model version were involved, what human reviewed the outcome and who ultimately approved it. Vendor contracts should also address data use, material model changes, incident notification, audit rights, remediation and liability.
The investment decision should come down to five questions: What value will the AI create? What authority will it have? How has it been challenged? How will we know if it goes off course? And who is accountable when it does?
A credible ROI should account for the full cost of operating AI responsibly and the potential cost when something goes wrong.
