Risk is getting harder to read, faster to move and more difficult to govern with the systems CROs relied on even a year ago.
Diligent Institute’s GC Risk Index now rates the current risk environment at 7 out of 10, up from 5.8 last year, while Protiviti and the NC State ERM Initiative found that 96% of near-term risks tracked over the last two years have worsened.
For CROs, the pressure points are clear: Cyber threats, emerging AI risks and third-party risk sit at the top of the near-term agenda. But the bigger shift is how those risks are being managed. Last year's focus was turning GRC into a system of action with AI. In 2027, CROs will need to govern both the risks on the horizon and the AI-enabled systems they use to monitor, escalate and act on them.
AI risk is no longer a future item for the risk register. Protiviti and the NC State ERM Initiative rank emerging AI risk as the second highest near-term risk for CROs, right behind cyber. And with the EU AI Act’s high-risk obligations now expected in December 2027, AI governance has moved from a future concern to a compliance priority with a hard deadline.
And the operational risk is real. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027 because of rising costs, unclear value or weak risk controls. Oliver Wyman's research points to the same gap: AI is already being used in production for risk work, but governance and approval processes are still immature. That gap, not the technology itself, is what will decide who gets burned in 2027.
Closing that gap means turning AI governance into a practical operating discipline. In 2027, CROs will need to know:
“The biggest AI risk in 2027 won’t be whether organizations adopt AI. It will be whether they can explain where it’s being used, what decisions it can make and who is accountable when something goes wrong.” Scott Bridgen, General Manager, Risk & Audit, Diligent
That level of oversight requires more than a policy. It depends on knowing which models are in use, who owns each workflow and where the audit trail sits when a recommendation is made. Diligent gives CROs a way to document that accountability inside the risk process itself, so teams can move quickly without losing control of how AI is being used.
Cyber is still the top-line risk for CROs, but the conversation about it at board level is changing. It is no longer enough to report on threat levels, controls or severity scores. With DORA in force, NIS2 obligations landing across the EU, and the SEC’s cyber disclosure rule keeping material incidents on the board agenda, CROs need to show how cyber risk could affect operations, recovery time, financial exposure and disclosure decisions.
The gap is readiness. Diligent’s analysis found that only an estimated 20% of companies are currently disclosing incidents in the way the SEC rule expects, while PwC’s 2027 Risk Agenda points to cyber threats carrying operational and physical consequences beyond data exposure. That makes cyber less of a technical update and more of a business resilience conversation between risk, IT, legal and the board.
To support that handoff, CROs and CISOs need a shared view of exposure, accountability and response readiness rather than separate reports that never quite line up. Diligent helps support that conversation by connecting enterprise and cyber risk in one shared view of exposure, ownership and response readiness, so teams can see what matters and what needs to happen next before an incident becomes a disclosure or recovery issue.
CSDDD may no longer be the 2027 deadline CROs were bracing for, but that does not make third-party risk a problem for later. Omnibus I pushed the directive’s compliance date to July 2029, with general due diligence guidance now expected in July 2027.
But sanctions, export controls, modern slavery obligations and supply chain transparency requirements are already live, and geopolitical volatility is making vendor exposure harder to separate from enterprise risk.
The bigger issue is visibility. AlixPartners points to nth-party risk, the vulnerabilities buried in your vendors’ vendors, as cloud, automation and outsourcing make supply chains longer and harder to see into.
The shift organizations need to make is from periodic supplier checks to continuous third-party oversight across ownership, sanctions, reputation and operational resilience. With Diligent, teams can connect third-party monitoring with enterprise risk, giving CROs a clearer view of vendor ownership, sanctions exposure, reputation signals and resilience issues before they escalate into broader business risk.
The headline you've probably heard is that U.S. investment screening is expanding, but the more precise story is narrower and still worth watching. The COINS Act expands the framework for screening certain outbound investments, with implementing regulations due in March 2027. In the EU, the revised Foreign Direct Investment Screening Regulation is already adopted, but mandatory screening does not fully apply until January 2028.
For most CROs, 2027 is not about rebuilding the deal process around new rules, but about making sure cross-border investment risk, subsidy exposure and ownership structures are picked up earlier in diligence, before a transaction is too far along. That shift puts CROs closer to the front of M&A decision-making, aligning with McKinsey’s finding that top-performing CROs are increasingly involved in strategy, markets and M&A rather than reviewing deals from the sidelines after the fact.
Understanding a deal’s exposure starts with knowing which entities, jurisdictions and ownership relationships are involved. With Diligent, risk, legal and leadership teams can connect scenario planning with legal entity data, giving them a clearer view of cross-border exposure, ownership structures and deal-readiness before a transaction reaches the boardroom.
Trade and tariff risk is becoming a standing enterprise risk, not a quarterly finance footnote. PwC calls this the politicization of interdependence: governments and other actors using economic dependencies as leverage across trade routes, supply chains, technology ecosystems and payment systems. The Red Sea disruptions and Strait of Hormuz risk show how quickly a regional chokepoint can become a global business issue, especially when more than 80% of traded goods move by sea.
The point is not to track every geopolitical flashpoint. It is to understand where trade disruption, sanctions, tariffs and inflation could affect supply continuity, cost exposure and operational resilience. That is why this risk needs a permanent place in scenario planning, alongside cyber, third-party and supply chain risk.
This is where scenario planning becomes a board-level discipline. By bringing trade and tariff exposure into the same view as cyber, third-party and supply chain risk, Diligent helps CROs show leadership where disruption could affect cost, continuity and resilience before it becomes a separate escalation deck.
Climate risk did not go away when disclosure rules cooled off. Extreme weather is already disrupting how work gets done, not just where assets sit. Deloitte's 2026 survey found that 31% of workers reported weather-related transportation disruption, 30% reported health impacts and 29% reported financial hardship from extreme weather events. For CROs, that means continuity planning has to account for workforce disruption, absenteeism and reduced productivity, not just physical assets and supply chains.
It also changes how business impact is assessed. Historical incident frequency is no longer enough when chronic hazards like repeated flooding or extreme heat can gradually degrade a site’s or workforce’s viability. As insurance costs and physical asset exposure keep rising, climate risk stays a continuity story, not a compliance issue to delegate and revisit only when disclosure rules change.
The board doesn't need another climate disclosure update in isolation. It needs a current view of physical, operational and workforce exposure. Diligent helps teams assess those risks, assign owners and track mitigation alongside other enterprise risks, giving CROs board-ready reporting on where resilience needs attention.
CROs aren't just tracking more risk, they're doing it with teams and budgets that aren't growing to match. The NC State ERM Initiative and Protiviti's 15th annual Executive Risk Survey names talent and labor availability as the single highest-ranked near-term risk for CEOs, ahead of both cyber and AI. Diligent's 2026 governance trends research points to the same capacity squeeze across governance more broadly, not just risk.
Barclay Simpson's 2026 risk and compliance salary survey puts a number on that squeeze: 89% of employers say it's challenging to hire skilled risk talent right now, while only 52% plan to add headcount this year. Heading into 2027, that leaves CROs needing to create more capacity from the teams they already have.
This is where AI governance and workforce capacity meet. AI can absorb the repetitive, document-heavy work that eats into a lean team's hours, but it can't replace the specialized expertise and human judgement CROs are already struggling to hire.
Creating capacity starts with reducing the repetitive work competing for specialists’ time. ACL Analytics is built around this constraint directly: automate manual processes and provide continuous monitoring, without adding headcount, so a flat team can cover more ground without losing the specialized judgment a smaller group can't scale on its own.
“The risk environment is moving too quickly for quarterly reviews to be enough. CROs need a more continuous view of how cyber, third-party, geopolitical and climate risks connect, so they can see where disruption could hit the business before it becomes a crisis.” Scott Bridgen, General Manager, Risk & Audit, Diligent
Cyber, third-party, M&A, trade and climate risk all point to the same reality: CROs can no longer manage fast-moving, cross-domain risk through quarterly reviews alone. An always-on, AI-assisted risk function can help monitor those exposures continuously, but only if the AI behind it is governed with the same discipline expected of the risks it tracks.
That means tiered oversight, a documented model inventory and clear accountability for every recommendation. Heading into 2027, the CRO’s system of action cannot just move faster. It has to be governed from the start.
For teams already using Diligent, you don't need to rip out what you've already built. DiligentAI plugs directly into your existing risk, audit and compliance workflows on the Diligent One Platform.
For teams still managing risk across disconnected systems, the next step is seeing how Diligent brings those pieces together. Explore what this could look like for your risk program: Request a demo.
Diligent Institute's GC Risk Index rates the current risk environment at 7 out of 10, up from 5.8 a year earlier. For CROs specifically, the near-term agenda is topped by cyber threats, emerging AI risk and third-party risk. Right behind those three sit AI governance, M&A exposure, trade and tariff volatility, climate risk and the team capacity needed to manage all of it.
Because it's no longer optional. The EU AI Act's high-risk obligations land in December 2027, putting a hard compliance deadline on every CRO's calendar, and most risk functions aren't ready for it: Oliver Wyman found 54% of banks already run AI in production for risk work, but only 12% call their AI governance process mature.
Yes, if AI is used to extend capacity rather than replace expertise. Talent and labor availability is the single highest-ranked near-term risk for CEOs, and automating repetitive work, like vendor assessments and evidence collection, frees a lean team's time for the judgment calls that still need a person.
