The Schellman Blog

Most enterprises have a sense of who owns AI risk, yet few know what happens when that risk turns into an incident.

On nearly all sales calls, we receive questions around how Schellman is using AI on the pen test team, how AI is going to change our processes, and how fast these changes will be implemented.

This article was drafted based on a panel discussion between Schellman's Danny Manimbo, an AI-focused attorney, and an enterprise AI risk management leader. Watch the full conversation here: AI Governance in an Era of Evolving Regulation.

A Q&A about the EU AI Act with Schellman CEO Avani Desai on risk classification, AI literacy, and the August 2 deadline

If you ask most enterprise leaders, 74% would say their organization could pass an AI compliance audit today. Yet if you ask about the maturity of their AI governance program, only 27% say their programs are fully mature.

As AI agents move into production and regulatory pressure grows, organizations face a widening gap between governance confidence and operational readiness.

Security leaders have heard the phrase “AI has expanded the attack surface” enough times. The more interesting story is the widening gap between what CISOs say they're doing about it and what's actually happening inside their organizations.

In 2020, Microsoft made a sweeping commitment to be carbon negative by 2030 and remove all the carbon it had ever emitted since 1975. It was ambitious, inspiring, and, as of 2025, slipping further out of reach. Microsoft leaders originally referred to their sustainability goals as a “moonshot,” and in their own words from their 2025 Environmental Sustainability Report, the moon has gotten further away.