The Schellman Blog

Security leaders have heard the phrase “AI has expanded the attack surface” enough times. The more interesting story is the widening gap between what CISOs say they're doing about it and what's actually happening inside their organizations.

In 2020, Microsoft made a sweeping commitment to be carbon negative by 2030 and remove all the carbon it had ever emitted since 1975. It was ambitious, inspiring, and, as of 2025, slipping further out of reach. Microsoft leaders originally referred to their sustainability goals as a “moonshot,” and in their own words from their 2025 Environmental Sustainability Report, the moon has gotten further away.

ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System (AIMS). Structured similarly to other ISO management system standards, like ISO 27001, with mandatory clauses 4 through 10 and an Annex A control set, it shares the same Plan-Do-Check-Act logic familiar to any management system practitioner.

This article was drafted based on a LinkedIn Live discussion between Danny Manimbo (Managing Principal, Schellman) and Christian Hyatt (CEO & Co-Founder, risk3sixty). Watch their full session here. The regulatory landscape for AI is shifting rapidly between evolving federal policies, an explosion of state-level legislation, and the emergence of industry-specific compliance requirements. Many organizations know they need AI governance but may face uncertainty about how to navigate the evolving landscape.

Enterprise AI systems are no longer simply running models that predict or classify; they’re now deploying agents that plan, reason, and act autonomously. These agentic systems have the ability to browse the web, write and execute code, make purchasing decisions, and interact with other systems across your organization, often with minimal human oversight involved.

AI is embedded in hiring decisions, customer service workflows, financial systems, and product development pipelines, among other essential business operations and services. AI undoubtedly comes with enhanced efficiency, scalability, and productivity, but it also brings concerns around risks, bias, transparency, reliability, and security.

As organizations scale their use of AI systems in key business processes, customer-facing products, and high impact decisions, the question is no longer whether AI can deliver value, but whether it can be deployed in a way that is reliable, secure, fair, and sustainable over time.

In the ever-changing world of information technology, the biggest topic of discussion is artificial intelligence (AI) and the influence it is having on security, compliance, and the administration of data. However, regarding data, the most important consideration should be how AI will impact our personal health information (PHI).