August 2026
C-suite executives report AI and emerging risks overtaking traditional concerns
Business conduct risk has traditionally focused on issues like corruption, human rights violation, and environmental harm. But a new set of risks is gaining ground, driven by advances in technology, data, and growing scrutiny around how companies operate.
The Business Conduct Risk Intelligence Report 2026, commissioned by RepRisk in collaboration with Oxford Economics, shows that C-suite leaders across banks, asset managers, and other financial institutions recognize the urgency of responding to a rapidly evolving risk landscape. Many are responding by improving early risk detection and taking a closer look at whether their existing oversight is still fit for purpose.
# A reshaping of material risks
Surveyed executives report a clear shift in the business conduct risks they consider most material:
- AI-related conduct risks have jumped from the least cited material risk in the past three years to the top risk for the next three years.
- Climate and energy transition risks also rose sharply, ranking second among the issues expected to shape the risk landscape ahead.
- Data privacy and cybersecurity breaches continue to rank among the top concerns, alongside misleading communications and greenwashing.
# Top material risks according to C-suite executives
At the same time, several historically prominent risks have fallen in relative priority. Corruption and bribery, previously among the top concerns, declined noticeably. Human rights and modern slavery risks saw the steepest drop, moving from a top-three concern, to the least cited risk looking ahead.
This does not mean that established risks are disappearing. Traditional risks remain embedded in global operations, particularly in jurisdictions with weaker regulatory oversight. But technology-related and transition risks are developing faster than many existing controls were designed to accommodate. As a result, many institutions are beginning to reassess whether existing governance structures and data systems are equipped to manage the next generation of business conduct risks.
“Business conduct risks aren’t necessarily increasing, but they are changing. The most significant growth we see is in cyber- and IT-related risks, including AI-driven threats such as fake news and cyberattacks. At the same time, traditional risks like human rights and environmental concerns remain firmly in place.”
Alexander Zanker, Head of ESG Analytics, LGT Capital Partners
# AI moves to the center of the risk agenda
The sharp rise of AI-related conduct risks illustrates how quickly risk perceptions can shift when technology adoption outpaces governance.
RepRisk data shows a 127% increase in AI-related risk incidents in 2025 across the 350,000+ public and private companies monitored. Over half of those AI-related risks were flagged in connection with human rights abuse and corporate complicity, controversial products and services, or both.
Source: RepRisk Platform. For illustrative purposes only.
This pattern is echoed in public disclosures. The Conference Board’s “AI Risk Disclosures in the S&P 500: Reputation, Cybersecurity, and Regulation,” finds that large companies are rapidly elevating AI risk in their public disclosures. The study analyzed annual filings between 2023 and 2025 and found that 72% of S&P 500 companies disclosed at least one material AI risk in 2025, up from 12% in 2023. Reputational risk related to biased outputs, misinformation, privacy violations, and implementation failures was the most frequently cited concern in the study, reflecting the wide range of ways AI failures can damage trust.
The findings underscore a broader conclusion: AI is rapidly moving from an emerging technology risk to a core business conduct challenge requiring attention at the highest levels of the organization. For financial institutions in particular, the governance of AI is quickly becoming inseparable from the broader challenge of managing trust, transparency, and accountability.
# Rising incidents and rising costs
C-suite respondents reported facing a 55% increase in major business conduct risk incidents between 2023 and 2025. At the same time, fewer firms reported no significant incidents. Risks are increasingly spread across operations, portfolios, and supply chains, making exposure harder to avoid.
# Average number and growth of significant risk incidents by year
The loss of key investors and clients, regulatory sanctions, and reputational brand damage emerged as the most common consequences of business conduct risk incidents, highlighting the direct commercial impact banks and asset managers must navigate.
# Most concerning consequences following a major business conduct incident
Business conduct risk incidents routinely cost millions, and more than half of executives surveyed are spending more to mitigate them. These risks are a direct driver of financial loss, operational disruption, and reputational harm, with consequences that extend far beyond regulatory penalties. As a result, prevention and early risk detection have become core priorities for senior leadership.
“We view [business conduct risk data] as a critical business expense rather than a discretionary investment tied to ROI. Its value lies in maintaining operational resilience and business continuity. After a high-profile incident in 2023, we strengthened our controls and have had no incidents since, reinforcing the importance of agile risk management and the significant financial and reputational risks of non-compliance.”
Chief Risk Officer, Asset Manager (Denmark)
# Implications for risk strategy
The risk landscape is not standing still. As emerging risks continue to reshape priorities, organizations will need governance structures, oversight mechanisms, and risk intelligence that are agile enough to respond. Those that adapt early will be better positioned to navigate uncertainty, strengthen resilience, and maintain stakeholder trust.
This evolving landscape sets the context for deeper questions explored throughout The Business Conduct Risk Intelligence Report 2026. These include how firms invest in risk data, where governance and integration gaps remain, and how leaders are using earlier risk detection and stronger oversight to create strategic advantage. Read the full report today.
Copyright 2026 RepRisk AG. All rights reserved. RepRisk AG owns all intellectual property rights to this report. This information herein is given in summary form and RepRisk AG and/or the third party contributors to this report make no representation or warranty that any data or information supplied to or by it or them is complete or free from errors, omissions, or defects. Without limiting the foregoing, in no event shall RepRisk AG and/or the third party contributors to this report have any liability (whether in negligence or otherwise) to any person in connection with the information contained herein. Any reference to or distribution of this report must include a link to the content to provide sufficient context. The information provided in this presentation does not constitute an offer or quote for our services or a recommendation regarding any investment or other business decision, and is not intended to constitute or to be used as a substitute for legal, tax, accounting, or other professional advice. Please note that the information may have become outdated since its publication. Should you wish to obtain a quote for our services, please contact us.
Decision‑grade means suitable for identifying and prioritizing risk exposure as an input into a broader decision‑making process. RepRisk data does not determine legality, compliance, thresholds, or required actions, and does not prescribe investment, procurement, or engagement decisions.
