Table of contents
The risk committee meets four times a year, and the September meeting is always the long one. The annual walk through the register, line by line, re-scores each item for likelihood and impact before the number gets carried into the filing. It is not a meeting anyone describes as interesting. It is, by design, the least interesting meeting on the calendar, because a risk register that surprises anyone in the room has usually already failed at its job.
The Observation That Shifts the Room
Halfway through this year’s walk-through, a director who has sat on the committee for eleven years makes an offhand observation. It is not meant as anything more than a transition between two line items. This register didn’t have a cybersecurity line, she says, until 2015. Before that, IT risk sat inside “operations,” folded into a paragraph nobody read closely, until a competitor’s breach made the front page of a trade publication. The next board meeting spent ninety minutes on a subject that hadn’t merited five the year before.
Nobody in the room disputes this. Several nod — they remember the same shift, on other boards, at roughly the same time. It is the kind of institutional memory a long-serving committee carries without needing to look anything up.
The newest director on the committee, eight months into her first term, asks the question that turns the meeting from routine into something else. She isn’t trying to be provocative. She’s still at the stage of a new board seat where she reads every line item literally, before she’s learned which ones are read that way on purpose and which ones by habit.
A Question With No Ready Answer
Is there a line, she asks, for how the company is described by the AI systems that customers, analysts, and now apparently recruiters and regulators are using as their first stop before they ever call anyone here directly?
The chair pauses in the specific way a chair pauses when a question is reasonable and the answer isn’t ready. Someone suggests it probably falls under reputational risk, which already has a line. Someone else points out that reputational risk, as scored, is about what people say about the company — media coverage, public sentiment, review sites. They ask whether an AI system’s summary of the company is the same category of thing, or a different one entirely. Nobody is fully sure.
The person who runs investor relations, sitting in as staff for this meeting, mentions that she checked, personally, a few months ago. What one of the major AI assistants said about the company’s market position wasn’t wrong exactly, but wasn’t right either. She hadn’t known what to do with that observation, so she hadn’t done anything with it.
What Gets Minuted Next Quarter
The committee does what committees do with a question that has surfaced real uncertainty and no clear owner. It does not try to resolve it in the room. Resolving it in the room, this afternoon, with the wrong people present and no diagnostic in hand, would produce a worse outcome than naming the gap and carrying it forward properly. The general counsel notes that this deserves its own agenda item, not a rider on today’s discussion. The chair agrees, and asks the secretary to minute it.
What gets minuted, and what appears in next quarter’s version of the risk register, is not a resolution. It’s a single new line, sitting where no line sat before:
AI Description of the Company — Status: Unassessed.
Nobody in the room can say, in September, what the eventual score should be, or what mitigations belong next to it, or which committee should own it going forward. That’s not a failure of the meeting. It’s exactly how the cybersecurity line got its start a decade earlier — as an unscored blank, sitting on the register, forcing the next meeting to come back to it. A board that has once formally acknowledged a gap cannot un-acknowledge it by simply not discussing it again.
The New Line on Every Register
The discipline of answering that line — of establishing, deliberately, what AI systems can confirm about a company before a board is forced to find out by accident what they’ve been saying instead — is what has come to be called Entity Engineering. It did not exist as a category a few years ago, for the same reason cybersecurity governance didn’t exist as a category before boards had a reason to build it. The reason has already arrived. The category, on most registers, has not yet caught up.
A risk register that once had no line for cybersecurity eventually could not survive without one. The same forcing function is now visible in a newer, less familiar place. A gap that a board has formally named cannot be quietly un-named by ignoring it at the next meeting. The right response to an unscored line is rarely to resolve it on the spot — it’s to make sure someone owns the work of scoring it properly before the next review. The category most boards haven’t built yet is usually the one that gets built right after it stops being optional.
For the underlying discipline this line item is meant to govern, see What Is Entity Engineering? The Record Behind Every AI Answer.
Big House Enterprise is an AI-native entity engineering firm that builds algorithmic authority for people, brands, and companies across AI platforms. Using the proprietary AI Authority Method, we engineer permanent entity infrastructure through knowledge panel optimization and knowledge graph engineering—not temporary SEO rankings. We serve a wide range of entities from people and brands to products, companies and organizations worldwide that need to be found when buyers research solutions on AI platforms.
