Using AI in Your BC Program: Opportunities, Risks, and Oversight

Many organizations are exploring whether AI systems can help with business continuity program development and maintenance. AI can indeed be helpful in such tasks as BIA data analysis and creating documentation, but its use comes with a significant risk of potentially costly errors.

Related: A Realist’s Guide to How AI Can Help with Business Continuity

The Promise and Perils of Using AI in BC

The advent of AI is potentially a great boon to BC teams, given the predicament most face of having too much work to do and not enough time to do it.

At MHA Consulting and our sister company BCMMETRICS, we have begun experimenting to see how we can responsibly use AI tools in our activities as advisors and BC platform developers. We’ve also been in touch with clients who have been using AI tools, whether it’s ChatGPT, Copilot, or something else.

It’s early days yet, and AI is evolving rapidly. However, a few things are coming into focus with regard to the uses and misuses of the current iterations of AI technology in business continuity.

There are a handful of important BC activities that AI is quite good at, such as analyzing data and creating rough drafts of documentation. At the same time, AI has the unique ability to slip in plausible-sounding errors that can be potentially devastating to an organization’s ability to recover in the event of an outage.

During the Cold War, U.S. officials used the phrase “Trust but verify” to describe a wise attitude to take regarding nuclear-arms treaties with the USSR. In that same spirit, a good approach to take regarding the use of AI in BC might be, “If you use, validate.”

Areas Where AI Can Potentially Help BC Teams

Early indications are that AI can be particularly helpful in the following areas:

Data analysis and validation

BC data gathered by humans commonly contains errors, inconsistencies, and duplications. We often see people use different labels for the same things in their BIAs, for example. AI’s ability to quickly scan data and documentation and flag possible errors can be of real value in cleaning up BC data sets. Using this functionality can lead to improved accuracy, sounder documentation, and fewer issues during recovery.

Generation of potential draft BC plans and recovery strategies

For the inexperienced, drafting BC plans and recovery strategies from scratch can be a daunting task. AI can quickly produce drafts of plans, strategies, or workarounds that give the team something to build on. The BC team might tell the AI, “Use this BIA data and these strategies to write a draft recovery plan for this business process.” ractitioners might find that AI suggests avenues of exploration that would not have occurred to them on their own.

Writing reports and status updates

Many BC practitioners find the writing of reports and status updates to be difficult and time-consuming. At the same time, this activity does not contribute directly toward the reduction of risk, the BC professional’s primary objective. These factors, combined with AI’s ability to swiftly produce adequate writing, make writing reports and updates another area where the new tools can make a significant contribution. By handing the job of drafting these documents off to the AI, the practitioner has more time to spend on activities that bear directly on reducing risk.

Taken together, these capabilities suggest that AI can serve as a valuable support tool for BC teams, especially in handling repetitive, analytical, and documentation-heavy tasks.

The Challenges of Using AI in BC

While AI can make meaningful contributions to BC, its use also brings significant challenges and risks. Organizations that use AI systems without being cognizant of and guarding against these are opening the door to significant impacts and liabilities. The principal risks and challenges that come with using AI in BC include:

AIs make mistakes

By now everyone has heard of the AI that cited nonexistent law cases in drafting a legal brief. If an AI introduces errors in working on your organization’s BC program, the result could be nonfunctioning plans or workarounds and delayed recovery, and all the associated costs in revenue, reputation, and penalties.

Using AI to do BC requires expertise in both AI and BC

AI is no substitute for human skill. Using it effectively requires that the user have skill and knowledge both in BC methodology and in how to prompt the AI system in order to get useful results. The AI might save time, but it does not eliminate the need for expertise. If anything, it creates the need for additional expertise.

AIs induce complacency

AIs are often very capable. They also seem very confident and all-knowing, characteristics that tend to lull their human overseers into complacency. When employees stop thinking for themselves, the risk of errors getting through increases dramatically. Such errors can lead to recovery delays and cascading impacts.

AI does not know your business

The AI might seem omniscient, but most likely it has access to little or no information about your business. Such unique details are the heart and soul of every company’s BC program. Only humans can gather and provide this critical data. Any AI-drafted documentation that lacks detailed customization is likely so generic as to be useless.

AI can create a new dependency

If you come to rely on AI to draft or maintain elements of your BC program, then you have created a dependency on the AI. AI, let us recall, is a piece of third-party software residing in one or more off-prem data centers; it is subject to the same availability risks as other such tools. If you become dependent on the AI, you need to develop a contingency plan regarding what you will do if it goes down.

AI creates potential added exposure for your confidential data

The data you provide the AI is only as secure as that AI system. Be sure whatever use you make of AI is consistent with corporate policy. This might restrict what you can share with the AI, thus limiting its usefulness.

AI can be a powerful aid to BC programs. But its potential to generate and mask errors, erode employees’ ability to think for themselves, compromise data security, and create overlooked dependencies is significant. Users who overlook these risks are setting themselves up for unpleasant surprises.

How to Make the Best Use of AI in BC

Organizations that want to reap the benefits of AI while avoiding its potential impacts should be mindful of the following:

AI is not the program

Some executives harbor a fantasy of turning the BC program completely over to AI. This is not a realistic aspiration. AI can help a BC team. It cannot replace a BC team.

Start small

Making safe and effective use of AI in BC is a major undertaking. It’s safer to start with smaller, less consequential areas like reviewing BIA data sets and creating rough drafts of documents.

Emphasize oversight

Close human oversight must be maintained to avoid potentially serious consequences. A quirk of AI is that it simultaneously makes such oversight absolutely essential and hard to sustain.

Cultivate AI literacy

People using AI must become cognizant of its quirks and limitations. Among these are its proclivity for making mistakes while sounding very self-confident and its tendency to lull users into passively accepting its output.

Mind your dependencies

BC teams that become dependent on AI must create plans that will enable them to carry out their essential functions without AI.

Protect your data

AI simultaneously creates strong incentives for users to input confidential company data and creates a new avenue by which that data might escape.

By keeping these considerations in mind, organizations can enjoy the benefits AI offers their BC programs while reducing the risks it will delay recovery and increase impacts.

Human Oversight Remains Essential

AI has the potential to become a valuable tool for BC teams, particularly in helping them manage data, create documentation, and generate ideas for plans and strategies. For organizations struggling with limited time and resources, these capabilities can provide meaningful benefits.

At the same time, AI introduces significant risks relating to potential errors, data security, dependency, complacency, and a tendency to produce plausible-sounding but fatally generic content. If unchecked, all of these traits have the potential to delay or prevent recovery and significantly increase the impact of outages.

Organizations interested in using AI to support their BC programs should proceed with caution. MHA Consulting helps clients strengthen their continuity capabilities while evaluating emerging technologies and managing associated risks. Contact us to learn how we can help your organization make practical and responsible use of AI in business continuity.

Further Reading

• Are You a Leader in BCM Governance, Risk and Compliance (GRC)?
• A BC Consultant’s View of the Risks of Generative AI
• A Realist’s Guide to How AI Can Help with Business Continuity
• The Human Touch: People and Teamwork Still the Key to BC Success
• A New Vision for BC Practitioners: Focus on Risk Reduction

Frequently Asked Questions

How can AI help organizations with their business continuity (BC) programs?

AI can help BC teams in a variety of ways, especially in handling analytical and documentation-heavy tasks. For example, AI tools can assist with reviewing BIA data for inconsistencies or duplications, generating draft recovery plans and strategies, and writing reports or status updates. Used appropriately, AI can help BC teams save time, improve consistency, and focus more attention on activities that directly reduce organizational risk.

What are some of the pitfalls organizations need to be aware of in using AI to help them with their business continuity (BC) programs?

AI systems can produce inaccurate, incomplete, or overly generic outputs while sounding highly confident. Organizations also need to be aware of risks relating to employee complacency, overreliance on automation, exposure of confidential data, and the creation of new dependencies on third-party AI platforms. In addition, AI lacks detailed knowledge of an organization’s unique processes, systems, and culture, making human oversight and customization essential.

What can go wrong if companies are not careful in how they use AI in their business continuity programs?

If organizations rely too heavily on AI without proper review, they risk introducing serious flaws into their BC documentation, recovery strategies, or planning assumptions. These errors could lead to delayed recovery, failed workarounds, increased outage impacts, reputational harm, regulatory issues, or financial losses. Organizations can also create new operational vulnerabilities if they become dependent on AI systems without planning for the possibility that those systems themselves could become unavailable.

What can organizations do to help them get the benefits of using AI in their business continuity programs while containing the risks?

Organizations should treat AI as a support tool rather than a replacement for human expertise and judgment. A prudent approach is to start with lower-risk uses such as data analysis or drafting documents, while maintaining strong human oversight and validation at every step. Companies should also ensure their use of AI complies with internal data-security policies, educate employees about AI’s limitations, and develop contingency plans for any critical dependencies they create on AI platforms or services.

What is AI literacy and how does it pertain to the use of AI in business continuity?

AI literacy is an understanding of how AI systems work, what they are good at, and where their limitations and risks lie. In the context of business continuity, AI literacy means recognizing that AI can be a valuable support tool for tasks such as data analysis and document drafting, while also understanding that AI systems can produce inaccurate, incomplete, or overly generic information. BC professionals using AI need enough familiarity with the technology to ask effective questions, evaluate outputs critically, recognize potential errors, and avoid becoming overly dependent on automated tools.