Why leadership debates AI risk instead of fixing it
Most AI steering committees can talk for an hour about responsible AI for overcoming adoption barriers and risks without agreeing on a single next step. Everyone names a worry, someone cites a survey, and the meeting ends with an action item to 'keep discussing.' This article is a working session design for a Chief AI Officer who wants the opposite outcome: one picked intervention, one owner, before the meeting ends.
In McKinsey's October–November 2024 survey of US employees, 41% described themselves as apprehensive about AI and said they would need additional support. About half of employees in that same survey worried specifically about AI inaccuracy and cybersecurity risks. Employees reported these worries themselves; the figures describe sentiment, not a measured error or breach rate.
In our view, 'build trust in AI' is not a decision a team can act on; naming one barrier and one risk, and assigning it to a person, is.
Call this what it is: an editorial exercise, a session format we recommend rather than a published or tested methodology. No supplied research validates this exact mapping exercise; treat it as a structured way to turn a survey report into a decision. It works best for a leadership team that already has some barrier data in hand, even informal data.
Sources: AI in the workplace: A report for 2025 | McKinsey
What you need in the room before the session
Before you book the room, pull whatever barrier data exists: a recent employee AI survey, an engagement pulse with AI questions added, or failing that, a round of informal manager interviews. From it, list the top five to eight barriers employees raise in their own words, not categories you've invented, but phrases like 'I don't trust the output' or 'I don't have time to learn this.'
Bring AI adoption barriers and risk categories to the table
Bring a short, fixed list of risk categories to the table rather than letting the group invent new ones mid-session. Accuracy, cybersecurity, intellectual property and privacy, explainability, fairness, and workforce impact make a practical starting list that keeps the group from debating definitions instead of mapping barriers.
NIST's AI Risk Management Framework organizes this work into four functions, govern, map, measure, and manage, which is a reasonable reference point for the risk side of your grid.
| Risk category | What it covers | Example signal from employees |
|---|---|---|
| Accuracy | Outputs being wrong or misleading | "I don't trust the numbers it gives me" |
| Cybersecurity | Data exposure or breach risk | "I don't know where this data goes" |
| IP and privacy | Ownership and handling of personal or client data | "Can I paste client data into this?" |
| Explainability | Understanding how a tool reached an answer | "I can't explain this decision to my manager" |
| Fairness | Biased or uneven outcomes across groups | "It seems to work differently for different teams" |
| Workforce impact | Job security and role change | "Will this replace part of my job?" |
PwC's September–October 2025 survey of 310 US business leaders named difficulty translating principles into scaled, operational processes as a top barrier to operationalizing responsible AI. That is a process and governance gap, not a technology problem, a distinction your grid should capture for every barrier you map.
A barrier labeled 'resistance to change' can land on culture as easily as on any risk category. Ralabs, the team behind AI Adoption Score, found that culture, not skills, was the real adoption bottleneck for its own engineering team, a reminder to leave room on the grid for culture, not only technical risk.
Sources: Responsible AI survey: PwC, Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Run the 60-minute mapping session
This is the one hour where overcoming responsible AI adoption barriers and risks stops being a phrase on a slide and becomes a named owner and a date. Keep the group moving through five short stages rather than one long debate.
NIST's AI Risk Management Framework states that executive leadership must take responsibility for decisions about the risks of AI system development and deployment. That responsibility is easiest to assign in the room, in the moment the group picks its hotspot, not afterward in a follow-up email nobody reads.
“The more we see organizations using AI, the more we recognize that it takes a topdown process to really move the needle.”
— Alexander Sukharevsky, Senior partner and global coleader of QuantumBlack, AI by McKinsey · Source: https://www.mckinsey.com/~/media/mckinsey/business%20functions/quantumblack/our%20insights/the%20state%20of%20ai/2025/the-state-of-ai-how-organizations-are-rewiring-to-capture-value_final.pdf
This session only counts if it ends with a name attached to a date, not another entry in a parking lot of good ideas. We'd skip any version of this session that ends in 'let's discuss further.'
Sources: AI RMF Core - AIRC
Keep the group from relitigating everything
The grid only works if the group accepts limits going in. Fix the risk categories before the meeting starts, time-box each stage, and agree that the session produces one decision, not a ranked backlog. Anyone who wants to add a ninth risk category can propose it for next quarter, not this hour.
We'd rather a team commit to the wrong fix for a quarter and learn from it than spend another meeting litigating which risk is 'real.' A wrong pick you can measure beats a right pick you never make.
Know you're done when one owner owns one fix
The session worked if, by the end, you can point to one barrier-risk cell, one named owner, one action due in the next 30 to 60 days, and a written note of what you'll re-measure next time. If the room produced a list instead, the mapping didn't do its job; run the vote again, don't add a sixth hour.
Imagine a 300-person insurance claims team where 'I don't trust the output' keeps surfacing as the top barrier. Mapped against the risk categories, it lands mostly on accuracy and explainability, not cybersecurity. That tells leadership to fund a verification workflow and clearer explanations, not another security briefing nobody asked for.
We think most teams already sense which cell is hottest before the session starts. Forcing them to say it out loud, in front of each other, is most of the value.
Make the mapping grid a repeating habit
Treat this as a quarterly or biannual exercise, not a one-off. PwC's 2025 survey found that roughly two-thirds of organizations at its own 'strategic' responsible-AI maturity stage reported having AI-agent evaluation and testing capabilities in place or planned, a sign that more advanced organizations keep revisiting this kind of check rather than running it once.
If your barrier list is thin, a predefined survey such as the AI Adoption Barriers Survey can surface the themes employees actually report before your next session, instead of relying on whoever spoke loudest in the last meeting.
Repeat the session each quarter and responsible AI for overcoming adoption barriers and risks stops being a committee topic and becomes a standing line on the agenda, with a score attached instead of a slogan. Pick one cell, name one owner, measure again next quarter.
Sources: Responsible AI survey: PwC
Frequently asked questions
Who should be in the room for this session?
Editorial guidance, not a fixed rule: aim for the Chief AI Officer, a people or L&D lead, a security or legal voice, and one business-unit owner. Fewer than four people limits perspective; more than six slows the vote. Pick people who can commit to an action, not just opinions.
How often should we run this mapping exercise?
Run it quarterly, timed to each refresh of your barrier data. Keep the risk categories fixed across rounds so results stay comparable, but expect the hottest cell to shift as fixes land; a repeated hotspot across rounds is a signal to escalate beyond a single owner.
What if we don't have employee survey data yet?
Start with informal manager interviews and write down the barriers in employees' own words, then run the session with that. A predefined employee survey is a faster way to get the same input with less guesswork before your next round.
Does this session replace a full responsible-AI risk assessment?
No. It's a prioritization step that picks one intervention, not a compliance review. NIST's AI Risk Management Framework is voluntary guidance covering governance, mapping, measurement and management of risk, and this session only touches a slice of that work in one hour.
Sources: AI RMF Core - AIRC, Artificial Intelligence Risk Management Framework (AI RMF 1.0)
