AI and technology disruption worry executives more than geopolitics, according to a new KPMG survey. But the takeaway for enterprises is not to slow AI adoption. It is to stop measuring success solely by what a system can do, and start testing what happens to the business when it gets something wrong, changes or stops working.
This is a business question before it is a technology question: Who has the authority to stop a process? Which operations must continue? And what is the cost of depending on a supplier you cannot replace within a reasonable timeframe?
- 64% ranked technology and AI disruption as their top concern.
- 58% cited geopolitical conflicts.
- 46% identified digital dependency as the most exposed link.
The figures come from KPMG's report on supply chain resilience, which draws in part on an Ipsos survey of 109 senior executives across major markets. That is a small sample, not a representative picture of every economy. Read it as a signal of management priorities, not proof that technology is more dangerous than war in every industry and country.
The risk is not just the model. It is the dependency built around it
Discussions of AI risk tend to focus on incorrect answers or information exposure. Both matter, but neither tells the whole story. The deeper risk emerges when an organization builds a critical process around a component it does not understand well enough and cannot operate without.
That dependency does not require a major AI program. Procurement starts relying on automated supplier summaries. Customer service uses AI to classify requests. Finance receives recommendations for handling exceptions. Each use looks local and reasonable. Together, they create an operational dependency that may never appear on the risk register.
Using multiple vendors does not necessarily create independence, either. Two different systems may rely on the same cloud provider, model or data source. Mapping vendors is no substitute for mapping the dependencies beneath them.
For enterprises already managing security, staffing and shipping risks, a technology scenario cannot be treated in isolation from operating conditions. A supply disruption may arrive precisely when the team is short-staffed, demand is shifting and the recommendation engine is working from data that no longer reflects reality.
Resilience is not a promise that the system will never fail. It is the ability to keep delivering an essential service when it does.
AI can strengthen resilience, provided its authority has limits
The report contains a useful paradox: 49% of respondents prioritize AI and predictive analytics as tools for strengthening resilience. The same technology causing concern can help identify anomalies, connect events and evaluate alternatives faster.
Consider an importer receiving supplier messages, shipping updates and inventory data. An AI agent can gather that information, flag an order at risk, explain the consequences and prepare alternatives for the procurement manager to review. The value is not another polished summary. It is less time between a problem emerging and a decision someone can act on.
But different tasks need different treatment. Calculating available inventory should rely on source data and tested logic. Interpreting an ambiguous supplier message may benefit from an LLM. Making a new financial commitment requires authorization and approval rules proportionate to the risk. Not every step needs AI, and not every AI output should trigger an action.
- Supplier message: AI extracts meaning and context; the control is a link to the source.
- Inventory balance: AI explains and presents the data; the control is verification against the system of record.
- Alternative supply option: AI prepares a recommendation; the control is a review of terms and costs.
- New order: AI prepares an execution request; authorization depends on the financial exposure.
These distinctions let an organization expand automation without granting the model unlimited authority. They also show where business expertise is required, rather than simply the ability to connect software interfaces.
A human in the loop should not become the next bottleneck
Requiring human approval for every action is an easy way to look cautious. It is not necessarily an effective way to manage risk. If an employee must reread every document and verify every conclusion, the organization may end up paying for both the technology and a human workload that has barely changed.
A better design lets people oversee a large volume of activity by handling exceptions. That requires clear rules about which actions can run automatically, which need review and which events stop the process. Triggers might include missing information, conflicting sources, an action outside delegated authority or unapproved financial exposure.
Watch out: Confident wording is not a control. A persuasive model response is not evidence that it is correct. Escalation to a human should depend on data checks, authorization rules and risk, not simply on the confidence the model expresses.
The oversight interface should show the reviewer the sources, the proposed action and the reason for the exception. With that information available, people can exercise judgment instead of reconstructing the system's work from scratch.
What management should demand before scaling
A striking gap in the report is the distance between confidence and actual dependency testing: 70% of executives expressed confidence in their ability to maintain critical operations during a major external disruption. That confidence matters, but it does not replace a rehearsal.
Instead of asking for another successful demonstration, management should ask what happens when a provider is unavailable, an authorization expires or the information contradicts itself. The process is as much managerial as technical:
- Map a critical business process: Identify the business outcome, data sources, dependencies and the person accountable for keeping operations running.
- Define authority boundaries: Establish what runs automatically, what requires approval and when the process must stop.
- Rehearse failure: Test a provider outage, missing information and an incorrect answer against a defined fallback workflow.
- Measure and expand gradually: Scale only after evaluating the benefits, oversight workload and ability to recover.
Metrics should include process completion time, cost per case, the share of actions requiring correction and recovery time. Human oversight minutes are a cost, too. A business case that ignores them, along with integration costs and control maintenance, can show efficiency gains that do not exist.
The capabilities enterprises need to build internally
Buying a platform is not enough. Organizations need to advance on two tracks: AI literacy for employees, and an internal capability to build and manage agents. The first improves task definition, answer checking and understanding of limitations. The second makes it possible to embed automated execution into workflows, sometimes without asking employees to substantially change how they work.
IT will need to manage agent permissions, identities, monitoring, versions and shutdown. Business teams will need to define success, exceptions and accountability. This is not a project to hand entirely to a vendor and forget after launch.
Choosing the right practitioners is also part of risk management. Familiarity with a popular tool is no substitute for relevant education, a deep understanding of AI and experience with business processes. The combination of academic grounding, practical experience and managerial judgment matters especially when a system participates in decisions rather than merely drafting text.
The right boardroom question is not whether the organization has AI. It is whether the organization knows how to extract value from it, oversee it and keep operating without it. That is a requirement you can test, rehearse and budget for. It is far more useful than another declaration of innovation.