AI with Judgment

Executive summary

Artificial intelligence (AI) is already inside your organization, through more paths than leadership has formally discussed, and so the useful question is no longer whether to adopt it, but where it is used, with what data, with how much autonomy, and under what governance. The advantage does not come from using AI, but from using it in the right process and with the right technique; and as AI moves from recommending to acting, what is being delegated stops being merely technology and becomes authority, with risks that grow with its autonomy and with the impact of what it does. Governing those risks first requires having information security in order, because AI frameworks are built on that foundation, and answering with evidence, not promises, the security, confidentiality, and privacy questions that are already arriving from customers, employees, and regulators. In Chile, the broadest obligation is Law 21.719 on personal data, which takes effect on December 1, 2026; the AI bill is still moving through Congress. For the organization that has not yet started, the guide proposes a 90-day plan: in the first month, find out where AI is being used, move sensitive work to enterprise accounts, define which data is never entered, and name an owner; over the following two months, approve a usage policy, adopt a governance framework, implement the controls, and train the organization’s people. This guide walks that path from the basics to the specifics, with familiar examples ranging from the first voice dictation programs to ChatGPT and DeepSeek, and closes with four reference annexes: security, confidentiality, and privacy questions (Annex A), a checklist for buying or building (Annex B), how to move from isolated initiatives to a program (Annex C), and a glossary (Annex D).

These three ideas rest on four dimensions that recur throughout the document, not as a sequence, but as cross-cutting questions worth asking again at every stage: Value · Technique · Autonomy · Governance.

The document’s reading path is different, and it is explained below.

How to read this guide

This guide does not aim to turn an executive or board member into an artificial intelligence specialist. It aims to give them enough judgment to tell a real opportunity from a fad, understand what authority is being delegated, identify the relevant risks, and ask the right questions before approving an initiative. To that end, the document moves through six stages, each building on the previous one. Each concept appears first in simple terms, with an everyday example or a real case, and then with the detail an executive needs in order to decide.

Quick-reference tools, gathered at the end in the Annexes section: Annex A. Security, confidentiality, and privacy questions, and how to answer them · Annex B. Checklist for buying or building · Annex C. From initiative to program · Annex D. Essential glossary

Reading paths

1What is already happening in your organization

AI is entering companies through many paths at once: corporate tools; copilots (AI assistants built into software already in use, such as email or the spreadsheet); applications contracted over the internet (SaaS, software as a service) that add AI without anyone explicitly asking for it; in-house developments; vendors that add it to their offering; agents (systems that, besides answering, carry out actions on their own; they are explained in section 2); direct connections between systems (APIs, application programming interfaces); tools that individual employees adopt on their own; voice assistants on phones and in offices; and tools that record and summarize meetings. That is why the board-level discussion has already changed shape:

2What AI is, and what it is not

Put simply, artificial intelligence is any system that does something we normally associate with human intelligence: recognizing a face, recommending a movie, detecting fraud, translating or drafting a text. There are different types, and it helps to arrange them as concentric rings.

These four levels do not compete with one another: they contain one another, and each inner ring is a subset of the ring that surrounds it. None replaces the one before.

AI did not begin with ChatGPT

The fact that generative AI has been in fashion since the public launch of ChatGPT in late 2022, and that other assistants, such as Claude or Gemini, extended it afterward, does not mean artificial intelligence began there. A good part of what is now called “AI” has been operating inside companies for decades, generally without that name.

Your organization has probably been using one of the first three categories for years without calling it “artificial intelligence” in its internal language. What was new in 2022 was not AI: it was that, for the first time, a generative AI became available in a conversational interface open to the general public.

Six moments everyone remembers, and what each one teaches

The history of AI is best understood through six public milestones, in chronological order. Each one illustrates one of the rings in the diagram above, and each leaves a lesson that is useful to an executive.

The AI you already use every day

Before discussing risks, it is worth noticing that AI is already part of daily life, almost always without being called that:

The practical difference between the rows: in the first seven, the AI does a single narrow task inside a product that someone designed and controls. In the last one, the person hands the AI information and an open-ended instruction. That is where this guide’s questions of confidentiality, accuracy, and accountability begin.

Generative AI is not only text

Within the generative AI ring in the diagram above, language models (LLMs) are the best-known case, but not the only one. The same generative family includes models specialized in other types of content:

Where agents fit in

An agent is not a fifth, smaller ring inside generative AI. It is a way of using a model, almost always an LLM, by connecting it to tools, memory, and the ability to carry out steps on its own. That is why it is drawn as a branch extending outward from the circle, not as a more specific level inside it.

Put simply: a language model is like an expert who can only converse. An agent is that same expert with access to your email, your calendar, and the company’s systems, and with permission to do things in them.

That a system can respond does not mean it should act on its own. Section 7 develops the different levels of autonomy and why this difference is critical for a board.

3What AI does well, and what it still does poorly

Before turning to which technique to use for which problem, it is worth setting an honest starting point on current capabilities.

Understanding what AI is does not yet determine where to use it. The next question is which technique truly fits the problem, and whether the value it generates justifies doing it.

4Which technique fits which problem

This section applies the guide’s central idea: first the problem, then the technique.

The variables you should look at before choosing

5When the right technique is not a language model: the CENIA case

At ELIAC 2026, the Latin American conference on AI applied to cybersecurity organized by iSecurity, Chile’s National Center for Artificial Intelligence (CENIA) presented three projects of its own. Its thesis in the talk: AI is not a synonym for language models; the technique is chosen for the problem, not for fashion.

6Economics and value: when an AI initiative is worth it

The right criterion is not “does the AI work?” It is “does it generate enough value to justify its cost and its risk?” A board should not first ask whether a solution is bought or built. It should first ask why this initiative should exist and what value it should generate; section 16 deals with how to obtain the solution, once the why is settled.

Example key performance indicators (KPIs), to be chosen according to the case: time saved, cost per transaction, automation rate, rate of human intervention required, accuracy, error rate, actual adoption by users, satisfaction, revenue increase, recorded incidents, cost per query, and return on investment.

Why AI projects fail

Frequent causes: a poorly selected problem, a process poorly designed before being automated, technology chosen by fashion and not by fit to the problem, insufficient or poor-quality data, weak integration with existing systems, no clear owner of the process, users who do not adopt the tool, absence of controls, unrealistic expectations about what AI can do, underestimated operating cost, and a return that was never formally measured.

Once a case with value has been identified, the next question is how much decision-making and execution power we are willing to delegate.

7From copilot to agent: what changes when AI acts

As long as a model only responds to a query, the risk is the quality of the answer. An agent starts workflows, calls other systems, chains several steps, and decides what to do next without a person intervening at every step. “Agentic AI” is the term for precisely that capacity to act with autonomy toward a goal, not just answer.

The autonomy level is not defined by the product’s name (“assistant,” “copilot,” or “agent”), but by what the system can actually do: its capabilities, its permissions, and the approvals it requires. The same tool can operate at more than one level depending on how it is configured. And not every automatic action is AI: a fixed rule that blocks an account when certain patterns appear is traditional automation.

The second dimension: the impact of the action

Classifying by autonomy alone is incomplete. A low-impact action executed autonomously is different from a high-impact one executed in the same way.

8How data lives and persists

To understand where information can end up, it helps to separate the components involved: model, inference service (the service that runs the model every time it responds), application, storage, vendor, and logs. During a normal query, the model’s weights (the parameters where what was learned in training is stored) are generally not modified by the prompt (the instruction or question that is typed in). But “the model does not retain the data” is not the whole story: the platform or service surrounding the model may retain, depending on the product, the architecture, the configuration, and the contract, the prompts, the outputs, files, logs, metadata, reasoning traces (the intermediate steps the model records), caches (temporary copies to respond faster), and information used for abuse detection.

The type of account matters more than the brand

The same AI tool treats data very differently depending on the type of account or contract. It is the distinction that most helps in answering whether the AI “keeps” the information.

Conditions vary by provider and over time: what counts is what the current contract says, not the advertising.

The AI tools already in use in the organization

The rule above does not apply only to conversational assistants. It also holds for the search engine, the browser, the phone’s voice assistant, and the tools that record meetings: in all of them, the same brand treats data differently depending on whether it is used with a personal account or a company account.

Conditions as reported by each provider on its official pages, reviewed in October 2026. They change frequently: before making a decision, confirm them against the current contract.

RAG, in one sentence

RAG (retrieval-augmented generation) lets a model consult external company information while responding, without that information necessarily having been incorporated into the model’s training. It is the difference between what the model “knows” out of the box and what it “looks up” at the moment of answering. Following the consultant example: RAG is handing them a folder of company documents to consult during the meeting; fine-tuning is sending them to a specialization course with those documents, and what they learned there can no longer be easily taken away.

Your organization probably already uses RAG without calling it that: NotebookLM, ChatGPT and Claude Projects, Microsoft 365 Copilot when it answers with SharePoint documents, or Gemini when it searches Google Drive. In all of these cases, the tool consults the documents in order to respond, and what defines the risk is who can see that folder and what type of account it is used with.

Autonomy and data access change the risk surface. The next question is what can go wrong and how it is controlled.

9The six risks an executive should know

Each risk is presented with what it is, an everyday example or a real case, and its controls.

10AI security: three different conversations

It is common to mix up three conversations that are actually separate, and it is worth distinguishing them explicitly in any discussion with a vendor or an internal team.

The AI usage policy for staff

The first of this section’s three conversations, using AI securely day to day, is resolved in large part with a usage policy that anyone in the organization can read in ten minutes. It does not need fifty pages: it needs to answer four questions clearly, and to match what the company’s technology actually allows.

When something goes wrong: incidents and business continuity

Sooner or later, something will go wrong: an employee enters a customer’s information into a public tool, an agent executes the wrong action, an assistant gives a customer a false answer, or a manipulated document alters an analysis. Without a procedure written in advance, the first time is improvised, and improvised badly. The general procedure has five steps:

1. Contain. Stop the damage before fully understanding it: pause the agent or the integration, revoke its access, and suspend pending automatic actions.
2. Scope. Use the logs to establish which data, which actions, which customers, and which period were affected. Without logs, this step cannot be done.
3. Notify. The internal owner first, and then whoever is required by law and by contract: the Agencia de Protección de Datos Personales (Personal Data Protection Agency) when the breach creates a reasonable risk for individuals, the Agencia Nacional de Ciberseguridad (National Cybersecurity Agency) if the company is bound by the Ley Marco de Ciberseguridad (Cybersecurity Framework Law; section 15), affected customers according to their contracts, and the AI provider.
4. Correct and reverse. Undo the actions that can be undone, formally ask the provider to delete whatever is appropriate, and correct with the customer whatever was delivered wrongly.
5. Learn. Identify the cause, adjust the policy, permissions, or controls, and add the case to the tests that are rerun before every change.

Annex A, question 10, applies this logic to the most frequent case: an employee who entered confidential information into a personal account.

There is also a kind of AI-specific incident that does not look like an incident: the system starts responding differently without anyone in the company having changed anything, because the provider updated the model. There are four controls for business continuity:

• Pin the model version used in production, instead of pointing to the “latest” version that the provider updates on its own.
• Keep a set of test cases with a known result, taken from real cases, and rerun it before adopting each new version.
• Adopt new versions with a validation window and with the ability to return to the previous one if results get worse.
• Require notice from the provider of changes to or retirement of the model, and notify your own customers when the result of the service they receive may change. If a component changes price or stops being available, the exit strategy in section 16 is what allows you to keep operating.

11AI is also available to attackers

This section aims only to raise executive awareness. It is not a guide to attack techniques. Malicious actors can use AI to improve social engineering, phishing, content generation, translation, message personalization, target research, automation, code generation or modification, and the speed and scale of certain campaigns. There is no evidence that AI has replaced traditional attack techniques: what it mainly does is lower entry barriers, increase scale, and speed up the attacker’s operation.

Controlling these risks requires more than technology: it requires authority, accountability, and clear rules.

12AI governance: who decides what AI can do

AI governance does not mean creating bureaucracy. It means defining, by name, who can approve use cases, who owns the process, who owns the risk, what data can be used, which models and providers are permitted, what level of autonomy is authorized, which uses are prohibited, when human oversight is required, how performance is monitored, how incidents are reported, and when a solution must be retired.

The names of the functions are indicative (board, general management, process owner, Technology, Security, Data, Legal or Compliance, Risk, Audit): each company adapts them to its size and industry.

AI and cybersecurity governance frameworks and models

Before governing AI specifically, it is advisable to have general technology and information governance in order. An organization that does not manage its information risks well is unlikely to manage well the newer and less familiar risks of its AI systems.

It helps to distinguish two levels: general risk and security management frameworks, which apply to any organization that uses technology, and AI-specific frameworks, which have only begun to consolidate in recent years.

They are not mutually exclusive: many organizations use the NIST CSF as an internal assessment framework and ISO/IEC 27001 as the certified management system that underpins that assessment.

With that general foundation in place, it finally makes sense to move on to the frameworks that address AI specifically:

Added to these two, with a different nature, is the European AI law (EU AI Act): it is not a voluntary management framework but a regulation with the force of law that classifies AI systems by level of risk and requires different obligations depending on that classification (section 15). An ISO/IEC 27001 ISMS protects the environment where the AI operates (the data, the access, the infrastructure), but it does not answer the questions specific to AI: what a system can decide on its own, with what level of autonomy, with what bias, or with what explainability. ISO/IEC 42001, the NIST AI RMF, and, as a legal obligation in certain markets, the European AI law are designed for that.

For privacy there is also ISO/IEC 27701, whose 2025 edition became a standalone standard for managing personal data: it no longer requires having ISO/IEC 27001 first.

In Chile, that foundation is already mandatory for some companies: the Ley Marco de Ciberseguridad requires operators of vital importance to have an information security management system (section 15).

In practice, an already mature ISO/IEC 27001 ISMS is not discarded when moving to AI: an important part is reused, and another part must be extended because AI introduces questions the ISMS was not designed to answer.

The recommended maturity sequence, in general terms, is the following:

Governing agents: identity, permissions, and logging

An agent is governed with the same logic used to bring on a new employee with access to systems: you know who they are, what they can do, who answers for them, and what they did. In practice, that means five rules for each agent:

• Its own identity. Each agent operates with its own identity, never with a person’s account or shared credentials, so that its actions can be told apart and revoked.
• One owner. A person with a name and a title who answers for what the agent does and decides when it is modified or retired.
• Limited, reviewed permissions. Only the access its task requires, with a review date, because permissions tend to accumulate: they are added one at a time and almost never removed.
• A record of what it does: what it was asked, what information it consulted, what actions it executed and with what permission, so that any result can be traced back to its origin.
• A switch. The ability to stop it immediately, without depending on the provider, and to reverse what it managed to do.

Beyond those basic rules, the industry does not yet have a single answer. At ELIAC 2026, three security vendors presented three different ways of controlling an agent, which are best read as complementary rather than alternatives:

Each thesis matches the product category sold by the company that presented it. That does not invalidate the diagnosis, but it requires separating it from the recipe: none of the three is a complete solution, and agents’ own identity remains an open issue, because each vendor builds its own scheme and those schemes still do not talk to one another.

What to report to the board, and how often

A board does not need a technical report on AI: it needs one page, in the same format every time, that lets it see the trend and decide. Five items are enough to start:

The frequencies are a starting reference: it is advisable to adjust them to the intensity of AI use and to the board’s calendar.

13AI ethics: not everything technically possible is acceptable for a business

Governance answers who decides. Ethics answers what we are willing to allow, even if it can technically be done. Ethics, regulation, and security overlap, but they are not the same: a decision can be legal and technically secure, and still be considered inappropriate by customers, employees, the community, or the board itself. The central themes are transparency, fairness, non-discrimination, privacy, the ability to explain a decision, accountability, human oversight, impact on people, and use proportionate to the problem being solved.

The lesson for a board: an AI that learns from the past can repeat, and amplify, the biases of the past. That is why decisions about people (hiring, credit, insurance, terminations) deserve the strictest oversight.

14Who answers when the AI makes a mistake?

The actual distribution of responsibility depends on the specific contract, the applicable regulation, and the concrete architecture: this table is a starting map, not an automatic assignment.

The lesson: in front of the customer, “it was the AI” is not a defense. The company answers for what its AI says and does.

15Regulation: AI as a corporate governance matter

AI already has implications for privacy, copyright, discrimination, transparency, automated decisions, accountability, and industry-specific sector regulation. The voluntary frameworks (NIST, ISO) were described in section 12. This section summarizes the most relevant legal obligations for a company operating in Chile or with customers in Europe, as of October 2026.

This guide does not replace legal advice: before a compliance decision, it is advisable to review the current text of each rule with a lawyer.

With these conditions defined (authority, ethical limits, accountability, and regulatory obligations), the organization can now decide how to implement the solution and whether it is ready to scale it.

16Build, buy, or partner: how to decide

There are at least eight distinct paths, and they are not mutually exclusive within a single organization:

Proprietary versus open weights, in simple terms

Neither option is intrinsically more secure: security depends on how each one is implemented and governed, not on the “proprietary” or “open weights” label. The same maker can offer both types of model.

For the buying or development stage, Annex B gathers a practical checklist of questions to ask before signing a contract or starting a development.

17The 18 questions before approving an AI initiative

The 18 questions, grouped by topic to make them easier to use in a board session.

18Where to start: a 90-day plan

You do not need to have everything resolved to begin governing AI, and waiting until you do is, in itself, a risky decision. The plan is organized in two stretches.

The timelines are indicative and depend on the size and complexity of the organization.

Closing: the decision framework

Before approving an AI initiative, an executive should be able to answer five questions with confidence:

Competitive advantage will not come simply from using AI. It will come from using it in the right processes, under the right level of autonomy, with reliable data, controls proportionate to risk, and accountability clearly defined before starting.

If the organization has not yet started, the plan in section 18 lays out the first 90 days.

And when someone asks whether the company’s AI is secure, it is worth remembering the rule from Annex A: you answer with evidence, not promises.

Sources and methodological notes

Project documents used: Guia_Educativa_Tipos_de_IA_y_Preguntas_Frecuentes_v2.00_20260924.html, Guia_Educativa_Arquitectura_3_Capas_v2.10_20260922.html, Marco_Conceptual_Preguntas_Clientes_Seguridad_IA_v1.00_20260922.html, Casos_de_Uso_IA_por_Tamano_de_Empresa_v1.00_20260916.html, ELIAC2026_Sintesis_Charlas_v1.10_20260824.html (CENIA talk at ELIAC 2026), Respuesta_Clientes_Seguridad_IA_v1.10_20260915.html (includes the log-preservation case in The New York Times v. OpenAI and Opinion 28/2024 of the European Data Protection Board), Seguridad_IA_Guia_Ejecutiva_Gobernanza_v1.00_20260916.html, Seguridad_Agentes_IA_Lado_Proveedor_v1.04_20260916.html (continuity in the face of model version changes), and ELIAC2026_Resumen_Ejecutivo_Consolidado_v1.00_20260916.html (the three agent-control theses presented at ELIAC 2026). The everyday analogies, the model answers in Annex A, the 90-day plan, the usage policy, the incident procedure, and the board report are original work developed with AI support from those sources.

External sources, consulted between October 14 and 16, 2026:

• History of AI: Deseret News with AP, “U.S. company introduces first speech typewriter” (March 1990, deseret.com); IBM, “Deep Blue” (ibm.com/history/deep-blue); eWeek, “IBM’s Watson Wins in Jeopardy, Needs Lessons in U.S. Geography” (February 2011, eweek.com); British Go Association, report on the Google DeepMind Challenge Match (March 2016, britgo.org/node/5458); Reuters via Inquirer, ChatGPT user growth according to UBS (February 2023, business.inquirer.net); Maginative, stock market drop after DeepSeek R1 (January 2025, maginative.com); Daily Maverick with Reuters, blocking of DeepSeek by the Italian data authority (January 30, 2025, dailymaverick.co.za).
• Watson in health care: New York Times, “What Ever Happened to IBM’s Watson?” (July 2021), summarized by Advisory Board (advisory.com); announcement of the sale of Watson Health assets to Francisco Partners (January 21, 2022, hpcwire.com).
• Risk cases: LawSites, sanctions in Mata v. Avianca (June 2023, lawnext.com); The Register, restriction of generative AI at Samsung (May 2023, theregister.com); The Hacker News, EchoLeak in Microsoft 365 Copilot (June 2025, thehackernews.com); Fortune, the Replit agent incident (July 2025, fortune.com); Malay Mail with AFP, fine imposed on OpenAI by the Italian authority (December 2024, malaymail.com); CNN via ABC17, deepfake fraud against Arup (May 2024, abc17news.com); MobileSyrup, Moffatt v. Air Canada ruling (February 2024, mobilesyrup.com); Reuters via CNBC, Amazon’s screening tool (October 2018, cnbc.com).
• Frameworks: NIST, launch of Cybersecurity Framework 2.0 (February 26, 2024, nist.gov); NIST, AI Risk Management Framework (January 26, 2023) and generative AI profile NIST AI 600-1 (July 26, 2024, nist.gov); ISO, fact sheets for ISO/IEC 27001:2022 (iso.org/standard/27001) and ISO/IEC 42001:2023 (iso.org/standard/42001); Kiwa, publication of ISO/IEC 27701:2025 (kiwa.com).
• Regulation: AZ, summary of Law 21.719 (az.cl); Prey, breach notification under Law 21.719 (preyproject.com) and reporting deadlines under Law 21.663 (preyproject.com); Carey, promulgation of Law 21.663 (carey.cl); Diario Constitucional, status of the AI bill (February 2026, diarioconstitucional.cl); CeCo, “Chile reescribe su ley de IA” (August 2026, centrocompetencia.com); Orrick, “EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes” (July 2026, orrick.com); Data use by tool: OpenAI, data policy for ChatGPT Business, Enterprise, and Edu (help.openai.com); Anthropic, “Updates to Consumer Terms and Privacy Policy” (August 2025, anthropic.com); Google, Gemini app for Workspace (knowledge.workspace.google.com) and Which?, Gemini activity (October 2025, which.co.uk); Microsoft, Copilot privacy controls (support.microsoft.com) and enterprise data protection (learn.microsoft.com); Hardware Busters, change in Google Search content use for AI (July 2026, hwbusters.com); Prey, impact assessment under Law 21.719 (preyproject.com); Voice assistants and meetings: Dark Reading, Apple’s Siri settlement (January 2025, darkreading.com); TechCrunch, change in Echo voice processing (March 2025, techcrunch.com); NPR, lawsuit against Otter.ai (August 2025, npr.org); Fortune, risks of AI browsers (October 2025, fortune.com).
• AI roadmap: Gartner, “AI Roadmap: How to Build and Scale AI” (gartner.com/en/articles/ai-roadmap). The seven-workstream framework is cited with our own translation and wording, without reproducing the original chart (© Gartner, Inc.).