How vCISOs Approach AI Security Risks

When we run an AI risk assessment for a company this size, the risk rarely lives in a custom model. Many of them do not train models at all. They call a hosted model through an API, wrap it in a feature, connect it to a vector database of customer documents, and give it a few tools. Then staff start pasting contracts, support tickets and source code into whatever chatbot they prefer.

That produces four places where things go wrong:

Data poisoning and adversarial images, the risks the old version of this post led with, matter far more to companies that train their own models. For a typical SaaS team they come lower on the list. That is an opinion, and an assessor at a model lab would rank them differently.

There are four frameworks worth knowing. They do different jobs, and buying into all four at once is how a 90 day project becomes a 12 month one.

Certification bodies will disagree with the last row. Our position is simple: an ISO 42001 certificate on top of weak access control and no AI inventory is paperwork, and the 2025 IBM numbers show how often the missing control is ordinary access control. If you already hold ISO 27001, the step to 42001 is shorter, and our ISO 42001 consulting page explains how we run that project.

This is the sequence we follow on a new vCISO engagement where AI risk is the trigger. Each step has an owner on your side and a document at the end.

A common pattern we see is that steps 1 to 4 close more real exposure than everything after them. They are also the cheapest.

There is no single AI law to comply with in North America, which makes the work less dramatic and more spread out.

In Canada, the federal Artificial Intelligence and Data Act died with Bill C-27 when Parliament was prorogued in January 2025. That left existing privacy law doing the work. PIPEDA, or the substantially similar private sector laws in Quebec, British Columbia and Alberta, governs personal information you send to a model provider. In June 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which would replace the privacy part of PIPEDA and require organisations to disclose automated decision systems that can have a legal or similarly significant effect on people. It contains no AI act like AIDA and, as of October 2026, has not passed second reading.

The federal, provincial and territorial privacy commissioners issued joint principles for generative AI in December 2023 that spell out how regulators read PIPEDA for AI. If you serve Quebec, section 12.1 of the Quebec private sector privacy act, in force since September 22, 2023 under Law 25, requires you to tell a person when a decision about them is based exclusively on automated processing and, on request, explain the factors behind it. Provincial health privacy laws such as Ontario's PHIPA apply if clinical data reaches a model.

In the US, the FTC has made clear that Section 5 applies to AI claims and AI products; its Operation AI Comply sweep in September 2024 opened with five enforcement actions. If you are a HIPAA covered entity or business associate, sending protected health information to a model provider makes that provider your business associate or subcontractor, so you need a business associate agreement in place before the first API call that carries PHI. State laws add rules on automated decision making. California's CCPA regulations on automated decisionmaking technology took effect on January 1, 2026, and businesses that use it for significant decisions must comply from January 1, 2027. Colorado replaced its original AI Act with SB 26-189, a notice based law that also takes effect on January 1, 2027.

None of this needs a lawyer on retainer for a company that sells B2B software. It needs someone to read the rules once, map them to your features, and keep the map current. That is vCISO work. For the policy side, our AI governance service covers the documents in detail.

IRM publishes its vCISO pricing in three tiers:

For comparison, the ROI calculator on our vCISO page uses a full-time CISO baseline of US$250,000 a year. The 90 day plan above fits inside the Walking tier for most companies with one or two AI features. Companies with no AI in the product can usually do days 1 to 30 inside the Crawling tier and stop there.

Hours are not the only cost. Expect two to four hours a week from your engineering lead during days 31 to 60. A vCISO who promises to fix your product without engineering time is selling you documents.

Some readers should close this tab.

You probably do not need outside help for AI risk if all of the following are true: you ship no AI features, you use one enterprise AI tool with training on your data switched off, no regulated data (health, financial, children's) moves through it, and no customer has asked you an AI question yet. In that case, write a one page acceptable use policy, run our free AI governance playbook, and revisit in six months.

You also do not need a vCISO if you already employ a security lead who has time. A vCISO adds most when nobody owns security, or when the person who owns it is also running infrastructure and on call.

And a vCISO will not fix a model that is wrong. Hallucinated answers are a product quality problem first. We can help you set rules for human review and disclosure, but accuracy belongs to your product and data teams.

Pick one action you can finish by Friday:

If the inventory comes back longer than expected, book a 30 minute call and we will tell you which tier fits, or whether you need us at all.