Cyber attacks, AI misuse and data privacy rules emerge as top boardroom risks for India Inc

A recent survey conducted by FICCI and EY highlights the pressing risks that Indian companies face, particularly in the realms of cybersecurity, artificial intelligence governance, and data privacy regulations. Released on February 8, the Risk Survey 2026 reveals that a significant 61% of business leaders consider cyber-attacks and data breaches as major threats, impacting both financial health and reputational standing. This shift indicates that digital risks have escalated from mere IT concerns to a primary focus for company boards. The report underscores the urgent need for robust cyber readiness, as threats like ransomware and phishing attacks continue to evolve in complexity and scale. It emphasizes that cyber risks directly jeopardize operational integrity, revenue streams, and stakeholder trust, making preparedness essential for business continuity. Additionally, the survey points to growing apprehension regarding the swift integration of artificial intelligence into business practices, especially where governance frameworks remain underdeveloped. Approximately 60% of executives acknowledged that poor adoption of emerging technologies, including AI, hampers operational efficiency. Alarmingly, over half of the respondents reported inadequate management of AI-related risks, such as ethical dilemmas and potential misuse. Key concerns identified include phenomena like hallucinations, data poisoning, and the emergence of 'shadow AI,' where employees utilize unregulated AI tools for sensitive tasks. The report highlights that agentic AI systems, which can operate with minimal human oversight, introduce new layers of legal and compliance uncertainty, particularly when decisions are made without proper approvals. Compounding these issues is a tightening regulatory environment, particularly in data protection. The survey found that 56% of respondents view heightened scrutiny of data privacy as a significant risk. Furthermore, 67% indicated that frequent changes in regulations necessitate urgent attention from management and board members. As regulations such as India's Digital Personal Data Protection Act evolve, companies are compelled to reassess their governance structures, internal controls, and oversight of third-party operations. The report cautions that failing to comply with these regulations could lead to severe financial penalties, damage to reputation, and erosion of investor confidence. In summary, the findings from this survey reveal a rapidly intertwining risk environment where cybersecurity threats, AI governance challenges, and potential data privacy violations can lead to operational disruptions and long-lasting credibility issues. The report advocates for a comprehensive, integrated approach to risk management, urging Indian businesses to break down silos and align their strategies, operations, and governance as they adapt to an increasingly digital world.