Rapid AI adoption is pushing financial institutions to balance aggressive innovation against strict risk and legal guardrails. Rather than treating AI as purely a technical problem, organizations must align the distinct perspectives of the CIO, CISO and CRO into a federated structure of responsibility, and prepare now for governance challenges such as agentic AI, said Shailendra Kothavale, chief risk and legal officer at Aditya Birla Sun Life Insurance.
As rules like the Digital Personal Data Protection (DPDP) Act take effect, insurers face tough questions on data consent, algorithm transparency and third-party vendor management. High-risk use cases such as automated underwriting and claims processing demand human oversight and strict vendor contract controls.
“When people say AI will replace human beings… who will replace them, and how will they mutate?” Kothavale said. “I think there ethics will play a role, governance again will play a role which you apply to humans, and then the CHRO will play a key role… You’ll need to treat the AI agents as your employees and have a separate code of conduct and identification for each.”
In this video interview with CISONow, Kothavale also discussed:
• Aligning CIO, CISO and CRO views to balance business velocity with risk appetite;
• Categorizing and tiering AI use cases by decision criticality and customer impact;
• Navigating DPDP requirements, consent withdrawal and vendor model restrictions in financial services.
Kothavale is Chief Risk and Legal Officer at Aditya Birla Sun Life Insurance, where he leads enterprise risk management, compliance, legal affairs and information security. A Chartered Accountant and Certified Information Systems Auditor (CISA), he has more than two decades of leadership experience in financial services.
