Secure by Design: Customer Protection in the AI Age

Companies may be more capable of addressing potential risks from AI if they shift customer protection from a narrow focus on data privacy and cybersecurity toward a broader responsibility for customer outcomes. As AI systems increasingly mediate recommendations, decisions, and interactions, companies could respond with governance practices that address security, product safety, model reliability, and human oversight.

This edition of the Investment Stewardship in the AI Era series examines how companies may be positioned for a broader approach to customer protection.

Key Takeaways

• The AI era has the potential to expand customer protection from safeguarding customer information to safeguarding customer outcomes. As AI becomes embedded in products and services, companies may have an incentive to reduce the risks of harmful, unreliable, or unintended AI-driven outcomes for customers.
• Managing these risks requires more than traditional privacy and cybersecurity controls. AI-related harms can appear from model failures, poor data quality, biased outputs, or inadequate oversight, even when systems remain secure and compliant.
• To explore how companies may be positioned to manage these risks, this report examines two capabilities that are already fundamental to customer protection today: the ability to build secure digital systems and the ability to develop safe and reliable products. Within the Corporate Rating framework, these capabilities can be assessed through the Customer Security and Product Design & Development indicators.
• Among 2,030 companies assessed, customer protection capabilities vary across sectors. Healthcare companies perform strongly across both indicators, while Technology, Media, and Telecommunications companies demonstrated stronger performance on Customer Security than on Product Design & Development, suggesting differences in governance priorities and risk exposures.
• For investors, the findings suggest that sectors have developed different governance capabilities in response to different customer risks. As AI becomes integrated into products and services, the question may be whether companies can combine the strengths traditionally associated with sectors such as Healthcare, where customer outcomes depend on strong safety, quality, and risk management practices, with the strengths of Technology, Media, and Telecommunications, where managing digital systems and cybersecurity risks has long been a core capability.