With the recent release to the general public of tools like ChatGPT and Google Bard, the long-heralded arrival of AI has now occurred, and in a big way.

In the wake of the debut of these tools, there has been a tsunami of think pieces on what AI means for society at large. Will it help cure disease? Ruin children’s ability to think for themselves? Make it easier to plan trips and meals? Worsen the problem of misinformation? Boost cybercrime? Improve mental health? Change warfare? Cost people their jobs? Destroy civilization?

For all anyone knows for sure, it might be any or all of the above.

Leaving the broader discussion to other people, I’ve been trying to come to grips with what AI might mean for the field of business continuity.

Influencing my thoughts is the fact these technologies are in their infancy. There will probably be huge advances in the next 10 years.  What will their capabilities be then? Nobody knows.

It seems to me there are two areas to look at in thinking about what AI means for BC: the risks AI poses to organizations’ ability to keep their critical processes running, and the possibilities of using AI as a tool to help in doing BC.

For a closer look at how resilience professionals might fear AI, use it to help them do BIAs, write plans, and devise exercises, you might take a look at recent online exclusive articles on the site: “AI Anger Management,” by Samson Williams; “Chat GPT Comes to Business Continuity,” by Lawrence Robert; and “Business Continuity and Artificial Intelligence,” by Suminda Jayasundera.

For a business continuity consultant’s take on the threat AI poses to organizations’ operations, check out “A BC Consultant’s View of the Risks of Generative AI,” by Richard Long, on the MHA Consulting blog

The articles above feed into the first tip I would give resilience professionals, faced as we are with the need to get our heads around the implications of AI: read widely about it, educate yourself, get into discussions about it. As uncomfortable as the rise of AI might be in some respects, putting our heads in the sand won’t make it go away.

Another tip I’d offer would be to use caution in leaning on AI to help with your BC program.

The reason why is simple. In scouring the internet for information to answer your questions, the tools might grab up bad data or advice—garbage which they would then feed it to you in a tone of absolute certainty. Plus, when AI tools like ChatGPT don’t “know” the answer, apparently they have a tendency to “hallucinate” a response, making something up out of thin air.

That being said, it has to be stated that tools such as ChatGPT have an extraordinary potential to help us in doing BC. This is not in the future. It’s right now.

Here’s an example of what they can do right now, for anyone, for free. I asked ChatGPT if it had the ability to evaluate a BC plan against the requirements of the FFIEC standard.

Its reply was pretty darn impressive:

Yes, I can certainly evaluate a business continuity plan against the requirements of the FFIEC (Federal Financial Institutions Examination Council) standard. The FFIEC’s Business Continuity Planning Booklet outlines the principles and expectations for effective business continuity planning in financial institutions.

The booklet provides guidance on the key components of a comprehensive business continuity plan.

ChatGPT then named them (risk assessment, business impact analysis, business continuity planning, testing and training, maintenance and review), concisely explaining each one. It concluded:

By evaluating your business continuity plan against the requirements of the FFIEC standard, I can identify any potential gaps or areas for improvement in your plan.

I then asked if it could look at a BC plan for me and tell me if there were any gaps. It replied:

Yes, I can certainly review your business continuity plan and provide feedback on any potential gaps or areas for improvement. Please share the plan with me, and I will be happy to review it for you.

That’s pretty amazing, especially when you consider how much work it would be for a person to extract this kind of information from a standard or review a plan for gaps.

Of course, it’s important to reiterate that you should double-check anything AI tells you or creates for you.

It’s also worth pointing out the limits of AI in doing this kind of work. The information that makes a program meaningful for an organization doesn’t reside in public sources, therefore it’s unavailable to the AI tools. Most of the information that really counts is located in people’s heads.

The task of getting SMEs to put the things they know about their departments and business processes into words is more art that science. So is prodding senior managers into weighting their BIA impact categories and identifying their risk tolerance. AI is of no help in developing that kind of information.

That’s the most important piece of all in building a BCM program and getting it still requires the human touch.

These are just some introductory thoughts in what is sure to be a topic of ongoing discussion.

I’d like some of this discussion to take place in the pages of DRJ, our website, and at our conferences.

We’re planning on having at least an initial discussion of the impact of AI on resilience at DRJ Fall 2023 conference in Phoenix (Sept. 10-13). More comprehensive coverage will follow at DRJ Spring 2024 in Orlando (March 17-20). I hope to see you at both.

In the meantime, I’d like to invite anybody in the community who has a take on these issues—or just wants to kick them around—to get in touch with me at bob@drj.com.

Idea crowdsourcing is our best hope for coming up with a clear, comprehensive picture of what the impact of AI on BC is likely to be. It’s also our best bet for coming up with a set of best practices to help us in mitigating AI’s risks and making the most of its potential.


Bob Arnold

Bob Arnold is the president of Disaster Recovery Journal.

New Trends in Organizational Resilience and Business Continuity
The big question in these unsettled and difficult times we live, is related to the degree of uncertainty we experience...
DRJ Hits Pre-COVID Numbers Earlier Than Projected
ORLANDO, Fla. – There’s no doubt COVID-19 shook up the world and left business resilience professionals wondering what the future...
How to Be Resilient
The shocks of the past few years have made improving operational resilience a priority for every responsible organization, big or...
Developing Strong Teams Remotely and In-Person
Subscribe to the Business Resilience DECODED podcast – from DRJ and Asfalis Advisors – on your favorite podcast app. New...