David Niccolini, the Founder of StatCrux, is a security and risk mitigation expert with almost 30 years of experience across six continents.
getty
Throughout this series, we have tracked a quiet, but growing, phenomenon. Private firms do much of the security work the public thinks of as governmental. In this paradigm, productivity can outpace justice, and some security teams, left unchecked, have turned protective tools into instruments of harm. Finally, we explored how AI is acting as an accelerator, scaling our failure of process and pulling human accountability increasingly out of the loop.
As the state no longer holds a monopoly on the tools—nor the data—used to keep us safe, an opaque gap between the private and public sectors has opened where unfortunate, and even tragic, events can transpire. In the growing confusion, as more events occur, legislation and regulation may arrive late and be emotionally drafted. This could smother true innovative collaborations that we need to make us safer.
Based on my 25 years of experience in enterprise security risk management (ESRM) across six continents, I believe a better path is market-led standards combined with a public-sector advisory role. As the Bard wrote, “What’s past is prologue,” and history provides a perfect example of how disruptive, and even scary, technology can be safely incorporated into everyday life.
The Underwriters Laboratories Precedent
At the 1893 Chicago World’s Fair, electricity was on display at a scale the country had never seen before. The electrical installations were awe-inspiring. They were also a major fire risk. A young engineer named William Henry Merrill was hired to certify that the new technology was safe. Based on that successful experience, and with modest means, Merrill started Underwriters’ Electrical Bureau, the laboratory that would ultimately become Underwriters Laboratories (UL).
Over 130 years later, UL is still a market standard in electrical safety. Part of UL’s success was driven by its adoption by the insurance industry, which quickly saw the benefit. Underwriters soon began to refuse fire coverage for uncertified equipment.
I consider AI the new electricity of security. Unvetted technology is already producing a modern version of the fires from uncertified equipment in the late 1800s. Consider the recent Hugging Face incident.
If self-regulation and standards could lead us out of the electricity risk, could something similar arise for AI?
The Developing AI Standards
The good news is that the work has already begun, and one of the early participants is none other than UL. Over the last 130 years, Underwriters Laboratories has expanded far beyond its early electrical and fire safety tests to match technological shifts: UL certification for vacuum cleaners (1909), airplanes (1921), microwave ovens (1977), personal computers (1978), etc.
In 2026, UL issued the first certifications under UL 3115, its outline of investigation for the safety of AI-based products. UL 3115 confirms “trustworthy performance in mission-critical environments” and signals “industry demand for independently validated AI systems capable of safely managing complex energy, power, cooling and operations at scale.”
UL is not the only organization attempting to regulate AI technology. Under the U.S. Department of Commerce, the National Institute of Standards and Technology (NIST) has developed the face technology evaluations (FRTE/FATE) project, as well as the AI Risk Management Framework (AI RMF). And there are more organizations, in and out of government, working on these issues.
Wonderful news, right? Yes, it is good news. Nevertheless, in the application of AI in security, there is a very big gap.
Minding The Gap
AI technology certification is a great start. Still, to create the world in which we all want to live, I believe we need to ask the question, “Is there a human in the loop?” Already in this series, we have seen how AI technology, without appropriate governance, can lead to disastrous outcomes. As one example, a CBS News investigation verified more than a dozen cases of wrongful and dangerous police interdiction linked to automated license plate reader (ALPR) errors.
In my experience, this type of gap is created by a lack of human processes, training and standards for how the technology is used. Algorithmic hits are too often treated as conclusive rather than as possible leads to investigate. So how can we create governance where humans and AI interface in real time?
How Private Leaders Can Help Bridge The Gap
I believe that the creation of public-private partnerships (PPP) is needed to address these growing problems. Buy-in, funding and implementation may indeed be difficult. Nonetheless, we as business leaders can begin the work to get ahead of these issues. Here are some principles you can use to start a dialogue about building a PPP in your sector:
• Subsidiarity: Subsidiarity holds that functions performed effectively by local organizations belong more properly to them than to a central organization. This concept is found in the principles of U.S. federalism and in the Treaty on European Union, and in this context, it would mean requiring that AI “decision-makers” be local and accountable.
• Human-In-The-Loop: The Hugging Face Incident showed that when we remove the human, no one is accountable. (As of this article’s publication, authorities are still investigating the hack). To avoid even more serious incidents in the future, humans should be responsible for and in control of AI.
• Stakeholder-Driven: Leaders from law enforcement, government, industry and technology, as well as a public advocate, should have a seat at the table in any PPP.
• Transparency: Technology and data are neither good nor bad. It is the implementation—the use or the misuse—that can lead down the wrong path. AI transparency and data provenance are important for creating accountability around implementation.
• Security Vs. Liberty: 100% security is not possible, but with each percentage increase in security, liberties can become threatened. There should be open dialogue among stakeholders about finding a balance.
• Best Practices: Above, we explored new standards from UL and NIST. Other potential frameworks include ANSI/ASIS PSC.1-2022, the Montreux Document and the International Code of Conduct Association. Each local PPP should implement the standards right for their community.
Conclusion
For business owners and executives—especially the buyers, builders and insurers of private security—these issues are here. Be aware and be ready. Advocate internally and externally for a better world.
Forbes Business Council is the foremost growth and networking organization for business owners and leaders. Do I qualify?
