Monday morning at the executive board meeting. The technical department presents an AI assistant designed to search through technical documentation, assist with troubleshooting, and help employees with routine tasks. The pilot is working, the first users are thrilled, and the expected productivity gains look promising. Then the discussion about risks begins. Data protection? Still under review. Hallucinations? Can’t be ruled out. Copyright? Please provide an expert opinion. Information security? Further analysis needed. AI Act? Better check with Legal again. After six months, the pilot project has turned into an 84-page governance document. The system itself is still not live. At the next strategy meeting, the sales team reports that two competitors are now offering exactly this feature to their customers.
Welcome to the “zero-risk” illusion.
Of course, there are areas where “zero errors” is a completely legitimate goal. No one wants a two-percent error rate for pacemakers, aircraft control systems, or the dosing of highly potent medications. In safety-critical processes, error prevention is fundamental. It only becomes problematic when this gives rise to a general corporate worldview: according to this view, a good company is one that takes as few risks as possible.
That sounds reasonable. Unfortunately, it’s not particularly entrepreneurial.
Because risk has two sides. We know one very well: downside risk. An investment can fail. A development project can end up costing more. A technology might not work. A product hits the market too late. Liability risks, liquidity needs, or write-downs may arise. All of this, of course, needs to be addressed.
But that same uncertainty also has another side: upside risk. A new product may be more successful than expected. A technology may open up a new market. Research may create a competitive edge over rivals. An investment may lead to higher margins or generate strategic options that aren’t even fully visible today.
Therefore, anyone who wants to completely eliminate uncertainty often eliminates not only the negative side of the outcome distribution. At the same time, they cut off the positive side of opportunity.
It’s a bit like a ski instructor announcing, “We’ve completely eliminated the risk of injury.” The method is as simple as it is effective: no one is allowed to ski anymore. In a business context, this means: no technological risk, no development risk, no market risk—and eventually, perhaps, no market at all.
AI: The Risk of Waiting
Hardly any current topic illustrates this dilemma more clearly than artificial intelligence. Of course, AI carries significant risks: erroneous results, data breaches, cyber risks, loss of know-how, liability issues, or unexpected dependencies on technology providers. It would be negligent to ignore these risks.
However, it could be just as negligent to wait to deploy AI until all uncertainties have disappeared.
Interestingly, the EU AI Act itself demonstrates that such an undifferentiated approach is not intended. Its fundamental principle is risk-based. The vast majority of AI systems considered to pose minimal or no risk are not subject to any additional obligations specific to the AI Act. In contrast, significantly stricter requirements apply to defined high-risk applications.
This is actually an invitation to intelligent risk management. An internal AI assistant for researching technical documents has a different risk profile than a system that makes personnel decisions or controls safety-critical machinery. Anyone who nevertheless treats every application as if it were autonomously operating a nuclear power plant may minimize a compliance risk—but at the same time maximizes the strategic risk of inaction.
After all, even inaction has a probability distribution.
Perhaps nothing will happen at first. Perhaps the competition will simply become a bit more productive. Perhaps other companies will gain experience, data, and expertise more quickly. Perhaps new business models will emerge. And at some point, at the right end of this distribution, it won’t say “AI project failed,” but rather: “Missed the technology window.” “Lost market share.” “Fallen behind.”
Not investing is simply not a risk-free decision. It is an investment decision with a different risk profile.
SpaceX provides a vivid counterexample. Starship was not developed by eliminating all technical uncertainties before the first launch. The program relies on flight and ground tests, using the lessons learned from their failures to improve the next generation. SpaceX itself describes how insights from failed tests are immediately incorporated into design changes, testing procedures, and future vehicles. By May 2026, twelve Starship flight tests had been conducted. Of course, this does not mean that failure is automatically a good strategy. It means that uncertainty is consciously accepted, limited, and translated into learning.
A similar approach can be seen at research-intensive companies. ZEISS, for example, spent approximately 1.73 billion euros on research and development in fiscal year 2024/25—about 15 percent of its revenue. The long-term nature of such investments is particularly evident in EUV lithography: Since the mid-1990s, ZEISS and ASML have invested billions over decades in a technology whose technical feasibility and economic success were by no means guaranteed at the outset. In the process, ZEISS developed the crucial high-precision optics for EUV and, later, high-NA EUV lithography. Today, this technology forms a central foundation for the manufacture of state-of-the-art semiconductors. The development of ZEISS’s Semiconductor Manufacturing Technology division also demonstrates just how much taking on long-term technological uncertainty can pay off: In 2024/25, it generated revenue of 5.055 billion euros, representing 23 percent growth. With investments of this kind, no one can guarantee in advance which research projects will be successful. If we were to allow only those developments whose technical and economic success is already certain, there would be no need for research. We could simply wait for the results.
The art, therefore, does not lie in eliminating as many risks as possible. The real management question is:
What risks are we willing to bear because the potential opportunity justifies the limited downside?
This is something entirely different from a call to act as risk-taken as possible. Upside risk does not automatically make a bad project good. A potential billion-dollar market does not justify an investment that, if it fails, would jeopardize the company’s very existence. Opportunities must always align with the company’s financial and operational risk-bearing capacity. The key is the balance: What can we lose? What can we gain? How do we limit the downside? What options arise in the event of success?
And there’s something else that makes this interesting: The same event can have completely different implications for two companies.
Artificial intelligence can pose an existential threat to an established business model and, at the same time, represent the greatest growth opportunity in a new provider’s history. A new technology is therefore neither a risk nor an opportunity in and of itself. Only when combined with strategy, capabilities, capital, speed, and adaptability does it give rise to a unique opportunity-risk profile.
The task of risk management is therefore challenging: It should make it possible to say “yes” intelligently.
Yes—if the potential loss is manageable.
Yes—if protective measures limit the downside.
Yes—if the potential opportunity is strategically relevant.
And sometimes also: No—if a single failure takes the company out of the game.
Perhaps that is why we need to correct one of the most popular misconceptions in risk management. The safest company is not necessarily the one that takes the fewest risks. It could also be the company that, at some point, no longer dares to take risks, no longer develops anything, and no longer changes anything.
The rocket is still standing securely on the launch pad.
Perfectly tested. Perfectly secured. Perfectly chained down.
Only the competition has long since entered orbit.
