How CIOs Can Manage Business Continuity with AI Ambitions

CIOs are being asked to accelerate AI adoption, manage cyber risk, and ensure their businesses remain resilient when facing disruption — a set of demands that leaves a whopping 91% of CIOs with moderate or high stress, according to a survey by cybersecurity platform SAFE. To maintain these responsibilities sustainably, modern enterprises must increasingly be built on a foundation of data that drives AI-powered business processes.

For CIOs, that means new risks must be faced. A comprehensive strategy can help manage that risk.

A New Way to Think of Resilience 

AI has heightened the criticality of business continuity and resilience.  

Traditionally, the focus was primarily on disaster recovery resulting from an outage or cyber event, and the primary objective was to quickly restore the environment. With a cyber-attack, you of course want to restore as quickly as possible but do so in a methodical way – containing the threat, assessing what was compromised and then identify a clean recovery point to bring the business back online.  

Considering those two scenarios and now injecting AI and automation workflows — which are becoming embedded in how business is conducted — CIOs need to think about the entire end-to-end processes, not just recovery and restoration of systems and data. This takes more than technology, but in-depth planning across teams, fully vetted business continuity plans and regular testing of those plans.

A good way to frame this is both resilience for AI, as well as resilience from AI.  Resilience for AI is data readiness: protecting the integrity of the pipelines and data lakes that feed models, and what those models produce. Resilience from AI is the new threat surface: attackers using frontier models to find vulnerabilities faster, and internal agents becoming the new insider threat, acting at machine speed. Most organizations have started on the first. Far fewer have a plan for the second. Highly regulated industries have a head start on this framework, with regulations like DORA in Europe and U.S. banking guidance asking whether an organization can keep critical operations running, not just restore systems. 

Risk and Dependencies on the Business 

AI introduces a new class of dependencies and subsequently risks that CIOs need to understand.  

Applications, infrastructure, and data should be a focus; however, focus should also be directed to a new layer of AI models, agents, and automations that sit on top of those things and potentially run critical business processes. CIOs need to consider what happens if a critical agent isn’t available – can employees run that process manually? As a result, owners of automated processes become as important, or in many cases even more important, than IT in a business continuity scenario. That’s why governance becomes so important across the organization.

Agentic AI adoption could deliver $3 trillion in corporate productivity gains globally over the next decade, according to the World Economic Forum, but governance at the organization level isn't keeping pace with employee demand. For a CIO, that changes the recovery question. An agent isn't just another application to bring back. It’s necessary to know what data it touched, what access it had, what it changed, and whether that can be rolled back.

In financial services, DORA already expects a map to those dependencies. In manufacturing and utilities, agents bridge IT and operations, so a bad action can have physical consequences.

Test for the Worst Case

Business recovery must be planned. Full stop. 

Recovery plans need to include representation from all parts of an organization – including leadership – and represent various scenarios. Traditionally, plans would prioritize systems as a path to recovery, but today they must also include AI, data, and infrastructure and determine what a minimally viable business operation entails – in other words, how to recover the business, not just the technology. This is known as the “minimally viable business.”

Raiffeisen Informatik, which runs IT for much of the Raiffeisen banking group in Austria, is a good example. Their traditional plan worked for everyday failures. But when they modeled an attacker taking out storage at data centers, recovery was estimated at 14 days. They redesigned around isolated, immutable copies and cut recovery to one or two hours. 

The lesson: you won't see the gap until you test for the worst case.

Invest in Faster Resilience, Not Just Innovation 

There’s a delicate balance between innovation and resilience. Hitachi Vantara, for example, has taken a stance not to limit experimentation and innovation. This is done in a very controlled fashion by conducting hackathons for teams to innovate and discover. In most cases, these hackathon ideas do become reality and are implemented under the Hitachi Vantara governance structure to ensure what’s out there is documented and considered business critical. The key is to have both innovation and resilience move at nearly the same pace.

In many organizations, there is investment in resilience, but not by design. Whereas innovation has a sponsor and a budget, resilience often gets funded after the fact. This creates a system where people build outside of governance and create shadow AI. That's why experimentation inside a governance structure works and provides visibility without slowing anyone down.

The University of Kent is a great example of an organization that built resilience into its modernization instead of bolting it on later. Restoring production from tape could have taken up to 12 weeks. Now, they have a tested recovery path they estimate is 80% faster. 

Foundational Capabilities for Business Continuity, AI Adoption    

The difference between organizations that talk about resilience and those that operationalize around it is whether resilience exists on a piece of paper, or whether it has been embedded across the business – and updated as AI changes the business.  

Organizations that operationalize resilience see it as a business capability, not just a traditional disaster recovery exercise. There are five main capabilities for resilience by design:

• Trusted data. AI and critical business operations are increasingly dependent on the same data, which needs to be available, recoverable and trustworthy.  
• Named dependencies. Dependencies must be known and document across business operations, meeting the requirements for a minimally viable business. 
• Governance investment. Ensure governance is moving at a similar speed as innovation and experimentation.  
• Recovery plan. Organizations must have a 360-degree recovery planning across all aspects of the business – technology, data and the automations the business is becoming increasingly dependent on.
• Integrated approach. One platform, one governance structure, and one policy architecture driving your recovery outcomes instead of protection managed tool by tool.

Actions Items to Build Confidence in Resilience

One thing organizations should all consider going forward in planning is not “can I recover my data and systems,” but “can I recover the way my business operates?” If there’s doubt, that needs to be investigated.

Pick a business service that really matters, ideally one with an agent or automation in it. Map what it depends on: data, applications, identity, third parties, the agent, and the person who owns it. Then run a recovery against a severe scenario in an isolated environment and measure the right thing. Don't ask “when did the systems come back?” Ask “when was the business operating again?” Find that number, close the biggest gap, then move to the next service.

The Foundation for AI Ambition

CIOs that pull ahead on AI won’t be the ones who deploy the most models or agents. They’ll be the ones who can say, without hesitation, that the business keeps running when something breaks. That confidence is quickly becoming a competitive advantage, shaping which projects get approved, which partners get trusted, and how quickly a company can take on its next ambitious initiative.

For CIOs, this reframes the professional role. Resilience is no longer a safety net held by IT in the background. It’s part of the business case: from persuading the board on AI investment, to the commitment every organization’s business owner is asked to share. 

Start now, while the stakes are still manageable, and build the habit before a crisis forces it.

One platform. Unified data. Provable resilience. Learn how Hitachi Vantara can help modernize your foundation and deliver predictable, SLA-backed outcomes across hybrid environments.