Nordic Institute for AI Risk and Resilience
About NIARR
Preserving human agency. Connecting knowledge. Strengthening societal resilience.
Why NIARR exists
Established in September 2026, the Nordic Institute for AI Risk and Resilience (NIARR) is an independent Nordic think tank, research and knowledge exchange platform dedicated to strengthening preparedness for the AI era.
NIARR was established to bring together people and institutions from different disciplines, sectors and ecosystems, and to encourage a more connected understanding of artificial intelligence and its implications for society.
Our purpose is to connect policymakers, public institutions, universities, research institutes, businesses of all sizes, investors, innovators, cybersecurity professionals and civil society.
Through research, dialogue, knowledge exchange and collaboration, NIARR seeks to advance responsible AI innovation, strengthen governance and risk preparedness, encourage coordinated responses to emerging challenges and contribute to national and societal resilience.
The Nordic region provides a natural starting point. Our highly digitalised societies, strong institutions and tradition of cooperation offer a solid foundation. At the same time, our interconnected economies, infrastructure and digital systems make cooperation and shared preparedness essential.
Our ambition extends across the Nordic region, Europe and beyond.
We believe artificial intelligence should expand human potential, create opportunities and contribute to prosperity while preserving human agency, fundamental rights and democratic values.
For NIARR, resilience is not only about protecting technology and infrastructure. It is about ensuring that people, organisations, institutions and societies have the knowledge and capabilities to understand technological change, make informed decisions, adapt and thrive.
The challenges ahead cross disciplines, sectors and national borders.
Our response must do the same.
Our vision
A society that harnesses the opportunities of artificial intelligence to advance human potential, knowledge, prosperity and societal well-being, while preserving human agency, fundamental rights and democratic values.
Through a deep understanding of AI’s capabilities, limitations, risks and wider impacts, and continuous, coordinated action across governments, industry, academia, civil society and communities, we envision a future where technological progress is shaped responsibly, emerging challenges are addressed collectively, and resilience is strengthened for the long-term benefit of humanity.
Our mission
NIARR brings together disciplines, institutions and communities to advance understanding of artificial intelligence and its implications for individuals, organisations and society.
Through interdisciplinary collaboration, knowledge sharing, foresight and collective action, we work to anticipate emerging risks, assess societal impacts, strengthen responsible governance and preparedness, and empower people and institutions to navigate technological change while preserving human agency, democratic values and societal resilience.
Our six core values
- 01
Independence & integrity
We serve the public interest.
We are an independent, non-profit and nonpartisan institute, guided by evidence, intellectual integrity and societal needs. We uphold transparency, objectivity and critical inquiry, free from undue political, commercial or institutional influence.
- 02
Human agency & societal well-being
Technology should empower humanity, not diminish it.
We believe artificial intelligence should strengthen human capabilities, preserve meaningful choice and control, respect fundamental rights and freedoms, and contribute to economic prosperity, social cohesion and human well-being. People and societies must retain the ability to shape their technological futures.
- 03
Foresight & preparedness
We anticipate change rather than merely react to it.
We look beyond immediate challenges to identify emerging risks, explore possible futures and strengthen society’s capacity to prepare, adapt and respond. We promote proactive thinking and practical action to build long-term societal resilience.
- 04
Interdisciplinary understanding
We connect knowledge to understand complexity.
Artificial intelligence cannot be understood through a single discipline or perspective. We bring together science, technology, law, economics, governance, the humanities, culture and society to develop a comprehensive understanding of AI, its opportunities, limitations, risks and impacts.
- 05
Constructive & responsible progress
We embrace innovation while addressing its consequences.
We recognise the transformative potential of artificial intelligence and approach technological progress with openness, curiosity and critical responsibility. We seek to enable its benefits while identifying, understanding and addressing risks, unintended consequences and societal challenges.
- 06
Openness & collective action
Knowledge becomes more powerful when it is shared.
We foster open dialogue, knowledge exchange and meaningful collaboration across disciplines, sectors, communities and borders. We believe that understanding and addressing the societal implications of artificial intelligence requires shared knowledge, diverse perspectives and collective responsibility.
Preserving human agency.Continuous risk response.Strengthening societal resilience.
AI risk & resilience timeline
1956
AI is born
The Dartmouth Summer Research Project established artificial intelligence as a scientific discipline. Seventy years later, AI systems can conduct research, write software and execute complex tasks with limited human intervention.
1973
Sweden pioneers data protection
Sweden introduced the world’s first comprehensive national data protection law, setting an international precedent for protecting personal information and fundamental rights in the digital age.
2024
EU AI Act
The European Union’s AI Act entered into force on 1 August 2024, introducing a comprehensive risk-based framework for artificial intelligence.
Its phased implementation established new obligations concerning high-risk systems, transparency, safety and fundamental rights.
2026
The next industrial revolution?
AI is moving beyond assisting humans to autonomously performing complex cognitive tasks, from software development and research to business operations and decision-making.
The implications could rival previous industrial revolutions, transforming employment, productivity, economic power and the organisation of society.
The defining question is no longer what AI can do, but whether our institutions, economies and societies are prepared for what comes next.
2026 so far
7 Apr 2026
Read our articleAnthropic’s Claude Mythos identified thousands of previously unknown software vulnerabilities, including weaknesses affecting major operating systems, browsers and critical software.
Its ability to discover and exploit vulnerabilities with limited human intervention exposed a critical challenge: AI-enabled threats can develop faster than fragmented governance, risk and compliance systems can respond.
7 Apr 2026
Source (opens in a new tab)Anthropic launched Project Glasswing with leading technology and cybersecurity organisations to strengthen software security using Claude Mythos.
No European-headquartered companies appeared among the original founding partners, raising urgent questions about European technological independence, access to frontier cybersecurity capabilities and strategic resilience.
Apr 2026
Source (opens in a new tab)The Swedish National Board of Trade (Kommerskollegium) highlighted gaps in European AI governance, particularly the challenges of addressing collective and systemic risks that extend beyond individual applications.
The findings raise questions about Europe’s ability to anticipate the wider consequences of advanced AI for institutions, markets and society.
Apr 2026
Source (opens in a new tab)AI Sweden warned of the need for urgent national preparedness as frontier AI systems become more capable.
The implications extend beyond technological competitiveness to national security, institutional readiness, economic resilience and society’s capacity to manage rapid technological change.
18 Jun 2026
Source (opens in a new tab)An autonomous OpenAI agent accessed non-public information in an Australian government Medicare statistics portal without authorisation.
Researchers described the incident as a possible world-first government website breach by an autonomous AI agent.
Other serious incidents reported during 2026 demonstrated the wider threat:
- United Kingdom: The AI Security Institute documented 19 unauthorised agent actions, including attempted supply-chain attacks and social engineering.
- Financial infrastructure: The deployment of autonomous agents inside US banks introduces risks involving privileged system access, sensitive financial information and interconnected banking services. This is an emerging security concern, not a confirmed banking breach.
These incidents and risks demonstrate a fundamental change in cybersecurity: autonomous systems can discover vulnerabilities, circumvent restrictions and act beyond their assigned tasks.
The challenge is no longer only protecting systems from human attackers. It is also ensuring that autonomous AI systems remain under effective human control.
Jul 2026
Read our articleApproximately 1,200 OpenAI agents established unauthorised communication channels, with around 700 participating in activity targeting Hugging Face.
Investigators reconstructed more than 70,000 messages and files.
Agents exchanged credentials, coordinated exploitation and compromised production infrastructure.
Following the incident, OpenAI notified more than 100 organisations about potentially concerning agent activity. These notifications did not represent 100 confirmed breaches.
The incident demonstrated how autonomous agents could coordinate complex cybersecurity operations beyond intended human oversight.
22 Sep 2026
Source (opens in a new tab)The European Union Agency for Cybersecurity (ENISA) documented 4,709 hacktivist claims targeting EU Member States during 2025, with more than 89% involving distributed denial-of-service attacks.
Its 2026 Threat Landscape also reported over 48,000 newly published vulnerabilities.
The findings expose the scale of Europe’s cybersecurity challenges and the vulnerability of interconnected digital infrastructure.
Oct 2026
Source (opens in a new tab)Hackers took control of refrigeration systems in French supermarkets, forcing a continuous defrost cycle and setting temperatures as high as 50°C. France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, and some stores had to discard food.
France’s cybersecurity agency said it was aware of numerous compromises of remote control modules for refrigeration systems. Danfoss, one of their makers, said most affected systems were older products that no longer received security updates.
There appeared to be no ransom demand or theft of information. The Paris prosecutor’s cybercrime unit opened an investigation; whether AI played a part was unclear.
21 Oct 2026
Source (opens in a new tab)Two critical PHP vulnerabilities, each rated 9.2/10, triggered an international cybersecurity response.
PHP underpins approximately 70% of websites with an identifiable server-side programming language, making vulnerabilities in the technology a potentially global threat.
Researchers recorded 482,342 suspicious requests targeting 21,998 websites across 103 countries within the first 24 hours.
The incident demonstrated how a small number of weaknesses in widely deployed software can expose governments, businesses and essential services to systemic risk.
23 Oct 2026
Source (opens in a new tab)Volvo Cars announced 2,500 additional job reductions, primarily affecting Sweden, following 3,000 earlier reductions.
The consequences of large-scale industrial restructuring extend beyond individual companies.
Job losses can weaken regional economies, reduce household spending and tax revenues, increase pressure on welfare systems and ultimately affect the resources available for healthcare, education and other public services.
Industrial resilience is inseparable from societal resilience.
29 Oct 2026
Source (opens in a new tab)The crypto exchange Binance said a security incident affected about $6.3 billion in client assets, the largest crypto hack on record. Bybit lost roughly $1.5 billion in 2025.
Around $3 billion was frozen on-chain, and stablecoin issuers including Circle and Tether froze affected funds. Binance first pointed to a compromised engineer’s laptop; its co-CEO later said the attack involved a more complex process.
Blockchain analysts pointed to North Korean hackers, though who was responsible wasn’t confirmed. The FBI said it was coordinating with partners.
2 Nov 2026
Source (opens in a new tab)Overnight, refrigeration and freezer systems were hit in several Ica stores and six Coop stores across Sweden, from Skåne and Öland to Värmland and Stockholm. On Öland, a freezer reached 55°C.
It came three weeks after hundreds of supermarkets were hit in France, and similar incidents were reported in Belgium and Estonia. Sweden’s National Cyber Security Centre is working on the incident.
When connected systems are left exposed, one weakness can disrupt food supply across several countries at once.
Today it is freezers and refrigerators. What comes next?
1956
AI is born
The Dartmouth Summer Research Project established artificial intelligence as a scientific discipline. Seventy years later, AI systems can conduct research, write software and execute complex tasks with limited human intervention.
1973
Sweden pioneers data protection
Sweden introduced the world’s first comprehensive national data protection law, setting an international precedent for protecting personal information and fundamental rights in the digital age.
2024
EU AI Act
The European Union’s AI Act entered into force on 1 August 2024, introducing a comprehensive risk-based framework for artificial intelligence.
Its phased implementation established new obligations concerning high-risk systems, transparency, safety and fundamental rights.
2026
The next industrial revolution?
AI is moving beyond assisting humans to autonomously performing complex cognitive tasks, from software development and research to business operations and decision-making.
The implications could rival previous industrial revolutions, transforming employment, productivity, economic power and the organisation of society.
The defining question is no longer what AI can do, but whether our institutions, economies and societies are prepared for what comes next.
2026 so far
7 Apr 2026
Read our articleAnthropic’s Claude Mythos identified thousands of previously unknown software vulnerabilities, including weaknesses affecting major operating systems, browsers and critical software.
Its ability to discover and exploit vulnerabilities with limited human intervention exposed a critical challenge: AI-enabled threats can develop faster than fragmented governance, risk and compliance systems can respond.
7 Apr 2026
Source (opens in a new tab)Anthropic launched Project Glasswing with leading technology and cybersecurity organisations to strengthen software security using Claude Mythos.
No European-headquartered companies appeared among the original founding partners, raising urgent questions about European technological independence, access to frontier cybersecurity capabilities and strategic resilience.
Apr 2026
Source (opens in a new tab)The Swedish National Board of Trade (Kommerskollegium) highlighted gaps in European AI governance, particularly the challenges of addressing collective and systemic risks that extend beyond individual applications.
The findings raise questions about Europe’s ability to anticipate the wider consequences of advanced AI for institutions, markets and society.
Apr 2026
Source (opens in a new tab)AI Sweden warned of the need for urgent national preparedness as frontier AI systems become more capable.
The implications extend beyond technological competitiveness to national security, institutional readiness, economic resilience and society’s capacity to manage rapid technological change.
18 Jun 2026
Source (opens in a new tab)An autonomous OpenAI agent accessed non-public information in an Australian government Medicare statistics portal without authorisation.
Researchers described the incident as a possible world-first government website breach by an autonomous AI agent.
Other serious incidents reported during 2026 demonstrated the wider threat:
- United Kingdom: The AI Security Institute documented 19 unauthorised agent actions, including attempted supply-chain attacks and social engineering.
- Financial infrastructure: The deployment of autonomous agents inside US banks introduces risks involving privileged system access, sensitive financial information and interconnected banking services. This is an emerging security concern, not a confirmed banking breach.
These incidents and risks demonstrate a fundamental change in cybersecurity: autonomous systems can discover vulnerabilities, circumvent restrictions and act beyond their assigned tasks.
The challenge is no longer only protecting systems from human attackers. It is also ensuring that autonomous AI systems remain under effective human control.
Jul 2026
Read our articleApproximately 1,200 OpenAI agents established unauthorised communication channels, with around 700 participating in activity targeting Hugging Face.
Investigators reconstructed more than 70,000 messages and files.
Agents exchanged credentials, coordinated exploitation and compromised production infrastructure.
Following the incident, OpenAI notified more than 100 organisations about potentially concerning agent activity. These notifications did not represent 100 confirmed breaches.
The incident demonstrated how autonomous agents could coordinate complex cybersecurity operations beyond intended human oversight.
22 Sep 2026
Source (opens in a new tab)The European Union Agency for Cybersecurity (ENISA) documented 4,709 hacktivist claims targeting EU Member States during 2025, with more than 89% involving distributed denial-of-service attacks.
Its 2026 Threat Landscape also reported over 48,000 newly published vulnerabilities.
The findings expose the scale of Europe’s cybersecurity challenges and the vulnerability of interconnected digital infrastructure.
Oct 2026
Source (opens in a new tab)Hackers took control of refrigeration systems in French supermarkets, forcing a continuous defrost cycle and setting temperatures as high as 50°C. France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, and some stores had to discard food.
France’s cybersecurity agency said it was aware of numerous compromises of remote control modules for refrigeration systems. Danfoss, one of their makers, said most affected systems were older products that no longer received security updates.
There appeared to be no ransom demand or theft of information. The Paris prosecutor’s cybercrime unit opened an investigation; whether AI played a part was unclear.
21 Oct 2026
Source (opens in a new tab)Two critical PHP vulnerabilities, each rated 9.2/10, triggered an international cybersecurity response.
PHP underpins approximately 70% of websites with an identifiable server-side programming language, making vulnerabilities in the technology a potentially global threat.
Researchers recorded 482,342 suspicious requests targeting 21,998 websites across 103 countries within the first 24 hours.
The incident demonstrated how a small number of weaknesses in widely deployed software can expose governments, businesses and essential services to systemic risk.
23 Oct 2026
Source (opens in a new tab)Volvo Cars announced 2,500 additional job reductions, primarily affecting Sweden, following 3,000 earlier reductions.
The consequences of large-scale industrial restructuring extend beyond individual companies.
Job losses can weaken regional economies, reduce household spending and tax revenues, increase pressure on welfare systems and ultimately affect the resources available for healthcare, education and other public services.
Industrial resilience is inseparable from societal resilience.
29 Oct 2026
Source (opens in a new tab)The crypto exchange Binance said a security incident affected about $6.3 billion in client assets, the largest crypto hack on record. Bybit lost roughly $1.5 billion in 2025.
Around $3 billion was frozen on-chain, and stablecoin issuers including Circle and Tether froze affected funds. Binance first pointed to a compromised engineer’s laptop; its co-CEO later said the attack involved a more complex process.
Blockchain analysts pointed to North Korean hackers, though who was responsible wasn’t confirmed. The FBI said it was coordinating with partners.
2 Nov 2026
Source (opens in a new tab)Overnight, refrigeration and freezer systems were hit in several Ica stores and six Coop stores across Sweden, from Skåne and Öland to Värmland and Stockholm. On Öland, a freezer reached 55°C.
It came three weeks after hundreds of supermarkets were hit in France, and similar incidents were reported in Belgium and Estonia. Sweden’s National Cyber Security Centre is working on the incident.
When connected systems are left exposed, one weakness can disrupt food supply across several countries at once.
Today it is freezers and refrigerators. What comes next?
1956
AI is born
The Dartmouth Summer Research Project established artificial intelligence as a scientific discipline. Seventy years later, AI systems can conduct research, write software and execute complex tasks with limited human intervention.
1973
Sweden pioneers data protection
Sweden introduced the world’s first comprehensive national data protection law, setting an international precedent for protecting personal information and fundamental rights in the digital age.
2024
EU AI Act
The European Union’s AI Act entered into force on 1 August 2024, introducing a comprehensive risk-based framework for artificial intelligence.
Its phased implementation established new obligations concerning high-risk systems, transparency, safety and fundamental rights.
2026
The next industrial revolution?
AI is moving beyond assisting humans to autonomously performing complex cognitive tasks, from software development and research to business operations and decision-making.
The implications could rival previous industrial revolutions, transforming employment, productivity, economic power and the organisation of society.
The defining question is no longer what AI can do, but whether our institutions, economies and societies are prepared for what comes next.
2026 so far
7 Apr 2026
Read our articleAnthropic’s Claude Mythos identified thousands of previously unknown software vulnerabilities, including weaknesses affecting major operating systems, browsers and critical software.
Its ability to discover and exploit vulnerabilities with limited human intervention exposed a critical challenge: AI-enabled threats can develop faster than fragmented governance, risk and compliance systems can respond.
7 Apr 2026
Source (opens in a new tab)Anthropic launched Project Glasswing with leading technology and cybersecurity organisations to strengthen software security using Claude Mythos.
No European-headquartered companies appeared among the original founding partners, raising urgent questions about European technological independence, access to frontier cybersecurity capabilities and strategic resilience.
Apr 2026
Source (opens in a new tab)The Swedish National Board of Trade (Kommerskollegium) highlighted gaps in European AI governance, particularly the challenges of addressing collective and systemic risks that extend beyond individual applications.
The findings raise questions about Europe’s ability to anticipate the wider consequences of advanced AI for institutions, markets and society.
Apr 2026
Source (opens in a new tab)AI Sweden warned of the need for urgent national preparedness as frontier AI systems become more capable.
The implications extend beyond technological competitiveness to national security, institutional readiness, economic resilience and society’s capacity to manage rapid technological change.
18 Jun 2026
Source (opens in a new tab)An autonomous OpenAI agent accessed non-public information in an Australian government Medicare statistics portal without authorisation.
Researchers described the incident as a possible world-first government website breach by an autonomous AI agent.
Other serious incidents reported during 2026 demonstrated the wider threat:
- United Kingdom: The AI Security Institute documented 19 unauthorised agent actions, including attempted supply-chain attacks and social engineering.
- Financial infrastructure: The deployment of autonomous agents inside US banks introduces risks involving privileged system access, sensitive financial information and interconnected banking services. This is an emerging security concern, not a confirmed banking breach.
These incidents and risks demonstrate a fundamental change in cybersecurity: autonomous systems can discover vulnerabilities, circumvent restrictions and act beyond their assigned tasks.
The challenge is no longer only protecting systems from human attackers. It is also ensuring that autonomous AI systems remain under effective human control.
Jul 2026
Read our articleApproximately 1,200 OpenAI agents established unauthorised communication channels, with around 700 participating in activity targeting Hugging Face.
Investigators reconstructed more than 70,000 messages and files.
Agents exchanged credentials, coordinated exploitation and compromised production infrastructure.
Following the incident, OpenAI notified more than 100 organisations about potentially concerning agent activity. These notifications did not represent 100 confirmed breaches.
The incident demonstrated how autonomous agents could coordinate complex cybersecurity operations beyond intended human oversight.
22 Sep 2026
Source (opens in a new tab)The European Union Agency for Cybersecurity (ENISA) documented 4,709 hacktivist claims targeting EU Member States during 2025, with more than 89% involving distributed denial-of-service attacks.
Its 2026 Threat Landscape also reported over 48,000 newly published vulnerabilities.
The findings expose the scale of Europe’s cybersecurity challenges and the vulnerability of interconnected digital infrastructure.
Oct 2026
Source (opens in a new tab)Hackers took control of refrigeration systems in French supermarkets, forcing a continuous defrost cycle and setting temperatures as high as 50°C. France’s finance minister told Parliament that about 700 of the country’s 10,000 supermarkets were affected, and some stores had to discard food.
France’s cybersecurity agency said it was aware of numerous compromises of remote control modules for refrigeration systems. Danfoss, one of their makers, said most affected systems were older products that no longer received security updates.
There appeared to be no ransom demand or theft of information. The Paris prosecutor’s cybercrime unit opened an investigation; whether AI played a part was unclear.
21 Oct 2026
Source (opens in a new tab)Two critical PHP vulnerabilities, each rated 9.2/10, triggered an international cybersecurity response.
PHP underpins approximately 70% of websites with an identifiable server-side programming language, making vulnerabilities in the technology a potentially global threat.
Researchers recorded 482,342 suspicious requests targeting 21,998 websites across 103 countries within the first 24 hours.
The incident demonstrated how a small number of weaknesses in widely deployed software can expose governments, businesses and essential services to systemic risk.
23 Oct 2026
Source (opens in a new tab)Volvo Cars announced 2,500 additional job reductions, primarily affecting Sweden, following 3,000 earlier reductions.
The consequences of large-scale industrial restructuring extend beyond individual companies.
Job losses can weaken regional economies, reduce household spending and tax revenues, increase pressure on welfare systems and ultimately affect the resources available for healthcare, education and other public services.
Industrial resilience is inseparable from societal resilience.
29 Oct 2026
Source (opens in a new tab)The crypto exchange Binance said a security incident affected about $6.3 billion in client assets, the largest crypto hack on record. Bybit lost roughly $1.5 billion in 2025.
Around $3 billion was frozen on-chain, and stablecoin issuers including Circle and Tether froze affected funds. Binance first pointed to a compromised engineer’s laptop; its co-CEO later said the attack involved a more complex process.
Blockchain analysts pointed to North Korean hackers, though who was responsible wasn’t confirmed. The FBI said it was coordinating with partners.
2 Nov 2026
Source (opens in a new tab)Overnight, refrigeration and freezer systems were hit in several Ica stores and six Coop stores across Sweden, from Skåne and Öland to Värmland and Stockholm. On Öland, a freezer reached 55°C.
It came three weeks after hundreds of supermarkets were hit in France, and similar incidents were reported in Belgium and Estonia. Sweden’s National Cyber Security Centre is working on the incident.
When connected systems are left exposed, one weakness can disrupt food supply across several countries at once.
Today it is freezers and refrigerators. What comes next?
People
The people behind NIARR.
NIARR brings together perspectives from science, technology, the humanities, culture, governance and society.
Founders
Hummam Wasfi
Founder & Board Member
- Artificial Intelligence Governance Professional
- Fellow of Information Privacy
- Certified Information Privacy Professional/Europe
- Certified Information Privacy Manager
- Certified Information Privacy Technologist
- Master of Business Administration
Founder & CEO of ART25 Defence · AI Governance, Data Protection and GRC Advisor and Technologist · International Speaker on AI Risk · ex-Workiva, ex-Vattenfall
Hummam is the Founder and CEO of ART25 Defence, where he is reimagining Governance, Risk and Compliance (GRC) technology for the AI era, embedding data protection, security and responsible AI by design and by default. He brings over a decade of experience across AI governance, cybersecurity, data protection, enterprise risk management, regulatory compliance and technology. His passion for digital risk began at Vattenfall, where he spent over seven and a half years working with GDPR, information security, Sweden’s Protective Security Act (Säkerhetsskyddslagen) and governance within critical infrastructure. As Compliance Officer for Corporate HR, he led international compliance and data protection initiatives, including building the HR organisation’s GDPR compliance framework from the ground up. An early and active adopter of AI, Hummam recognised the emerging governance and societal risks associated with increasingly capable AI systems. In 2024, he made the decision to leave the stability of his career at Vattenfall to dedicate himself fully to AI risk and governance, driven by a desire to extend his impact beyond a single organisation to society at large. Since then, he has combined technology development and advisory work with writing, public speaking and engagement across the AI ecosystem, including discussions with public authorities, educational institutions and industry leaders. He also established the AI Governance Leadership Council, bringing together experts and representatives from major organisations for monthly discussions on AI risks emerging at machine speed and the need to rethink traditional GRC strategies and technologies. These conversations helped shape the Nordic Institute for AI Risk and Resilience (NIARR), transforming a collaborative forum into a broader initiative focused on AI risk strategy, awareness, preparedness and societal resilience.
Alysha Adams
Co-founding Board Member
AI & Transformation Strategist, Global People Leader & Non-Executive Director
Alysha is an expert in organisational effectiveness, the future of work and AI. She has led AI adoption programmes inside two technology companies, challenging the approach both times. She saw that most companies’ approach to AI adoption left them exposed to new, unseen risks. Having spent years working with frontier companies and AI academics, she believes AI strategy should be intentional rather than a chase for the latest tools. In her view, the real work is redesigning how organisations work, from the operating model to the skills needed for augmented intelligence. That’s why she founded OSSA, a consultancy that builds the new structures and capabilities needed to realise real value from AI and insure against long-term risks. She’s spent over a decade leading people & transformation across billion-dollar public tech and fintech companies and international NGOs. She’s also a Strategic Adviser to founders and boards on how intelligent technology changes the business, not just the tech stack, and leads AI across her varied board roles. Her focus now is designing fast, effective organisations built for the competition ahead. At the heart of her work is one belief: AI should be a multiplier of human value, not a replacement for it.
Alexander Alaraj
Co-founding Board Member
- Artificial Intelligence Governance Professional
- Fellow of Information Privacy
- Certified Information Privacy Professional/Europe
- Certified Information Privacy Manager
- Certified Information Privacy Technologist
Alexander Alaraj is a privacy and data protection professional with over a decade of experience in operational, strategic and advisory roles within complex, global organisations. Active in the field since 2014, he brings broad expertise across the privacy profession, from designing and implementing compliance frameworks and processes to addressing strategic, operational and emerging privacy matters across business functions.
Board
Priscilla Carlsson
Deputy Board Member
Member of Technical Staff, Product & Creative, ART25 Defence
With a background in ESG compliance, and a strong interest in AI governance, risk management and how regulation shapes responsible technology.
Further members of the institute will be introduced here.
From the events
Hummam Wasfi, Nordic Privacy Arena 2025 Alysha Adams, Data & AI Summit Stockholm 2026 Priscilla Carlsson
Our founding story
The Nordic Institute for AI Risk and Resilience (NIARR) emerged from the professional experience and observations of its founder, Hummam Wasfi (LinkedIn, opens in a new tab).
The problem is not simply a lack of expertise or ambition. It is that the people, disciplines and institutions needed to understand and respond to AI’s wider implications are not sufficiently connected.
NIARR is institutionally independent of ART25 Defence and of any other commercial undertaking.
Start a conversation.
We welcome conversations with researchers, institutions and practitioners who share these questions.