Welcome to RIMScast. Your host is Justin Smulison, Business Content Manager at RIMS, the Risk and Insurance Management Society.

In this first episode of 2026, Justin interviews Morgan O'Rourke and Hilary Tuttle of RIMS Risk Management Magazine. They discuss major cyber events of 2025, court rulings on AI fair use, and what risk professionals should take away about AI training data and intellectual property. They discuss regulations about forever chemicals or PFAS and what to look for in 2026 and beyond as these regulations change. They discuss the U.S. government shutdown of October and its residual effects.

Listen for a call for content submissions for RIMS Risk Management Magazine.

Key Takeaways:

[:01] About RIMS and RIMScast.

[:17] About this episode of RIMScast. This is our first episode of 2026. We're going to look forward and back, and who better to do that with than Morgan O'Rourke and Hilary Tuttle of RIMS Risk Management Magazine?

[:44] We will discuss some of the top risk management stories of 2025 and what they might mean for 2026. There's so much to discuss, from forever chemicals to AI! But first…

[:55] RIMS-CRMP and Some Prep Courses. The next virtual prep course will be held on January 14th and 15th, 2026. These are virtual courses. Links to these courses can be found through the Certification page of RIMS.org and through this episode's show notes.

[1:12] RIMS Virtual Workshops are coming up. This is the last call for "Intro to ERM for Senior Leaders". It will be held on January 8th, led by Joe Mayo.

[1:24] On January 21st and 22nd, Chris Hansen returns to deliver the course, "Managing Worker Compensation, Employer's Liability and Employment Practices in the US".

[1:35] On February 4th and 5th, Ken Baker will return to deliver the course, "Applying and Integrating ERM".

[1:45] The full schedule of virtual workshops can be found on the RIMS.org/education and RIMS.org/education/online-learning pages. A link is also in this episode's notes.

[1:57] RIMS members always enjoy deep discounts on the virtual workshops.

[2:06] The RIMS-CRO Certificate Program in Advanced Enterprise Risk Management is hosted by the famous James Lam. This is a live virtual program that helps elevate your expertise and career in ERM.

[2:19] You can enroll now for the next cohort, which will be held over 12 weeks from April 14th through June 23rd. Links to registration and enrollment are in this episode's show notes.

[2:34] On with the show! The annual Year in Risk Review edition of RIMS Risk Management Magazine is now available. Visit RMMagazine.com for more information.

[2:47] We're going to pick up where we left off with Morgan O'Rouke and Hilary Tuttle of RIMS Risk Management Magazine and the RIMS Publication Department.

[2:54] Feel free to check out Episode 371 to get caught up as we discuss natural catastrophes and their impact on the landscape.

[3:04] In this episode, we're going to talk about AI, PFAS forever chemicals, and how you can contribute to RIMS Risk Management Magazine in 2026.

[3:14] Risk Management Magazine is an Azbee award winner, so you are hearing insights from the best in the business of risk management reporting. Let's get to it…

[3:24] Interview! Morgan O'Rourke and Hilary Tuttle, welcome back to RIMScast!

[4:01] The Year in Risk 2025 Edition of RIMS Risk Management Magazine has been on digital shelves for a few weeks now. We're going to look a little bit forward and backward.

[4:34] Data Privacy Day comes up on January 20th every year. All eyes turn to cyber. At RIMS, all eyes turn to Hilary because she is the cyber guru. Hilary thinks every day of the year is Data Privacy Day.

[5:15] Hilary says, in the Year in Risk edition, they talked about 2025's Amazon Web Services outage, which took about 70,000 companies offline. It's a solid example of third-party risk and vendor security risks.

[5:31] The economic impact of the outage was estimated to be in the billions of dollars, in terms of lost business and business interruption. Hilary said the AWS outage lasted about 16 hours.

[5:53] It's a good reminder of vendor concentration risk in cloud services. The cloud services market has three major vendors; Amazon has about 30% of the market. If Amazon goes down, that's a significant number of clients who are at risk.

[6:10] Hilary says insurers are not at real risk for this outage. A lot of cyber coverage has provisions for outages with waiting periods of eight to 12 hours. Your insurer might come in for the end of that situation, but most of it is on the insured.

[6:38] For insurers and reinsurers, it was a pretty mild event. It's not going to cause huge changes in capacity or rates. It is a reminder that a lot of the risk is going to be on you, depending on the factors that are involved and the vendors that you pick.

[6:58] There was also the Marks & Spencer ransomware incident that impacted their stores and online services. They sell about four million Great British pounds a day of products online. Their website was down for three months because of the ransomware event and recovery process.

[7:29] Marks & Spencer had to go to pen and paper for in-store sales, and they operate hundreds of stores. It also caused inventory problems. It was a huge increase in waste because they didn't have ways of tracking or selling all of their inventory of food and other goods.

[7:45] The cost to Marks & Spencer was estimated to be about three hundred million Great British pounds.

[7:53] 2025 was a big year for cyber. Some other British retailers had some issues that have had retailers around the world taking note.

[8:04] Morgan was interested in the Jaguar Land Rover case. Since Morgan was a child, he wanted a Jaguar for the hood ornament. If they're taken offline, how is Morgan ever going to get himself a Jaguar?

[8:35] Hilary says, You and a lot of other customers, because they had to take all of their very automated production offline for a while. Parts and Sales were interrupted. They saw quarterly revenues drop around 24%, year-over-year, a difference of several hundred million pounds.

[8:58] Morgan says it becomes a little bit the same. It doesn't mean that it's not important. It's one of those things we encounter with perpetual risks, whether it's disasters or cyber.

[9:12] When they're always happening, they tend to get overlooked until some marquee event like an Amazon Web Services outage takes down a lot of people, or a company is taken offline for months and has to go back to pen and paper. That's not easy at large volumes.

[9:38] The underlying current of the risks you have to deal with still needs to be a part of your day-to-day mitigation exercises.

[9:59] Hilary says The more things change, the more things stay the same.

[10:18] Morgan says There is a broader perspective to everything. A risk is not just going to affect you; it's going to affect people down the line who are connected to your business. A cybersecurity event that happens over here is bound to have an impact on you, in some way.

[10:35] Hilary says concentration risk is an increasing issue, and dependency is an issue. We have allowed some of the market players to become so large that the impact, if anything happens to them, is astounding.

[10:50] There are advantages in having a large company as your vendor, but there's also a certain amount of instability in the lack of control you have in what's going on upstream. There's a lot that can happen downstream, to you.

[11:26] Hilarity may attend a Black Hat conference this year. From that, she may see what is coming several years down the pike.

[12:00] Justin says that AI is omnipresent. Regarding AI, in 2025, courts ruled on Fair Use. Multiple lawsuits were filed, and major settlements were reached. One lawsuit about scrubbing user data came from violating the Terms of Use, rather than copyright infringement.

[12:44] Morgan says companies that use AI or are creating an AI should be looking at the emerging liabilities and governance challenges of AI.

[12:55] There were a lot of cases. Two cases discussed in the Year in Risk 2025 were about Anthropic and Meta being sued by groups of authors. The courts ruled in both cases that if the AI made substantial changes to the material, they could use it under Fair Use.

[13:32] The cases weren't definitive that you have an open free-for-all. Anthropic was guilty of using pirated materials from the authors to train its AI. Anthopic settled by paying $1.5 billion to the authors. The ruling was that you can use material that you get legally, by paying for i...

Risk Outlook '26 with Morgan O'Rourke and Hilary Tuttle