OpenAI CEO Sam Altman has said society should expect “some bad things” to happen as AI adoption expands, arguing that the overall benefits of the technology will outweigh harms such as scams, hacks and other misuse. The comments, reported by The Verge, come at a time when AI regulation, model safety and the security of AI agents are under closer scrutiny.

What happened

According to The Verge, Altman said the world should accept a degree of harm from AI because people will also use the technology for much larger amounts of beneficial work. The report links those remarks to OpenAI’s broader support for a lighter regulatory approach to AI, even as concerns continue around the safety and real-world behaviour of advanced models and AI agents.

The comments do not create any new legal requirement by themselves, and they should be understood as a position in an ongoing policy and industry debate. Still, they are notable because they come from the head of one of the most influential AI companies and touch directly on questions European businesses are already facing: how much operational, legal and security risk is acceptable when adopting AI at speed?

Why it matters for European businesses

For European companies, the practical issue is not whether AI can deliver productivity gains. Many businesses are already testing AI for customer support, content production, internal search, software development, analytics and workflow automation. The more immediate question is whether AI systems are being introduced with appropriate controls.

Altman’s remarks are relevant because they underline a tension that many businesses now face: vendors and executives may emphasise speed, competitiveness and innovation, while IT, legal, compliance and security teams must manage the downside risks. Those risks can include data leakage, prompt injection, fraudulent content generation, automated phishing, insecure integrations and overreliance on AI outputs in sensitive processes.

In Europe, this discussion also intersects with regulation. Depending on how AI is used, businesses may need to consider GDPR, sector-specific rules, contractual obligations and, for some organisations, cybersecurity obligations under frameworks such as NIS2. Companies should also monitor how the EU AI Act applies as implementation progresses, especially where AI systems affect employees, customers, decision-making or regulated operations.

Who may be affected

• SMEs adopting AI tools quickly: Smaller companies may benefit from low-cost AI services, but often have fewer internal controls, making them more exposed to data, privacy and security mistakes.
• Marketing and e-commerce teams: AI-generated content, campaign automation and customer-facing bots can improve efficiency, but can also introduce brand, compliance and fraud risks.
• IT and security teams: Teams integrating copilots, AI agents or third-party APIs may need to review access permissions, data flows, logging and model-related attack surfaces.
• Founders and business owners: Leaders setting AI strategy may need to balance speed of adoption with governance, vendor due diligence and accountability.
• Regulated businesses: Organisations in sectors with stricter oversight should be especially careful about using AI in workflows involving personal data, customer communications or operational decision-making.

What companies should consider

• Treat AI as a governance issue, not only a productivity tool: Assign responsibility for approval, oversight and risk review before deploying AI in core processes.
• Review vendor claims carefully: A provider’s public position on safety or regulation is not a substitute for technical controls, contractual protections and independent internal assessment.
• Limit access and data exposure: Avoid giving AI tools unnecessary access to sensitive systems, confidential documents or customer data.
• Set clear usage policies: Employees should know which AI tools are approved, what data can be entered, and when human review is required.
• Prioritise high-risk use cases for extra scrutiny: Customer-facing bots, automated decision support, code generation and systems with external actions should be tested more carefully than low-risk internal drafting tools.
• Prepare for misuse scenarios: Businesses should update phishing awareness, fraud detection and incident response plans as AI lowers the cost of scams and persuasive impersonation.
• Monitor the regulatory landscape: European businesses should distinguish between political or industry arguments for lighter regulation and the rules that actually apply to their operations.

The broader message for European businesses is straightforward: AI may offer significant upside, but the market is still debating what level of harm is acceptable and who carries responsibility when systems are misused or fail. Companies that adopt AI with stronger governance, security controls and legal review are likely to be in a better position than those relying mainly on vendor optimism.