Resilience starts where the risk register ends

Magda Davila, CEO Middle East & APAC, Clarity AI

The world is constantly recalibrating.

Geopolitical tension, climate disruption, energy insecurity, and supply chain fragmentation are no longer isolated risks. They interact, amplify one another, and move across systems faster than many organizations are prepared for.

The challenge this creates is not new, but it has changed shape. For years, resilience meant mapping direct suppliers, reviewing annual disclosures, and diversifying portfolios across sectors and geographies. That approach assumed the risks that mattered would show up where organizations were already looking. Increasingly, they do not. The dependencies that matter have moved one or two layers below the risk register, and organizations need the capability to see that far down.

The limits of first-layer thinking

A supplier may appear local while relying on materials, logistics corridors, or energy infrastructure exposed elsewhere. A diversified portfolio may still rest on the same water basin, semiconductor cluster or shipping corridor. Investors see this when a drought forces the Panama Canal Authority to slash daily ship transits from 36 to 22, or when the expansion of advanced chip manufacturing drives TSMC’s (Taiwan’s chipmaking titan) annual water consumption over 100 billion liters, straining local supplies.

The energy transition compounds this picture: a solar farm displaces fossil fuel imports, but its panels, inverters, and storage cells may trace back to a small number of mineral basins and manufacturing hubs. The IEA notes that the top three refining nations now control 86% of processing for critical minerals like lithium and cobalt. Shifting away from one dependency may simply shift the geography of risk rather than reducing it.

The constraint here is no longer information. If anything, it is the opposite: enormous amounts of fragmented information flowing in from supply chains, climate models, satellite imagery, financial disclosures, operational systems, and geopolitical signals. The harder problem is tracing that information down through the layers where vulnerability concentrates and doing so before disruption rather than after.

What boards need to change

The real shift needs to happen here. Resilience has largely been treated as a compliance exercise: disclosures, a risk register, an annual review. That framing was adequate when the risks that mattered sat close to the surface. It is not adequate now. Boards must treat systemic intelligence, the ability to see two or three layers into their dependencies, as a strategic capability on par with financial or operational risk management, not a periodic reporting obligation.

In practice, that means three things. First, extending risk mapping beyond named suppliers and portfolio holdings to the materials, corridors, and infrastructure they depend on. Second, integrating climate, geopolitical, and resource signals into a single view rather than tracking them in separate reports that never get read together. Third, building the internal muscle, whether through in-house teams or external partners, to update that view continuously because dependencies shift faster than reporting cycles.

This is where advances in data infrastructure and AI become genuinely consequential: not as a replacement for human judgment, but as a way to surface risk exposures that traditional frameworks were never designed to detect.

A growing ecosystem of solutions is tackling this challenge from different angles, from supply chain mapping and geospatial intelligence to climate risk analytics. Our own work at Clarity AI focuses on turning fragmented data into a clear line of sight, tracing a holding or supplier back to the physical, environmental, and geopolitical dependencies behind it, so hidden exposures surface before they become business disruptions.

For boards, adopting AI is only part of the equation. The systems they use must also be transparent, auditable, and continuously updated, so decision-makers can verify evidence and challenge assumptions as conditions change. Strategic accountability must remain with people, not algorithms.

A resilience mindset

Risk intelligence is now as strategic a capability as risk management. The institutions best placed to navigate this environment will not simply have more data or better tools; they will approach resilience systemically, understanding how operational, geopolitical, climate, and resource dependencies interact over time.

In many ways, that mindset is already deeply familiar in the Gulf.

Water scarcity, extreme heat, and energy dependence forced governments and institutions in the region to think in systems long before the advent of “systems resilience” as management vocabulary.

In the UAE, water and energy are not separate questions. Around 40% of the country’s water supply comes from desalination, which is one of the grid’s largest sources of electricity demand. A disruption to energy infrastructure could disrupt drinking water. That dependency became embedded in infrastructure planning, sovereign investment strategy, and more recently, the renewable energy transition.

The result is a different instinct around resilience, asking what sits beneath it and constantly preparing for what may change. That instinct is becoming increasingly important well beyond the region. As geopolitical, environmental, and operational pressures become more intertwined, companies and investors are discovering that vulnerabilities do not necessarily sit where their risk frameworks expect them to.

In a constantly recalibrating world, resilience will increasingly depend on seeing beyond the first layer: identifying vulnerabilities early, understanding hidden dependencies, and adapting before disruption cascades through the system.