Fortune-100 companies now report 24% more causal links between the risks they face than they did in 2019 and AI adoption and supply chain dependencies are driving that increase, joint research by Swiss Re Institute and the London School of Economics (LSE) finds.
The study draws on 10-K filings from 91 Fortune-100 companies, using a large language model (LLM) to map the connections companies themselves identify between their reported risks. It measures changes in reported risk perceptions rather than changes in systemic risk itself, and results can be influenced by shifts in regulation and disclosure practices.
The headline figure is less about any single hazard than about the architecture of risk. When more risks share pathways, the severity of a crisis depends not on the size of the initial shock, but on how widely its effects travel. A contained disruption can become systemic if it hits a critical node at the right moment, and the research suggests those nodes are multiplying.
The share of companies reporting AI and new-technology risks has increased by around 30% between 2019 and 2026. That shift is no longer confined to the technology sector. Retail, airlines, pharmaceuticals, and food companies now report AI exposure, meaning institutions across different industries are increasingly relying on common technologies and similar underlying models.
When many companies run comparable systems, a shock that would otherwise affect one sector can trigger synchronised responses across several.
"We tend to prepare for the last crisis and try to predict the trigger for the next," said Jón Daníelsson, director of the Systemic Risk Centre and reader in finance at LSE. "But systemic crises are defined by what happens after the shock, and AI could fundamentally change that dynamic. If institutions increasingly use similar models and react at machine speed, a containable shock can become systemic before there is time to respond. The challenge is not to predict the next crisis, but to be prepared for shocks we cannot foresee."
Conventional accumulation monitoring tools are calibrated for slower-moving loss events, and the window between a contained shock and a systemic one is now compressing faster than those tools were designed to track.
The July 2024 CrowdStrike outage demonstrated what technology concentration looks like. A faulty software update affected 8.5 million Windows devices globally. Parametrix calculated total economic damages to Fortune 500 companies at approximately US$5.4 billion, against insured losses of between US$300 million and US$1 billion, based on Guy Carpenter's estimates. AI dependency concentrated in a smaller number of model providers and cloud platforms would create a comparable exposure profile at greater scale.
Supply chains function as transmission networks for risks that would otherwise remain separate. Geopolitical tensions, tariffs, climate events, pandemics, and cyberattacks can each activate a supply chain pathway, and those pathways have grown more numerous since 2019.
Climate risk mentions in corporate filings increased by around 31% over that period, reflecting growing recognition that physical hazards no longer stay bounded by geography when supply chains concentrate production in specific locations.
The exposure has a measurable physical dimension. More than a quarter of US data centres sit in areas subject to at least three large-hail days per year, and more than 40% are in zones of significant tornado risk. In Taiwan, 88% of semiconductor fabrication plants are in areas of extreme seismic risk.
When a local event disrupts infrastructure that cannot be quickly replaced, losses extend well beyond physical damage into contingent business interruption across multiple sectors. High-voltage transformers can carry lead times of multiple years, extending the loss period long after the triggering event passes.
Concentration risk runs beyond geography too. Three providers controlled 70% of global cloud infrastructure in 2024, and three companies process approximately 97% of global credit card transactions.
"A company may look diversified until you discover that its suppliers, technology providers and customers depend on the same infrastructure," said Ivan Gonzalez, chief executive officer of Corporate Solutions at Swiss Re. "One disruption can, therefore, affect more parts of a business than expected. Understanding those dependencies may help companies reduce concentrations, strengthen resilience and decide which risks they can absorb and which they need to transfer."
As accumulation modelling challenges mount across AI and digital infrastructure, identifying where client exposures converge across supply chains, technology platforms and physical infrastructure becomes a source of underwriting differentiation.
A third dimension of the study concerns governments' capacity to respond to systemic stress. Risk compensation is low by historical standards for some financial assets, and governments in many advanced economies carry high debt loads that constrain their ability to deploy the fiscal responses used in 2008 and 2020.
"Interconnected risks leave less room for error, while governments in many advanced economies have less room to respond," said Jérôme Haegeli, group chief economist and head of Swiss Re Institute. "High debt and constrained policy buffers mean resilience cannot start when a crisis hits - it has to be built beforehand, by reducing critical dependencies, strengthening buffers and preserving the capacity to transfer risk."
Jean-Pierre Zigrand, director of the Systemic Risk Centre and associate professor of finance at LSE, identified the structural tension. "Connections can make the system more resilient when they genuinely spread risk," he said. "But common dependencies can turn those same connections into channels that amplify shocks. The challenge is to preserve the benefits of being connected without concentrating risk in the same places."
When governments have less capacity to act as backstop, more of the expected loss from a systemic event falls on the private market. Risk transfer structures that determine how much of that loss is absorbed, and by whom, carry more weight as a result. The study's findings on interconnectivity reinforce the case for building resilience into physical and digital infrastructure before underwriting it at scale.
