Is Your Crisis Plan Built for a World That No Longer Exists?

KEY TAKEAWAYS

The normalisation trap is the risk that organisations become so accustomed to operating in volatile conditions that they mistake continued survival for genuine preparedness.

Control Risks names it directly in RiskMap 2026. It is not complacency in the loose, everyday sense. It is a structural dynamic: institutions calibrate their risk tolerance to the volatility they have already survived, then stop recalibrating. The environment keeps shifting. The calibration does not.

Organisations that navigated COVID, supply chain fracture, and geopolitical realignment often drew the wrong lesson from the experience. The lesson they took: we handled it. The lesson they should have taken: the conditions that produced that volatility are still intensifying — and the next wave will not look like the last one.

For crisis communicators specifically, the trap closes quietly. There is no alarm. The gap between the actual risk environment and your organisation's communication capability widens without fanfare, until the moment it becomes suddenly and painfully visible.

Three major assessments published in early 2026 converge on a single underlying finding: governance is fracturing faster than organisations are adapting their communication capabilities.

The Global Catastrophic Risks 2026 report (Global Challenges Foundation, 2026), the Annual Threat Assessment 2026 (Office of the Director of National Intelligence, March 2026), and RiskMap 2026 (Control Risks, 2026) each approach the risk landscape from different angles. They arrive at the same place.

The numbers tell the story. Seven of the nine planetary boundaries — the scientifically defined thresholds within which human activity can safely operate across climate, biodiversity, freshwater, and other Earth systems — have now been breached (Global Challenges Foundation, 2026; PBScience, 2025). The ODNI recorded 61 active state-based conflicts in 2024, the highest number since World War II (ODNI, 2026). And Control Risks argues that the rules-based international order is not merely eroding — it is being deliberately replaced, with sovereignty now asserted through national security tools rather than multilateral frameworks (Control Risks, 2026).

Three different organisations. Three different methodologies. One common signal: the operating environment is significantly more unstable than most crisis plans reflect.

A cascading crisis is one where a single triggering event sets off secondary and tertiary failures across connected systems — and where the communication burden multiplies faster than response capacity can scale.

Most crisis communication plans are built around a separable-event logic. One thing goes wrong, you respond to that thing, you recover. Clean. Sequential. That logic is structurally inadequate for the current environment.

The GCF report describes environmental tipping points as cascading — one triggering another across climate, ocean, and biosphere systems (GCF, 2026). The same dynamic applies at the organisational level. A supply chain disruption coinciding with a cyber incident coinciding with an executive reputational crisis creates a communication challenge that no sequential plan was designed to handle. The compound interaction is where plans fail. Not the individual events — the collision between them.

The right planning question is no longer "what is the one thing most likely to go wrong?" It is "what happens when three things go wrong at once — and they interact?"

Messaging built on appeals to shared norms is losing reliability as a toolkit — because the norms themselves are actively contested.

Control Risks makes a stark argument in RiskMap 2026: the rules-based international order is being deliberately replaced, not simply challenged. Countries are imposing sovereignty through national security tools. Multilateral processes are giving way to bilateral and coalitional arrangements. Interests, not shared values, are the new architecture of international relations.

The consequences for communicators are immediate and operational. Appeals to international standards, institutional legitimacy, or established regulatory frameworks carry diminishing credibility when those frameworks are being renegotiated in real time. A message that lands well in one regulatory context may trigger hostility in another — increasingly because the contexts are diverging, not converging.

Control Risks pushes this further. As geopolitical alignment becomes consequential, your organisation's supply chains, operational territories, and partner networks carry associations that shape how your communications land across different audiences (Control Risks, 2026). Managing reputational risk and managing geopolitical positioning are no longer separable activities. Treating them separately now carries a higher cost than it ever has.

AI-enabled disinformation is not a future risk for crisis communicators. It is the current operating condition.

The 2025 India-Pakistan conflict featured organised AI-generated content campaigns operating at speed and scale (ODNI, 2026). The 2026 US/Israel/Iran conflict went further. Iranian actors used AI tools — including Google's Veo 3 — to fabricate videos depicting missile strikes on Tel Aviv, downed US aircraft, and destroyed Israeli cities. Amplified across pro-Iran networks on X, these reached over 100 million views before effective intervention (BBC Verify, 2026; CEDMO Hub, 2026). AI-altered satellite images falsely depicting damage to US bases in Qatar were published by Iran's Tehran Times and circulated widely before fact-checkers could intervene.

That is the external threat. Most crisis plans at least acknowledge it exists.

The internal dimension receives far less attention. As AI tools are integrated into crisis communication workflows — drafting statements, monitoring sentiment, flagging emerging narratives — the question of accountability for AI-assisted decisions becomes genuinely complex. When an AI-informed decision proves wrong, existing governance frameworks rarely define who is responsible or how that error is attributed. Most organisations have not answered that question yet. They need to — before the next crisis, not during it.

All three 2026 assessments point to the same strategic response: build capability before the crisis that will reveal whether you have it.

Run a compound crisis exercise. If your most recent tabletop used a single-event scenario, you tested the wrong environment. The minimum useful exercise in 2026 combines a cyber incident, a reputational crisis, and a geopolitical disruption running simultaneously. The compound interaction — not the individual events — is where plans break down.

Map your activated society exposure. Control Risks identifies activated societies as targeting specific companies, leaders, and institutions — energised by perceived complicity as much as direct harm (Control Risks, 2026). This is not a social media audit. It is a threat intelligence exercise against your organisation's perceived stakeholder positioning. Who believes your organisation is complicit in something? Where are those audiences organising? What would trigger mobilisation?

Build pre-authorised frameworks for governance-gap scenarios. When regulatory and normative frameworks are unclear or contested — AI governance, supply chain integrity, geopolitical positioning — communication hesitation is as costly as the wrong message. Organisations with pre-developed position frameworks communicate faster and more coherently under pressure than those drafting positions in real time.

As Philippe Borremans, crisis, risk, and emergency communication specialist and founder of RiskComms, puts it: "The normalisation trap closes when organisations mistake their ability to cope with the past for preparedness for the future. The audit question is simple: are your current capabilities matched to the actual operating environment — or the one your last crisis plan was written for?"

What is the normalisation trap in crisis communication? The normalisation trap, named by Control Risks in RiskMap 2026, is the structural dynamic where organisations calibrate their risk tolerance to volatility they have already survived — then mistake that calibration for genuine preparedness. It is dangerous precisely because it feels like stability.

Why is single-event crisis planning no longer adequate? With 61 active state-based conflicts in 2024 — the highest since World War II — and with cyber, reputational, and geopolitical pressures routinely intersecting, a single isolated crisis is increasingly the exception. Plans need stress-testing against compound scenarios where two or more events hit simultaneously.

What is a compound crisis tabletop exercise? A compound crisis tabletop runs two or more simultaneous crisis scenarios — for example, a cyber incident alongside a reputational crisis and a geopolitical disruption. It tests how your communication function performs when response resources are divided and narratives are competing for attention at the same time.

What does "activated society" mean in a crisis communication context? Control Risks uses the term to describe publics — consumers, employees, civil society groups — sufficiently energised around a cause or grievance to target specific organisations directly. Activation is triggered by perceived complicity, not just direct harm.

How is AI disinformation affecting crisis response in 2026? AI-generated content — including deepfake videos, altered satellite imagery, and algorithmically amplified narrative campaigns — is now a documented feature of conflict environments, as recorded in the ODNI's 2026 Annual Threat Assessment. It operates at a speed and scale that outpaces traditional fact-checking.

What is a governance-gap communication scenario? A governance-gap scenario is one where the relevant regulatory or normative framework is unclear, contested, or in active transition — AI regulation, trade policy, data sovereignty. Without pre-built position frameworks, organisations in these scenarios frequently hesitate, and hesitation itself becomes a reputational liability.

What should a pre-authorised crisis communication framework include? At minimum: defined topics requiring pre-approved positions, the process for activating those positions under pressure, clearly accountable decision-makers, and protocols governing AI-assisted response tools — including who can authorise their use and how errors in AI-assisted decisions are handled.

What are planetary boundaries and why should crisis communicators care? The Planetary Boundaries framework defines nine Earth system thresholds — including climate, biodiversity, and freshwater — within which human activity can operate safely. Seven of the nine have now been breached (GCF, 2026; PBScience, 2025). For crisis communicators, the relevance is compounding: environmental instability drives political conflict, displacement, infrastructure failure, and resource scarcity — all of which generate downstream communication crises.

How should organisations govern AI use in crisis communication decisions? Organisations should define, before a crisis occurs, which AI tools are authorised for use in response workflows, under what conditions, and who carries accountability when AI-assisted decisions prove incorrect. Leaving these questions unanswered until a live crisis is itself a governance failure.

How do I know if my crisis plan is built for the wrong environment? Ask when it was last stress-tested against a compound scenario. Ask whether it addresses AI-assisted response and AI-enabled disinformation. Ask whether it includes pre-authorised positions for governance-gap topics. If the honest answer to any of those is no, the plan needs updating — as of 2026, not eventually.

Sources:

Philippe Borremans is a crisis, risk, and emergency communication specialist with 25 years of international experience. He is the founder of RiskComms and author of the Wag the Dog Newsletter, covering crisis communication strategy, AI's role in emergency response, and information warfare. Updated April 2026.