Are We Effectively Addressing AI Risks?

AI is helping people across the extended enterprise in many ways. It's bringing efficiency, improved insights and the ability to enhance products and customer services.

Every day I hear about new uses.

But I still worry that it can bring serious harm if we are not careful.

Practitioners need to know how it is being used and what controls are in place to ensure it only brings benefits and not serious harms.

AI Adoption Soars, and So Do the Issues

Look at this article in CFO magazine, "Employees take AI usage into their own hands." It tells us:

Companies may have strategies in place for acquiring and adopting AI tools, but so far, workers appear to have minds of their own when it comes to day-to-day usage.

Among 1,017 U.S. full-time desk workers with a bachelor’s degree or higher who have worked with AI in the past 12 months, 80% said they’ve had a net positive experience with AI at work.

Yet, barely more than a third (36%) of those surveyed by consulting firm EisnerAmper said their company has a formal AI policy in place. Worse, only 22% reported that their employer actively monitors their AI usage.

A far greater proportion of the surveyed workers (60%) said they use free AI platforms than those who use internally developed platforms (24%) or external tools paid for by the company (43%).

And in a telling indicator of how AI is becoming embedded in some workers’ daily lives, 25% use AI tools that they personally pay for. Further, 28% of the employees admitted that they would use AI at work even if it were banned.

Now see this, from the Law Offices of Anidjar & Levine: "Judgment Day: AI’s Rise in the Courtroom":

Nearly three-quarters of lawyers say they plan to use AI for document review, memo writing and legal research in the coming years. Most law firms are already using AI in some form, and its role continues to expand across legal practice areas.
The advantages of AI come with clear limitations. Accuracy, reliability and data privacy are the top concerns with legal AI, and the “hallucination risk” can have serious consequences when errors go undetected.
56.3% cite reliability issues, while 47.2% worry about data privacy.
AI hallucination rates range from 58% to 82% without domain-specific training.
Westlaw AI hallucinated in 34% of tests.
Lexis+ AI, even with hallucination-reducing RAG technology, still showed error rates above 17%.

The AI Governance

I see two discussion threads among risk and audit practitioners.

How can they make use of AI tools themselves?
Does their organization have the right AI governance framework in place?

Google’s AI defines AI governance as:

AI governance is a framework of policies, principles, and practices designed to ensure the ethical, responsible, and safe development and use of Artificial Intelligence systems. It encompasses managing risks such as bias, privacy breaches, and security threats, and includes fostering transparency, fairness, and accountability throughout the AI lifecycle. The goal of AI governance is to align AI initiatives with organizational objectives, legal regulations, and ethical standards, ultimately building trust and enabling beneficial AI innovation.

What AI Governance Entails

Policies and Standards: Establishing clear rules, guidelines and best practices for how AI systems are designed, built, and deployed.

Principles: Adhering to core values such as fairness, transparency, accountability and privacy in AI applications.

Processes: Implementing systematic approaches for risk management, bias mitigation, data governance and AI system monitoring.

Frameworks: Creating comprehensive oversight structures to guide AI development and ensure alignment with ethical and legal boundaries.

Why AI Governance Is Important

Risk Mitigation: Helps to prevent potential harm from AI systems, including biased outputs, security vulnerabilities and privacy violations.

Ensures Trust: Builds confidence among users, stakeholders and the public by ensuring AI systems are reliable and ethical.

Legal and Regulatory Compliance: Ensures that an organization's AI practices align with relevant laws and regulations, avoiding potential legal and financial penalties.

Facilitates Innovation: By providing clear guidelines and guardrails, governance enables responsible AI-driven innovation and helps organizations adopt AI safely.

Promotes Ethical Use: Fosters a culture of responsible AI development and deployment, ensuring that AI is used for beneficial purposes.

Key Components of an AI Governance Framework

Ethics: Ensuring AI development and use are human-centric and respect fundamental rights.

Accountability: Assigning clear responsibilities for AI decisions and ensuring human oversight.

Transparency: Making AI systems understandable, including the logic behind their decisions and the data used.

Fairness: Working to eliminate biases in AI systems and ensure equitable outcomes.

Security and Privacy: Protecting data and systems from unauthorized access and cybersecurity threats.

How Effective Is Your AI Governance?

The risk to the organization from AI hallucinations and other errors could well be significant.

As practitioners, are we spending sufficient time addressing the risks?

Maybe your organization has an AI governance framework and related policies. But how effective are they? Are they being followed? Do they have policies without measures (controls) to ensure they are followed?

How effective are controls over AI use?

Learning Opportunities

Conference