AI Governance: Are We Having Fun Yet?

“AI Governance” has become a huge buzz word and a source of FUD (fear, uncertainty and doubt) in pretty much every industry.

What is it, what’s really needed, and what’s the right balance?

Here are some recent observations from dealing directly with clients (from global tech providers to start-ups) and from detailed scanning of the current global landscape:

1. People use the term “governance” regularly, yet different people have different definitions, so they are often talking at cross-purposes without realizing it.
2. Many companies are just getting started on establishing appropriate governance and documenting AI policies (especially with regard to tools and risk tolerance), and are slow to admit that the horse is already out of the barn – many groups are using unapproved tools on a daily basis, with little understanding what the tool’s license agreement allows the tool vendor to do with their data. This is a big problem in highly regulated industries.
3. In companies where an AI Governance Program has been implemented:
   1. There is often an issue with role clarity – who is actually responsible and accountable for key decisions. And for those responsible and accountable, do they truly have the skills and experience for the role, or were they the best choice at the time?
   2. There is rarely role accountability to keep up with the incredibly fast-moving AI landscape of opportunities, tools, vendors, risks, etc.
   3. Many companies have not fully thought through the risks from their partners and vendors, and the guardrails needed to manage the emerging risks from those relationships.
   4. Most of those subjected to an AI Governance program are frustrated by the lack of speed of decision making, the number of people who need to be consulted, and some (many?) try to “fly under the governance radar.”
4. All of the global consulting giants have “AI frameworks” (some good, some generic) to try to provide thought leadership (and to lead to the next multi-million-dollar consulting deal), yet many of those being assigned to help clients execute the frameworks, are junior and inexperienced (creating a different set of problems).
5. Get the right executive leaders (CTO, CISO, CSO, C- and SVPs-from Product Groups, Head of Audit and Compliance, etc.) in a meeting to honestly assess, explicitly agree on, and document, the following:
   1. What do we mean when we use the word “Governance” – how will it work in day-to-day decision-making around use of AI in the business?
   2. Do we understand the current level of risk? What tools are being used and where? Are there compliance considerations (existing and emerging)?
   3. What are the goals of the program (e.g. headcount reduction, competitive differentiation, speed, cost savings….)? Who will be responsible for measuring them?
   4. Do we currently have the right skills and roles to provide effective AI Governance? Are new skills/roles needed?
   5. Do we have an effective innovation function, or is it spread across or embedded in each team? How do we balance driving innovation within the context of AI governance?
   6. How do we communicate our program goals and operational cadence to our employees, customers, partners, and vendors?
6. If needed, revise the organizational design and detailed role descriptions to support leadership’s agreements. Be very clear on the small group of decision-makers, and their level of accountability.
7. Develop a clear and compelling communications plan to support the governance program. Adjust as needed as you get feedback and evaluate your level of success.
8. Leverage stellar program managers to support execution, metrics, reporting, feedback management, and continuous improvement.

How difficult it is to achieve effective AI governance is highly dependent on how large, regulated, complex, decentralized, political, and tech-savvy a company is. So, we are not saying that this is easy, but that it will have to be tackled eventually, and the longer executive leadership waits, the harder it will be to effectively implement.

If you have any interesting anecdotes of what you have seen work (or not), please note them in the comments – we would love to start a community dialog about this important topic.