Do you need a separate AI Governance Framework
Do we really need a separate AI Governance Framework, or can existing frameworks handle AI?
I was recently asked this question by an Exec, so thought I would do a post on it.
My starting point would be:
If you have mature corporate governance, risk management, data governance, technology/cyber security/SDLC processes and third-party risk framework, a significant proportion of the underlying governance capability may already exist.
However, my 20 years of risk experience tells me Executives’ belief in the maturity of their processes and actual maturity can sometimes differ.
So first, I would have your Audit/Risk teams do a thorough review of existing frameworks and maturity. AI will expose the gaps if you have any.
I’d then break it down like this:
Corporate Governance
Existing board and governance may be capable of overseeing AI, but I would still implement a clear AI governance structure, including appropriate oversight, delegation of authority and reporting.
Risk Management
AI risks generally sit within the existing risks, but there will be new risks or different characteristics, if you are covering Risk Appetites and KRIs correctly then your current framework will suffice.
However, many organisations are good at managing risks but poor when it comes to Risk Appetite and meaningful KRIs.
Data Governance
Existing data governance should provide much of the foundation, but AI requires particular attention to data quality, provenance, representativeness, bias, privacy, lineage and appropriate use.
Technology
Existing governance provides a useful foundation, but AI requires additional controls around model selection, training, validation, testing, explainability, human oversight, monitoring, model drift and retirement.
Ethics
This area deserves specific attention, you may already have conduct, ethics, fairness, human rights or responsible-business frameworks, but these need to be deliberately applied to AI.
Operational Resilience
Much of the framework may remain relevant, but you need to consider AI-specific failure modes, dependencies, concentration risks, fallback arrangements and what happens when an AI system produces an unexpected or unsafe output.
Third-Party
This is really important, it’s no longer enough to ask whether a supplier provides an AI product, you need to understand:
• What AI systems does it use?
• What data is provided to those systems?
• What data do we supply to it?
• Which models or third parties sit behind it?
• What happens if those capabilities fail or change?
For a mature organisation, the better approach is extend, adapt and connect existing governance capabilities.
The right answer will depend on the organisation
The objective isn’t to create more governance. It’s to create governance necessary to use AI responsibly, proportionately and with clear accountability.
