Earlier this week, the USA released an official policy on using Artificial Intelligence. All federal departments and agencies will need to adhere to the guidelines on using AI as announced by the White House Office of Management and Budget. (OMB)
The OMB policy aims to achieve below five objectives:
1) Address Risks from the Use of AI
2) Expand Transparency of AI Use
3) Advance Responsible AI Innovation
4) Grow the AI Workforce
5) Strengthen AI Governance
On the surface, one may think this applies only to US government agencies, so how does this impact me? How would it affect the Governance, Risk, and Compliance practices?
The ripples of this OMB policy would be felt beyond US borders. Through my post, I will cover the possible developments related to the points in this policy that will shape the template of global controls and frameworks for firms.
Beyond US Borders: A Catalyst for Global AI GRC.
This move towards centralized oversight will have a cascading effect that will prompt international organizations and countries to a) have their own AI GRC policies in place, if not currently, and b) fine-tune their policies to align with emerging guidelines in the form of EU AI Act, and now OMB policy.
GRC experts must monitor these frameworks closely to identify the standard requirements and exceptions. Once we are past this storming phase, the next phase of fostering collaboration and knowledge sharing across borders will play an important role, which is imperative in building trust and ensuring responsible AI use through global alignment on AI governance.
CIO to CAIO: The balancing act between a technocrat and a strategist
The OMB policy calls for appointing a Chief AI Officer (CAIO) to coordinate the use of AI across all government agencies. Many larger firms must have started rethinking their organizational structure regarding an internal AI governing body. In some firms, the CIO role would be the best fit to incorporate CAIO roles and responsibilities. Some firms may want to appoint a chief AI Officer for an independent role.
GRC professionals also have an opportunity to fill the CAIO role by upskilling themselves to learn AI technology and the scale and scope of AI adoption within their organization to prepare for the upcoming wave of regulatory compliance. You do not have to understand the code or the application of AI solutions in detail; however, you should be able to read into the risks associated with AI, including bias, security vulnerabilities, and potential misuse. This necessitates strong leadership skills and a strategic mindset.
Preparing for the AI Governance Wave: A Call to Action
The OMB Policy has listed a few pointers on what GRC professionals can expect to fall in their kitty to work upon:
1) Annual inventories of AI use cases
2) Metrics reporting on AI use cases
3) Stakeholder declaration (Government, Shareholders, Vendors, Public)
Government-vetted AI solutions will gain wider acceptance, adding a new level of certification or whatever form this takes. Discussions between firms and vendors will accelerate, and companies will need to review what approach they need to take when declaring their in-house AI solutions to external stakeholders.
The emphasis would be on transparency and the ethical application of AI through annual inventories of AI use cases at enterprise, department, and project levels. Your metrics reporting would be linked to the supply chain associated with the firm, and it cannot operate in a silo and hence an apparent cascading effect.
Conclusion
The announcement of a chief AI Officer role would add a new dimension to the GRC landscape. Not all companies need to follow suit in appointing such a role; however, they must be proactive in establishing internal AI governance committees, conducting regular AI risk assessments, and developing clear policies for ethical AI use. Firms should anticipate the growing demand for expertise in building secure, responsible AI solutions. Integrating GRC considerations into the design and development process will be crucial to meeting compliance.
