AI Governance and Risk Management

Artificial Intelligence (AI) has become more integrated in the operations of modern organizations and provides substantial advantages in terms of automation, analytics, and decision-making. Still, AI poses a variety of risks, including ethical, legal, and privacy concerns, and requires organizations to implement governance and risk-management practices. This paper analyzed AI governance as an essential process for distributing accountabilities, establishing policies, maintaining human oversight, and ensuring proper use of AI systems. The article furthered describes how AI risk management supports governance objectives through risk identification and control measures at different stages of an AI model’s life cycle. Illustrative examples of software flaws resulting from inadequate risk management procedures included errors in automatic recruitment processes and issues with the Netherlands’ childcare benefits system. Analysis of the NIST AI RMF and ISO/IEC 42001 Demonstrate that Organizations can Effectively Structure their AI Governance Processes at a Practical Level. However, Frameworks are Only the Starting Point, as Their Success Depends on Implementation Consistency, Accountability, Inadequate Resources, Monitoring, and Adaptability. In addition, Organizations Should View AI Governance and Risk Management as Evolving, Not Static, Activities, Adaptable to the Nature of the Technology and Its Development Trajectory Within the Company Context.

[1]   S. Wachter, B. Mittelstadt, and L. Floridi, “Why a right to explanation of automated decision-making does not exist in the General Data Protection Regulation,” International Data Privacy Law, vol. 7, no. 2, pp. 76-99, 2017. [2]  I. D. Raji, A. Smart, R. N. White, M. Mitchell, T. Gebru, B. Hutchinson, S. Smith-Loud, D. Theron, and P. Barnes, “Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing,” Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency, pp. 33-44, 2020. [3] L. Floridi, J. Cowls, M. Beltrametti, R. Chatila, P. Chazerand, V. Dignum, C. Luetge, R. Madelin, U. Pagallo, F. Rossi, B. Schafer, P. Valcke, and E. Vayena, “AI4People—An ethical framework for a good AI society: Opportunities, risks, principles, and recommendations,” Minds and Machines, vol. 28, no. 4, pp. 689-707, 2018. [4]   Organisation for Economic Co-operation and Development (OECD), OECD AI Principles, 2024. [5]  J. Dastin, “Amazon scraps secret AI recruiting tool that showed bias against women,” Reuters, Oct. 10, 2018. [6]   Amnesty International, Xenophobic Machines: Discrimination Through Unregulated Use of Algorithms in the Dutch Childcare Benefits Scandal, 2021. [7] National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework (AI RMF 1.0), U.S. Department of Commerce, 2023. [8]  International Organization for Standardization (ISO), ISO/IEC 42001:2023 — Information technology — Artificial intelligence —  Management system, 2023. [9] National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, 2024. [10]  International Organization for Standardization (ISO), ISO/IEC 23894:2023 — Information technology — Artificial intelligence —  Guidance on risk management, 2023.