The Board Member's Guide to Overseeing AI

The first step for any journey is to know your starting position. Boards of directors, and Chairs in particular, have a responsibility to assess their level of comfort and understanding of the topics affected by AI and work quickly to close any gaps. Given the rapid rise and evolution of AI technology, it is safe to assume there are significant gaps on this topic inside nearly every corporate boardroom.

To develop a baseline level of understanding of both AI technology and the key areas it affects for their organization, we recommend the following starting steps for every board:

As the board develops a common language and understanding of AI, it becomes possible to delve deeper into more complex issues, which include three primary areas: (1) Strategic Urgency, (2) Responsible AI, and (3) Risks and Regulations. We break down each of these areas in detail along with several key questions board members will want to ask.

1. Strategic Urgency: The Risk of Inaction

As board members, many have seen waves of technology come and go, promoted one day as “the next big thing” and obsolete soon thereafter. Given the bold claims for AI, some might argue we should wait and see. Others will say we’re already too late given that AI is already disrupting and transforming entire industries. While we don’t have the absolute answer, it is the responsibility of boards to make a conscious decision, recognizing that doing nothing is also a choice – and a risky one.

Mitigating the risk of inaction requires board members to be proactive in understanding the potential benefits and challenges of AI adoption. They need to foster a culture of innovation and continuous learning within the organization, encouraging exploration and experimentation with AI applications.

As the pace of innovation increases, AI has the power to turbocharge everything. New players are entering the scene, and even old ones are using AI to get ahead. Being too risk-averse and simply sticking to the old ways of doing things may be a death sentence for a company. As it becomes increasingly integrated into business processes and decision-making, companies that refrain from leveraging its power may struggle to keep up with the pace of change and find themselves lagging behind more agile and tech-savvy competitors.

Implementing AI technologies thoughtfully and ethically can lead to significant gains in productivity, efficiency, and innovation. Ultimately, recognizing the urgency and embracing the potential of AI is no longer an option; it is a necessity for the long-term success and survival of businesses today.

This area addresses AI issues surrounding fairness, accountability, transparency, ethical considerations, and the well-being of both individuals and society. The goal is to mitigate the potential negative impacts and risks of AI technologies while maximizing their positive contributions. There are several key components of Responsible AI:

1. Accuracy:​ One of the biggest concerns of AI is accuracy, as predictive models are never able to perform at 100% accuracy. Generative AI models can easily spread misinformation or draw inaccurate conclusions. To ensure AI-generated content is accurate, having the right safeguards is key. Companies also need a plan to handle different scenarios – what happens if customers are presented with false data or if internal decisions are based on inaccurate AI answers?
2. Bias: Since AI models are trained on historic observations, biases can creep into AI models, which can create disadvantages for some populations or result in outright discrimination. Boards will want to ensure that their organization’s use of AI is ethical and has a system to account for biases. (There is research underway into systems that can correct for some biases using synthesized data on protected attributes such as gender, race, and ethnicity.)
3. Security: AI relies heavily on data, and companies need to collect, store, and process large amounts of data to train and operate AI systems. This increases the risk of data breaches and unauthorized access, potentially exposing sensitive information. In addition, AI systems need to be able to withstand attacks, where bad actors may attempt to input data that would trick the AI model into making incorrect predictions or classifications, which could lead to misinformed decisions or actions.
4. Transparency: Transparency in AI is crucial to building trust, ensuring ethical use, and facilitating accountability. AI users and stakeholders should have a clear understanding of how their particular model arrives at its decisions, stores data, and how to evaluate its performance.
5. Environmental and Societal responsibility: As people and functions are disrupted by AI, what are the values that will guide your business as you adopt AI? Should you buy carbon offsets to address the impact that training and running AI models have on the environment? What obligations will your company undertake to retrain or upskill employees or provide a level of job protection?

One of the critical areas of AI that demands attention from the board is concern for liability. As generative AI models become more advanced and capable of producing innovative works, questions arise about intellectual property infringement and ownership of the work. Companies must address whether they have the right to claim ownership over outputs generated by their AI models and whether they can patent these new works. Additionally, understanding the complexities of data rights and ensuring compliance with data protection regulations is essential.

As new policies and regulations emerge from various authorities, including the European Union (EU) and U.S. Securities and Exchange Commission (SEC), companies must closely monitor these developments. Ignorance or negligence in keeping up with the ever-changing legal landscape could lead to inadvertent violations, which might result in severe financial penalties and damage to a company's reputation. In addition, compliance with existing regulations, such as the General Data Protection regulation (GDPR) or the California Consumer Protection Act (CCPA) in the United States, is essential to safeguarding user data and maintaining trust with customers.

To date, the most significant piece of legislation addressing the use and scope of AI is the European Union’s AI Act, which goes into effect on August 1, 2024. The US does not currently have any similar comprehensive federal legislation or regulations for the development of AI or that specifically prohibit or restrict their use, although elements of the EU AI Act will apply to US companies providing AI-based solutions. ​ Additionally, several frameworks and guidelines exist to guide the regulation and use of AI such as the White House landmark executive order on AI and the proposed Blueprint for an AI Bill of Rights, and regional legislation including the Colorado AI Act are also important to consider. With AI regulation still emerging, it is still up to companies to decide their own appropriate level of governance for now. Developing a framework for AI operations will provide clarity and transparency throughout the organization and position your company to comply when even more regulations come. Clear testing procedures to evaluate and validate your AI systems are also needed to ensure functionality, reliability, accuracy, security and performance meet the desired standards.

Navigating the uncharted waters of AI regulation requires companies to adopt a proactive and adaptable approach, collaborating with legal experts and stakeholders to develop comprehensive and compliant AI strategies that align with the evolving regulatory framework. By staying ahead of the regulatory storm, organizations can not only mitigate potential risks but also position themselves as leaders in the responsible development and deployment of AI technologies.