Business leaders are facing a crucial challenge in managing the risks associated with artificial intelligence (AI) due to a lack of visibility regarding its usage within their organizations. While efforts are being made to identify potential AI use cases and projects, as well as gather information from technology and business teams about existing AI applications, a significant gap remains.
Organizations worldwide are scrambling to respond to the opportunities, challenges, and risks presented by AI since the launch of OpenAI’s language model, ChatGPT, in November 2022. The rapid pace of AI development has caught many leaders by surprise, resulting in varying levels of AI governance maturity across the business community.
While organizations recognize the potential of AI to revolutionize their operations, they are also cautious when it comes to integrating AI offerings from vendors. Legal teams and risk management functions are carefully scrutinizing existing and new AI projects. However, despite this increased scrutiny, there is still a substantial gap in the organizational firewall, allowing AI risks to go unnoticed and unreviewed.
Enterprise IT systems, including productivity suites, web browsers, and ERP/CRM systems, form the backbone of business operations. These systems are usually procured based on standard terms with minimal scrutiny. Additionally, limited engagement with risk management functions during renewal further contributes to the lack of review.
Unfortunately, AI functionality is being introduced into various tools by software vendors without undergoing legal and risk reviews. This means that business leaders remain unaware of the risks being introduced into their organizations, and AI tools may not align with their risk approaches and policies. In effect, existing implementations and contractual relationships act as Trojan horses, introducing risk without detection.
To mitigate this issue, organizations should consider the potential for AI to be introduced through existing vendor relationships without triggering a review. The integration of AI into enterprise IT products may result in additional contractual terms that should not be accepted without adequate oversight during the renewal process. Similarly, existing legal and commercial arrangements addressing risk factors should be reviewed to ensure they account for the changing risk profile brought about by AI.
It is crucial to establish processes that trigger reviews when new functionalities are introduced into existing tools and determine who should be responsible for initiating these reviews. Reviewing vendor roadmaps and collaborating with technology sourcing teams to identify renewal dates can help organizations plan for risk assessments. Effective communication between technology and business teams responsible for the tools and those managing risk is essential.
In conclusion, business leaders must address the challenge of managing AI risks by improving visibility and implementing robust review processes. Organizations should proactively assess AI functionality integrated into their IT systems, ensuring it aligns with their risk approaches and policies. By adopting a cautious and proactive approach, organizations can mitigate potential risks and fully leverage the transformative power of AI in a controlled manner.
