Raphael John-Lall

Boards of di­rec­tors must move be­yond sim­ply ap­prov­ing Ar­ti­fi­cial In­tel­li­gence (AI) poli­cies to en­sure they un­der­stand how the tech­nol­o­gy is al­ready be­ing used across their or­gan­i­sa­tions, says Es­ther Cal­len­der, Pres­i­dent of the ISACA Trinidad and To­ba­go Chap­ter.

ISACA (pre­vi­ous­ly the In­for­ma­tion Sys­tems Au­dit and Con­trol As­so­ci­a­tion) is a world­wide as­so­ci­a­tion of in­for­ma­tion­al sys­tems gov­er­nance pro­fes­sion­als.

Speak­ing at the s (CC­GI) two-day vir­tu­al con­fer­ence last Tues­day, Cal­len­der said the rapid adop­tion of AI had out­paced the abil­i­ty of many busi­ness­es to es­tab­lish ap­pro­pri­ate gov­er­nance struc­tures.

“When I con­sid­er the ques­tion, is your board ready to gov­ern AI? The ques­tion that ac­tu­al­ly came to me was, does the board ac­tu­al­ly know how AI is be­ing used across its or­gan­i­sa­tions or com­pa­nies to­day?”

She said the chal­lenge was no longer sim­ply whether boards should ap­prove AI adop­tion, but how they could ef­fec­tive­ly mon­i­tor and gov­ern tech­nol­o­gy al­ready be­ing used by em­ploy­ees and em­bed­ded in ex­ist­ing busi­ness sys­tems.

“How do you gov­ern some­thing that you are not in full con­trol of? So that’s the ques­tion, I think, be­cause it’s the pace at which it has been adopt­ed and the pace at which it is chang­ing is def­i­nite­ly a chal­lenge.”

The CC­GI, with the spon­sor­ship of First Cit­i­zens host­ed its 7th An­nu­al Glob­al Con­fer­ence on Cor­po­rate Gov­er­nance, bring­ing to­geth­er in­ter­na­tion­al and re­gion­al thought lead­ers, di­rec­tors and se­nior ex­ec­u­tives to ex­am­ine the grow­ing im­por­tance of AI in cor­po­rate gov­er­nance.

The two-day vir­tu­al con­fer­ence held last Tues­day and Wednes­day, themed “Gov­ern­ing AI: Lead­er­ship, Risk and Boards in an In­tel­li­gent World,” ex­plored the op­por­tu­ni­ties, risks and gov­er­nance chal­lenges as­so­ci­at­ed with the rapid adop­tion of AI, with par­tic­u­lar em­pha­sis on the re­spon­si­bil­i­ties of boards to pro­vide ef­fec­tive over­sight, strate­gic di­rec­tion and ac­count­abil­i­ty.

Train­ing and ac­count­abil­i­ty crit­i­cal

Cal­len­der said board mem­bers did not need to be­come tech­ni­cal ex­perts but had a re­spon­si­bil­i­ty to un­der­stand the dif­fer­ent types of AI, how the tech­nol­o­gy was be­ing de­ployed and its im­pli­ca­tions for busi­ness de­ci­sions, ac­count­abil­i­ty and risk.

She said train­ing should ex­tend be­yond board mem­bers to em­ploy­ees, warn­ing that work­ers could in­ad­ver­tent­ly ex­pose com­pa­ny in­for­ma­tion through AI pro­duc­tiv­i­ty tools.

“Users may think that they may not even think that they’re do­ing any­thing ma­li­cious. It’s not ma­li­cious, but they are in­ad­ver­tent­ly shar­ing and send­ing your com­pa­ny’s da­ta by us­ing these pro­duc­tiv­i­ty tools.”

Cal­len­der ad­vised or­gan­i­sa­tions to have con­tin­u­ous mon­i­tor­ing and ap­pro­pri­ate gov­er­nance struc­tures to ac­com­mo­date AI’s unique char­ac­ter­is­tics, in­clud­ing its de­pen­dence on da­ta and in­creas­ing­ly un­pre­dictable be­hav­iour.

She said AI gov­er­nance could not be left sole­ly to in­for­ma­tion tech­nol­o­gy de­part­ments. Hu­man re­sources, le­gal, da­ta pri­va­cy and in­for­ma­tion se­cu­ri­ty teams all have im­por­tant roles to play, par­tic­u­lar­ly as AI adop­tion af­fects pro­duc­tiv­i­ty, em­ploy­ment, le­gal oblig­a­tions and or­gan­i­sa­tion­al se­cu­ri­ty.

Cal­len­der al­so high­light­ed da­ta sov­er­eign­ty as an im­por­tant con­sid­er­a­tion, urg­ing or­gan­i­sa­tions to un­der­stand where their in­for­ma­tion was stored, who could ac­cess it and which laws gov­erned its use.

She fur­ther urged boards to en­sure that or­gan­i­sa­tions had clear­ly de­fined risk ap­petite state­ments for tech­nol­o­gy risks rather than group­ing them un­der broad­er op­er­a­tional risk cat­e­gories.

“If there are no risk ap­petite state­ments for tech­nol­o­gy risk and you lump it up in­to op­er­a­tional risk, I am telling you right now, it’s not the time for that. You need to break out that risk ap­petite state­ment for tech­nol­o­gy and make sure that AI guardrails and AI mon­i­tor­ing is in place for key risk in­di­ca­tors in­side of there against your ap­petite in­tol­er­ance.”

Mixed sig­nals

Ar­ti­fi­cial In­tel­li­gence is gen­er­at­ing wide­spread un­cer­tain­ty, with some view­ing it as a rev­o­lu­tion­ary de­vel­op­ment, while oth­ers are in­tim­i­dat­ed by its rapid ad­vance­ment, says Lon­don-based Pro­fes­sor Bob Gar­ratt who is a cor­po­rate gov­er­nance ex­pert and the keynote speak­er at the CC­GI’s two-day vir­tu­al con­fer­ence.

Gar­ratt said the de­bate sur­round­ing AI was be­com­ing in­creas­ing­ly po­larised, with sig­nif­i­cant in­vest­ments be­ing made in the tech­nol­o­gy de­spite con­cerns about the fi­nan­cial risks and the qual­i­ty of in­for­ma­tion be­ing gen­er­at­ed.

“That’s where I find the de­bate on Ar­ti­fi­cial In­tel­li­gence is over the place at the mo­ment. And those peo­ple are to­tal­ly in­tim­i­dat­ed by it, as they are the glob­al scene. There are those who are say­ing it’s the best thing since sliced bread, and putting vast sums of mon­ey in. Al­though of­ten those sums of mon­ey, par­tic­u­lar­ly in Cal­i­for­nia, etc., are backed by the most enor­mous debt, which could go hor­ri­bly wrong.”

He said da­ta was fun­da­men­tal to AI, but stressed that the re­al chal­lenge was trans­form­ing the enor­mous vol­umes of avail­able da­ta in­to use­ful in­for­ma­tion through ef­fec­tive ques­tion­ing.

“But it’s the turn­ing of da­ta in­to in­for­ma­tion through ques­tion­ing, which to me is ab­solute­ly fun­da­men­tal to be­gin to an­swer how we gov­ern AI. And that use of your own in­tel­li­gence, not ar­ti­fi­cial in­tel­li­gence, but hu­man in­tel­li­gence to ask those ques­tions is to me what I’m re­al­ly be­gin­ning to fo­cus on right now.”

Gar­ratt warned that the grow­ing vol­ume of AI-gen­er­at­ed ma­te­r­i­al in­clud­ed con­sid­er­able amounts of poor-qual­i­ty in­for­ma­tion, which he de­scribed as “slop”.

He said boards had an im­por­tant re­spon­si­bil­i­ty to dis­tin­guish be­tween per­ceived dan­gers and ac­tu­al risks.

“And so, if our so­cial me­dia bash­es out vast sto­ries on sens­ing dan­ger, it’s not good at turn­ing the da­ta in­to in­for­ma­tion to al­low us to as­sess the risks. That to me is a fun­da­men­tal part of the board, and the board as the busi­ness brain.”

He al­so high­light­ed lim­i­ta­tions in the use of AI agents, say­ing his ex­pe­ri­ences with au­to­mat­ed cus­tomer ser­vice sys­tems had demon­strat­ed the dif­fi­cul­ties they still pre­sent­ed.

Gar­ratt said boards need­ed to im­prove their un­der­stand­ing of AI while main­tain­ing their es­tab­lished gov­er­nance re­spon­si­bil­i­ties.

He con­clud­ed that or­gan­i­sa­tions must learn at least as quick­ly as their en­vi­ron­ments change.

“The rate of learn­ing has to be equal to or greater than the rate of en­vi­ron­men­tal change. And if not, you don’t sur­vive.”

Keep­ing up with tech­nol­o­gy

AI can help make cor­po­rate gov­er­nance more trans­par­ent, mea­sur­able and hard­er to ma­nip­u­late, but boards must en­sure that hu­man ac­count­abil­i­ty is not sac­ri­ficed in the process, says Dr Vish­nu Do­er­ga, chair­man of Ac­tion/IN­VEST Caribbean and founder of the Suri­name/Guyana Cham­ber of In­dus­try and Com­merce.

Speak­ing at the CC­GI we­bi­nar on Ar­ti­fi­cial In­tel­li­gence and cor­po­rate gov­er­nance, Do­er­ga ques­tioned whether AI could make gov­er­nance more wor­thy of stake­hold­ers’ trust, ar­gu­ing that the tech­nol­o­gy was ad­vanc­ing faster than the frame­works de­signed to reg­u­late it.

“We are kind of be­hind the ball right now, be­cause Ar­ti­fi­cial In­tel­li­gence, that in­no­va­tion is ac­tu­al­ly out­pac­ing gov­er­nance,” he said.

Do­er­ga said ef­fec­tive gov­er­nance in busi­ness rest­ed on three prin­ci­ples: clear rules, test­ed out­comes and ac­count­able peo­ple.

He cau­tioned that AI should not be in­tro­duced sim­ply for the sake of adopt­ing new tech­nol­o­gy, warn­ing that un­nec­es­sary ap­pli­ca­tions could pro­duce poor re­sults that or­gan­i­sa­tions would not use.

Us­ing sup­pli­er se­lec­tion as an ex­am­ple, he said AI sys­tems could ap­ply agreed cri­te­ria con­sis­tent­ly, record de­ci­sions and flag ex­emp­tions, in­clud­ing in­stances where a chair­man’s rec­om­mend­ed sup­pli­er might not meet es­tab­lished re­quire­ments.

He al­so warned that AI could re­pro­duce ex­ist­ing hu­man bi­as­es and mis­takes on a much larg­er scale, mak­ing it nec­es­sary for boards to test sys­tems for ac­cu­ra­cy, fair­ness and rel­e­vance to Caribbean cir­cum­stances.

“Have we asked AI to de­liv­er our stat­ed val­ues, or sim­ply re­pro­duce our ex­ist­ing habits?” he asked.

Do­er­ga said every AI-sup­port­ed de­ci­sion need­ed a re­spon­si­ble own­er, a mech­a­nism to chal­lenge out­comes and the au­thor­i­ty to stop a sys­tem when nec­es­sary.

“A board can­not de­mand ac­count­abil­i­ty from tech­nol­o­gy while grant­i­ng ex­emp­tions to it­self.”

He rec­om­mend­ed that boards in­tro­duce pi­lot pro­grammes and con­trolled, test­ing en­vi­ron­ments to com­pare hu­man and AI de­ci­sion-mak­ing in ar­eas such as pro­cure­ment, re­cruit­ment and cus­tomer com­plaints.

“Tech­nol­o­gy alone can­not sup­ply the courage that good gov­er­nance re­quires.”