AI adoption has been a hot topic of discussion among corporate executives in the last year as companies explore ways to leverage AI technology to compete more effectively within their industries. Director Columnist Matthew Scott recently sat down with Diligent CEO Brian Stafford to share insights about what he's learned about AI adoption from the 700,000 board members, CEOs, CFOs and GCs who use the company's board portal and other services. The following has been lightly edited for length and clarity.
What are the biggest challenges related to AI implementation cited by Diligent's corporate board clients?
In the AI adoption space, the most common question our clients have is, “How widely is AI being used across the organization and for how many different uses?” What are the policies on how AI should be used within the organization? And for each of the different use cases for AI, how does the company manage the potential risks associated with those use cases, such as hallucinations, privacy issues, third-party content, etc. How should it be used and how should it be operationalized?”
Many of our clients are also trying to understand the risks associated with the shifting workforce and skills opportunities associated with AI adoption.
Understanding the impact that AI adoption will have on the entire organization is critical. Are there any potential risks you have raised that the board should pay more attention to?
When you look at all the potential use cases, I think most organizations would say one of the interesting things about AI is that it's going to be used by so many employees so quickly. Therefore, boards should focus on: What is AI governance? Where and how is it being used? What controls and safeguards are in place for overall management? And how can AI be used to improve productivity, such as improving the code you write to bring products to market faster or creating new use cases for servicing your clients? Do you use it?
Focusing on each of these areas can help boards understand how their company is using AI within their organization.
Can you provide specific examples of how some boards are addressing the risks associated with AI implementation?
Many boards are creating policies to better govern how their organizations use AI. As AI is rapidly becoming more pervasive, it's becoming increasingly important for boards to first ask, “Where in the organization are we using AI?” Who is using it? how do they use it? Also, what is your usage policy?”
There are many companies out there that are still struggling to answer these questions. Many organizations, with board oversight, are adding an “AI Champion” within the organization – a global head of AI – to help clarify some of the opportunities available and understand where and how AI can be used to avoid risks.
What is the role of an “AI Champion”?
Many organizations select an AI Director or AI Champion to have someone knowledgeable about, and in some cases responsible for, how AI is used within the organization. They are responsible for the education component, understand usage and adoption within different groups within the organization, and ultimately help the organization determine where AI should not be used across its products and services. Masu.
What AI implementation policies do your clients say they are leveraging to improve their organization's operations?
Most of the policies our clients use around AI focus on data privacy. Therefore, one policy addresses the fact that there are many different large-scale language models. Not knowing what data a particular large-scale language model was trained on can expose your organization to copyright challenges.
However, many companies also have major concerns about the potential for employees to incorporate customer information into their use of AI. This means training language models based on customer data, which is a privacy violation for most organizations. Therefore, it is very important to understand the technology, understand what can and should not be used with AI, and create policies around it.
Adopting AI requires talking about AI governance. But is that the same as addressing information governance, or is it more like cybersecurity governance for most companies?
Different risks and opportunities within an organization require different sets of monitoring. The way we look at cyber risk oversight is different from the framework for how we look at enterprise risk. It may also differ from how we view climate risk.
To aggressively move forward with AI adoption, many organizations have a variety of use cases for creating content faster. But who is responsible for making sure that content is actually accurate or that they have the right policies in place? If you're using AI to accelerate product development and bring new products to market faster, have you identified what type of code the AI was trained on? Do you have policies to account for that? If you're inputting customer data to provide customer support information, how do you ensure that third-party organizations have the right safeguards in place around customer data? There are all these different components within an organization. Directors need to make sure that the company understands how these issues impact their operations and determine the right policies around it.
What advice would you give to boards about the process of adopting AI within their companies?
First, your organization likely has many use cases for AI. Therefore, it's important to understand what's currently going on within your organization and ask executives to clarify their strategy around AI. No matter what industry they operate in or what country they operate in, each organization needs to have a strategy for the use and adoption of AI. It also requires efforts to manage how AI is used. Today, we increasingly see governments rushing regulations to understand AI. Governments are asking companies, “How are you actually using AI?” The European Union recently did this.
Boards should start by asking, “What is our strategy as an organization?” Then, “How can we best deploy powerful AI tools to execute that strategy more effectively and quickly?” The next question is, “How can we ensure that we have the right guardrails and the right governance structures in place so that we don't create additional risk?” Boards should address these questions around privacy, disclosure, and many other areas that are important to the organization.
On the positive side, we found that our client’s boards go through a process of asking their companies the following question approximately every 18 months: “How are you thinking about managing that risk in addition to supply chain risks and emerging risks in your product development cycle?” Boards are now doing this on a regular basis and asking the same questions around understanding and managing the risks of AI adoption. Most organizations are focused on where they can start the adoption process and how AI can help accelerate their strategy. So it’s important for companies to have people on their boards who can think differently about how AI can drive incredible advancements and positive outcomes for customers. Mitigating risk and providing good governance means having people at the board level who can ask tough questions of management and help hold management accountable. That’s what good oversight is all about.
