Steps to promote trustworthy AI

By Ryan Hittner, Audit & Assurance Principal, Deloitte & Touche LLP

Talking points

• The remarkable potential of artificial intelligence (AI) may be tempered by growing challenges to data privacy, risk mitigation, and cybersecurity—in short, to trust and transparency.
• How can you harness AI’s vast potential while managing its risks?
• What steps can companies take to help develop effective AI strategies that build transparency and trust with shareholders and other stakeholders? 

The word on the street

Thanks to the recently developed large language models, or LLMs, we may be close to realizing a decades-old quest: the creation of intelligent machines. This technology, which seeks to imitate the human brain, has opened a new realm called Generative AI—software that can write coherent text and create images and computer code at a level close to that of humans.

As we ponder the vast business potential of AI, one thing is abundantly clear: AI requires sound human decision-making to curb its potential shortcomings.

So how do we harness the power of AI while managing its risks in a manner that engenders trust and not suspicion?

Putting our POV to work

Regulation and transparency are likely to be part of the answer. For example, the city council of New York City recently passed a law requiring bias audits of automated employment decision tools (AEDT) used by companies for employment decisions (e.g., select job candidates from pools of applicants). Moreover, Local Law 144-21 mandates that companies publish a summary of the audit results and that they alert job applicants or employees to the use of AEDTs as well as to the “categories” and “screens” set in evaluating qualifications and background.

Federal, state, and local governments/agencies as well as international bodies are taking a closer look at how organizations use AI. For example, officials in in several states have proposed AI legislation and regulations to enhance transparency and accountability, while the National Institute of Standards and Technology has released an AI Risk Management Framework. In Europe, the Artificial Intelligence Act seeks to provide a framework to regulate AI based on the level of risk that a system might pose and to harmonize cross-border rules dealing with this technology.

This activity suggests that it’s time for companies to focus on developing or refreshing their own AI strategies as well as usage and governance models—because there’s more to concerns over AI than just bias. It’s a matter of trust—the trust between stakeholders (e.g., shareholders, employees, etc.) and companies. 

­­AI presents new and growing challenges to data privacy, risk mitigation (including reputational risk), cybersecurity, and disruptions of operations and business models. And those may increase as the technology and use cases expand. So, what should be on a company’s AI transparency and trust agenda as it works to reimagine and manage risk mitigation, operational controls, and governance processes? 

Steps to consider

1. Compile an inventory of the AI technologies and use cases in place for your company. An inventory is vital to assessing potential risks and facilitating discussions with other stakeholders in the organization (e.g., management, compliance, legal, etc.).
2. Review existing laws and proposals to proactively evaluate the potential impact of current and pending legal and compliance obligations.
3. Design and codify a mission statement and guidelines for the development and use of AI within your organization.
4. Create and implement an AI-specific risk framework and governance model to implement pertinent controls and real-time monitoring systems.
5. Bring employees up to speed on issues of acceptable usage by creating appropriate guidelines supported by the requisite training.
6. Work with your legal counsel to identify compliance gaps, determine appropriate remediation, and take other necessary measures to avoid missteps.
7. Engage with your vendors to learn about their uses of AI as well as their standards and regulations to help mitigate any acquired business or reputational risks. Update any service agreements, contracts, licensing terms, etc. as needed.

What all this talk means for you

Expectations around AI continue to grow, and companies are increasingly harnessing AI and expanding its impact. Just think, AI is already capable of writing this post with some human assistance. Next time it just might. That’s a reality worth pondering.

Please read our Wall Street Journal article to learn more, and if you have any questions, please contact me.