What the C-Suite Needs to Know About AI Governance

AI adoption is moving like a rocket ship; maybe faster.

For most companies, AI governance is not. At many companies, closer to a turtle.

The bad news is that your employees are using it anyway and if you tell them they can’t or block them, they just do it on personal devices, exposing company data even more.

The big (mega?) consulting firm PwC says that companies are LESS PREPARED TO PROTECT AGAINST ATTACKS ON AI SYSTEMS.

Half of security leaders admit that protecting AI was THE SINGLE largest gap in their cybersecurity program. Even more of a problem than third-party breaches if that is possible.

AI Risk and AI Opportunity need to be viewed as two sides of the same coin. And, if they are handled by two different teams, operating out of two separate silos and not talking to each other, you have a problem.

Let’s start with a simple question.

WHO OWNS AI GOVERNANCE AND AI RISK?

Simple question. Is there one person? If so, who does that person report to?

Given the velocity of AI, who is being briefed and how often? Is that leadership trained in AI? No, I don’t mean are they an expert prompt engineer, but do they understand the risk that they are allowing to go on in the company? If they tell you to ask IT, you have a problem. Unfortunately, you can’t do that in a fifteen minute briefing once a year. Given the velocity of AI, this is a non-stop education requirement.

Where in the org chart is that owner? If they are buried 6 levels below the CEO or Board reporting to someone in operations, you have a problem.

PwC questioned 3,900 people in 71 countries.

Less than 30 percent of AI accountability rests in a CIO or CTO or similar title. Depending on the company, that CIO may not even be high enough in the food chain.

If you are developing and deploying AI agents, how are you managing:

• Identity/authentication/ownership, – CAN YOU NAME EVERY AGENT RUNNING IN YOUR COMPANY RIGHT NOW AND WHO OWNS IT?
• Access/audit and – CAN YOU TELL ME WHAT DATA ANY ONE OF THOSE AGENTS TOUCHED LAST TUESDAY?
• Data inventory? – CAN YOU TELL ME WHERE EVERY LAST PIECE OF YOUR FINANCIAL (AND ALL OTHER SENSITIVE) DATA IS, INCLUDING CLOUDS, PHONES, TABLETS AND LOCAL PCs?

If you don’t have a good handle on these you could be the next Amazon China (if that fiasco does not ring a bell, give us a call).

And, don’t forget that those third party tools that you use everywhere are implementing AI to be one of the cool kids. How are they managing their use of AI?

Don’t forget shadow AI. How are you managing that, both within the four walls and outside of it?

If this scares you, give us a call.

Credit: Cybersecurity Dive

by