TheCorporateCounsel.net

Whether or not boards are using AI tools themselves, directors and management teams need to ensure that they’re providing adequate oversight to AI governance efforts. This Gallagher blog discusses the board’s oversight role and offers up the following roadmap for boards and management teams to consider in developing their own AI governance structure:

Phase one: Understanding current use. The first step is understanding where AI is being used within the company. Management can develop an AI inventory, identify high-risk use cases, determine whether employees are using publicly available AI tools and assess whether vendors are embedding AI into existing products or services.

Phase two: Assigning ownership. Companies should clearly identify who owns AI governance at the management level and where AI oversight sits at the board level. Expect this to involve a discussion at the board level, with an existing committee or with a combination of committees. Several companies have disclosed their approaches to AI governance in their proxy statements. It may be worthwhile to look at some of those examples for inspiration.

Phase three: Adopting policies and controls. Companies should develop and adopt policies governing AI use, data protection, vendor diligence, documentation, employee training and incident escalation.

Phase four: Integrating into existing governance processes. AI considerations should also be incorporated into enterprise risk management, cybersecurity, privacy, compliance, internal audit, disclosure controls and incident response processes.

Phase five: Reporting to the board. Management should give periodic updates to the board or the relevant committee. Cadence will depend on the company, but those updates could cover AI strategy, important proposed use cases and their associated expenditures, risk management, regulatory developments, incidents, training and disclosure considerations.

The blog also addresses why AI has become a board-level governance issue, how large public companies are structuring AI oversight, what AI governance failures might look like and how they can evolve into regulatory, litigation and insurance issues.

– John Jenkins