Why AI Needs Its Own Risk Management Policies and Processes

Existing risk management policies, and the related business processes, which may have been appropriate for the traditional information technology environment, will not be workable in the AI environment. In this presentation, we’ll discuss what’s markedly different between the traditional information technology risk management environment, and the new AI risk management environment. For example, there is a risk of model stealing with publicly facing AI systems, but no such risk is found in traditional publicly facing systems. Likewise, the result provided by a certain query submitted to a Generative Artificial Intelligence (GAI) system may not be the same from day to day, but no such phenomenon is present with traditional information systems. Similarly, the great power of AI systems can be used to overcome traditional privacy-protection mechanisms such as anonymization, and this has not been previously encountered with traditional information systems. Also covered in this presentation will be suggested managerial and technical responses to these differences, such as an AI Acceptable Use Policy and an AI Life Cycle Process. Some recent legal developments in the AI risk management area will also be briefly covered.