AI Governance for Boards: Turning Oversight into Competitive Advantage

Introduction : In every discussion at the boardroom regarding artificial intelligence, the debate seems to end up at a crossroad. On the one hand, there is the need to embrace innovation, approve pilots, vendor agreements and experimentation to stay ahead of the curve. However, there is also a quiet, persistent concern about the risks and liabilities in case things go awry. This is especially so considering the risks that AI poses in terms of prejudice, brand damage and data risks.

In most cases, boards end up taking one view over the other. Some seek to cut through red tape and get approvals fast, brushing-off governance worries as details best left to the experts. They then leave directors fumbling in the dark when things go wrong. Others cling to unreasonably long review cycles. This leaves directors frustrated and angry, and creates a proliferation of shadow AIs (AIs not accessible to directors, if not invisible entirely). Not pretty positioning for either camp.

However, the best approaches to AI governance are those that have eliminated the dichotomy between governance/oversight and speed. They have implemented governance policies that serve as traffic rules, guiding appropriate action and ensuring that everyone is accountable and not creating roadblocks that lead to frustration and workarounds. That transition from governance as brake to governance as infrastructure, is what distinguishes companies that scale AI safely from those that either get stuck or end up creating a headline, making failure.

This article focuses on what that infrastructure actually comprises; how to organize decision-making processes with clarity, responsibility, and appropriate escalation features to protect the company and its directors while minimizing the burden on the business.

Approval Frameworks

The inclination for many boards when considering AI is to create a committee that will oversee all applications of AI within the firm. However, this approach is flawed in most cases considering the varied risk profiles that different applications pose. For instance, the marketing team experimenting with a copywriting tool poses a different risk profile from the finance team using an algorithm to score applications for a loan. As such, an approval structure should be created that takes into account the risk appetite of the firm.

First of all, boards should consider implementing a triage process wherein applications for AI approval are placed in different categories depending on the risk that they pose. For instance, applications that involve internal processes and have little impact may be approved through a self-registration process by the business units. Medium risk use cases such as those that involve customer data or that take decisions that affect operations, require a formalized review by a cross functional group, typically charged with such responsibility by the risk or technology committee. High risk applications, on the other hand, need to be reviewed by the board before implementation.

The most important step is to design these parameters for segmentation in advance so that every application for approval can be routed depending on its impact. When everyone is aware of what falls under which category, the process becomes much simpler. Approval no longer feels like a mystery and is instead something to be anticipated.

Accountability Mapping

One of the biggest pitfalls in terms of AI governance is that of vague accountability. While the establishment of committees helps in terms of assigning responsibility, many times there is no one specific person that is accountable for any particular aspect of AI adoption. This is especially so in cases where there are overlapping responsibilities. For instance, who is responsible for ensuring that an approved AI application adheres to the stipulated ethical guidelines? Who is accountable for reviewing its ongoing usage? To address this, there should be a need to assign three levels of accountability.

There should be specific people that are accountable for the business case, application performance and monitoring of applications. In most cases, they can be different people depending on the nature of the application. Boards should insist on getting an accountability matrix as a prerequisite for every significant AI initiative that the firm undertakes. This matrix will indicate who is responsible for what, based on their areas of authority. This way, the board can protect itself as well as the firm from unwarranted risks and liabilities arising from vague accountability in the adoption of AI.

Escalation Triggers

Most governance frameworks are focused on the ideal case, when everything goes as planned. But what if the opposite happens? What if your model starts producing unexpected results? What if a vendor reports a security breach? What if a regulator starts investigating a similar use case at another company? Without clear escalation scenarios, these incidents will be handled in an ad-hoc manner, possibly taking too long, by whichever party takes notice first.

Boards should work with management to identify specific triggers that require escalation such as increases in customer complaints related to an AI function, a substantial change in input data or regulatory environment, or model failure.

The board of directors needs to consider specific escalations or triggers that require human intervention in the decision-making process of an AI function. Some examples include; increase in customer complaints about a specific business function, significant change in the input data or regulatory environment in which the AI function operates, and model failure. Escalation triggers must be clearly defined and should require escalation to specific individuals with assigned timeframes for action.

This is not about creating more paperwork; it's about making sure that the first response to the problem is something that's been rehearsed in advance rather than a quick ad hoc response that might win the fight but lose the lawsuit later.

Documentation

Documentation of the decisions, rationale, actions, and information is too often viewed as something that only must be done if a regulator or plaintiff’s lawyer asks for it. This is a mistake. Documentation serves an extremely important role as the working memory of the organization, capturing the who, what, when, where, and especially why of a decision.

A board should require comprehensive documentation of any business rationale for the use of the technology, risk assessment and who performed it, data sources and any knowledge of their limitations, testing and validation, and monitoring and audit plans as the technology is deployed in a commercial setting. The documentation must be living and updated as the technology changes, not simply created at some point during its development and then left to gather dust.

Finally, documentation serves a critical purpose for the board specifically. If a dispute ever arises or a government asks for information, the documentation serves as evidence that the board asked the right questions and has a reasonable understanding of the issues and the rationale for decisions made. Without such documentation, even if the board’s conclusion was correct, it may find itself in a difficult position defending its decision.

Conclusion

Good AI governance will not impede innovation. Boards which set out decision making hierarchies, ownership and escalation policies, provide managers with the reassurance that they can act quickly and confidently within a framework that safeguards the best interests of the enterprise. Such boards also know that quick, pragmatic decisions are likely to be defensible ones.

The companies that will most benefit from good governance in the years ahead are not necessarily those that are best at model development, but rather those that have optimized decision making and established the necessary if not sufficient conditions for rapid, responsible innovation. This is because any apparently thoughtful decision made at the eleventh hour can always be rationalized by the decision maker.

Author: Malvika Chavan in case of any queries please contact/write back to us via email to content@khuranaandkhurana.com or at  Khurana & Khurana, Advocates and IP Attorney

Endnotes / References

1. Companies Act, 2013, s. 166(3) (India): statutory duty of care, skill, and diligence for directors, the Indian equivalent of the Caremark oversight duty.

2. Companies Act, 2013, s. 134(5) & Sch. IV (India): director responsibility statement and independent director duties, relevant to accountability mapping and escalation review.

3. Digital Personal Data Protection Act, 2023 (India): governs data-related risk assessment referenced in AI documentation and risk categorization.

4. Securities and Exchange Board of India (SEBI), (Listing Obligations and Disclosure Requirements) Regulations, 2015, reg. 17 & 21 (India): board/committee oversight obligations, relevant to escalation to board level for high-risk matters.

5. KPMG India, "AI in the Boardroom: From Experimentation to Governance Imperative,"

6. National Association of Corporate Directors & Data & Trusted AI Alliance, Director Essentials: Implementing AI Governance.