← Back to White Papers

In a World With AI, IT Governance Alone Is No Longer Sufficient.  

September 23, 2024

Written by: Angelo Mazzocco, VP Of Advisory Services at AVAAP, LLC and John S. Farhat, CEO of the Farhat Family Companies

Summary  

Many large and well-established companies have formal IT governance structures in place to manage their technology resources and align IT with business objectives. In this paper, we define IT governance and introduce the role of AI governance. We discuss the differences and why both are needed for the ethical operations of IT in an AI-centric world.  

IT Governance  

Well-established and compliant companies implement IT governance frameworks to manage their technology effectively, mitigate risks, and ensure that IT investments contribute to their overall business success.  

IT governance is about how a company manages its technology to make sure it helps the business succeed and follows the rules. It includes setting up compliance and procedures to ensure that technology projects align with the company’s goals. This means deciding who is directing what, managing risks and compliance, and making sure technology investments are worth it.  

There are a few important parts of IT governance. First, strategic alignment ensures that technology supports the company’s main goals. Second, risk management means identifying and dealing with potential problems. Third, resource management focuses on using technology and people efficiently. Lastly, performance measurement tracks and evaluates how well technology is working. Good IT governance helps a company make smart decisions about technology and makes sure compliance is in place and everything runs smoothly.  

AI Governance  

AI governance involves creating policies, procedures, and frameworks to manage the use of artificial intelligence (AI) in a way that ensures ethical standards, compliance with regulations, and alignment with organizational goals. As AI technologies become more integral to business operations and daily life, effective AI governance is crucial for managing risks, compliance, and leveraging AI's benefits responsibly.  

The role of AI governance is to establish foremost Ethical Guidelines and Compliance for the ethical use of AI. These ethical guidelines may be different in different industries, but must encompass transparency, accountability, fair and unbiased training of the models.  

These principles are essential to ensure that AI is used responsibly and ethically with foremost concern for individuals affected. As such, AI governance must embody the following main principles:  

  • Transparency and Trust: Nothing shatters trust and builds resentment more than secrecy. With AI systems being used to manage human affairs and, in many instances, replace some of the workload, it is important for all stakeholders to know that nothing is being done behind closed doors in any malicious or at least non-benevolent way.AI systems should operate in a transparent manner, providing clear explanations of how decisions are made and what data is used. This transparency helps build trust and allows users to understand and scrutinize AI processes.  
  • Security, Privacy, and Data Protection: Manipulating AI systems may not have to involve changes to the programming, and manipulation can be done via the training space. This gives the AI a unique requirement to safeguard not only the code, but most importantly, the type and quality of the data being taught to the models. This is even more serious when you note that the training space for the models may be personal data with identifiable markers.  
  • Explainability: Related to Transparency is "Explainability". Because AI is complex and its decision-making processes are not defined in a linear fashion, the organization must be able, at a minimum, to understand its processes and the model training that took place.  
  • Accountability: Clear lines of accountability should be established for AI systems, including who is responsible for their development, deployment, and outcomes. This ensures that there are mechanisms to address and correct any issues that arise.  
  • Regulatory Compliance: This point may sound much like general IT governance, but in this instance, any regulatory or industry standard for the deployment of systems must be adhered to. For example, AI Freedom Alliance has rules governing the creation and viewing of AI generated content (https://aifalliance.org/resolutions-standards/). Recently, there has been talk of states adopting some standards related to such content.  

IT Governance vs AI Governance  

The overall scope of IT governance is the information technology resources and their alignment with the organization's objectives. In short, IT governance is the ‘WHAT’.  

AI Governance focuses on something different; Oversight of AI systems. Its primary focus is the ethical and legal challenges of running these systems. In short, AI governance is about the ‘SHOULD’. Just because we can, should we?  

These differences can be shown in the makeup of these boards. An IT governance board is usually made up of:  

  • Chief Information Officer / VP of Information Systems  
  • Chief Financial Officer (CFO) 
  • Chief Security Officer (CISO) 
  • Chief Operating Officer, Business Unit leaders  
  • Compliance staff  
  • Auditors 

On the other hand, an AI governance board should be made up of:  

  • Chief Data Officer (CDO)  
  • IT directors and managers  
  • AI and Modeling Technical Experts  
  • Specialists in ethical data usage  
  • Legal experts  
  • High level subject matter experts  
  • External Advisors and perhaps External Reviewers 

In summary, IT governance boards typically consist of individuals with expertise in IT management, finance, security, and compliance, focusing on the broad spectrum of IT systems and operations. AI governance boards, on the other hand, include specialists in AI technologies, data management, ethics, and legal compliance, addressing the unique challenges associated with artificial intelligence.  

This is reflective of the different missions of the different governance bodies. IT governance is about building capacity and business alignment in a scalable way. AI governance is essential for managing the complexities and risks associated with artificial intelligence. It helps ensure that AI systems are used ethically, transparently, and responsibly, aligning with legal requirements and organizational goals while managing risks and building trust among users and stakeholders.  

Final Thoughts  

Every established organization with an IT governance board should be looking at establishing an AI governance board if it does not have one. And every organization must constantly be asking itself, just because we can, should we?  

Summary 

As AI technologies become increasingly integral to business operations and everyday life, traditional IT governance alone is no longer sufficient. This paper defines IT governance and introduces the concept of AI governance, explaining the distinct roles and why both are necessary for ethical and effective technology management. 

IT Governance 

IT governance ensures that a company’s technology resources are managed effectively to support business goals and comply with regulations. It involves: 

  • Strategic Alignment: Ensuring technology supports business objectives. 
  • Risk Management: Identifying and mitigating potential risks. 
  • Resource Management: Efficient use of technology and personnel. 
  • Performance Measurement: Evaluating technology’s effectiveness. 

AI Governance 

AI governance involves creating policies and frameworks to manage AI technologies ethically and responsibly. Key principles include: 

  • Transparency and Trust: AI systems should be transparent, with clear explanations of decision-making processes. 
  • Security, Privacy, and Data Protection: Safeguarding the data used to train AI systems is crucial. 
  • Explainability: Understanding and explaining AI processes and training. 
  • Accountability: Establishing clear responsibility for AI system development and outcomes. 
  • Regulatory Compliance: Adhering to relevant regulations and industry standards for AI systems. 

IT Governance vs. AI Governance 

  • Scope: IT governance focuses on the overall management and alignment of IT resources with business objectives (WHAT). AI governance, on the other hand, addresses the ethical and legal challenges specific to AI systems (SHOULD). 
  • Board Composition: IT governance boards typically include CIOs, IT managers, and compliance staff, while AI governance boards involve Chief Data Officers, AI experts, ethical data specialists, and legal experts. 

Conclusion 

Organizations with established IT governance boards should also consider forming AI governance boards to address the unique challenges posed by AI technologies. The question to constantly ask is, “Just because we can, should we?”