Responsible Generative AI Governance for Business Teams

Why governance is needed now

Generative AI tools are easy to access, and staff use them to draft emails, summarize documents, write code and analyze data. Without guidance, confidential data ends up in consumer tools, inaccurate output reaches customers and nobody knows which teams depend on which tools. Governance should make safe use easy rather than make all use difficult.

Frameworks worth borrowing from

• The NIST AI Risk Management Framework organizes AI risk work into four functions: govern, map, measure and manage.
• NIST AI 600-1, the Generative AI Profile, lists risks specific to generative AI and suggested actions.
• ISO/IEC 42001 defines requirements for an AI management system, for organizations that want a certifiable structure.

1. Approved tools

Before approving a tool, review its data processing terms, retention settings, whether customer data is used for training, where data is processed, security certifications, administrator controls and audit logging. Publish the approved list and a simple way to request new tools.

2. Data rules by classification

3. Human review and accountability

• The person who uses AI output is responsible for it.
• Check facts, figures, citations and legal statements before relying on them.
• Review and test AI-generated code like any other code.
• Follow the organization's rules on disclosing AI assistance, especially in customer communications.

4. Risk tiers for use cases

5. Intellectual property and confidentiality

• Do not paste third-party confidential material into AI tools unless contracts allow it.
• Check licensing terms for AI output used in products or publications.
• Review AI-generated code for licensing and security issues.

6. Privacy

Using personal data in AI systems is processing under the Data Privacy Act. Apply its principles of transparency, legitimate purpose and proportionality, keep privacy notices accurate, respect data subject rights and carry out a privacy impact assessment for projects that process personal data.

NPC Advisory No. 2024-04 explains how the Act applies to AI systems. Organizations should be able to explain the purpose, inputs, risks and expected output of AI processing; remain accountable when development or operation is outsourced; use governance measures such as privacy impact assessments, monitoring and human review; allow meaningful human intervention in automated decisions that pose significant risks; and monitor AI systems for bias. The advisory also warns against overstating the role of AI to the detriment of the people affected.

7. Security

• Use single sign-on and MFA for AI tools.
• Never place credentials or secrets in prompts.
• Be aware of prompt injection when AI tools read emails, documents or web pages.
• Keep logs where tools provide them.

8. Transparency with customers

When customers interact directly with an AI system, such as a chatbot, tell them, and give them a way to reach a person.

9. Incidents and training

• Tell staff how to report harmful output, data exposure or suspected misuse.
• Offer short training on approved tools, data rules and verifying output.

Operating model

• A named executive owner and a small group from IT, security, legal or privacy, and the business.
• An intake form for new AI use cases, routed by risk tier.
• A register of approved tools and use cases with owners.
• A policy review at least yearly, or sooner when tools or regulations change.

Getting started

1. Find out which AI tools are already in use.
2. Approve at least one business-grade tool and publish the data rules.
3. Set up the intake process and the risk tiers.
4. Train staff and gather feedback.
5. Review incidents, requests and usage, then refine.