In this post
Start with a simple policy
- Which tools are approved and for what.
- What data may and may not be entered.
- What must be reviewed by a person before use.
- Who to ask when unsure.
Assign accountability
Name an owner for AI use in the organisation and for each system that makes or informs a decision. Keep a list of where AI is used.
Manage risk in proportion
A drafting assistant and a system that decides on loan applications need different levels of control. Classify uses by impact and apply controls to match.
Build capability
- Train people on what the tools do and their failure modes.
- Share examples of good use.
- Collect incidents and near-misses and learn from them.
- Review the policy regularly as tools and rules change.
Sources and further reading
- NIST. AI Risk Management Framework (AI RMF 1.0). nist.gov/itl/ai-risk-management-framework.
IICTP is a new independent credential and is not ISO/IEC 17024 accredited.