It might seem odd to think that a Board of Directors in Canada might need to think about Artificial Intelligence in the company. Isn’t that a CIO or CTO decision or perhaps, marketing, since that’s where AI is seeing the most traction in Canadian companies? While the AI tools selected and how they’re deployed rests within the company’s employees, the impacts of AI in terms of privacy, employee policies and customers needs board oversight.
A Board helps govern the company, deciding on significant policies and assisting with strategy, financial management and other activities. As Artificial Intelligence gets better and finds it’s way into key areas of the business though, there are aspects of using AI that need Board oversight. Added to this is the impending new Canadian privacy act, expected to come into law sometime in 2022.
If there’s one thing that AI tools and applications need to work well it is data. Lots and lots of data. The more data, the better the AI tool. When you make a simple request of Siri on your smartphone to find something, Siri is connecting to a massive data centre somewhere in Canada or the U.S. and relies on those data centres to deliver the answer.
In a company using AI for say, helping with strategic decision-making for capital allocations or analysing competitors financial statements, or identifying subtle changes in customer preferences and behaviours, that AI needs a lot of data. Most of that data is within the company. If it’s customer data the AI tool is accessing, then governance issues come into play. Even buying or accessing data outside the organisation has implications.
We also know now, that AI tools have issues with gender and racial bias. A situation tech giants like Apple and Google are trying to resolve. An American company used AI tools to manage employee contracts and the AI system ended up firing a perfectly good employee, who then sued the company. These are issues that a Board needs to consider and set policies for. To properly guide the way that senior management, IT and marketing select and implement AI tools for the company.
Back to the impending Consumer Privacy Protection Act (CPPA), which will replace the 20 year old PIPEDA, that had little teeth to it. The new act will see the Privacy Commissioner have Order Making powers, such as forcing a company to comply, requiring transparency after a data breach and forcing a company disclose how it is using technologies like Artificial Intelligence to make decisions about customers. Then there’s the fines. Upwards of $25 Million and if your prior year’s gross revenue at 3-5% is higher than the $25 Million, it could be more.
So for a Board of Directors in Canada, in for-profit or non-profits, considering policies around the use of AI, data governance and data management, need to be on the agenda. This is mission-critical risk mitigation. The risks are financial in terms of significant fines, but also in the form of litigation by consumers affected by a breach and employees affected by bias in AI systems used internally.
Three steps for Boards to Consider for AI in the Boardroom
- Form and ad-hoc committee to assess how AI is or might be used in the organisation. If it is being used, assess how and if risk mitigation has been implemented by senior management. This committee may also determine if a standing committee is required and what that structure may be. If you have an existing standing committee on the use of technology, this can be a sub-committee explicitly focused on AI.
- Develop a method of how any plans to implement AI within the organisation for either internal or external purposes should be governed by senior management.
- Review the organisations Best Practices with regard to Information Technology, cybersecurity and data governance.
You may want to consider bringing in an outside consultant to educate the board on what Artificial Intelligence is at a high level and who can also explain the implications and risks around AI that a Board needs to consider. The consultant should also understand digital governance as a whole and how it impacts HR, IT and management.