Two years ago, we outlined how directors should think about oversight of AI-related risks. Since then, we have seen a steady increase in AI projects that sit squarely inside our clients’ core business functions, which raises three board oversight issues that we discuss in this Debevoise Data Blog update: (1) identifying core AI projects, (2) assigning specific management responsibility, and (3) peer benchmarking.
- Identifying Core AI Projects
Corporate boards should consider asking management to provide them with periodic briefings on any major AI project that involves a core business operation of the company, including projects that are anticipated to significantly impact revenue, core risk or legal compliance controls, or large-scale customer experiences.
- Designating a Senior Owner
Many substantial enterprise AI projects involve multiple senior stakeholders (e.g., CFO, COO, CCO, CLO, CIO, CRO, etc.) but it is often unclear to the board who is responsible for overall risk management. For cybersecurity, some companies have solved this lack of clear ownership by having a Chief Information Security Officer (“CISO”) with a dotted reporting line directly to Audit Committee. Accordingly, the board should consider asking management to designate one senior executive or committee who is responsible to the board for risk management and reporting for all core AI projects, perhaps allowing for a different person or committee to be designated, as appropriate, for certain key projects. As with cybersecurity, for AI, clear ownership of mission-critical risks, if any, reduces the chances of gaps and speeds up escalation and decision-making when issues arise.
- Peer Benchmarking
As part of any reporting on core AI projects, boards should consider asking management to identify similar projects undertaken by other companies in the same industry and explain, if knowable, what risk-management controls those companies have adopted.
Bottom line: Knowing about core AI projects, having a designated senior owner of risk, and tracking similar projects at peers will position directors to help their companies capture AI’s upside while managing the risks that come with adding AI to the heart of the enterprise.
To subscribe to the Data Blog, please click here.
The Debevoise STAAR (Suite of Tools for Assessing AI Risk) is a monthly subscription service that provides Debevoise clients with an online suite of tools to help them with their AI adoption. Please contact us at STAARinfo@debevoise.com for more information.
The cover art used in this blog post was generated by ChatGPT 4o.
