You probably have a lot more AI to manage than you think

At the Senior Team meeting, someone raises the topic of AI risk. They have heard about companies accidentally exposing sensitive data and wonder if it could happen here. Another manager is dismissive: “we are still working on our AI strategy, we don’t have much AI in the business, I don’t think we should be spending time on this”. But they task an intern with counting all the places AI appears in the business, expecting a handful of well-managed applications.

Two days later, the intern returns with a report. There are 61 (this is a real example from a medium-sized company in Kenya). Sixty-one different places where AI is in active use in the business.  These include: 

AI embedded into everyday tools like browsers
Any number of third-party “AI assistants” and note takers
“AI extensions” that have been added to a wide range of mainstream software in common use, from graphics packages to customer management tools
And then there are the tools that employees are using on their company machines to make themselves more productive – usually free

Every one of these has the potential to cause harm if not used properly. The note taker that forwards confidential discussions to a past member of the group. The AI extension that is passing your confidential client data to an AI located somewhere in the cloud, with data protection and privacy rules that you cannot see. And, perhaps worst of all, the marketing manager who uses her free ChatGPT account to help format the new product launch presentation – literally handing the company’s confidential information to a public platform.

You don’t need to deploy AI to have AI

The message is clear. Like it or not, AI is everywhere. For sure, if you are developing your own AI applications, there is an extra level of control required, but even for commercial applications, you cannot simply assume that the application providers have you covered.

That is why every company needs to undertake an AI audit: 

Where is the AI in the business (both formally and informally)?
How would we know? (Ask your staff – an amnesty-style survey works well – and check software subscriptions, expense claims and browser extensions.)
What is each tool used for, and what data and systems can it access? An AI note taker in Board meetings is a very different risk to a grammar checker.
What are the contractual terms of the application that relate to the embedded AI? Do they even state whose AI model they are using and the terms of that use?
Where does the data go? Is it outside the country (almost certainly)? If it includes personal data, is that transfer permitted under the Data Protection Act?
And what can the vendor or the AI company do with my data? Can they retain it, can they train using it?

Knowing what AI is in the business is the most critical first step. After all, you can’t manage what you can’t see. You can do this yourself or you can get a consultant to do this for you. If you have a list of applications, an AI chatbot is actually quite a good way of getting a clear overview of the risk in the AI you have – just make sure it is an approved one, and check what it tells you.

Knowing what AI is in the business is the most critical first step. After all, you can’t manage what you can’t see.

You can’t manage what you can’t see
There is almost certainly more AI in the business than you think
The first step is to undertake a formal audit of what AI is in use  and rank each of them in terms of data, usage and cyber risk
This is not a one-off. Vendors add AI features all the time,  so repeat the audit regularly

To explore further

Take a look at our Resources page with many  other helpful articles on AI and governance

Try our tools and solutions

Discover Akili’s tools and solutions designed to help you understand,
assess and govern AI with confidence.