Share This Article
The AI policy is the backbone of a compliance program on artificial intelligence, otherwise no regulatory framework and proper usage of AI can occur.
This is a scenario we at DLA Piper per are increasingly experiencing these days:
- Your company decides that generative AI solutions are crucial for its future to avoid losing a competitive advantage against competitors.
- Your IT department approaches several providers and starts running pilot projects, claiming no compliance assessment is needed since “they are just pilots” with a few employees.
- If you’re lucky, your compliance department or DPO raises legal concerns and instructs a law firm (like us) to conduct a DPIA, TIA, or an IP and AI Act compliance assessment for the AI systems the business needs to adopt.
- Your diligent lawyers run the assessment and conclude that, since artificial intelligence usage is not regulated in your company, it is hard to ensure the AI solution doesn’t expose processed personal data to potential risks, prevents use of IP-protected content, and is fully compliant.
This story may seem imaginary, but it’s not. It’s the experience of most AI lawyers trying to convince their clients that without an AI policy governing artificial intelligence usage within their organization, any compliance assessment would be meaningless.
These AI lawyers need to be “creative” in finding solutions to argue that adequate protections are in place. However, we know that human errors and misbehaviors are the main source of company violations. And if there’s no policy governing AI usage, potential employee misbehavior can’t even be challenged.
This is why we always recommend clients to:
- Map their current policies and operations;
- Understand the areas where AI solutions will be mainly exploited; and
- Implement an AI policy that: Sets rules for artificial intelligence usage within the organization Provides a process for assessing AI solutions through tools like the one available HERE, subsequent approval, and monitoring of its functioning, without creating an additional committee or function, but leveraging the current organizational model to ensure appropriate assessments are performed.
This process enables companies to exploit AI solutions to their fullest potential while implementing safeguards to protect the company’s interests against potential challenges.
Do you agree with this process? What is your recommended course of action? Read more articles HERE
