AI Governance Essentials: A Comprehensive Guide for Enterprises and AI Projects

AI is here to stay. So we need to adapt our organizations and our project-working to adapt to it and harness its capabilities. But, as the press continues to remind us, there are risks. Our best defense against these is a robust AI Governance platform. This needs to be at the enterprise or organization level and also trickle down to the levels of portfolios, programs, projects, and product development.

As you’d expect, this is a fast-developing area. So please consider this article as provisional. I would expect to update it, as more examples of good practice emerge.

And, talking about ‘good practice’, I have made a conscious decision to supplement my research by enlisting the help of AI. Specifically, I have asked a number of tools (ChatGPT, Perplexity, Claude) to suggest topics I need to cover. This was an experiment that I am finally ready to take, for my last article of 2024! I would say that the outcome is a 60:40 collaboration, with HI contributing 60% and AI 40%.

But, in line with best practice, I have reviewed, curated, and heavily edited the AI content. Most importantly, I stand behind this article and the responsibility for any errors or omissions is mine. As always, I welcome comments, questions, and suggestions.

Our Agenda

As suggested by my panel of AI tools and my own thoughts, this article covers:

1. What Do We Mean by AI Governance?
2. The Need for AI Governance
3. The Key Principles of AI Governance
4. Regulatory Landscape for AI Governance
5. AI Governance at the Enterprise Level
6. An Implementation Plan for AI Governance
7. An AI Risk Management Framework
8. Governance Considerations for Projects Using AI-Enabled Tools
9. The Challenges and Future of AI Governance
10. Conclusions about AI Governance

That’s a big list, so let’s get to it!

What Do We Mean by AI Governance?

Let’s start with the basics: what is AI governance, and why does it matter?

Defining AI Governance

AI governance refers to the structured framework of policies, practices, and procedures aimed at overseeing the development, deployment, and operation of artificial intelligence (AI) in a responsible manner. As with project governance, AI governance must cover:

1. Setting strategic direction for the use and development of AI capabilities.
2. Operational decision-making around the use of AI and also the use of AI for decision-making.
3. Oversight of the use of AI and its implications for the various stakeholders and stakeholder groups.

Good governance plays a big part in ensuring that AI not only functions optimally but does so ethically and in alignment with legal, social, and organizational standards. At its core, AI governance strives to balance innovation with accountability. It must prioritize the well-being of users, stakeholders, and society as a whole.

The Dual Challenge

AI governance is complex in that it must address the dual challenge of governing:

1. Standalone AI systems and
2. AI-enabled tools embedded in broader ecosystems

Enterprises must create governance structures that encompass both isolated AI applications and integrated solutions impacting workflows across multiple functions, departments, regions, and initiatives.

Why AI Governance Matters

The increasing reliance on AI technologies across sectors – from healthcare and finance to customer service and manufacturing – has amplified the need for robust governance. Unregulated AI can introduce severe risks:

• Opacity: ‘Black box’ algorithms make decision processes and evidence sources difficult to understand.
• Bias: Algorithms can be trained on biased data and so perpetuate social inequalities.
• Privacy Infringements: Mismanagement of data can lead to privacy violations.
• Security Threats: Vulnerabilities in AI systems can be exploited by malicious actors.

Conversely, strong governance fosters trust and transparency. This allows organizations to deploy AI responsibly and harness its full potential, while safeguarding against unintended consequences. This not only ensures legal compliance but also enhances user confidence and promotes sustainable growth.

The Need for AI Governance

We’ve seen why AI governance matters. But this is critical, so let’s go deeper.

The Key Drivers for AI Governance

AI governance is driven by three big imperatives (and, doubtless, many others):

• Ethics: Companies must ensure that AI systems uphold ethical standards to maintain public trust and the trust of their employees and delivery partners. Decisions made by AI can have life-altering implications, as seen with self-driving car algorithms deciding between potential accident scenarios.
• Regulatory Compliance: As global regulatory bodies start to introduce policies regarding data privacy and AI usage (e.g., GDPR, California Consumer Privacy Act, EU AI Act), organizations must comply to avoid costly legal repercussions.
• Risk Management: Effective governance mitigates risks such as unintended algorithmic bias, operational failures, and reputational damage.

Other concerns include:

• Algorithmic Bias: Bias in data sets and model training can result in discriminatory outputs. For instance, facial recognition technology has shown higher error rates when identifying people of certain ethnicities. In addition to the ethical concerns this can drive is the risk of:
• Poor Decision-making: With poor governance, AI tools will lack accountability. As a result, we may see AI tools making bad decisions.
• Privacy Violations: AI systems that use personal data can unintentionally breach privacy rights if data handling protocols are not strictly followed.
• Security Vulnerabilities: AI models can be manipulated through adversarial attacks, where bad actors introduce data inputs to deceive the model.
• Lack of Transparency: AI systems often function as “black boxes,”

AI’s Role in Enterprises and Projects

AI has become a cornerstone in decision-making and operational efficiency. By automating tasks, analyzing large data sets, and delivering predictive insights, AI tools help organizations make more informed decisions and streamline operations. For example, in the financial sector, AI can assess creditworthiness faster and more accurately than traditional methods. In healthcare, it can assist with diagnostic imaging and predictive analysis for patient care.

In Project Management and other project-based working, we are finding more and more uses for AI tools. We have a great guest article, by Yaniv Shor: Artificial Intelligence Tools: Top 5 Practical Project Management Applications.

These are just two examples of our large and growing library of AI content.

Competitive Advantage

We have looked in some depth at the kinds of risks AI can pose in the absence of effective AI governance. But the flip side is the many benefits it can bring in terms of:

• Competitive Advantage: AI tools can deliver new and better products and services
• Labor and Cost Efficiencies: AI can facilitate faster, more precise, and more accurate working.
• Innovation, Creativity, and Speed to Market: AI tools can generate ideas and increment variations tirelessly.
• Talent Retention: Yes, the new AI tools will make some roles redundant and result in the loss of some jobs. But equally, AI creates new roles and the use of advanced AI tools in innovative ways will be a draw to talented workers and professionals.

The Key Principles of AI Governance

There are some key principles with which any effective AI governance framework will need to conform. Let’s see what some of them are.

Fairness and Non-Discrimination

To promote fairness, governance processes need to test for and remove bias at multiple stages: during data collection, model training, and post-deployment. Diverse data sets and active oversight can help ensure models do not favor any demographic disproportionately.

Bias mitigation strategies include:

• Diverse Training Data: Ensuring training data reflects a balanced demographic.
• Algorithmic Audits: Regular checks to identify and correct bias in model outcomes.
• Feedback Mechanisms: Allowing stakeholders to report discrepancies and biases in real time.

Transparency and Explainability

Transparency means making the internal workings of AI models interpretable to non-experts. This way, we can understand how and why AI makes the recommendations and decisions it does.

Explainability tools, such as LIME (Local Interpretable Model-agnostic Explanations) and SHAP (SHapley Additive exPlanations), break down how decisions are made, helping stakeholders trust and validate AI outputs.

Privacy and Data Protection

Data protection is paramount, requiring strict data access controls, anonymization techniques, and compliance with regulations such as GDPR and the CCPA. Companies must adopt clear data handling policies, ensuring user consent and safeguarding data throughout its lifecycle.

Accountability and Oversight

AI accountability involves designating clear ownership for the behavior and outcomes of AI systems. Establishing oversight and ethics committees, and having a Chief AI Ethics Officer can help ensure that AI is implemented in line with an organization’s ethical framework and legal obligations.

Security Measures

Securing AI systems involves applying robust cybersecurity practices:

• Secure Model Training: Protect models from data poisoning during the training phase.
• Access Controls: Limit who can modify or interact with AI systems.
• Incident Response Plans: Have a protocol ready for AI-specific security incidents.

Legal and Regulatory Compliance

Organizations must continuously adapt to the evolving landscape of regulations. Compliance checks, AI audits, and active participation in policy discussions can keep organizations ahead of legal mandates.

Ethics: Human-Centered AI

AI works within an ethical framework that complies with societal and cultural norms. It should always serve humanity’s needs, prioritizing human welfare and enhancing user experiences without undermining social and moral frameworks.

Safety and Reliability

Ensuring safety requires that AI systems undergo thorough testing under various conditions. Reliability is bolstered by fail-safe mechanisms and robust contingency planning.

Sustainability and Social Impact

AI should be developed with environmental sustainability in mind. Projects should assess energy use, data center efficiencies, and potential social implications, aligning with corporate responsibility goals.

Continuous Learning and Adaptation

AI governance isn’t static. As AI technology evolves, so must the governance strategies organizations deploy. Continuous learning programs and adaptive governance models ensure policies remain effective and relevant.

Regulatory Landscape for AI Governance

The regulatory environment for AI is fragmented, with significant regional variations. I am not qualified to advise on this, but as examples:

• European Union Artificial Intelligence Act: The proposed EU AI Act categorizes AI systems into different risk levels and sets out clear compliance requirements for high-risk applications. It covers biometric surveillance, critical infrastructure, and employment-focused AI.
• United States: While no comprehensive federal law currently exists, various initiatives like the Blueprint for an AI Bill of Rights set ethical guidelines. NIST guidelines for trustworthy AI and state-level bills show progressive steps toward formalized regulation.
• China’s Draft Regulations: China’s approach to AI regulation is focused on data sovereignty and AI security. It is likely to enforce real-name verification and mandate security reviews for high-impact AI applications. Industry-Specific Requirements

Sector-based Regulation

Certain industries will face specific compliance needs. Again, I am not qualified, but three examples stand out for me:

• Healthcare and Pharmaceuticals: Pharmaceuticals and medical tools are highly regulated in every jurisdiction.
• Automotive and Aerospace: Autonomous vehicles pose not just safety threats (arguably, AI is a safer driver/pilot than a human can be) but massive legal challenges around liability for injuries.
• Finance: Regulatory oversight needs to prevent algorithmic biases and runaway trading in investment platforms.

AI Governance at the Enterprise Level

A comprehensive AI governance framework should include:

• Policy Creation: Develop principles and guidelines addressing ethical AI use and legal compliance.
• Regulatory and Industry Standards: The organization must understand and address all relevant external requirements and good practices.
• Oversight Structures: Specific roles and committees need to oversee the work on and by AI throughout the organization.
• Role Definitions: Define roles and responsibilities, such as appointing data custodians and technical leads.
• Communication Structures: Foster transparency through cross-departmental teams.
• Review and Update Cycle: Governance structures and processes need to be maintained under regular scrutiny and review.

Executive Sponsorship and Oversight

Executive buy-in is crucial for setting the tone across an organization. Senior leaders can prioritize resources and align governance with strategic objectives.

AI Ethics or Governance Board/Committee

An AI oversight or ethics committee can advise on complex regulatory and ethical issues, ensuring that projects meet societal and corporate responsibility standards. This committee should be composed of diverse stakeholders, including legal experts, data scientists, and representatives from affected user groups. Cross-functional boards that include members from IT, ethics, HR, and legal departments help align AI initiatives with governance standards.

Chief AI Ethics Officer

Consider the value of recruiting a Chief AI Ethics Officer who can lead strategy and serve as a liaison between the technical teams and governance bodies.

Developing AI Policies and Procedures

Enterprises should outline specific governance policies for:

• AI Development Lifecycle: Include governance at each stage, from conceptualization and design to deployment and retirement.
• Model Validation and Testing: Implement tests that mimic real-world applications to confirm reliability.
• Bias and Fairness Protocols: Employ iterative testing to detect and mitigate bias.

Transparency and Accountability Mechanisms

Embed traceability into AI projects through comprehensive documentation and real-time reporting. Mechanisms should include:

• Audit Trails: Maintain detailed logs of AI development and modifications.
• Review Boards: Institute regular review boards to evaluate the compliance and ethics of AI use cases.
• Independent Audits: These should be conducted periodically to review an AI system’s impact on different demographic groups and ensure fairness.

AI Audits and Impact Assessments

Perform regular AI audits focusing on compliance, performance, and risk. Conducting impact assessments helps preemptively identify ethical and operational challenges.

Risk Assessment and Management

Effective AI risk management needs to follow and adapt good risk management practices, with which project professionals are very familiar. This involves:

• Risk Identification: Catalog potential failures and unintended outcomes.
• Scenario-based Risk Analysis: Test AI systems under different stress conditions to preempt risks.
• Developing Risk Mitigation Strategies: Develop layered defense strategies, from technical safeguards to process adjustments.
• Robust Risk Management Action: To implement mitigation plans.
• Risk Monitoring and Review: To assess the effectiveness of risk responses and review analysis and plans in the light of changing circumstances.

Data Governance

Strong data governance policies ensure data quality, protect user privacy, and secure sensitive information. This includes:

• Data Quality Protocols: Use automated tools to ensure data accuracy.
• Privacy Safeguards: Encrypt sensitive data and anonymize identifiers to prevent data re-identification.

Compliance and Regulatory Considerations

Organizations must anticipate and adapt to regulatory changes to maintain compliance. Proactive monitoring and participation in policy discussions are necessary for aligning with new standards.

An Implementation Plan for AI Governance

In my research, the best process model for implementing AI governance that I have found is the one in Matthew Simons’ article, ‘7 Steps to Implementing Effective AI Governance’. The model I offer here is based closely on Matthew’s work, so I have kept my comments short. I strongly recommend you read his original article for the detail and insights he offers.

I have interviewed Matt for the OnlinePMCourses YouTube channel:

The AI Governance Implementation Process

I have adapted, in a minor way, the seven steps that Matt proposes are:

1. Understand AI Governance: Research the topic thoroughly
2. Build the Business Case for AI Governance: Matt simply argues for educating yourself about the benefits. However, as project professionals, we know that we need to justify the costs of any change we implement.
3. Define Your AI Ethics Framework: What matters to you from the dual perspectives of your industry sector and your prevailing culture?
4. Develop an AI Usage Policy: Here we get down to practical nuts and bolts. What will you allow and what will you forbid?
5. Consider Adoption of AI Governance Tools: What are the tools, systems, and structures you need to implement to properly govern AI usage? I recommend you work incrementally. Trying to implement too many new components at once will cause problems.
6. Foster Ongoing Engagement and Communication: As a project professional, you know all the channels open to you in implementing a change like this. Use as many as you can, to ensure the greatest levels of positive stakeholder engagement.
7. Build a Culture of Responsible AI: Again, with our change management and transformation hats on, we know about the roles of communication, consultation, and continuous learning in making this work.

To Matt’s seven steps, I’d add an eighth.

• Maintain Your AI Governance under Continuous Review: Adopt an adaptive, iterative, incremental approach, and never be complacent about the effectiveness of your processes.

AI Governance Implementation Resources

Matt Simons leads the business AI Catalyst Partners, which has some tremendous resources on its website, including a helpful download, their AI Strategy Canvas.

I would also single out the PMI’s excellent template document: Artificial Intelligence Governance Plan for Project Management. This is also a free download.

An AI Risk Management Framework

I outlined AI Risk Assessment and Management in the section above, AI Governance at the Enterprise Level. But, there are some special risks that we need to be aware of, and find active responses to. These include:

• Vendor Evaluation and Due Diligence: Evaluate vendors’ compliance with data protection laws, security protocols, and their approach to ethical AI.
• Data Handling and Privacy: Privacy safeguards should include strict data access controls and consent management, ensuring adherence to privacy laws.
• Ethical and Reputational Risks: I have covered these all, earlier in this article.
• Decision-making threats: This covers the transparency and accountability of AI-led decisions, and the impacts of poor decisions arising from flawed or biased data sets, or poorly-implemented AI algorithms.
• Monitoring and Compliance: Sustained compliance requires tracking AI performance against pre-defined metrics. Ensure continuous documentation and transparent reporting.
• Regulatory Risks: There is not just the risk of failing to implement processes and controls that address regulatory requirements. There is also the risk that regulation changes outpace your ability to track them and prepare for them.
• Integration and Dependency Risks: Assess how AI tools interact with existing systems and third-party services to anticipate potential issues.

Governance Considerations for Projects Using AI-Enabled Tools

All the risks and governance concerns above will trickle down to all levels of project-based working: portfolio, program, and project management. However, there are specific considerations we need to attend to. I expect this list to grow as I learn more. At the moment (winter 2024), I would draw your attention to:

• Integrating AI Governance into Project Management: Embedding governance early into project planning ensures AI tools are managed and monitored effectively from the start.
• Assessment Criteria for AI Tool Selection: Organizations should evaluate AI tools based on performance, data handling practices, and ethical standards.
• Vendor Due Diligence: Conduct in-depth reviews of AI vendors’ governance practices to ensure alignment with internal policies.
• Stakeholder information and consultation: I think it will be seen as good practice to ensure users, customers, and other stakeholders are aware of the role AI plays in your project, and the specific risks you are able to identify. This need may diminish, as the use of AI becomes more routine. But for now, its risks are front of mind and in the absence of open communication, rumor and speculation can lead people to dark places.
• Data Sharing Agreements: Clearly outline responsibilities related to data usage, privacy, and protection in agreements with partners and vendors.
• Monitoring and Auditing: Regular audits ensure AI tools comply with governance frameworks and meet expected performance benchmarks.

Implementation Guidelines

To address these concerns, implement strong procedures, including:

• User Access Controls: Restrict system and data access based on roles.
• Testing and Validation Requirements: Ensure tools undergo rigorous quality checks before deployment.
• Ongoing Maintenance: Schedule regular updates to address software vulnerabilities.

Data Management in AI Projects

A particular concern, for some types of project, will be data management. Effective data management includes:

• Data Collection and Quality Assurance: Vet the source and quality of data used.
• Privacy Protection: Ensure informed user consent and compliance with privacy laws.
• Data Retention Policies: Establish retention periods aligned with both operational needs and legal requirements.

Project-Specific AI Audits

Secure periodic project audits to evaluate the impact of AI on project outcomes and adherence to ethical standards.

The Challenges and Future of AI Governance

Who really knows what is coming around the corner? What we do know is that some changes have come into view and are inevitable.

• An Evolving Regulatory Landscape: As AI regulations continue to evolve, organizations must remain agile, frequently revisiting governance practices.
• Development of International Standards: The ISO/IEC 42001 standard applies to organizations implementing and managing AI systems. Adhering to international standards like ISO AI helps create a unified governance approach that facilitates global operations.
• Scalability of Governance Frameworks: Organizations will need to continuously adapt their governance models to scale as their AI capabilities expand. This will be a particular challenge due to both the evolving regulator landscape and…
• Rapid Technological Advancements: The pace of AI development can outstrip regulatory and ethical frameworks, leading to dilemmas in implementation.
• Ethical and Safety Dilemmas: AI decisions will increasingly impact human lives. Examples are automated hiring systems and autonomous factory processes that involve moving vehicles and machinery. These will need ongoing evaluation to avoid unethical or unsafe outcomes.

Conclusions about AI Governance

Robust AI governance is essential for aligning technological innovation with ethical principles and legal requirements. Enterprises and project teams must develop and adhere to governance structures that foster trust, transparency, and sustainability.

AI Governance Best Practices

Best practices will emerge and evolve. These include things like:

• Collaboration between departments like IT, HR, legal, and business units ensures holistic governance and aligns practices with organizational goals.
• Continuous Learning and Adaptation so AI governance evolves with changing technologies. Investing in training programs helps keep teams up to date with the latest standards and techniques.
• Adopting governance tools like AI Auditing Software to track algorithmic decisions and identify potential risks, and Explainable AI Platforms that enhance transparency and build trust.

Proactively investing in AI governance will position your organization to lead in a responsible, innovative way. As AI evolves, so should the commitment to comprehensive governance, ensuring AI’s benefits are maximized while minimizing its risks.

Learn More about Project Governance:

• What is Project Governance? | Video
• Project Governance 101: A guide to the governance of projects
• Navigating Success: How to Deliver Excellence with Good Project Governance
• Agony Angels: Setting up Project Governance – with Rich Maltzman
• 5 Project Governance Tips | Video

What are your thoughts about AI Governance?

This is all new to many of us. So, I’d love to read (and respond to) as many ideas, observations, and questions as you have.