Ethics, AI & Risk Management: Finding the Sweet Spot in Your GRC Framework

By Anna Nicolis
for the 2024 Risky Women Writing Competition, presented in partnership with Bovill Newgate

This article examines the importance of defining AI ethics within organizations, emphasizing its role in decision-making and relationships between people and AI systems. It highlights key issues like bias, accountability, and privacy while advocating for a proactive approach to ethical risk management. By setting clear ethical standards, companies can navigate regulatory landscapes, protect their reputations, and foster trust with stakeholders.

Whenever I bring up “ethics” in conversations about AI governance, I’m often met with polite nods that signal, “Sure, that’s nice.” It’s a reaction I’ve grown used to—AI ethics, much like ESG, can sometimes be dismissed as a feel-good concept, something that looks great on a corporate webpage but doesn’t necessarily drive business decisions.

But what does “ethics” actually mean? The word “ethics” is derived from the Greek word ethos, meaning “character,” and in the Western legal context, it has come to define how individuals choose to interact with one another. At its core, ethics is about how we make decisions and navigate relationships—whether those are between people or, increasingly, between people and the AI systems we build.

The word “ethics” does not come with a prescribed set of values on its own. It’s not a one-size-fits-all, universally accepted guidebook. Instead, ethics is about a practice, a process of determining what is right or wrong.

Saying that your organisation values “AI ethics” without defining what that means in practice is like saying you care about risk management without ever setting any parameters or controls.

So what is AI ethics about?

AI ethics has emerged as a response to the potential harms AI systems can cause through misuse, poor design, or unintended consequences[1]. Key issues include:

1. Bias and discrimination: AI systems can replicate societal biases, amplify discrimination, and produce unequal outcomes due to flawed data, design choices, or unrepresentative datasets.
2. Denial of autonomy and accountability: individuals affected by AI decisions may struggle to hold responsible parties accountable, leading to violations of rights and autonomy.
3. Opaque and unjustifiable outcomes: AI models often operate in ways that are difficult to explain, which can lead to unjust or biased outcomes, especially when discrimination or inequality is embedded in the data.
4. Invasions of privacy: AI development and deployment can infringe on personal privacy by utilising data without consent or profiling individuals without their knowledge, limiting their ability to control their personal information.
5. Unreliable or poor-quality outcomes: poor data management and negligent design can result in AI systems that produce unsafe or low-quality outcomes, damaging public trust and potentially causing harm.

Setting a risk appetite for AI ethics risk

Of course AI ethics is hard to pin down in a business context. We’re all familiar with setting risk appetites for financial or operational risks. But why not treat ethical AI risk with the same seriousness? Define your company’s tolerance for ethical grey areas concerning the use of AI. Where do you draw the line?

Here are some examples of risk appetite statements for AI ethics risks:

1. Bias and fairness: “We have zero tolerance for the use of AI systems that produce biased outcomes in decisions relating to recruitment, promotions, or customer access to services. All AI systems must be rigorously tested for fairness and bias before deployment.”
2. Explainability: “Our risk appetite for AI decision-making opacity is low. We require that all high-impact AI systems be explainable, with clear and understandable rationales for their decisions available to both internal and external stakeholders.”
3. Data privacy: “We have no tolerance for breaches of data privacy. All AI systems must handle personal data in strict compliance with data protection regulations and be transparent in their use of individuals’ data.”
4. Human oversight: “We maintain a moderate risk appetite for automated decision-making but require human oversight in all high-stakes decisions. Automated systems must have clear escalation processes for human intervention when necessary.”

The tension between ethics and regulatory compliance

There is often a gap between ethical standards and regulatory requirements, AI governance efforts are not immune to it. Regulations, such as the EU AI Act and Biden’s Executive Order on Safe and Responsible AI[2], provide a necessary foundation by setting legal expectations around AI transparency, accountability, and bias mitigation. However, these rules typically represent the minimum standards for specific AI use cases (e.g. “high risk” systems constitute the majority of the EU AI Act regulatory burden[3]).

The key question is whether to simply adhere to these baseline requirements or strive for a higher ethical standard. While following the law may keep you compliant, it won’t necessarily protect your reputation or build the trust needed for long-term commercial viability.

AI Ethics as a catalyst for proactive risk management

By centering discussions around AI ethics, dismissing myths it’s a somewhat ethereal concept, organisations can move beyond the confines of reactive compliance and minimal legal requirements. Focusing on ethical considerations encourages a more proactive approach to risk management, where potential risks are anticipated and mitigated before they escalate into crises.

Defining clear ethical boundaries within your organisation aligns internal stakeholders and fosters a culture of responsibility and transparency. This approach not only reduces the chances of ethical breaches but also strengthens the organisation’s ability to navigate evolving regulatory landscapes and technological advancements.

Ultimately, embracing AI ethics as a strategic element of governance transforms it from a nebulous concept into a practical tool that drives sustainable growth, safeguards reputations, and builds long-term trust with customers and investors.

References:

1 https://www.turing.ac.uk/sites/default/files/2019-08/understanding_artificial_intelligence_ethics_and_safety.pdf
2 https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/
3 https://artificialintelligenceact.eu/chapter/3/