Three lines of defense against risks from AI

Abstract

Organizations that develop and deploy artificial intelligence (AI) systems need to manage the associated risks—for economic, legal, and ethical reasons. However, it is not always clear who is responsible for AI risk management. The three lines of defense (3LoD) model, which is considered best practice in many industries, might offer a solution. It is a risk management framework that helps organizations to assign and coordinate risk management roles and responsibilities. In this article, I suggest ways in which AI companies could implement the model. I also discuss how the model could help reduce risks from AI: it could identify and close gaps in risk coverage, increase the effectiveness of risk management practices, and enable the board of directors to oversee management more effectively. The article is intended to inform decision-makers at leading AI companies, regulators, and standard-setting bodies.

How to design an AI ethics board

“…It is worth noting that some companies already have a function which is responsible for assessing the adequacy and effectiveness of their risk management practices: internal audit [146,147]. If the company already has an internal audit function, the additional value of an ethics board with similar responsibilities would be limited.…”

“…In addition to that, they need sound risk governance [15,92]. For example, they may establish a board risk committee, appoint a chief risk officer (CRO), and set up an internal audit function [146,147]. In this paper, we explore yet another way in which AI companies can improve their risk governance: by setting up an AI ethics board.…”