Feedback / considerations relevant to the AIAF
Adoption decision stages:
Knowledge – For any organization to explore the adoption of AI, it would be vital to understand the governance constraints / regulations around specific data types and its intended usage. Such as personal data regulated under POPIA (Protection of personal information Act). Legal constraints around the generation, usage and commercial value of all IP (Intellectual Property) generated as a result of adopting a successful AI framework should be understood and clarified right at the outset. Not only the local governance / regulatory laws need to be well understood, but also that of all countries in which the organization functions or have stakeholders in that would be either data sources, processors or consumers. From a legal perspective, Data Processing Agreements with all key stakeholders (data sources, processors, consumers, custodians) should be in place right from the start.
Persuade – One of the first steps in establishing a basis for effective persuasion, could include the definition of feasible Use Cases demonstrating how the adoption of AI could either mitigate risks or unlock opportunities for the organization. From an ISO 9001 perspective, using the Stakeholder Analysis of the organization could be helpful in this exercise. For each stakeholder, the questions can be asked how the adoption of AI can enable the organization to mitigate risks or unlock opportunities related to each key stakeholder. For example, not only understanding a client’s current requirements, but being in a position to predict its future requirements, could enable the timely recruitment / upskilling of critical resources to offer a service superior to any competitor, at the perfect timing. In all cases, Use Cases should be supported by its business impact, feasibility to execute and if the required data types are / will be available to implement each Use Case with the intended outcomes. Use Cases should be prioritized to demonstrate early success / quick wins first, followed by more complex and resource intensive Use Cases once momentum has been secured.
One aspect of an ISO 9001 compliant organization would be to leverage the principles and objectives of Chapter 10 of the standard, namely Continuous Improvement. Tangible benefits of an AI platform enabling automation (less human error, time saving) and quality (self-correcting, predictive analysis, pattern recognition to avoid risks / identify opportunities) of business processes and services could be strong arguments driving the funding and adoption of an AI platform.
Confirmation – Use Cases defined during the persuasion stage should be followed through with solid evidence of benefits achieved and lessons learned. A critical part of refining the ideal AI platform is to not only understand what works, but also to have deep insights into what does not work and which pitfalls to avoid.
Implementation – In organizations maintaining ISO 9001 certification, the anchoring of all decisions in formal processes would be an essential mechanism to ensure commitment for implementation in a consistent manner, thereby ensuring a better chance of achieving the intended benefits. Where possible, all decisions supporting an AI adoption strategy should be written into process to ensure alignment in architecture, compliance, roles, responsibilities and KPIs.
Considerations:
Technological – It would be important to understand which tools supporting the adoption of an AI platform are already in use within the organization and which architectural blueprints exist to get going and would in future either inhibit or support the expansion of such toolsets as the AI adoption strategy gains momentum. Processing power, storage capacity of all systems and throughput of its supporting networks and interfaces need to be well understood to manage any potential performance issues that an AI platform might impose on existing systems. End users frustrated by a drop in performance of systems as a result of AI integration would be a formidable force to contend with in any AI adoption strategy.
Environmental – From an IT-Security perspective, various aspects of all applications and data sources need to be evaluated in terms of its Information Classification into various risk categories, ranging from low to high. Pilot stages need to be focused on low risk applications and data sources until confidence is established around IT-Security robustness of the AI platform and any unforeseen vulnerabilities properly mitigated. All applications / systems integrated into a planned AI platform should undergo an IT-security Conformity Statement, with all critical items accounted for. Penetration tests of applications and data sources are required to ensure adequate levels of security before adding an AI layer. Thorough Identity and Access Management policies and procedures must at all times be implemented and maintained to prevent unauthorized access to the data sources as well as the AI insights and IP generated by the AI platform.
Organizational – The organizational risks and opportunities emanating from the implementation of an AI platform should be thoroughly explored and the consequences / impact thereof well understood upfront. All existing risks that could be mitigated, as well as new risks arising should be weighed up in terms of probability and impact to determine suitable risk strategies upfront. For example, just as effective as a successful AI system could be in the correct hands to gain deep insights into organizational strengths and weaknesses, it could be detrimental in the wrong hands when leaked to the organization’s key competitors.
TISAX certification (based on ISO 27001, Information Security Management) of the organization itself, as well as strategic decisions about insisting on TISAX certification as prerequisite from all external stakeholders or business partners (clients, service providers, etc.) could be a fairly costly, but very prudent approach to cover a myriad of IT-Security requirements and mitigate a wide range of risk around Information Security topics upfront, as solid basis for rolling out an AI platform.
Preventing a potentially oppressive environment as a result of implementing AI:
The sole aim of any AI platform should be to create value for all stakeholders. If this strategic objective is built into the Product Vision of AI Initiatives and properly anchored in KPIs ensuring such value, an oppressive environment is highly unlikely. An example of how such a vision could be practically lived out, is the active upskilling of employees in AI technologies and systems where their existing jobs might become redundant due to automations materializing from AI automations. Such employees would embrace AI as growth opportunities when made part of the AI adoption strategy instead of feeling threatened / victimized by the adoption of AI. Proper Data Processing Agreements would ensure that data is only used for its intended purpose and personal data should always be governed according to the POPIA to ensure that the rights and privacy of individuals are always protected. A culture of embracing change and continuous improvement would welcome new technologies like AI and the benefits it holds for all stakeholders. Incentives for innovate ideas and internal competitions could foster a healthy and positive outlook on AI and the strategic benefits it yields for organizations and ultimately its employees. The success stories of the AI journey should be communicated frequently and transparently and where possible, the benefits achieved for the organization should be shared with its employees to make the benefits tangible right down to individual level.
