• Nominate a senior leader as the overall AI governance owner

  The guidance recommends nominating an “AI governance owner” who will have oversight and responsibility to ensure responsible AI practices are implemented. Ideally, this should be someone who is sufficiently senior and has a firm understanding of AI capabilities and how to navigate risk. 

  Tip: If you don’t have a senior leader who is confident in overseeing AI use, this may be an opportunity to invest in specific training. 

• Adopt (or review and update) your AI Policy

  The Guidance helpfully provides an AI Policy Template and Guide, which you can tailor for use by your organisation. The AI Policy should set out how your organisation will responsibly use AI and navigate its risks, as well as clarifying roles and responsibilities.

  Consider whether this policy should be made public (similar to your Privacy Policy) to ensure that there is clear accountability in relation to your use of AI.

  It will be important to consider how your existing privacy, data governance and cybersecurity practices and policies will link to your AI policies and processes. 

  Tip: You may need to disclose specific risks of the AI systems you use, such as where AI models learned using commercially sensitive data or personal information or are used for decision making, in associated policies such as your privacy policy.

• Implement appropriate risk assessment and management processes (including ongoing monitoring or audit of AI systems)

  Prior to the deployment of an AI system, we recommend undertaking a suitable impact assessment. Consider developing and implementing an initial ‘threshold’ assessment template, as well as a long-form risk assessment template. 

  Tip: Check out the risk screening template in the Guidance as a starting point.

  These documents should be used to undertake an appropriately robust risk assessment prior to the adoption of an AI system, to consider and identify key stakeholder groups, assess potential impacts(such as unfair decisions or inaccurate or harmful outputs) and to identify appropriate risk mitigations.

  Similar to an effective privacy impact assessment framework, this process will support key stakeholders to undertake appropriate risk assessments as well as to identify key mitigation steps or strategies. 

• Develop an AI Governance Framework

  Similar to the concept of ‘privacy by design’, embedding a strong culture of AI governance and compliance from the outset will be protective over the long term. Even where it may take time to approve and implement a formal policy or risk assessment process, education, training and embedding core company  values around AI adoption can be done more quickly and will assist to amplify polices and processes as they are implemented.

  If you already have an AI Policy, the next step is to develop that policy into a broader AI Governance Framework. This should include criteria on how to determine whether the risks posed by certain AI tools are acceptable to your organisation, and consider potential harms.

  Your AI Governance Framework should establish a risk assessment triage system, document controls for those risks, and create a process for monitoring and reporting incidents.

  Tip: As always, training is key to ensure that your governance frameworks are embedded across the organisation and operate effectively.

• Manage your third party and supply chain risks

  There are a broad range of issues to consider when negotiating contractual arrangements or drafting contractual templates for procurement of technology solutions including AI systems. In particular, consider the ways in which your contract will address and allocate risk and responsibility in connection with the use of AI, including which party owns any data (including personal information) which forms part of an input or output, and intellectual property rights in the tools themselves as well as the outputs.

  Tip: Negotiate appropriate contractual provisions with suppliers of AI systems, to ensure suitable oversight and transparency, as well as to appropriately allocate risk. Consider what reporting or audit rights you require to ensure you can comply with your own legal obligations, as well as any commitments you have made in your own governance or policy documents.

Key takeaways 

New Guidance has been released by the Australian National AI Centre to support Australian organisations, no matter where they are on their AI journey.

Consider how the Guidance applies to your organisation, and work to implement each of the 6 key practices identified. Key action items include:

• Adopting an AI Policy or an AI Governance Framework. You may wish to adopt and tailor the AI Policy template which has been provided.
• Appointing a senior AI governance officer. Similar to a privacy officer, this role provides a single point of accountability and oversight for the responsible deployment of AI within your organisation.
• Refer to the Guidance as well as the pre-prepared template documents when assessing and implementing AI systems, or considering your broader AI compliance posture. 

Finally, do not ‘set and forget’. In this rapidly evolving area, it is critical to ensure you revisit your governance framework, policies and processes, and undertake regular reviews. Use the templates and questionnaire tools to streamline and simplify the process, and deliver appropriate training sessions to key stakeholders internally.