Unapproved AI use in Business. What is Unsanctioned AI Use?

Unapproved or unsanctioned AI use in business refers to situations where employees or teams use AI tools or systems without explicit approval from management or compliance teams, with no oversight and no alignment with the organisation’s policies and objectives. This can manifest in many ways.

Examples:

• Employees using personal AI applications for work tasks.
• Employees quietly use unapproved public AI tools unknowingly inputting confidential company data, client information, or proprietary IP into models that can absorb this information for further training. 
• Using AI tools to analyse the business’ confidential data, automate processes, or enhance customer interactions without following established protocols. 
• Teams developing AI-driven solutions without IT involvement or governance.
• Sharing sensitive company data with external, unvetted AI platforms, e.g. random web-based generative AI sites or browser extensions, accessed through personal accounts.

Risks:

• Data privacy and exposure to data breaches or leaks. 
• Visibility into exactly what corporate information—such as internal documents, proprietary sources, or customer data—is being shared with which AI models. 
• Compliance Issues: Violations of legal cyber security regulations, like the GDPR—General Data Protection Regulations.
• Quality Control: Inconsistent results due to lack of oversight.
• Reputation Damage: Trust erosion among clients and partners.

Effective strategies to address unsanctioned AI use in your business:

Addressing unsanctioned AI use is crucial for maintaining data integrity, ensuring compliance, and fostering a responsible AI culture in the workplace. By implementing the following strategies, businesses can mitigate risks and harness AI’s potential effectively:

• Encourage open communication: Foster a culture where employees feel comfortable discussing AI tools they wish to use and can seek guidance from management.
• Create a compliance framework: Assemble an internal steering committee with representatives from various key departments to oversee AI initiatives and to evaluate new tools and ensuring they align with business objectives. Include leaders from data science, legal, compliance, operations, HR, and business units.
• Identify existing use: Discover what AI tools your employees are already using to prevent blind spots. Identify any "shadow AI" (unapproved applications) currently operating within the organisation.
• Audit usage risks: determine the data types being fed into these systems and potential compliance exposures.
• Establish clear policies on acceptable AI use: outline what is allowed, what is off-limits, and how to request approval for new technologies.
• Promote approved tools: Provide access to a catalogue of vetted AI tools that employees can use.
• Educate employees: train staff about the potential risks of unsanctioned AI use and the importance of adhering to company policies.
• Document and communicate policies.
• Implement monitoring systems: software to track the use of AI tools within the organisation and real-time triggering of data loss.
• Regular audits: Conduct periodic reviews of AI usage in the organisation to identify any unsanctioned applications and assess compliance.

The Takeaway: 

Rapid innovation requires proactive risk management. Safely establishing AI governance policies in your business requires a structured approach and the most effective path involves adopting Standardised Frameworks. Adapt your policies to align with established international standards to ensure comprehensive coverage rather than building your governance strategy from scratch.

• NIST AI RMF: Leverage the NIST AI Risk Management Framework to identify, measure, and mitigate potential algorithmic harms.
• ISO/IEC 42001: Consider adopting or mapping processes to this international AI Management System Standard.

Conclusion:

Businesses should take heed of the fact that AI governance is not a one-time setup; it requires continuous monitoring as and when regulations and models evolve.