AI Governance Overview

Organizations are using new and innovative technologies to process large amounts of data, including Artificial Intelligence (AI) and Machine Learning (ML). As AI becomes more widespread, there is growing regulatory oversight and businesses need to ensure they are using AI ethically and compliantly. This requires embedding data ethics, privacy, and security practices by default into the use of AI across the business.

OneTrust AI Governance provides the visibility and control compliance teams and data scientists need to promote responsible use of AI and ML technologies. Once AI Governance inventories AI projects, models, and datasets, you can build relationships to better understand data flows, evaluate the risks, and demonstrate compliance with global requirements.

Module Benefits:

• Maintain an inventory of AI technology across your business

• Assess AI for bias, fairness, and transparency against global laws and frameworks

• Evaluate use cases, surface risks and govern every phase of AI development

Problems Solved by AI Governance:

Lack of Visibility

: Know where and how AI is used across your organization.

Risk Management

: Assess the risk levels of individual AI projects and technologies.

Ethical Concerns

: Address fairness, accuracy, and explainability in your AI models.

Regulatory Compliance

: Assists enabling compliance of your AI models with existing laws and standards.

Data Management

: Understand and control the data used to train your AI models.

Third-Party Risk

: Manage risks when incorporating AI models provided by external vendors.

A Project is an object type used to track where AI is deployed for business initiatives, applications or services in order to fulfill unique and specific business outcomes. The Projects inventory allows organizations to capture a detailed record of a system’s main optimization goal(s), purposes, or foreseeable uses of the AI system for improved project tracking and progress monitoring.

Models are the learning frameworks used to build and inform the AI/ML application. This object type helps users distinguish whether the model is of internal origin or from a third party, what risk stems from the use of the systems, and for what tasks this model is intended so organizations can properly identify how many models are in production.

A Dataset object helps keep track of a specific dataset used for building, training, or testing a model. It simplifies the way we understand and manage data used by AI systems. With this organizations can understand how the data used by AI is tracked, versioned, and annotated in the data source.

OneTrust has created comprehensive assessment templates to help organizations embed AI impact assessments based on common laws and frameworks into AI development and vendor onboarding. With customizable templates, automated workflows, and integration ability with the Notification Center, AI Governance easily becomes a familiar usage and extension of the OneTrust intelligence platform.

AI Intake Assessment

This questionnaire assists organizations in evaluating and managing risks in their AI projects, aligning with key AI regulations like the EU AI Act (Draft). It’s adaptable to many AI technologies, including generative AI systems.

Assessment List for Trustworthy Artificial Intelligence (ALTAI) Framework Checklist - 1.0

: This questionnaire is based on the European Commission's ALTAI framework, and supports the protection of people's fundamental rights by helping organizations assess the trustworthiness of their AI systems in development. This Responsible AI Assessment is best completed involving a multidisciplinary team of people. These could be from within and/or outside your organization with specific competences or expertise on each of the requirements and related questions. Among the stakeholders you may find, for example, the following: AI designers and AI developers of the AI system, Data scientists, Procurement officers or specialists, Front-end staff that will use or work with the AI system, Legal/compliance officers, and Management. Prior to self-assessing an AI system with this Assessment List, you may want to conduct a fundamental rights impact assessment (FRIA).

EU AI Act Conformity Assessment

: This assessment aims to provide a structure and a methodology to perform a Conformity Assessment (henceforth also referred to as 'CA') under the EU Artificial Intelligence Act (henceforth also 'AIA').

'Conformity Assessment' is defined under Article 3 of the AIA as the process of verifying and/or demonstrating that a High-risk AI system (henceforth, System) complies with the requirements enumerated under Title III, Chapter 2 of the AIA that include risk management system, data governance, technical documentation, record-keeping, transparency and provision of information, human oversight and accuracy, robustness, and cybersecurity.

EU AI Act Fundamental Rights Impact Assessment

: This assessment aims to provide a structure and a methodology to perform a Fundamental Rights Impact Assessment (below also referred to as 'FRIA') under the EU Artificial Intelligence Act.

A Fundamental Rights Impact Assessment (FRIA) is a mandatory exercise under the EU AI Act for certain deployers of high-risk AI systems. Its purpose is to evaluate and mitigate the potential harm these systems might pose to individuals' fundamental rights.

NIST AI Risk Management Framework (RMF) Playbook Assessment - 1.2

: The NIST AI RMF assessment template is based on the NIST AI Risk Management Framework (RMF) Playbook—a companion resource to the NIST AI RMF. Each question in this assessment corresponds to a subcategory of the NIST AI RMF, and contains suggested answer options by default based on the "suggestion actions" in the NIST AI RMF Playbook. The suggested answer options should be treated as prompts to assist in answering each question as fully and comprehensively as possible. In addition to the suggested answer options, respondents are encouraged to draft their own answers using the "other" option and the supplemental textbox provided.

Note:

To learn more about the NIST AI Framework, read our blog post here.

OECD Framework for the Classification of AI Systems Checklist - 1.0

: This questionnaire is based on the OECD Framework for the Classification of AI Principles, a user-friendly tool to evaluate AI systems from a policy perspective. It can be applied to the widest range of AI systems across the following dimensions: People & Planet;Economic Context; Data & Input; AI model; and Task & Output. Each of the framework's dimensions has a subset of properties and attributes to defineand assess policy implications and to guide an innovative and trustworthy approach to AI as outlined in the OECD AI Principles.

U.S. FTC

: This questionnaire is based on the U.S. Federal Trade Commission's Business Blog post "Using Artificial Intelligence and Algorithms." It aims to help organizations understand and evaluate the consumer protection risks of their use of AI and algorithms, namely, to help ensure that the use AI of tools is transparent, explainable, fair, and empirically sound, and to demonstrate accountability.

UK ICO AI & Data Protection Toolkit Checklist - 1.0

: This questionnaire is based on the UK ICO's AI and Data Protection Toolkit, and is intended to help guide two main audiences: (1) those with a compliance focus, such as data protection officers (DPOs), general counsel, risk managers, senior management, and the ICO's own auditors; and (2) technologist specialists, such as machine learning developers and data scientists, software developers/engineers, and cybersecurity and IT risk managers. While this guidance is written to be accessible to both audiences, some parts are aimed primarily at those in either compliance or technology roles and are signposted accordingly at the start of each section as well as in the text.

This questionnaire divides the risks and controls by high-level lifecycle stages to help as a guide to what risks and controls you should be considering at each stage. You can use this tool as a way to assess the risks to fundamental rights and freedoms of individuals. By undertaking these practical steps, risks to fundamental rights and freedoms are reduced and compliance with data protection law becomes more likely. Documenting your assessment of the risk and the steps you take to mitigate them can help you demonstrate compliance.