Leading the Future – New AI Governance Guidance for Australian Directors

ELEMENT

WHAT SHOULD BOARDS BE DOING?

Roles and Responsibilities

• Identifying the management and board individual/body accountable for AI decision-making.
• Identifying those involved in, and responsible for, AI system procurement, development and use.
• Considering whether decision-making processes applied by key accountable persons incorporate consideration of AI risk and opportunity.

People, Skills & Culture

• Verifying that management have assessed the organisation’s AI skills, capabilities and training needs, and implementing upskilling programs (including at the director-level).
• Discussing the potential for AI to impact the workforce and workforce planning.
• Considering how AI governance structures can incorporate a diversity of perspectives, including expert views, to aid diversity of thought and avoid ‘group think’.

Governance Structures

• Determining which existing or new board and management governance structure would most appropriately support AI oversight.
• Reviewing board and management committee charters to determine whether and how they incorporate AI issues.
• Considering how external experts can be leveraged within existing governance structures.
• Considering the nature and frequency of management reporting to the board/ relevant board committee.

Principles, Policies & Strategy

• Requiring that AI is considered and, where appropriate, embedded, within the organisation’s strategy. AI use should have a clear business value – ‘AI for AI’s sake’ should be avoided.
• Engaging with management to discuss how safe and responsible AI principles have been incorporated into relevant policies (such as AI/IT use, privacy, confidentiality and cyber security).
• Recognising that principles and policies need to be proactively implemented and enforced across the supply chain.

Practices, Processes & Controls

• Working with management to understand what controls are in place for AI use (e.g. risk appetite statement and risk management framework).
• Confirming with management that there are processes in place to assess supplier and vendor risk.
• Monitoring and regularly reviewing the effectiveness of controls.

Stakeholder Engagement &

Impact Assessment

• Identifying and engaging with stakeholders to understand AI’s impact and stakeholder expectations of AI use and governance.
• Confirming with management that AI system design and assessment processes incorporate accessibility and inclusion practices.
• Considering whether AI-generated results/outcomes are explained to stakeholders and whether an appeal process is available.

Supporting Infrastructure

• Confirming awareness of where, within the organisation, AI is currently being used.
• Verifying that management is aware of, and has a robust data governance framework in place to manage data collected and stored by the organisation to train AI systems.
• Focusing on increasing transparency to end users about how the organisation's AI systems use data.

Monitoring, Reporting & Evaluation

• Confirming that a risk-based monitoring and reporting system for mission-critical and high-risk AI systems is in place.
• Developing and implementing a monitoring and reporting framework with metrics and outcomes to track and measure progress.
• Considering seeking internal and external assurance.