AI governance, From Denial To Discovery

AI governance is, in part, a discovery problem for cyber leaders - one that's already creating additional pressures on stretched teams. 

First there's the challenge of identifying where and how AI is already being used within the organisation, a process that Kevin Schawinski described as 'moving through the stages of grief, from denial to acceptance.' He recounted the story of a lawyer who discovered no fewer than 400 AI systems in use within their organisation, one-third of which were considered high-risk under the EU AI Act. 

A university CISO also shared their struggles negotiating with academic colleagues determined to operate their own AI systems outside of any central governance framework. Several cyber leaders have been locking down access to all public large language models (LLMs), often simply to buy time to work through governance issues.

Another issue is unwanted discovery. It was reported at the summit that a team had discovered employees searching for sensitive information, such as salaries and health data, which had been stashed within documents in obscure locations but surfaced easily by tools like Copilot. Few organisations have a truly robust framework for information classification and permissioning, and addressing this issue may require cyber teams to take on the role of knowledge managers.

The conversation also touched on how employers or employees might even weaponise AI discovery, using inferences based on co-workers' patterns of information creation or communication. With such rapidly emerging risks, the increased use of AI within enterprises is already placing additional strain on cyber teams and has the potential to be highly disruptive, often in negative ways. Still, leaders who embrace the new capabilities, rather than remaining in denial, will arrive at solutions more quickly. 

Jessica Figueras, Co-founder, CxB - Cyber Governance for Boards