Risk management frameworks key to mitigating AI risks, says Ferma webinar

Responsible AI policies and risk management frameworks will be critical to navigating the complex technical and compliance challenges of artificial intelligence, according to a webinar hosted by the Federation of European Risk Management Associations (Ferma). The AI risk landscape is complicated, according to Dan Adamson, co-founder and chief technology officer at Toronto-based insurtech start-up Armilla AI. Regulation is developing quickly at an international, national and local level, while emerging standards and best practices are still being worked on. “This can all get quite complicated, so it is very important to have a touchstone [policy] or a bible that your corporation develops,” he said. AI is a broad field with different approaches and definitions that incorporates machine learning and neuron-based AI like large language models, explained Adamson. “For the purposes of risk management, it is important to take a broader perspective and have a broader definition, so that when you look at AI risks you can encompass or include those types of systems under the umbrella of risk management,” he said. In particular, organisations should develop a responsible AI policy as a foundation for AI risk management. This should include an inventory of AI models, and an assessment of model risk and materiality, as well as an acceptable use policy. It should also define the risk framework, controls and accountability for AI, Adamson advised. “Today, for the first time, your employees can use AI systems outside the procurement cycle – for example, they can swivel to ChatGBT or use AI in an [internet] search. So it’s very important that you incorporate AI acceptable use policies, either in the policy itself or in an employee policy,” he said. AI risk management is both important and different to normal practice, according to Barbara Mayer, risk management expert at SAP in Germany. Speaking on the Ferma webinar, she advised companies to build a “solid foundation” for AI today and “plan for the future”. “Establish security standards and AI policies to found a solid platform. You need at least to have in place a policy for data protection and privacy with focus on AI topics, and a special policy focusing on trust,” said Mayer. “Everyone is driving to be part of the AI world… If your AI system is not trusted by your customers, no one will use it. The key differentiator is to build an AI system and use it in a way that a customer can trust the data,” she said. AI is not like traditional software development because the outputs are not defined by a discrete path, but by the actions of a neural network, explained Adamson. “A lot of things can go wrong when you start to implement these in production, or against a specific use case… you need to think about the risks of these systems differently,” he added. The evolving nature of AI clearly creates risk, according to Anderson. For example, generative AI can give rise to privacy, bias and performance risks. Systems may be trained on data stets that leak data or contain bias, while AI systems can also produce hallucinations – whereby they generate convincing yet made-up outputs. “You need to be very careful and understand that performance is a big category [of risk],” he said. Reputational damage is the most important risk that materialises from using AI applications, according to Jos Gheerardyn, co-founder and chief executive of Netherlands-based AI model risk management platform Yields.io. “Many AI systems are built on complex algorithms, and because they are so complex it is very hard to understand how it came to a particular conclusion… It is very hard to detect whenever the system is biased as it is rather untransparent how conclusions are drawn. There are many metrics and controls you can put in to limit those risks, but still the fact that an algorithm is more of a black box remains an important issue,” he said. The huge amount of data used to train models is a big driver of AI risk, according to Mayer. Training large language models like ChatGPT may require upwards of ten trillion words, including real life data. This often means personal data that is subject to data governance, and would need consent under the GDPR. “You always need to keep in mind that AI does not think, it only predicts. It’s all about probabilities. And when something is based on probabilities, there will always be mistakes. And it is always based on past data, on the training data. So, you will always have mistakes, and whatever you do, you will have bias,” said Mayer. In addition, not everyone understands the difference between correlation and causation, she said. “We have to clearly show, and again and again explain, that correlation is not causality, and that is why we should never replace, but always use AI for assistance, and always keep the human in the loop,” she said. The process of developing AI use cases and systems that involve multiple stakeholders requires clear communication and processes, explained Gheerardyn. While systems may be purchased from third parties, they will almost always require quality data for training and fine tuning. And for some types of AI, testing can only take place in the real world, he said. “When you build use cases, it is extremely important to define in what context it will be used in order to identify when the AI application is fit for purpose. In the context of generative AI applications like ChatGPT, this may be harder, as it is harder to control the inputs and questions that users will ask the system,” said Gheerardyn.

Risk management frameworks key to mitigating AI risks, says Ferma webinar

Want to read this article?

Read Next

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

Want to read this article?

Read Next

AstraZeneca places innovative outcomes based policy that covers interconnected risks

40% of ESG investment funds in Europe accused of greenwashing

Talanx brings forward targets in new sustainability strategy

German insurers brace for rising fraud cases

FM Global reveals record $1.4bn renewal credits

Related Articles