Tackling Trust, Risk and Security in AI Models

Generative AI has sparked extensive interest in artificial intelligence pilots, but organizations often don’t consider the risks until AI models or applications are already in production or use. A comprehensive AI trust, risk, security management (TRiSM) program helps you integrate much-needed governance upfront, and proactively ensure AI systems are compliant, fair, reliable and protect data privacy.

If you have any doubt that AI TRiSM is needed, consider these six drivers of risk, many of which stem from users simply not understanding what is really happening inside AI models.

• Don’t just explain AI terms; be able to articulate:

  • Details or reasons that, for a specific audience, clarify how a model functions 

  • The model’s strengths and weaknesses

  • Its likely behavior

  • Any potential biases

• Make visible the datasets used to train and the methods used to select that data if that information is available to you. This can help surface potential sources of bias.

• GenAI can potentially transform how enterprises compete and do work, but it also injects new risks that can’t be addressed with conventional controls.

• In particular, risks associated with hosted, cloud-based generative AI applications are significant and rapidly evolving.

• As your organization integrates AI models and tools from third-party providers, you also absorb the large datasets used to train those AI models.

• Your users could be accessing confidential data within others’ AI models, potentially creating regulatory, commercial and reputational consequences for your organization.

• Specialized risk management processes must be integrated into AI model operations (ModelOps) to keep AI compliant, fair and ethical.

• There aren’t many off-the-shelf tools, so you likely need to develop custom solutions for your AI pipeline.

• Controls must be applied continuously — for example, throughout model and application development, testing and deployment, and ongoing operations.

• Malicious attacks against AI (both homegrown and embedded in third-party models) lead to various types of organizational harm and loss — for example, financial, reputational or related to intellectual property, personal information or proprietary data. 

• Add specialized controls and practices for testing, validating and improving the robustness of AI workflows, beyond those used for other types of apps.

• The EU AI Act and other regulatory frameworks in North America, China and India are already establishing regulations to manage the risks of AI applications.

• Be prepared to comply, beyond what’s already required for regulations such as those pertaining to privacy protection.