Proactively governing AI risk before it becomes business risk: An integrated framework for companies

Copyright and IP: The risk from outside

Commercial use of AI-generated text, logos, or figures may infringe third-party copyright. However, the basis for infringement may have started much earlier. If the AI system was trained on copyrighted information, the output may come too close to the copyright protected content.  The business user usually only sees the final result. The vendor or model provider controls the data and training processes behind it. Yet it is the corporate user who may face legal exposure when using the AI model’s output. This does not mean companies should avoid using AI-generated content. It means they should select trusted vendors, set rules for use of AI-generated content, train users, and check output before publication or commercial use.

Confidential information and trade secrets: The prompt risk

Especially for companies in technology-intensive sectors, some of the most valuable information is not protected by patents. It is kept as confidential information and trade secrets. Secrecy is what protects its value.

AI use may put that secrecy at risk. Employees may prompt AI with sensitive information to make their work easier. Yet, if the information is entered into an AI system without proper safeguards, the company may lose control over it. If the information becomes public, it may lose its competitive value. This can harm the company’s own business and may also create liability for breaching confidentiality obligations toward others. AI prompting with sensitive information needs proper safeguards: confidentiality obligations, zero-retention commitments from AI vendors, clear prompt rules, and user training. Without them, convenience could quickly become very expensive.

International arbitration: The enforceability risk

Many international business contracts contain arbitration clauses. One main reason is  the advantage of arbitration over ordinary court litigation: parties obtain one award that can, in principle, be enforced internationally.

AI use can support arbitration proceedings through case management, legal research, document summaries, evidence evaluation of evidence and document drafting.[1] Yet, if AI  is used without human review and it creates incorrect statements, national courts may refuse enforcement of the arbitral award.[2]

Contractual rights may then exist on paper but offer little practical commercial protection. To mitigate the risk, parties and arbitrators should agree on transparency and human oversight and accountability.

Most companies manage these risks in a piecemeal manner: by focusing only on one law, one country, involving one specialist team. For instance: copyright risks are treated as an intellectual property issue and managed by the intellectual property group; confidentiality risk is treated as a data protection issue and moved to the cybersecurity department;  risk of AI use in arbitration risk is left for the  litigation counsel to resolve.

This approach has clear limitations. International corporations rarely operate in only one legal system and AI is rarely used for just one purpose by just one department. Companies operating cross-border would, therefore, benefit from an integrated AI risk governance framework which can be applied consistently across use cases and departments. This article draws on recent research[3] and presents 10 common AI risk mitigation measures (Figure 1), which are applied within one integrated framework (Figure 2).

10 measures for reducing risk

The starting point is risk assessment: the phase in which risks are identified and evaluated. This includes assessing compliance with applicable AI laws and of the specific risks created by the particular use case. Without understanding what the extent of risk is, it is not possible to identify risk mitigation principles. This should be supported by documentation and transparency, to clearly document the allowed AI use, the risk assessment, the responsibilities, and safeguards. Companies should also carefully select their vendors and AI-systems to mitigate risks introduced by the design and training of the AI-system.

The next layer is day-to-day control. Prompt checks and filters help prevent users from entering confidential, protected, or risky questions (e.g., triggering copyrighted output) into AI-systems. Output checks and filters reduce the risk that AI-content is inaccurate or infringes (copy)rights. Human oversight of the proper functioning of the AI-system remains essential, especially where AI supports legal, commercial, or strategic decisions. Training helps make these controls work in practice, because the users need to understand the boundaries and risks of AI-use.

Contracts may be used to bind others to apply these measures and to allocate liability where appropriate. Insurance may help to absorb financial exposure for risks that cannot be fully prevented, controlled, allocated, or absorbed.

From principles to AI risk governance

The 10 measures of Figure 1 work best when they are part of a strategic, cross-functional and cohesive AI risk governance framework. A vendor checklist, a prompt policy, a training program, and a contract with the AI-vendor will likely leave gaps if they operate in isolation.

Such integrated framework is proposed in Figure 2. It starts with the question of where AI can create business risk – the risk assessment. Once assessed, the company can decide how the risk should be governed. Governance then turns into prevention and control. Prevention aims to reduce the risk before it occurs. Control checks whether the rules are actually followed –  and takes action where they are not. Allocation of risk serves to make others responsible and liable for adherence to the rules. Finally, absorption can help reduce the business risk.

The proposed AI risk governance framework does not remove all risk. Like with all business activities, residual risk always remains. That should not stop companies from using AI. With the right safeguards in place, use of AI may increase profitability without increasing liability. The framework turns AI risk from scattered legal concerns into a manageable business process.