Vice President, Risk Advisory
Artificial intelligence is moving quickly from experimentation to everyday business use. Employees are using AI to summarize information, draft content, analyze data and automate routine tasks, while organizations are evaluating more sophisticated applications that can affect financial reporting, regulatory compliance, operations and decision-making. The technology can create meaningful efficiencies, but it also introduces risks involving data privacy, cybersecurity, intellectual property, accuracy, and accountability.
Effective AI governance does not mean eliminating those risks or preventing employees from using new technology. It means understanding the risks, establishing appropriate controls, and periodically evaluating whether those controls remain effective.
AI governance needs a clear owner, whether that is IT, legal, compliance or a cross-functional group. That owner decides who approves new tools and uses, who evaluates risk and who answers employee questions. Senior leadership should set how much AI risk the organization will accept and receive periodic updates on how AI is being used.
Expectations should be captured in a short, practical AI use policy that employees actually read.
AI is often already in the building. Employees may be using personal accounts on free tools, and AI features are now built into email, productivity suites and other software the business already licenses. Start with an inventory of which tools are in use, by whom and for what purpose. Without it, you are governing only the AI you know about.
Before approving an AI tool for employees to use for company work, review how it handles data, its security practices and its contract terms. Know whether the vendor can train its models on your information, who owns the output and what happens to your data when the relationship ends. The analysis can then be used to guide the effective implementation of the tool to best protect the company. Keeping and publishing a list of approved tools also gives company personnel a clear view of what AI tools are to be used and how.
Drafting a newsletter with AI is not the same as using it to screen job applicants or prepare figures for financial statements. Higher risk uses need more review, and a named person should check AI output before anyone relies on it. That oversight matters even more as AI tools begin to send emails, update records or initiate transactions on their own.
Expectations should be captured in a short, practical AI use policy that employees actually read.
Employees need to know what they can and cannot enter into an AI tool. Rules should cover confidential business information, personal data, financial records and intellectual property, and explain when information must be removed or kept out of AI systems entirely.
AI can repeat biases found in the data it learned from. When it is used in hiring, lending, pricing or other decisions about people, existing anti-discrimination and consumer protection laws still apply. AI-specific laws are also emerging and changing at the state level and abroad. Organizations should also decide when to tell customers they are interacting with AI, and avoid overstating what their own AI can do.
Training should cover approved tools, data rules and the need to verify AI output, which can sound confident and still be wrong. It should also warn employees about deepfake voice and video scams that impersonate executives and reinforce one simple habit: confirm unusual requests through a separate, known channel.
Decide in advance how employees report AI problems, who investigates and when customers or regulators must be notified. Then revisit the program regularly. Vendors change their terms, uses evolve and regulations shift. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide useful structure.
Before expanding AI use, leadership should be able to answer:
☐ Who owns AI governance, and is leadership informed?
☐ Do we have a written AI use policy?
☐ Do we know where AI is already being used?
☐ Have our AI tools and vendor contracts been reviewed?
☐ Which uses are high risk, and who reviews the output?
☐ Are data-handling rules clear?
☐ Have we addressed fairness and legal requirements?
☐ Are employees trained, and do we have a plan for when AI gets it wrong?
Martindale Consultants’ Risk Advisory team helps organizations assess AI risks, evaluate controls and build practical governance programs, from AI strategy and secure deployment to ongoing oversight. If your organization is adopting AI or expanding its use, we can help you move forward with confidence. The goal is not simply to reduce risk, but to give leadership a clear picture of where AI fits, what controls it needs and how those controls should evolve as the business changes.
Fill out the form below, and we will be in touch shortly.
Fill out the form below, and we will be in touch shortly.