AI Governance: A controls playbook with mappings to the European Union AI Act and the NIST AI Risk Management Framework

This book focuses on the governance of artificial intelligence (AI). Consistent with emerging regulations, the book defines "AI" in a broad sense to include traditional machine learning and newer generative AI use cases. The book is targeted at AI governance professionals who may be starting in the field and do not have deep experience. The book does not go into extensive detail on the math and statistics behind artificial intelligence.The book covers the following topics:Overview of AI governance18 case studies across financial services, information technology, healthcare, insurance, airlines, manufacturing, and other industriesAI governance framework with 13 components and 76 controlsDetailed explanation for each component and control with mappings to relevant regulations, industry standards, and technologiesFive business cases for AISample AI governance impact assessment for AI-enabled code generationThe book addresses five vectors of AI governance:People: Details emerging roles and groups, such as the AI executive sponsor, AI governance leader, AI oversight board, AI steward, and AI center of excellenceProcess: Adopts the AI governance framework with 13 components and 76 controlsTechnology: Maps specific controls to selected technologies and vendors, including Adversarial Robustness Toolbox (ART), Amazon QuickSight, Anthropic Claude, ChatGPT, Collibra AI Governance, Datacebo's Synthetic Data Vault (SDV), Dataiku, DataRobot, GitHub Copilot, Google Vertex, IBM AI Fairness360, LangChain, Microsoft Azure AI Content Studio, Microsoft Bing Content Credentials, Microsoft Copilot for Microsoft 365, Microsoft PowerBI, Microsoft Purview, Microsoft Purview Data Loss Prevention, Nightshade, and Projected Gradient Descent (PGD)Regulations: Links components and controls to numerous U.S., EU, and other regulations, including the California Consumer Privacy Act, As Amended and (Proposed) Regulations on Automated Decision-Making Technology; China 20 Data Measures; China Deepfakes Law; EU Artificial Intelligence Act; EU General Data Protection Regulation (GDPR); EU Directive 2016/2012 ("Web Accessibility Directive"); EU Directive 2019/882 relating to accessibility requirements for certain products and services; U.S. Americans with Disabilities Act; U.S. Civil Rights Act, Title VII; U.S. Copyright Act; U.S. Equal Credit Opportunity Act; U.S. Export Administration Regulations (EAR); U.S. Fair Housing Act; U.S. Federal Trade Commission Act; U.S. Health Insurance Portability and Accountability Act; U.S. Sherman Anti-Trust Act; U.S. Telephone Consumer Protection Act of 1991; and U.S. White House Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial IntelligenceIndustry Standards: Maps controls to industry standards, including AI Verify Foundation; Good Machine Learning Practice (GMLP) from the U.S. Food and Drug Administration (FDA), Health Canada, and the UK's Medicines and Healthcare products Regulatory Agency (MHRA); FDA Paper on Responsible AI; National Institute of Standards and Technology (NIST) Adversarial Machine Learning taxonomy; NIST AI Risk Management Framework; ORX for Operational Risk Management; and Saudi Arabia's National Data Management Office (NDMO)Going forward, the discipline of AI governance needs to evolve in several areas. Hackers will discover new attack vectors for AI models. The pace of AI technology advancements is accelerating. Governments are adding new regulations. AI governance will become more automated. Finally, there are several "unknown unknowns." With the rate of change in generative AI, this book will probably be outdated in three months. However, the book should provide AI governance practitioners with a baseline understanding of this exciting and emerging discipline. Read more