Addressing Artificial Intelligence Threats and Risks from the Board of Directors Perspective Using COBIT 2019

Author: Luiz Claudio Diogo Reis, CISA, CRISC, CDPSE, COBIT 5 & 2019 Certified, Marcos Sêmola, CISM, CIPM, CDPSE, PCI/DSS, ISO27k LA, IAPP Vanguard Award LA 2023 and Paulo Sergio Pagliusi, Ph.D. in Information Security - RHUL, CISM, C|CISO, LA7799
Date Published: 2 April 2024

In the era of rapid technological advancement, artificial intelligence (AI) stands as a beacon of innovation to drive transformative changes across industries through value aggregation by improving performance and achieving a sustainable competitive edge.

An effective AI approach requires a thoughtful initiative to integrate this technology into the core business strategy to ensure it is aligned with the organization’s mission, goals and values. Understanding AI challenges, threats and risks is imperative for board members to steer organizations toward sustainable growth while ensuring ethical practices and robust governance.

From this perspective, this blog post highlights an executive overview of AI: a board of director’s roles and challenges with AI risks and a set of good practices based on the COBIT 2019 framework to guide the board in evaluating, driving and monitoring AI corporate governance.

Understanding the Ethical and Strategic Implications of AI

AI is core to organizations; thus, it represents a paradigm shift in how to approach problem-solving, decision-making and automation within various industries. From machine learning algorithms to natural language processing systems, AI technologies are increasingly being integrated into businesses to enhance efficiency, drive innovation and gain competitive advantage. However, adopting AI also brings challenges for executives and board members alike.

One of the key principles that requires executive comprehension is the ethical implications surrounding AI. As AI systems become more sophisticated and autonomous, questions arise regarding issues such as data privacy, algorithmic bias and the ethical use of AI in decision-making processes. Thus, executives must navigate these ethical complexities to ensure AI technologies are deployed responsibly and aligned with their organization’s values and principles.

Another critical aspect revolves around the strategic implications of AI adoption. From identifying opportunities for AI integration to assessing potential risks and mitigating challenges, executives play a pivotal role in shaping the strategic direction of AI initiatives within their organizations. This affects not only understanding AI’s technical capabilities but also its broader implications for business models, operations and competitive positioning.

Furthermore, executives must consider the regulatory landscape surrounding AI, as governments worldwide are increasingly implementing policies and regulations to govern AI’s ethical and legal use. By focusing on these regulatory developments and ensuring compliance with applicable laws and regulations, executives can mitigate legal risks and foster trust among stakeholders.

In essence, the structural executive comprehension of AI encompasses a multifaceted understanding of the key principles, ethical considerations, strategic implications and regulatory requirements associated with AI technologies, as shown in Figure 1.


Figure 1: Crucial executive aspects concerning AI

By properly framing these aspects, executives can effectively navigate the complexities of AI adoption and harness its transformative potential to drive sustainable growth and innovation within their organizations.

Multiple AI Layers Overview

AI has become a universal term woven into the fabric of our daily lives and organizations´ business. From virtual assistants like Siri and Alexa to personal recommendations on Netflix, AI’s invisible hand shapes the experiences in several ways.

To assist board members from a technical perspective, this blog post explore the four fundamental approaches fueling AI´s advancements: RAG, ASM, Multi-Model AI and Cognitive Architectures. 𝗥𝗔𝗚 (𝗥𝗲𝘁𝗿𝗶𝗲𝘃𝗮𝗹-𝗔𝘂𝗴𝗺𝗲𝗻𝘁𝗲𝗱 𝗚𝗲𝗻𝗲𝗿𝗮𝘁𝗶𝗼𝗻) merges neural models with external data for richer AI interactions; 𝗔𝗦𝗠 (𝗔𝘂𝘁𝗼𝗿𝗲𝗴𝗿𝗲𝘀𝘀𝗶𝘃𝗲 𝗦𝗲𝗾𝘂𝗲𝗻𝗰𝗲 𝗠𝗼𝗱𝗲𝗹𝘀) powers sequence understanding and prediction, refining AI accuracy; 𝗠𝘂𝗹𝘁𝗶-𝗠𝗼𝗱𝗲𝗹 𝗔𝗜 integrates diverse models for versatile, complex problem-solving; and 𝗖𝗼𝗴𝗻𝗶𝘁𝗶𝘃𝗲 𝗔𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲𝘀 designs AI to mimic human cognition, enhancing autonomous decision-making. In summary, Figure 2 summarizes AI approaches concerning these components.


Figure 2: AI's four fundamental components

AI’s multiple layers show that businesses can explore the multifaceted applications of AI systems to achieve stakeholders’ needs, develop innovative solutions and improve performance enhancement. However, board members should bear in mind that AI’s emerging risks are inherent to its essence, and they should be identified and addressed.

What is the Board of Director’s Role in AI?

The board of directors plays a crucial role in organizations by setting corporate strategic directions and ensuring alignment with stakeholders´ interests. The board’s duties include approving budgets, overseeing the CEO, ensuring legal compliance, managing risk and upholding ethical standards. The board contributes to the organization’s long-term success and public trust through effective governance and oversight.

Concerning AI, the board of directors plays a key role in guiding and overseeing an organization’s engagement. This involves setting strategic directions for AI initiatives; ensuring that AI technologies are integrated and aligned with the organization’s mission, values, and ethical standards; ensuring the organization’s use of AI complies with regulatory standards and industry best practices; fostering a culture of innovation and responsible AI use; and improving the decision-making processes by creating new opportunities for growth and competitive advantage.

Based on the board of director’s roles within AI systems, the board must assess the potential risks and benefits associated with AI systems, concerning the organization’s image, ethical issues, privacy and sensitive data, strategic and financial concerns, cybersecurity incidents, and social implications.

AI Threats and Risks for the Board to Consider

Table 1 summarizes the key concerns the board of directors should have regarding AI threats and risks, by emphasizing the importance of governance in ensuring responsible and strategic use of AI technologies.

Table 1: AI threats and risks concerning the board of directors’ roles

Good Practices for the Board of Directors Based on COBIT 2019

The COBIT 2019 Governance and Management Objectives, widely adopted, provides a comprehensive governance and management guidance for Information and Technology (I&T). This framework can be tailored to comply with AI businesses and IT needs. Thus, to address AI systems challenges, threats, and risks from the board of director’s perspective, this blog post proposes an approach based on COBIT 2019 Framework, as described in Table 2.

Table 2: COBIT 2019 tailored to AI systems from the board perspective

This comprehensive alignment with COBIT 2019 framework ensures a holistic approach to AI governance and management, addressing ethical, legal, operational and strategic challenges. It positions the board of directors to oversee AI initiatives effectively, ensuring they contribute positively to the organization’s goals while managing related risks responsibly.

The Ultimate Goal: Trusted and Responsible AI Operations

The advent of AI technology brings a complex array of threats and risks that require careful consideration. The board of directors, equipped with a deep understanding of these challenges and guided by COBIT 2019 Framework, can play a pivotal role in steering their organizations toward responsible and effective AI planning and operation.

By implementing robust governance structures, ensuring alignment with organizational objectives, advocating for ethical AI use, and fostering a culture of continuous learning and monitoring, board members can harness the potential of AI while mitigating its risks, ensuring a sustainable and prosperous future for their organizations.

Additional resources