When change happens due to technological advancements or the introduction of change to legal or regulatory frameworks, the world around that change adjusts, and Risk and Compliance functions build out the necessary governance and controls to manage that change. 

With GDPR, we saw investment in governance, resources, and in technology to deliver compliance, alongside a shift in the way businesses operate. In the grand scheme of things those organisations that already had a strong respect for and approach to privacy didn’t feel significant disruption to their overall business model.

This time with Artificial Intelligence (AI), it’s different—everything is changing. Throughout the supply chain, the internal and external technology environment, threats, risks, client or prospective client requirements and expectations, and the way talent acquisition interacts with AI is fundamentally shifting from industry norms.

With such significant change, building out robust, scalable, efficient, and effective AI risk governance is a challenge. So, how do we accomplish this task when we have nothing static to anchor our governance activity?

Our answer is flexibility and focus, with one eye always on the future.

Systems and processes that allow for rapid change to accommodate the changing environment are essential. We must do something, but we also know that whatever we do will need to rapidly shift to keep up to date with the change around us.

Targeting our resources based on risk is essential, but this can only be done if we understand not just our risks, but also our client’s risks. Industry law, or sectoral regulatory guidance is in some cases moving much faster than comprehensive national AI law. Applying our effort to deliver a service that enables our customers to achieve their objectives is not just desirable, but a key part of what drives us and allows us to succeed.

Being aware of what might “be next” helps, but even better is preparing for it by building a framework that is scalable, and sufficiently robust so when changes are required—and they definitely will be required—then they won’t need a full redesign of the overall program.

Finally, people powered partnership isn’t just a company slogan. Ensuring you have the right people with the right skills to work in this new world is not optional—it’s essential. 

Prepare all your people for this change well before it’s needed, because if you don’t, you may be playing catch up for a long time to come.