While the craze over generative AI, ChatGPT, and the fear of employees in the professions landing on breadlines in the imminent future may have subsided a bit, many concerns remain about how best to use and manage AI. Of course, these concerns are not specific to Fortune 500 companies.

A recent story in CIODive reports that most Fortune 500 businesses have identified AI as a potential risk factor in their SEC filings. As the article suggests, many organizations are grappling with how to use AI and derive a discernable benefit amid many present challenges. Perhaps the most critical challenge, as organizations toil to find and deliver effective use cases, is a lack of effective governance, leaving business leaders and risk managers concerned. No doubt, organizations below the Fortune 500 are facing the same obstacles, likely with fewer resources.

Putting a structure around the use of AI in an organization is no easy task. There are so many questions:

• Who in the organization leads the effort? Is it one person, a group? From what areas of expertise? With what level of institutional knowledge?
• As an organization, do we have a sufficient understanding of AI? How deep is our bench? Does our third-party service provider(s)?
• If we engage a third party to help, what questions should we ask? What should we cover in the agreement? Can we shift some of the liability?
• What is the ongoing quality of our data? Does it include inherent biases? Can we adjust for that?
• How do we measure success, ROI?
• Who is authorized to use AI or generative AI, and under what circumstances?
• How do we train the AI tool? How do we train employees or others to use the tool?
• Have we adequately addressed privacy and security of confidential and personal information?
• What kind of recordkeeping policies and procedures should we adopt?
• Have we appropriately considered potential ethical issues surrounding the development and use of the AI?
• How do we keep up with the rapidly emerging law and compliance obligations relating to the development and deployment of AI? What requirements are specific to our industry?
• How do we approach notice, transparency, safety, etc.?
• How do we track what different groups in the organization are doing with AI, the problems they are having, and the ones they may not be aware of?

On top of this list being incomplete, organizations also should be thinking about whether and how these and other considerations may be shaped based on the particular use case. That is, for example, deploying a generative AI tool to develop content for a marketing campaign likely has significantly different challenges to wrestle with than, say, permitting sales and other employees to use AI notetakers, or permitting the HR department to source, select, and assess candidates and employees in the workplace.

For sure, the development and deployment of AI will continue to face significant headwinds in the near future. While no governance structure eliminates all risk, addressing some of the questions above and others should help to manage that risk, which many organizations inside and outside the Fortune 500 recognize.