Governance and compliance recommendations for Artificial Intelligence in Business Management

Recomendaciones de gobernanza y cumplimiento para la inteligencia artificial en la gestión empresarial

Esta obra está bajo una Licencia Creative Commons Atribución-NoComercial-CompartirIgual 4.0 Internacional.

Artificial Intelligence (AI) can be understood as the “study of agents that receive percepts from the environment and perform actions” (Russell & Norvig, 2016).¹ There are many legal and ethical discussions about AI personality and its condition as an Agent of Law (Pagallo, 2018; Santos Divino, 2021); for this essay, AI is a tool used to improve and perform actions. AI can be used in different sectors of the economy (Furman & Seamans, 2019).²

The importance of this technology is linked to the development of computers capable of transforming the society. At this point, the Law is an actor aiming to verifying how this integration of these means can be achieved without harming individuals. To date, recommendations and ethical guidelines that resemble soft law are being drawn up to set parameters and tackle the issues that AI presents.

From this background, this essay seeks to answer the following research questions: RQ1: What are the possible legal issues in the use of AI in Business Management? RQ2: How to solve these challenges using Compliance and Governance?

First, the legal treatment of this issue should begin with an analysis of the factual aspects in which the use of these technological tools is most prevalent. Subsequently, it becomes possible to intervene without illegitimately suppressing the public sphere in the private sphere. In essence, it is a question of being able to exercise and reconcile the practicality and ease of the information society with the protection of the subjects of law.

The first section describes the methodology used for this study. The method used is integrated research associated with the bibliographic research technique and the Boolean technique. Google Scholar was used as the database. The search terms were “Artificial Intelligence” + “management” + “review”" and “Artificial Intelligence” + “Organizations” + “review”. The justification for limiting the search to the term “review” lies in the extensive and qualified bibliography of integrated reviews. The articles were selected based on the following criteria: a) open-source availability; b) simultaneous combination of search terms; c) thematic articles on business management; and d) chronology (after 2020).

The second section presents two results: the first relates to the articles selected according to methodological standards; the second relates to the Potential areas (PA) of application of AI and Possible Legal Issues (PLI). Finally, the third section presents 12 Governance and 8 compliance recommendations for Artificial Intelligence in Business Management.

The methodology used in this essay is sustained by Higgins and Green (2008) proposal in his Cochrane Handbook for Systematic Reviews of Intervention. In this protocol, at least five steps must be followed: I) Selection of bibliometric databases; II) Defining Strings; III) Inclusion and exclusion criteria; IV) Identification of research gaps and future research directions; and V) Quality Assessment.

2.2. Defining Strings

This essay was made for a Call for Papers on Artificial Intelligence and Organizational Management. The strings used aimed to answer the RQ1 and RQ2 according to the call proposal are: Artificial Intelligence and Organizations. However, the author's contribution relies on governance and compliance proposals. So, we use "management" as a third string, and the Boolean Method (Sampson et al., 2008) in the Search Engine.

Table 1
Final Strings considering the search process strategy

After the methodological selection procedure, 16 articles were selected.

Table 2
Summary of the categorisation of the literature

After carefully reading each article, the common areas and possible legal issues directly associated with Business Management are defined. The method used to define each problem was the inductive method and the author's experience report. Therefore, based on the professional background, we can infer possible situations that could give rise to one or more legal issues. It is important to emphasize the term "possible". Therefore, it is not a statement that the crime will occur. It is a hypothetical allegation aimed at the adoption of preventive practices and the duty of caution.

Table 3
Summary of the possible legal issues on Artificial Intelligence Business Management

Based on the Possible Legal Issues (PLI) detected, the author will present his contributions through Governance (GR) and Compliance (CR) recommendations.

Governance is management practices. Compliance is the adaptation of practices to the law. Three observations should be made. First, is that not all GRs are classified as CR, as they may not be associated with a regulatory guideline. Second, is that there are PLIs that are verified in the same way in different APs. Therefore, they will be treated as one. Third, is that Table 3 shows that some PLIs can be split up, as they have different objects of legal protection. Therefore, the PLIs listed here will not correspond correctly to the PLIs in Table 3.

Furthermore, it is important to note that the recommendations will be based on the Control Objectives for Information and Related Technologies (COBIT), an IT governance and management framework that offers guidelines for strategic alignment, value delivery, risk management, and optimization of IT resources (Pereira & Ferreira 2015). Finally, as each economic management system is unique, aiming to reach the greatest number of companies, the recommendations are more generic and possibly suitable for any kind of business.

PLI1: Lack of Confidentiality and Privacy issues.

Privacy issues can originate from human actions (data leaks) or computer actions (data erasing). Regardless of the origin, in the Brazilian legal system, companies should already be compliant with the General Data Protection Regulation since September 2020. If the company under analysis or the object of management is not compliant, it is strongly recommended that it comply with the GDPR (CR1). The purpose of this guideline is to avoid fines for non-compliance. For this to happen, it is essential to define (CR2): 1) what type of economic activity will be carried out, to define the legal basis for data processing, as well as the respective purposes; 2) what data will be collected (including in order not to collect sensitive -biometric- data without the respective observance of the need and the legal basis); 3) why this data will be collected; 4) what the purposes of this data are; 5) who the holders of this data are; 6) what the mechanisms and methods of access to this data by the holder will be based on the creation of logical management software (COBIT DSS05. 04); 7) how to respond to the data subject's request; 8) the preparation of the Data Protection Impact Assessment (DPIA). It is understood that the absence of a GDPR compliance program is a priority action and the necessary allocation of resources (COBIT APO06.02).

However, adopting an adequacy system is not enough. The manager needs to allocate ongoing resources so that data protection is constantly updated and, whenever possible, adequate against any type of external interference (COBIT APO06.03 and COBIT DSS05.01). This review allows the manager to align, plan, and organize the COBIT domain based on more appropriate and efficient responses to the demands that arise, such as changes in managed service contracts (COBIT APO09); improving managed quality (COBIT APO10); reducing and mitigating managed risk (COBIT APO11); and having a better-managed data system (COBIT APO14) (CR3 and GR1).

Through constant monitoring practices, it will be possible to identify whether external compliance requirements are being met (COBIT MEA03.01) (GR2). The standard for analysis in this case will be the GDPR. However, this is not the only challenge. There are also possible copyright violations from the use of AI in Business Administration.

PLI2: Intellectual property breach and violation.

The first legal issue is copyright infringement. You should adopt a database where copyright has been correctly collected or does not exist (copyleft) (GR2). In other words, the data entered is free and has no restrictions on use. However, it is always important for the manager to assess the origin of this database to avoid copyright infringement, especially concerning the image of the owners and musical, literary, and visual works (CR4 and GR3).

Even if an incident involving copyright infringement occurs, the company must have a response system in place to quickly take down the content. This speed and agility can be acquired through an organizational change (COBIT BAI05) and the implementation of a managed and monitored process (COBIT MEA01 and 02) for this purpose (COBIT BAI11). The need for this is justified by the fact that the Brazilian Civil Rights Framework for the Internet adopts the notice and takedown system (art. 19, §3) in this area. Therefore, to avoid aggravating legal claims, it is highly recommended to establish a sector so that responses to these problems are quick and effective (CR5 and GR4).

To prevent security incidents, it is recommended to establish vulnerability management and monitoring software for the entire data infrastructure (COBIT DSS05.07) (GR5). The following should be established: an adequate level of access terminal security (COBIT DSS05.03); ensuring that a restricted number of users have access to the database (DSS05.04) and that these users only access it with justification; and establishing a mechanism for detecting and managing documents and output devices to locate when and where possible violations arising from human error have occurred (COBIT DSS05.06).

These shortcomings can, in a way, be mitigated by properly training the company's employees. Although the National Digital Education Policy (Bill 14.533/2023) is aimed at public administration, it establishes guidelines for digital training and specialization (art. 4) that are fully applicable to the private sector.

PLI3: Violation of digital literacy.

Digital Literacy is nothing more than the competence and skill that human beings possess in dealing with technology. It means knowing how it works and understanding its limits. Digital literacy empowers human beings and, in a way, includes them in a computerized society. It is a skill that is constantly required in the selection processes of companies operating in the technology sector. If a company intends to adopt AI resources in its management aspects, it is worth creating, maintaining (COBIT APO06.03), and prioritizing the allocation of resources (COBIT APO06.02) for adequate employee training (GR6). Here's a note: as digital literacy is linked to the performance of the job, if the employee needs to train during working hours, the time spent should be counted towards their hours worked (CR6). This is the understanding of the current Superior Labor Court. In addition to being a humanistic practice, an employee who is suitable for the job can train himself to perform his job better. However, if the company finds that it is not appropriate to proceed with the training, it is recommended (GR7) to analyze the costs of dismissal compared to hiring an already trained employee (CR7). This option is recommended when the costs of the former outweigh those of the new hire or cannot be implemented due to a limitation in the intellectual capacity of the employee to be trained (GR8) (COBIT BAI04).

PLI4: Fairness violation, Biased decisions, and discrimination.

PLIs involving biased decisions and discrimination can be resolved using the following recommendations (GR9) (COBIT DSS03): 1) prior verification of the database; 2) not making decisions solely and exclusively on the score of the client/data owner; 3) using AI programmed with ethical guidelines and that do not perform discriminatory acts; and 4) constantly analyzing and reviewing (every six months - COBIT DSS04) the databases to avoid the implementation of biases and that the information is relevant, current, validated and reliable for knowledge and management for business decisions.

PLI5: Lack of audit tools and standards or guidelines, Cyber threats, and Security Risk.

As mentioned above, security threats and incidents can be of human or computer origin. To avoid both, it is highly recommended to adopt layered protections against malicious software (COBIT DSS05.01) (GR10). It is suggested that, whenever possible, the Linux system should be used, given its low propensity to malware (Carrillo-Mondéjar et al., 2020). However, as tools are constantly being developed for this purpose, it is essential to constantly manage network security and connectivity (COBIT DSS05.02). This is a practice designed to minimize the impact of digital vulnerabilities and security incidents on corporate business (GR11).

For companies that don't have verification tools and compliance policies, this is an urgent need. Therefore, those responsible should be integrated based on their expertise, functions, and positions, to work as a team. Based on this integration, the main areas of risk should be detected. The team will be responsible for the innovative development of the AI tool within this risk area. It is extremely important to constantly review and evaluate it, as it must be auditable if third parties request reviews or even explanations about automated decision-making (according to Art. 20 of the GDPR) (CR8).

This whole process involves creating a culture that involves collaboration, data management, agility, digital awareness, and business awareness. It is not recommended (GR12) to completely delegate this service or task to third parties since internal employees have considerable value due to their experience over the years in the organization.

Note that although the focus is on AI, the beginning and maintenance of the entire management process is centered on humans. AI has the function of optimizing processes. But human participation still seems indispensable in the face of AI's inexperience or limitations. Another point worth highlighting is the limitations of the research. As the CRs and GRs are generic and the business areas are specific, it is believed that one or the other may not be suitable for the business under analysis. However, it is believed that the recommendations are, to a certain extent, sufficient to remedy most of the PLIs listed and make a considerable contribution to a sensitive subject that needs to be addressed.

The research problem of this article was: what are the possible legal issues regarding the use of Artificial Intelligence in business management, and how can they be solved? As a result, the main areas for the use of AI in business management are innovation; supply chain management; decision-making; human resources; strategic management; and product management. Furthermore, the possible legal issues that can be faced are lack of accountability; biased decisions; discrimination; non-compliance with digital literacy; violation of privacy; and unfair decisions. Finally, the original contributions of this work are 12 Governance recommendations and 8 Compliance recommendations.

All the contributions used the COBIT guidelines. This is an important business management tool involving information technology. The limitations of the research lie in the impossibility of covering all areas of business management. However, the research makes progress in the area of information security involving the use of AI in the private sector. Strategies are presented based on the strengths and interactions between internal and external agents so that they can collaborate in pursuit of a common goal: legal compliance, profits, and management optimization. In addition, the research shows that it is important, and perhaps essential, to understand and define the risk contexts that entrepreneurs need to be aware of. Only in this way will it be possible to infer actions and propose management practices to reduce the consequences and impacts of the use of AI in their management. This whole process involves a comprehensive acceptance of the limited knowledge we have about the use of AI.

Given the above, it can be seen that the integration of AI into organizational headquarters, whether to reshape workflow, strategic practices, or market tactics, runs up against legal issues associated with privacy, trust, transparency, biases, regulation, and, above all, human connections. AI should not be thought of as a substitute for human beings but as a necessary tool for achieving effectiveness and efficiency.

It is hoped that the contributions of this research will be used as avenues for further practical work that will provide answers about how it works. Based on these results, we will be able to broaden our horizons and develop strategies that are better suited to protecting rights and making the market more efficient.

Cómo citar: Divino, S. (2024). Governance and compliance recommendations for Artificial Intelligence in Business Management. Nuevo Derecho, 20(35): 1 – 17. https://doi.org/10.25057/2500672X.1665