Six steps for developing an AI ethics framework

Managed the right way, the opportunities for application of artificial intelligence (AI) are endless—but managed the wrong way, so are the legal, regulatory, reputational, and financial risks. “A myriad of opportunities to leverage AI highlight why an ethical mindset is critical to protect an organization from unintended, unethical consequences,” Maureen Mohlenkamp, a principal in Deloitte’s risk and financial advisory practice, said during a recent Deloitte Webcast on AI ethics.

In broad terms, artificial intelligence encompasses technologies that are designed to mimic human intelligence. Because AI’s application is still in its early stages, companies across all industries have only just begun to scratch the surface of its full potential in the business world.

“A myriad of opportunities to leverage AI highlight why an ethical mindset is critical to protect an organization from unintended, unethical consequences.”

Maureen Mohlenkamp, Principal, Risk and Financial Advisory Practice, Deloitte 

In the financial services industry, for example, banks are using machine-learning algorithms to sift through vast oceans of data to uncover anomalies and possible fraud scenarios in payment transactions in real-time. In healthcare, hospitals are using AI to more accurately diagnose and treat patients. In the transportation industry, AI is being used to create self-driving vehicles intended to reduce accidents and—eventually—replace human drivers for some businesses (think trucking, shipping, ride-sharing, etc.).

Enter AI ethics

“AI ethics is about integrating ethical constructs into how organizations develop new technologies,” Mohlenkamp said. Chief ethics and compliance officers (CECOs) play a very important supporting role in this process. Consider the six key steps below as you think about developing your company’s AI ethical framework.

1. Develop an AI Code of Ethics. Many companies as a matter of practice include in their Code of Business Conduct reflection questions to support individual decision making in a wide variety of risk areas. This same idea could be applied in a similar manner to questions around the ethical use of AI. Examples of reflection questions to include might be:

• How is artificial intelligence used in my specific job function, and how does AI help me achieve that?
• What consent do I need (from customers, employees, etc.) around that data?
• What third parties will be handling sensitive data, and for what purpose?
• Does that purpose align with the organization’s core mission and values?

“The challenge is to ensure that the guidance provided on this topic does not become so specific that it is silo-bound and simply reflects the nature of the department that has introduced it,” Guendalina Dondé, head of research at the Institute of Business Ethics, told Compliance Week. “Issues can and should extend across different departments and activities.”

What’s also important is for the company to recognize what expertise it needs and be willing to seek it out—data scientists, software engineers, analytics experts. Tae Wan Kim, associate professor of business ethics at the Tepper School of Business, Carnegie Mellon University, put it this way: “There are computer scientists who are interested in ethics, and there are ethicists who are interested in computer science … but it’s not easy to find one single person who can address these two aspects at the same time.”

It’s also important that a speak-up culture be in place that complements an AI ethics policy, Dondé said. And those responsible for fielding employee concerns and complaints should be aware of any potential ethical lapses created by AI, not unlike any other risk.

2. Embed an ethical framework into AI. “Given the rapid adoption of AI in business, there is the risk that the governance systems required to mitigate the potential risks of its deployment are overlooked,” Dondé said. This would be a mistake. The ethics team needs assurance that the AI systems align with the company’s core values, while legal and compliance needs assurance that the company complies with relevant rules and regulations, especially concerning data privacy and cyber-security.

“This is going to require a team approach, with different lenses of expertise and different areas of focus both inside and outside the organization,” said Christopher Adkins, executive director of the Notre Dame Deloitte Center of Ethical Leadership, who spoke on the Deloitte Webcast. “We really need to think from the beginning about, what is our design mindset? Not just what can be built, but what should be built.”

Consider creating internal workshops or working groups that bring together different departments and functions—led by IT, data-security, and privacy, in collaboration with ethics and compliance, HR, risk, legal, procurement, and senior management—to share AI-related issues from various perspectives. In conducting an AI impact assessment, questions to explore may include:

• How is the company using AI?
• Where does this happen within the organization?
• What job functions should be thinking about AI ethics?
• What data is being fed into the algorithms?
• Does the AI solution’s intended purpose align with the organization’s mission and values?
• How do you get consent around the data? Do customers need to be informed, for example, that you’re capturing their data?
• Is there a reporting process in place to escalate issues concerning ethical lapses in AI?

Think of it as an AI ethics-by-design framework. Much like privacy-by-design, which is thinking about data protection and privacy controls from the outset, AI ethics-by-design is thinking about the ethical use of AI data and technology at the outset.

3. Conduct an AI ethics gap analysis. The next step should be to test and monitor the data to ensure that it’s of sound quality and to reduce the risk of inherent biases and inaccuracies. “The objective of zero bias is unlikely to be realized. That is true with humans, with machines, or a combination of both,” said Nicolas Economou, chair of the law committee of the IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems. But companies can develop ways to determine the impact that algorithms will have and the extent to which the processes they have in place produce desirable effects, he says.

For example, many large companies today are using AI in their hiring practices to sift through résumés and narrow them down to the top job candidates. Here, an analysis could be performed to ensure that the résumés received through the AI process align with the decisions that HR would have made, Economou said.

Real-world scenarios provide cautionary tales about what can happen when proper testing and monitoring is not done. Amazon, for example, once tried using an algorithm in its hiring practices by training computer models to vet the best job candidates, but because the algorithm was based on historical job data in the technology industry, it inherently favored men over women.

“AI ethics is as much about understanding the risks as it is about establishing a process for avoiding them,” Mohlenkamp said. “Review existing organizational policies, procedures, and standards to address existing gaps, then expand existing policies or build new ones accordingly.”

4. Conduct due diligence on third parties. It is also prudent to monitor any third parties that handle sensitive data to ensure that they commit to similar ethical AI standards. “The design of these systems might be outsourced, and it is important to conduct ethical due diligence on business partners,” Dondé says.

“A similar principle applies to clients and customers to whom AI technologies are sold,” Dondé said. “Testing a third-party algorithm in a specific situation is also important to ensure accuracy.”

5. Educate and train. “It is not realistic to expect that every company can train every employee to become experts at AI,” Economou said. Instead, focus on training and educating those who make extensive use of AI in their job functions. Make sure they know which fundamental questions to ask and whom to ask, and what answers reasonably make sense. Also, those developing algorithms and managing data will need to be specially trained to identify and mitigate bias within AI applications.

AI competence builds confidence. Users of AI should be competent enough to understand its limitations, understand where weaknesses or biases in the data may be located and how to correct for them, ensuring that the decisions being made by AI technologies are consistent with those that an expertly trained, qualified employee would have made. “That’s a nascent challenge, that there is more AI than competent people to utilize it across the board,” Economou said.

“Employees and other stakeholders need to be empowered to take personal responsibility for the consequences of their use of AI,” Dondé said. They need to be provided with not only the technical skills to build or use AI, but also understand the potential implications that it can have, she said.

6. Establish accountability. Accountability is another important consideration in the AI ethics process. Companies simply do not have the prerogative to blame ethical lapses on AI systems. Business leaders, regulators, enforcement authorities, customers, and other stakeholders will demand full transparency and accountability, and accept nothing less. “You can’t hold a system accountable,” Economou said. “You have to hold humans accountable.”

The difficult question, however, is who should be held accountable when an AI system produces an unethical outcome, whether that outcome is intentional or not? “You need to be able to map out the accountability,” he said. “Who is accountable and responsible for what decision?” It’s a complex question with no easy answer.

Accountability should also extend to third-party service providers and vendors. The IBE recommends including in contracts with third parties a clause defining each party’s responsibilities and limitations. “Although it is not always practicable or comprehensive and it can’t substitute for individual empowerment, this can help to prevent a situation where all parties have shared responsibility and, therefore, it becomes difficult to attribute accountability appropriately,” Dondé said.

Finally, it’s important for CECOs to stay on top of the latest developments in AI ethics. The National Institute for Standards and Technology, for example, recently announced that it is developing standards for the use of AI. The Council of Europe, too, is currently working to develop a certification program and legal framework for use of AI application. Such guidance will serve as real-world, practical instruments that CECOs can turn to in their important quest to help advance the ethics of AI.