ICGN Viewpoint 

Artificial Intelligence and Board Effectiveness 

February 2020 

Artificial Intelligence (AI) is a broadly used term to describe computer-based technologies that employ complex logic to perform tasks.   The potential applications of AI are wide in scope and pose commercial opportunities for companies. As with any opportunity, however, implementing AI can also present significant risks and requires specific governance considerations by company management and corporate boards. In some cases, management, board and organisational practices may warrant changes to adapt to AI. The cultural change and new skills sets required to maximize AI’s use within a company and boardroom can also be formidable.  

Unlike conventional programs designed to perform a specific task, AI programs make inferences by analysing large data sets. Current AI applications can conduct these analyses at speeds and complexities that were previously unattainable.   Cloud computing¹ has brought AI to the masses, allowing companies across the globe to use huge data sets and processing power. The recent surge in AI investment is likely to continue, and companies that capture its value could develop a significant competitive advantage.  

This Viewpoint is not intended to detail the technological aspects of AI implementation. Instead, it is meant to give investors an overview of how AI is used, to summarize the risks and opportunities AI offers, and to offer suggestions on how company boards can address these factors. We also provide questions that can help investors begin a dialogue with a company on AI governance. 

What is AI? 

Artificial intelligence approaches include machine learning, deep learning and robotics. Advancement of global computing power and the availability of very large data sets (“big data”) have provided the infrastructure to accelerate the adoption of AI.    

Machine learning is a type of AI that enables programs to self-learn by identifying patterns from big data. These programs can use additional data to create a feedback loop of analysis and validation, increasing accuracy. Deep learning is machine learning that applies multiple analytical layers to learn and make decisions. This kind of multifaceted analysis is especially suitable for analysing intricate data such as language, sound and images.   

Today, companies are using AI to transform existing business models or create new ones, to achieve greater efficiencies and productivity, and to enhance strategic decision making. Table 1 (in the Appendix) provides examples of how AI is being deployed in various industries.  

Opportunities for companies using AI will continue to grow as technological capabilities improve over time—and as data scientists and company employees learn through trial and error. However, AI adoption also brings a variety of risks and challenges that company management teams and boards must be able to contend with.  

The audit and professional services firm EY identifies six key areas of AI risk²: 

1. Algorithmic bias: If data has built-in biases, then AI will carry that bias through to the output. 
   
   

2. Overestimating AI capabilities: Underlying data may have flaws that lead to misleading outcomes. 
   
   

3. Programmatic errors: As with other types of computer programming, errors in the program itself may compromise the output. 
   
   

4. Risk of cyberattacks: AI systems may become the target of choice for hackers. 
   
   

5. Legal risks and liabilities: Legislation will likely evolve, and AI applications may no longer be compliant with frameworks such as the EU’s General Data Protection Regulation (GDPR). 
   
   

6. Reputational risks: Data can be used and misused in many ways, and in some cases without the company’s knowledge.    
   
   

This Viewpoint offers insight on these opportunities and threats, and explores how investors should engage with company boards on this increasingly important topic.  

New opportunities – unlocking big data for competitive advantage 

AI-related opportunities span industries and geographies. AI applications underpin recent advancements in autonomous driving, fintech, online retail, healthcare diagnostic and energy, among many others. For example, the app-based US insurance start-up company Lemonade is using AI to deliver 24-hour customer service and analyse customer data to provide personalized quotes. Other insurance applications are improving risk underwriting and fraud detection. In radiology, Siemens is developing AI imaging programs that can improve detection rates of potential malignancies.   

Darktrace is another example of AI use: The popular cybersecurity defence platform uses AI to continuously monitor clients’ systems and improve the recognition of cyberthreats over time. Google uses “DeepMind” to monitor its data centres and improve energy usage.  

Underpinning these applications are huge data sets that enable AI to analyse, interpret and learn.  Access to these often-proprietary data sets is increasingly viewed as a strategic imperative by companies looking to leverage AI. Early AI adopters may gain competitive advantages by developing or acquiring these data sets, while gaining essential experience in real-world applications before competitors do.  

AI Can Drive Better Decisions 

AI can also enhance companies’ decision making. The US company Salesforce uses a version of its proprietary AI, named Einstein, to analyse and answer questions on company performance in executive meetings. One advantage of this approach has been the ability to distinguish trends in actual company data from organisational politics. In this role, AI can help address biased decision-making by adding a new layer of insight and validation to the boardroom.   

As businesses become more complex and change becomes more rapid, it is challenging to evaluate all of the available information and make good decisions. AI can assist in this by offering directors insights into areas such as determining how capital should be allocated. For example, AI can give directors a better perspective on competitor trends, such as the expansion of manufacturing facilities, and it can systematically scan the news for new product launches.  

Early adoption of AI can be financially rewarding: According to a McKinsey Global study, “early AI adopters that combine strong digital capability with proactive strategies have higher profit margins and expect the performance gap with other firms to widen in the next three years.”³  

AI can be impartial under optimal conditions, but this does not necessarily make AI decisions “right.” While AI can bring a new data-driven perspective to the table, it should not replace the knowledge, accountability and diversity of views that a human board can provide.  

AI risks and challenges  

AI provides new and advanced capabilities, but it also poses unique risks. Because AI is programmed by humans, it is still subject to a certain degree of human error and bias.  

One key challenge with AI programs is that they can be a “black box,” making decisions where the underlying logic is not transparent or discernible to users—and sometimes even to programmers. This is because the logic programmed into the software (the algorithms), is not designed to produce an exact outcome. This lack of transparency poses significant risks to companies when AI produces an outcome that is undesirable or unexplainable.  

AI’s autonomous nature poses issues when it can make decisions using personal data—especially if people are not aware that their data is being used by AI, or if they do not trust the technology. Biased data might also train AI towards biased actions. A recent example is Amazon’s AI facial recognition program, which enforced racial and gender biases learned from historical data on recruitment practices. Such biases pose risks and repercussions for companies, including the breaching of anti-discrimination regulations and data-privacy laws as well as missed marketing opportunities.  

AI technologies are also exposed to hacking. These risks are compounded when companies do not have transparency in their AI’s logic and cannot detect that the program is not performing as intended. These risks may be innocuous, such as implanted bias, or at worst they may endanger human life—including cases of autonomously operated machines malfunctioning. The scale of hacking risks can be very large in the case of malicious infiltration of AI used to manage large systems and assets.  

Ethics and the use of AI 

It is already apparent that AI can positively advance the world in which we live. However, AI applications are only as good as the man-made algorithms that underpin them.  Poorly designed or tested AI programs can have unintended consequences. Conscious and unconscious bias can seriously impact the outcome of the AI technology. There are also examples of algorithms written to scan resumes to identify potential candidates which have a bias towards picking white men. Other uses of AI can significantly impact workers’ livelihoods, such as self-driving trucks and other vehicles. Boards will need to consider what role they should have in addressing the larger impact of their use of AI on society at large.         

The use of AI and understanding the ethical implications should be a core priority for a board. The board should have proper oversight to ensure ethical considerations are engrained in the decision-making process from design through to testing and onto the audit of actual outcomes. Implementing an AI code of conduct for developers that serves as a modus operandi will assist in ensuring compliance to the company’s stated values. Within this, a whistleblowing mechanism should be present for employees to raise concerns. It is critical to ensure that company policies not only consider the human workforce but also the virtual implementation of a corporate policy. Ultimately, as the general public becomes more aware of the use of AI by industry the potential damage caused by ethical misuse of AI will increase. An ongoing review and development function of AI, which includes the board, would allow for a regular review of the tolerances and thresholds in operation. What is appropriate today, can quickly become antiquated.  

How Boards Can Provide Effective AI Oversight   

Boards have an important role in this new arena: ensuring that company leadership is effectively managing both the potential of AI and its organisational risks—including ethical, programming and reputational risks. It is part of a board’s fiduciary responsibility to oversee AI and its potential impact on the business. Even if AI is being used in boardrooms, it does not replace the board’s responsibility to exercise due care and loyalty—to be fully informed and make its own decisions in the best interests of shareholders and stakeholders. 

A board can provide effective oversight by focusing on three key areas:   

1. AI technical expertise 
   
   

2. Infrastructure oversight 
   
   

3. Impact to the business model, culture, and industry  
   
   

Board Education and Technical Expertise  

In order to provide effective oversight, directors must be educated about AI. This is not a responsibility that should be relegated to the “risk” committee of a board or some other specialised committee, because AI has far-reaching strategic—and potentially the most transformative—implications a board will face.  

AI creates similar challenges in terms of cyber risk—there are many unknowns for a company and board that make constant oversight critical. All directors need to be fully informed on how AI is being used within and outside the organisation, how management expects it to impact the firm and industry over time, and what actions management is taking to leverage AI while managing its risks.    

It takes progressive and innovative thinking to determine how AI might disrupt an industry. Board committees responsible for director nominations should update their skill-set matrix to incorporate the need for technical and innovative board members—and make it an integral part of the board refreshment process. A board may have to add one or more new members with technical expertise if the opportunity to develop new talent is not a near-term one.  

Boards should also consider if/when a separate technical and/or innovation committee may be necessary. For instance, some forward-thinking boards, including the New York Times and Proctor and Gamble, have already created formal Technology and Innovation Board Committees.    

Boards should also reassess the current company management team to determine if it has the expertise and innovative mindset to navigate the firm through the impact of AI. If there are gaps in this expertise or mindset, the board should work with the CEO to develop a plan to acquire the necessary talent to fill them. This task should be addressed now: time is of the essence.    

Infrastructure Oversight  

With data as the backbone of AI, a board needs to understand the company’s current infrastructure, including the quality, accessibility, and security. Directors should ask management for a baseline assessment of data infrastructure, data analytics and data security. Having board members with expertise in this area should provide the opportunity to ask the right questions.  

An opinion from an external technical expert may be well worth the investment to augment the board’s work. It can help identify vulnerable areas as well as areas where investment in human capital and other resources may be needed to improve the quality of the data environment and security. Without a robust data infrastructure in place, companies will be more vulnerable to making decisions based on bad data, and they may be more exposed to cyberattacks.    

Diversity plays an important role in AI. Many firms are focusing on building more diverse and inclusive workforces, but the proliferation of AI makes this effort even more important. The risk of bias in using AI is high: The board must be confident that management is taking diversity and inclusion efforts seriously, and that it has a structure in place to ensure diverse AI working groups.    

Business Impact 

Directors also need to ensure management is considering the broad impact of AI on the company and industry: the implications for their business model, workforce, and ultimately the ability to sustain the business.  

This effort requires both inward and outward assessments. A key component is determining how the company wants to position itself: does it want to be a leader or laggard in its industry? A leadership role will likely require investments of time and resources, but being at the forefront of AI innovation can also pay off.   

In either case, directors need a solid grasp of the opportunities and risks that AI presents. From an opportunity perspective, directors should ask themselves and management how their products or services might be enhanced or transformed by AI, or how AI can improve quality, safety and decisions—and ultimately drive better profitability. American Express, for example, analyses large volumes of cardholder spending data to better target new products. To minimize losses, it seeks to identify fraudulent activity in real time by using data analytics and machine learning.   

In addition to making sure visionary management is in place to manage through this transformation, boards also have to ensure that a talent management strategy is in place. Employees are starting to see how AI is transforming businesses: some workers’ jobs may become obsolete; some employees may see AI as a way to leverage their skills and contribute to the transformation. Boards have a responsibility to ensure management is effectively identifying and addressing how its labour force will evolve. They need to assess whether the right skill sets in place as well as the gaps — what investment is needed to acquire the talent to lead the company into the future. 

In summary, AI creates a significant challenge for directors and boards. It is a complex field and technical expertise is in its infancy, even as AI usage is accelerating. AI must become a standard agenda item at board meetings, and both management and boards need to acquire the right talent to help navigate the evolving landscape, capitalize on opportunities and manage risk.       

AI Questions for investor engagement 

Qualifying the use of AI 

• Has the board assessed the use case for AI within the company and if so, what were the findings?  
  
  

• Across the sector, are you aware of companies that effectively use AI systems? 
  
  

• Which area of operations do you think AI could add the most value? Has this been explored?  
  
  

• Do you foresee areas in which AI use could widen or enhance current revenue streams? 
  
  

• How does the board keep abreast of AI developments, both in terms of AI services available and relevant legislation that could impact the company’s use of AI (GDPR for example)?  
  
  

Understanding risk & controls 

• Has management evaluated the risks associated with AI to the business? If so, can management explain the core risks and how they are measured and managed?  
  
  

• What processes oversee operations using AI to ensure that the outcomes are appropriate and/or indicate potential problems? 
  
  

• Have there been any cases within the company of incorrect AI outcomes, such as selection bias? Were these flagged by internal or external stakeholders? If yes, how have the cases been dealt with? 
  
  

• Does the risk management process include independent oversight, and if so, how is this integrated into workflows?  
  
  

• How does the company ensure effective protection of AI intellectual property assets? How often is this reviewed and have the lines of defence been tested?  
  
  

• If data is purchased from an external vendor, how do you ensure the data’s integrity and that it is appropriate for the use case? 
  
  

• If data is collected from a global client base, how has varying regional legislation around individuals’ personal data such as GDPR been managed? 
  
  

• How is data privacy ensured across the organisation and how does the data oversight reporting structure communicate with senior management and the board?  
  
  

Stakeholder management  

• What has been provided to external stakeholders to provide satisfactory insight into how AI is used by the company? 
  
  

• Are the systems in place to meet GDPR and other legislative requirements regarding individual’s right to access data content and ‘opt-out’ where preferred? 
  
  

• The term AI often brings operational efficiencies: How is its use communicated to employees to ensure the use case is fully appreciated? 
  
  

• What training is provided to upgrade skills in the existing company workforce to allow them to assist the company with the AI journey? What are the board and management’s plans to fill the knowledge gaps? 
  
  

• What data privacy training, if any, is provided to employees? 
  
  

Expertise 

• Does the board have AI/technical/innovative expertise on the board? If yes, who determines how and why person(s) are judged to be adequately skilled?  
  
   

• Have they updated their skills matrix for this skill?  
  
  

• How have they assessed the management team to determine if they are adequately skilled and if not, where are the gaps?     
  
  

• What information the board received from management that gives them a perspective on the current AI expertise in the firm and how diversity is included?   
  
  

• Is the board as a whole provided training in AI and its governance implications? 
  
  

Appendix 

Source:  Hermes Investment Management, Investors’ expectations on responsible artificial intelligence and data governance, April 2019 

Sources and references:  

ICGN Guidance: Corporate Risk Oversight (2015): http://icgn.flpbks.com/icgn_corp_risk_oversight/#p=1 

ICGN Viewpoint: Cyber Risk: (2016): https://www.icgn.org/policy/viewpoints/cyber-risk 

American Bar Association Business Law Section, Corporate Directors Must Consider Impact of Artificial Intelligence for Effective Corporate Governance (2019): https://businesslawtoday.org/2019/02/corporate-directors-must-consider-impact-artificial-intelligence-effective-corporate-governance/ 

Corporate Boardmember: What Directors Need to Know about AI (2018): https://boardmember.com/directors-need-know-ai-2018/  

EY, Artificial Intelligence research (2019):   https://www.ey.com/en_gl/ai 

McKinsey Global Institute, How artificial intelligence can deliver real value to companies (2017): https://www.mckinsey.com/business-functions/mckinsey-analytics/our-insights/how-artificial-intelligence-can-deliver-real-value-to-companies 

MIT Sloan Management Review, Big Idea: Artificial Intelligence and Business Strategy (2017): https://sloanreview.mit.edu/article/ai-in-the-boardroom-the-next-realm-of-corporate-governance/ 

PWC, 2018 AI Predictions (2018): https://www.pwc.com/us/AI2018 

ICGN Viewpoints 

ICGN Viewpoints are produced by Secretariat and by our member-led Policy Committees. While not defining a formal ICGN position on the subject, they provide opinion on emerging corporate governance issues and are intended to inform and generate debate.  This ICGN Viewpoint was drafted by members of ICGN’s Board Governance Committee (Committee) led by a working group comprised of Linda Giuliano, Daniel Jarman and Joel Posters. The Committee has contributed to the review of this document. We welcome dialogue with the ICGN Secretariat and/or Committee members, as follows: 

Gigi Dawe, Co-chair, ICGN Board Governance Committee: gdawe@cpacanada.ca 

Carola van Lamoen, Co-chair ICGN Board Governance Committee: c.van.lamoen@robeco.nl 

George Dallas, ICGN Policy Director: george.dallas@icgn.org