Let's talk about GRC: Governance, Risk and Compliance.
So this is something that a lot of organizations struggle with.
And while there are many reasons for that, one of the biggest is that there's a diffusion of responsibility across each one of those domains.
Now, when we think about that when we're building technical models and we're trying to validate, govern, check for risk--
--this gets infinitely more complicated as the diffusion of responsibility expands to technical teams, legal teams, lines of business.
Let me show you what I mean by that. We have our governance team.
If they're building a model, they're concerned about governance structure, the model validation, where are we getting things?
How are we auditing?
That's going to be your risk manager.
Your model risk manager.
We also have our chief privacy officer, our chief compliance officer and our CISO, who are all worried about data privacy.
So their concerns are going to be the privacy, security compliance piece of this.
Now, on the other hand, we also have to think about how we're organizing and managing our data.
So that's where a chief data officer or a data engineer comes in,
and they're worried about creating governed, quality-checked assets, and they're thinking about data lineage.
Then we also have our Build AI team.
So these are the individuals that are data scientists.
They're mostly concerned with how are we looking at the data and what models are we creating from it.
On the other end of the spectrum, we've got the Deploy AI team.
So they're the ones that are taking this from the data scientists and they're scaling it into production.
They're also running the models again and making sure they're up to compliance.
And then finally, we have our data management team--
AI management team --who is very concerned about keeping up with the tenets of a trustworthy AI model.
And when you look at this holistically, it's an absolute mess.
So no wonder why nobody really wants to touch governance, risk and compliance. Right?
It's going to be a political mess.
How do you assign accountability?
How do you make sure that overall we are governed and we are always in control and monitoring our risk?
Let me show you how.
So if we start with our governance, as we always do, and we're thinking about our model validation, where we're getting our data sources from, right?
We create a nice two-way connection between these two groups where we're sharing data, we're accounting for it.
So there's already this automated, auditing workflow that's built in.
So you're always within your privacy and security and compliance.
Now, if we are looking down below at how we are building our models, we want to make sure that we are testing and validating here.
Before we go into production, we want to make sure that we are within compliance so that lies within this risk category.
But then once we are in production, we also want to make sure that we are validating
our models to make sure that they are still accurate, that they're unbiased.
All of these things that we've touched on previously.
So the robustness as well.
Now, finally, we want to make sure that we are communicating correctly.
So as we are tracking compliance and risk, we are making sure that we are still pulling from these fully qualified data assets.
We also want to make sure that we are updating our governance structure to say "Yes, this model has been checked.
It's been checked recently, it's been rechecked. We are still within compliance."
So we're creating this workflow where we're sharing across different parts of the organization to first build the model
and then deploy it with safe, trusted government assets.
And this is how you create a governance risk and compliance structure for your trusted AI models.
If you have any questions, please leave them in the comments below.
Also, please remember to Like this video and Subscribe to our channels so we can continue to bring you content that matters.
Thanks for watching.