AI Governance Framework: A Practical Guide for In-House Legal Teams

Five steps to building an AI governance framework

That’s why it’s crucial for organizations (in partnership with their in-house counsel or other legal operations professionals) to create a robust AI governance framework that goes beyond a traditional checklist of compliance tasks, so that organizations and teams can safely harness the latest technology with confidence and peace of mind.

Consider these five steps as you develop your own framework and policies. This is a foundational starting point, so keep in mind that you may need to customize these steps or add more to meet the specific needs of your organization.

Step 1: Understand evolving AI regulation and policy

As policymakers move to establish guardrails for AI, the EU and U.S. are taking notably different paths. In Europe, lawmakers have enacted the EU AI Act – a comprehensive framework designed to harmonize rules across member states.

In the U.S., no comparable federal law exists, leaving states to develop their own requirements, such as the Colorado AI Act or the laws in Tennessee and Illinois that protect an artist’s name, image, and likeness from being replicated by generative AI.

For companies operating across these markets, the result is a complex and evolving regulatory landscape. Differing standards and obligations can create meaningful compliance challenges and increase potential liability exposure – particularly for organizations deploying AI at scale.

For companies that are subject to oversight by regulatory bodies, it may be helpful to consider the hierarchy of related regulations.

For instance, when it comes to creating an AI governance framework that is compliant with known regulations, consider that your primary bright line may be compliance with the EU AI Act, as it has the most robust provisions, even in the United States.

Then consider any existing and potentially forthcoming state laws that may affect your organization, and consider the voluntary AI guidelines established by the National Institute of Standards and Technology and resources from its risk management framework.

Organizations also should follow any applicable federal regulations. For example, the Federal Trade Commission, Equal Employment Opportunity Commission, Department of Justice’s Civil Rights Division, and Consumer Financial Protection Bureau issued a joint statement in April 2023 to note the use of AI could violate existing laws under certain circumstances.

Once you’ve established your framework, be prepared to show which regulations or guidance your organization is following. If any AI activity is considered unacceptable or prohibited under applicable laws, your organization should cease those practices and reconsider your proposed AI systems.

AI activities to avoid

Here are some examples of unacceptable AI processing activities that organizations may consider as part of their risk assessment based on laws in the United States and the EU AI Act.

The bottom line: Use your best professional judgment to ensure compliance with all applicable laws and regulations, and plan for an iterative process of updates and audits to ensure that your framework stays current with legislative developments.

Step 2: Review and update your organizational policies

Governance starts with reviewing and supplementing your organization’s existing rules – not beginning from scratch.

So, consider a review of the following policies.

• Your employee code of conduct
  Define your organization’s stance on AI as a management tool. For instance, are you in favor of AI use? And would you allow your employees to use it in all cases or just certain circumstances?
• Your device management policy
  Determine how to regulate AI access on company vs. personal devices. For instance, would you allow employees to access mass market AI-tools on their devices even though these tools can have privacy issues and can be subject to hallucinations? Or would you permit employees to use only trustworthy and company-approved AI-powered tools on their professional devices?
• Your antidiscrimination and HR policies
  Ensure that the organizational use of any AI tools for recruitment or other job functions would not violate any EEO laws. And keep accessibility in mind when choosing and implementing AI tools in the workplace, making sure there is space to engage with employees and applicants who request alternatives or accommodations.

Step 3: Draft a clear AI usage policy

If you choose to allow the use of AI to help with productivity and compliance, you must then be specific about how employees are permitted to use such tools. To outline these permissions and requirements, draft your own AI usage policy with the following considerations.

Define what would be “acceptable” AI use vs. “prohibited” use

For instance, would you want your organization to ban the use of all mass-market AI tools – and only allow the use of trusted and company-approved tools? Would you merely ban the input of proprietary code or sensitive client data into public LLMs? And are there certain processes that should avoid the use of AI altogether?

Note how employees should review output from AI-powered tools

To reduce risk, for instance, legal teams may consider mandating human review of output to verify accuracy before use.

Address transparency and set rules on disclosures

In this way, your framework should confirm when employees should note that they have used AI to create a work product.

Step 4: Mitigate risk and confirm compliance

Today’s AI technology has countless benefits for innovation and productivity. But, if misused, it can introduce dangerous risks such as bias, inaccuracies, and data security breaches. To mitigate these threats and confirm compliance, consider the following actions.

• Create an AI oversight committee
  Stakeholders and employees with varying skillsets are needed to develop and operationalize an AI governance program – from individuals trained in law, data privacy, intellectual property (IP), technical skills, human resources, marketing, and procurement.
• Work with your committee to identify, assess, and document AI risks
  Provide direction, support and training to employees, commensurate with their roles and experience, so that they can successfully follow your requirements.
• Discuss whether your organization should audit your chosen tool for compliance issues
  Notably, laws vary by jurisdiction. For example, Illinois amended its Human Rights Act to prohibit an employer from using an AI system “that has the effect of subjecting employees to discrimination on the basis of protected classes … or to use ZIP codes as a proxy for protected classes,” and New York City Local Law 144 focused on avoiding discrimination by requiring employers to conduct a bias audit before using AI to make employment decisions. And remember that there are laws of general applicability in different countries, industries, and sectors that require AI compliance or comprehensive AI governance laws, so keep those standards in mind.
• Identify potential privacy risks before deploying new tools
  Organizations must ensure that AI does not violate regulations or policies that safeguard proprietary data and personal protected data. For example, improper implementation of common AI-powered biometric tools, such as facial recognition for employee verification, can expose employers to costly fines or litigation costs for the misuse of personal information.

Step 5: Consider vendor management and liability issues

As savvy legal professionals know, an organization’s compliance responsibilities extend beyond its borders when it works with third parties.

So, consider the following vendor management measures:

• Work with your AI Oversight Committee to determine how to best manage and oversee your company’s compliance with AI requirements with any third-party vendors, suppliers, service providers, contractors, and processors. As part of this work, review indemnification clauses with vendors and check insurance to ensure it covers AI-related claims (such as those related to copyright or privacy breaches).
• Consider allowing only certain AI tools for employee and vendor use. And when working with approved AI vendors, ensure that appropriate contractual provisions are in place – including any AI regulatory requirements – so your organization remains protected and compliant with laws and regulations.