AI Governance: Beware the Perfection Trap

With the AI regulatory and risk management environment evolving so rapidly, it is very difficult to articulate a comprehensive approach to AI governance – but that’s something that lawyers are trained to do.  As this Jackson Walker blog points out, that kind of mindset sets organizations up for a “perfection trap,” where they are unable to develop policies that address key governance issues in the absence of more definitive guidance. This excerpt suggests an approach to governance designed to avoid the perfection trap by “putting the forest first”:

If the perfection trap is the problem, the answer is not to lower the standard. It is to build the system through which the standard can be applied, tested, and improved.

Putting the forest first means establishing the structure within which individual risks can be identified, prioritized, assigned, controlled, and revisited. It does not mean ignoring individual defects. It means having a process capable of finding, prioritizing, and addressing the ones that matter most.

That process depends on visibility and trust. In all but the smallest organizations, legal and governance professionals rely on cross-functional partners to answer a basic question: What are we governing? Without reliable information about systems, data (and the data’s own reliability), vendors, users, and use cases, governance efforts can easily become detached from the environment they are intended to govern.

Trust is equally important, and it is not automatic. Legal and governance teams must account for compliance obligations, operational realities, and organizational priorities. The process should translate legal and organizational requirements into controls that operational teams can implement and governance teams can test.

A documented interim framework with assigned owners, priorities, deadlines, and escalation paths can provide a more defensible basis for action than unmanaged delay, particularly if the organization can show that the framework actually operated. The initial framework need not be complete. It does need to be real.

The blog goes on to identify action steps that companies can take to build this kind of governance framework.  This includes defining a governance framework’s purpose and boundaries, building an appropriate decision structure, using the process to develop visibility into non-obvious areas where governance efforts are required, using proportionality in risk assessments, monitoring changes, and preparing for failures by developing a robust incident response program.