Beena Ammanath explains how companies should assess AI risk for each use case by defining their own tolerance levels and assigning clear accountability before deployment. She argues that technologists skip risk discussions because project tools focus on ROI, and recommends embedding simple risk checkpoints into planning processes to force concrete mitigation actions.
Chapters
And one thing across, you know, our discussion so far that is a common theme, a common thread is the importance of looking at it by a use case by use case basis. Right. The importance of understanding the level of risk across different use cases. So maybe how do you think about a framework for categorizing risk for different AI applications? I know this is maybe a bit of an annoying question in the sense that there are different use cases across different industries, but how would you, what is the kind of a framework that you would apply when it comes to categorizing applications of AI vis a vis their risk level or potential risk level?
Yeah. And look, there are going to be regulations that come into play and will help us define this more in a standard way. But as of today, there is a balance of self regulation that needs to happen. Right. And it is the organization that is building or using the AI that has to define the tolerable level of risk for their enterprise. And that's why it's absolutely important to include your chief legal or compliance officer, chief risk officer in these conversations. Right. I don't think it's a one size fits all. And even within an organization, right. We've talked a little bit about patient diagnosis, but if you're using AI for hospital bed allocation, right. And you're using AI to do it in an automated way, you know, how are you going to make, you know, is that, you know, is that less risky? Like, you know, if your marketing department is using AI for providing targeted marketing, right. Would that be considered less risky? And I think that's where having that, you know, that AI steering committee or a group of stakeholders that come together and have that discussion, right. Taking it beyond your IT or AI team to bring in the business leaders and having that discussion and defining the level of risk tolerance for your own organization, I think that's, you know, that's, that's the number one thing that needs to be done to define the level of risk. There is, there is no one size fits all. Even at an organizational level. It will be, you know, based on what marketing tool might, what the AI marketing tool might be doing versus what the AI tool is doing in the factory floor. Very different. But the stakeholders have to weigh in. And I have a pillar in the book Adele called accountability. And I think that one is where it kind of forces that discussion because accountability is about as you are building the project or as you are building the product or designing it, defining upfront who is accountable for it when things go wrong. Because we've seen scenarios in the Last three, four years. When, you know, when there is, when you, when the algorithm does something wrong, you know that the CEO might have to go face the law enforcement. Sometimes the data scientist gets fired. Right. There is no fixed protocol for it. So defining accountability upfront is actually, you know, serves two purposes. One is it forces that risk discussion and it forces the discussion with bringing all the stakeholders together. And secondly, it also almost puts a level of urgency to have that discussion and mitigate them. Because I fundamentally believe that all of us, technologists especially, are not setting out to do harm. It is just that in our processes, in our project management tools, there are no checks for these wrists. Right. For too long, we focus just on the ROI and the positive value creation of AI. Right. And look, I'm a technologist by training. It is very easy to get enamored by the, you know, the, the cool things that AI can do. But when you're doing it at an enterprise level, I think bringing in that risk lens is crucial. And, you know, whether it's just adding a simple check into your project management tool, saying what are the, you know, have the risk for trust and ethics being considered. Right. And forcing that conversation. And even if you spend just 5% of your entire project planning time brainstorming it, if you identify those risks, I fundamentally believe that you will do something to fix it. Right. The discussion doesn't happen today. The conversation doesn't happen today because our processes are not set up to force that discussion. So that's why we, we are not thinking about those risks. But thankfully now we are at that point where there is more urgency around operationalizing for these risks. And especially after regulations come in, it will be a mandate. But I think there's a lot companies can do today to start operationalizing.
