{"id":7352,"date":"2023-08-25T10:30:38","date_gmt":"2023-08-25T09:30:38","guid":{"rendered":"https:\/\/www.gpsj.co.uk\/?p=7352"},"modified":"2023-08-25T10:31:06","modified_gmt":"2023-08-25T09:31:06","slug":"risk-and-data-regulation-are-we-playing-catch-up-with-ai","status":"publish","type":"post","link":"https:\/\/www.gpsj.co.uk\/?p=7352","title":{"rendered":"Risk and Data Regulation: Are We Playing \u2018Catch Up\u2019 with AI?"},"content":{"rendered":"
\"\"<\/a>

Jakub Lewandowski<\/p><\/div>\n

By Jakub Lewandowski, Global Data Governance Officer at <\/em>Commvault<\/em><\/a><\/p>\n

It can\u2019t have escaped your notice that there\u2019s a lot of heated debate around AI at the moment, most specifically around the emergence of generative AI algorithms and Large Language Models (LLMs) like ChatGPT, Google Bard, Dolly, and others.<\/p>\n

The rapid uptake of this technology has had a significant impact on just about every aspect of life: stimulating conversations around whether AI will take over human jobs, when and how it is ethically appropriate to use LLM tools, and how best to address the potential privacy and data security risks associated with using these tools.<\/p>\n

Ethical and philosophical debates aside, organisations looking to deploy LLM-powered solutions to streamline and automate processes, or summarise and generate intelligence gained from massive data sets, will need to give due consideration to the risks involved.<\/p>\n

Alongside creating internal policies and guidelines on how and when employees can use these tools, and for what, awareness of the current legal and regulatory landscape within which this technology currently operates will be key.<\/p>\n

LLM \u2013 what is it, and how does it work?<\/strong><\/p>\n

LLM is a type of AI algorithm that uses deep learning techniques and large data sets to understand, summarise, generate, and predict new content.<\/p>\n

Unlocking new possibilities in a range of fields, the potential applications for LLMs are infinite, encompassing everything from customer service chatbots through to anomaly detection and fraud analysis in financial services. It is also being used to speed up software development, generate complex legal summaries, provide insights for investment decisions, and create models that generate new insights on molecules, proteins, and DNA for pharmaceutical and life sciences researchers.<\/p>\n

Clearly, LLMs are already proving to be a game-changer for multiple industry sectors and have a strong appeal for any organisation looking to increase efficiency and productivity. But there are a number of well-documented challenges that come with using the technology. These include dealing with issues like fabricated or inaccurate answers, model and output bias, intellectual property and copyright infringements, as well as data protection concerns.<\/p>\n

Considering the risks<\/strong><\/p>\n

In terms of risk assessment and due diligence activities, some key questions will need to be asked around the sources from which data is taken to train and power LLM models, the licensing arrangements relating to that data, and how the data is sourced. Let\u2019s take a look at why this is important.<\/p>\n

LLMs can collect, store, and process any kind of data, including personal and other confidential data, at an unprecedented scale. This opens organisations up to some key challenges that arise from determining who is responsible for the legitimacy and quality of data used to train generative products.<\/p>\n

Without knowing this, organisations could face significant legal or regulatory penalties if their models utilise personal data that has not been obtained using appropriate permissions. For example, personal information disclosed to LLMs could subsequently be used in additional ways that violate the expectations, or permissions, given by the people to whom this information explicitly relates.<\/p>\n

\"\"<\/a>Secondly, how does an organisation prevent or guardrail against the generation of problematic content such as observed biases, deep fakes, or outright discrimination? The responsibility of solution providers and organisations in terms of who is accountable for prevention, monitoring, and response needs to be clearly understood and documented.<\/p>\n

When it comes to automated decision making or other outputs, who or what will gain access to the data or results generated by LLMs, and what are the implications of these systems in relation to cybersecurity risks?<\/p>\n

Finally, organisations intending to use AI will need to think carefully about how they address privacy related obligations such as responding to the requests from data subjects to access or delete their data.<\/p>\n

Regulatory compliance<\/strong><\/p>\n

LLMs are subject to the same regulatory and compliance frameworks as other AI technologies, but the speed at which they are becoming ubiquitous highlights some challenges in relation to compliance with existing data privacy and protection frameworks.<\/p>\n

Let\u2019s take a look at the key overarching legislation that organisations will need to be mindful of.<\/p>\n

General Data Protection Regulation (GDPR)<\/em><\/strong><\/p>\n

Encapsulating the crucial principles of data sovereignty \u2013 that digital data is subject to the laws and regulations of a country in which it is physically located, that the government has jurisdiction over it, and can enforce its data protection policies \u2013 GDPR sets out a number of key requirements and principles in relation to the processing of personal data. These include:<\/p>\n