Before You Draft: What Do You Need From A Workplace AI Policy?
With that background knowledge in mind, the next step in formulating an AI policy for your organization is to look inward and ask:
- How are you using AI today?
- How do you want to use AI in the future?
- Do you have sensitive data that needs to be protected from AI tools?
- What are the biggest risks AI presents to your organization?
Having a firm grasp on the answers to these questions will guide you in deciding what your AI use policy will look like. Consult with those responsible for IT and data privacy in your organization, as well as business unit leaders to determine the roles they see for AI, both currently and in the future. Knowing what you need from your workplace AI policy can guide you in the drafting process as you evaluate the risks and benefits, determine who needs to use AI and for what tasks, and consider how to guide employees’ conduct related to AI.
AI Legal Considerations.
Private-sector use of AI is not highly regulated at this point in time, but AI is on the radar of state governments, and many are taking action in certain industries and contexts.8 The Federal government is similarly exploring AI policymaking.9 For companies doing business internationally, many other countries and the EU are ahead of the curve, and have taken AI-specific regulatory action.10 Before drafting a workplace AI use policy, you should make sure you are aware of any laws related to AI in the jurisdictions where your business operates. Even if you are not impacted by any specific laws now, it is likely that state and Federal laws will be passed in the future which will impact your workplace AI use policy, at which point reevaluation of the policy will be necessary.
Not all laws which need to be considered when drafting a workplace AI use policy are AI-specific. Data protection, consumer protection, anti-discrimination, and other general laws regulations affecting your business should be considered when evaluating an AI policy and AI tools. This will vary industry-to-industry and business-to-business.
Key Workplace AI Policy Components.
A workplace AI use policy should outline reasonable use guidelines, restrict data inputs, protect intellectual property, and require employee review and disclosure. Like any good policy, your workplace AI use policy should define its purpose and scope, define key terms, identify related training, and describe or refer to reporting procedures and consequences for violations. Depending on the policy and the nature of your workplace, you may want to outline general principles, list approved AI tools, and identify who must approve the use of AI. Restricting data inputs and protecting intellectual property may best be couched in confidentiality, with reference to any confidentiality and data use policies you may already have. Similarly, you may need to incorporate document retention and intellectual property policies.
Reasonable use guidelines will vary company-to-company, but in any event should be clear. Limiting AI use to approved tools or narrowly-defined tasks is one way to allow AI use in the workplace, while preventing data loss, compliance issues, and ethical concerns. Another option may be to limit who is permitted to use AI. The policy should encourage employees to recognize the limitations of any AI tools they may use. Your policy should prohibit employees from inputting sensitive or confidential information into non-secure AI tools. Requiring employee review of AI outputs is also key to ensure accuracy, as AI tools have been known to give misleading and sometimes completely made-up information. It is also prudent to require employees to disclose when a task has been completed by AI. Combining the review and disclosure requirements will help ensure accountability and accuracy when AI tools are used in the workplace. With respect to the limitations of AI, it may be appropriate to make employees using AI responsible for knowing, recognizing, and respecting the limitations of the tools they are using, with an emphasis on avoiding over-reliance, careful output review, and vigilance.
Conclusion.
In many industries, the modern workplace demands both the use and control of artificial intelligence. Creating a workplace AI policy is important to ensure the protection of your organization, while allowing innovation and the utilization of new technologies. As the world of AI continues to evolve, the requirements of AI policies will too, so it is important that once drafted, a workplace AI policy is regularly revisited, reviewed, and revised, to keep up with new advances, trends, and threats. AI is probably already in your workplace, and it is here to stay. Addressing AI and crafting a workplace AI use policy is important to ensure all employees are on the same page as to responsible, ethical, and legal use of artificial intelligence tools.
1 Kevin Roose, How ChatGPT Kicked Off an A.I. Arms Race, NEW YORK TIMES, Feb. 3, 2023, https://www.nytimes.com/2023/02/03/technology/chatgpt-openai-artificial-intelligence.html.
2 Dall-E is a neural network that generates images from text descriptions. DALL-E, OPENAI, Jan. 5, 2021, https://openai.com/research/dall-e. Gemini is a generative AI chatbot, similar to ChatGPT, from Google. Gemini, GOOGLE, https://gemini.google.com/ (last visited Feb. 26, 2024). Copilot is a chatbot powered by GPT-4 and DALL-E 3, combining the capabilities of both. Copilot, MICROSOFT, https://copilot.microsoft.com/ (last visited Feb. 26, 2024).
3 R. Scott Raynovich, The Top Five Real Risks of AI to Your Business, FORBES, June 22, 2023, 1:29 p.m., https://www.forbes.com/sites/rscottraynovich/2023/06/22/the-top-five-real-risks-of-ai-to-your-business/?sh=5cd98e331e4a; Edward Segal, 10 Threats That the Use of AI Poses for Companies and Organizations, FORBES, May 2, 2023, 9:32 a.m., https://www.forbes.com/sites/edwardsegal/2023/03/02/10-threats-that-the-use-of-ai-poses-for-companies-and-organizations/?sh=683dfb403c7a; Kay Firth-Butterfield, Impact of Artificial Intelligence and Business Concerns, WORLD INTELL. PROP. ORG., https://www.wipo.int/tech_trends/en/artificial_intelligence/ask_the_experts/techtrends_ai_firth.html. (last visited Feb. 23, 2024).
4 Cameron Coles, 11% of Data Employees Paste Into ChatGPT is Confidential, CYBERHAVEN, Feb. 28, 2023, https://www.cyberhaven.com/blog/4-2-of-workers-have-pasted-company-data-into-chatgpt/.
5 Sarah Jackson, Nearly 70% of People Using ChatGPT at Work Haven’t Told Their Bosses About It, Survey Finds, Mar. 21, 2023, 5:18 P.M., https://www.businessinsider.com/70-of-people-using-chatgpt-at-work-havent-told-bosses-2023-3/.
6 Thomas H. Davenport & Rajeev Ronanki, Artificial Intelligence for the Real World, HARV. BUS. REV., Jan.–Feb. 2018, https://hbr.org/2018/01/artificial-intelligence-for-the-real-world; Take Advantage of AI and Use it to Make Your Business Better, IBM, Aug. 15, 2023, https://www.ibm.com/blog/take-advantage-of-ai-and-use-it-to-make-your-business-better/; Brenna Sniderman, et al., Generating Value from Generative AI, DELOITTE, https://www.deloitte.com/us/en/insights/topics/digital-transformation/companies-investing-in-ai-to-generate-value.html/ (last visited Feb. 23, 2024).
7 Michele Lerner, Worried About AI in the Workplace? You’re Not Alone, AM. PSYCHOLOGICAL ASS’N, Sept 7, 2023, https://www.apa.org/topics/healthy-workplaces/artificial-intelligence-workplace-worry.
8 Artificial Intelligence 2023 Legislation, NAT’L CONF. OF STATE LEGIS., Jan. 12, 2024, https://www.ncsl.org/technology-and-communication/artificial-intelligence-2023-legislation.
9 See Blueprint for an AI Bill of Rights, THE WHITE HOUSE, https://www.whitehouse.gov/ostp/ai-bill-of-rights/ (last visited Feb. 26, 2024).
10 Joe Mariana, et al., The AI Regulations That Aren’t Being Talked About, DELOITTE, https://www2.deloitte.com/us/en/insights/industry/public-sector/ai-regulations-around-the-world.html (last visited Feb. 26, 2024); Bill Whyman, AI Regulation is Coming – What is the Likely Outcome?, CENT. FOR STRATEGIC & INT’L STUDIES, Oct. 10, 2023, https://www.csis.org/blogs/strategic-technologies-blog/ai-regulation-coming-what-likely-outcome.