Forest First: Escaping the Perfection Trap in AI Governance

In this piece for Jones Walker’s AI Policy Navigator, authors Michelle Ramsden & Jason M. Loring share their thoughts on the need for organizations to move beyond waiting for comprehensive AI governance guidance and instead establish workable frameworks now. They note that AI systems, vendors, and standards are evolving too quickly for organizations to wait for regulatory certainty, while current resources such as NIST’s AI Risk Management Framework provide a useful foundation that can be refined over time.

The authors argue that effective governance should prioritize building a flexible system for identifying, assigning, controlling, and revisiting risks rather than seeking a perfect framework from the outset. They recommend starting with organizational purpose and boundaries, identifying acceptable and unacceptable AI uses, assigning decision-making authority, and integrating AI governance into procurement, vendor management, internal development, and other existing processes.

The piece also recommends developing visibility through ongoing discovery rather than waiting for a complete AI inventory, and assessing risks proportionately based on factors such as potential harm, affected individuals, system autonomy, data sensitivity, third-party dependencies, and the ability to override or stop AI-driven decisions. The authors emphasize that risk assessments should reflect context, with greater scrutiny for systems that could affect employment, healthcare, safety, financial access, or legal rights.

The autors stress that governance must continue after deployment. Organizations should establish clear triggers for reassessment when systems, data, vendors, users, autonomy, or scale change, while preparing defined procedures for AI-related failures and incidents. They conclude that the objective should not be theoretical completeness, but resilience: a governance system capable of identifying consequential changes, responding to failures, and improving as AI technologies and organizational practices evolve…

CONTINUE READING…