A human resources department now culls through resumes using an Artificial Intelligence (AI) tool. No human eyes see the candidates’ credentials until the pool of job seekers is culled down to a manageable number. Elsewhere, an online insurance company has a very quick turnaround and low cost of client acquisition when selling life insurance. Prospective clients provide minimal personal information into a web interface and thereafter the company’s AI application crunches the provided information with various relevant databases to automate underwriting and make a go, no-go decision within hours, not days or weeks. Somewhere, a financial organization uses chatbots to securely process banking transactions for customers. Another firm uses facial recognition to allow employees to enter the building and to gain access to the company’s technology systems and data. Healthcare professionals use AI to improve accuracy and efficiency in diagnostics, treatments, and predictions. And a widget manufacturer does quality control and visual inspection with the aid of Machine Learning so that human verification of its products is no longer necessary.
All of this makes business better, cheaper, and happen faster. But the changes that come with new processes require lawyers, business folks, and information and technology professionals (at a minimum) to play a new role in managing the informational output of the processes to deliver compliance with laws and regulations, and to manage risk and cost. This article explores how AI creates information that must be proactively managed and who is needed to get such management done right.
Will AI Be Coming to Your Company?
There are numerous predictions about the growth and impact of AI, Machine Learning (teaching a tool by using known parameters) and Deep Learning (neural networks that behave like a human brain), and it appears that these technologies will continue to be transformative. The corporate pressure to use AI makes it almost impossible to avoid if your corporation wants to stay competitive. According to the International Data Corporation (IDC), the AI hardware and software market is predicted to be $156 Billion in 2021. What this means in practical terms is that many businesses are committing to using these powerful tools to transform all kinds of business processes. But as AI changes the way businesses function, there is still a need for regulatory compliance, and to have evidence of business activities and operations.
AI isn’t just about “running faster,” as the implementation of AI tools creates unique, information issues (e.g. ownership, bias, privacy, retention), which must be addressed by the company using the AI. An example may help make this point clear.
Building a Better Widget: A Business Case
Company manufactures and sells widgets around the world. While they produce high quality widgets, ABC Company is always striving to better the process, predict errors, advance new innovations, and cut costs. The head of manufacturing entertains various proposals each year to help manufacture a better widget. So how can ABC Company automate more of the manufacturing process and make AI robots do the heavy lifting? How can the manufacturing process attain better product consistency and reduce variables in the manufacturing process across the globe, in the various plants?
Just about every proposal advanced in 2021 to better the manufacture of the widget involves the application of technology in various aspects of the manufacturing process (sometimes referred to as Digital Transformation or applying new technologies to radically change processes, customer experience, and value). So, ABCCompany decides to begin producing widgets by using robots, and inspecting them with the aid of AI tools. ABC Company’s R&D team decide to make the widgets “smart,” such that the widgets now send information back to ABC Company.
Every time technology is brought to bear on the design and development of the widget, there is new information output that needs to be addressed. In other words, the company has to deal with issues like information access, ownership, control, lifecycle, etc. for each new process that bettered the manufacturing process of the widgets. And unless these issues are addressed up front from legal, information and records, technical and business perspectives, there will be many downstream legal issues that are more thorny to unwind.
So, for example, because ABC Company’s widget became “smart” and sends information back to the company, there are now privacy, liability, ownership and other previously unaccounted for challenges. And because ABC Company’s widget is now produced by robots and inspected with the aid of AI tools, there is information output which must be managed. The remainder of this article provides an approach to taking on these new information issues.
Let the Past Be Your Guide
As AI technology is introduced into your business processes, it may make sense to use the old rules that you developed in the past as a guide and morph them for today’s technology realities, rather than starting from scratch in your approach to managing the information that is generated because of AI. Let’s say your company is using AI tools to cull through engineers’ resumes, in order to find skilled resources to help build the new manufacturing lines; the engineers’ experience will be vital to reworking the manufacturing process. If your company previously kept the resumes for workers that you did not hire, then it may be worth keeping the resumes reviewed by the AI tool as well. Perhaps the resumes rejected by the AI tool will be useful if you wish to interview the candidates in the future, such as for a position different from the candidate’s original application. Or perhaps the resumes were kept in the past to address claims of discriminatory hiring – in this case, keeping not only the resumes reviewed but also the method the AI tool used to cull through the resumes seems logical. In any event, it is essential to consider what existing laws and regulations say about retaining the information in the relevant jurisdictions.
Does the Information Document a New Process or System?
When the implementation of AI technology to a business process creates a whole new way of doing things, you will need to consider how the technology functions; what information is used in or created by the process; how the process and AI technology is set up and what the output of the process is.
Let’s say ABC Company wants to do a better job of quality control on their widgets while also phasing out inspection operators on the assembly line. Instead of using humans to review the quality of the widgets during production, the new process will use AI tools. Images of the widget will be taken and compared to the images that were used to train the AI tool to determine which widgets conform to quality standards and which widgets don’t meet specifications. Machine Learning techniques (or something similar) will be required to get the system to assess which widgets pass the minimum quality standards without human intervention. If done correctly, the AI or Machine Learning application will be far faster and more consistent at reviewing the quality of the manufactured product.
To get this process right, the following questions regarding information retention should be considered:
- Should information related to the development, sourcing and implementation of the AI software and any hardware to run the AI or Machine Learning process be retained, and for how long?
- Should the company keep information related to the decision-making process during which it was determined where AI would be applied in the business or manufacturing process?
- Should the company retain information related to the AI technology in use (both hardware and software), and if so, what information should be kept?
- What decisions regarding implementation of the AI technology should be documented for future reference?
- Should the company retain documentation related to the AI functionality?
- What information regarding training and testing (Machine Learning) should be retained?
- What does the law of the relevant jurisdictions say about retaining these various types of information?
Machine Learning and the Need to Understand Training Records
Back to the earlier example, if the company is seeking to replace human inspection with AI tools, a “learning” or “training” process will be needed to teach the system what good widgets look like, and what defective parts should be flagged or discarded. Many training examples will be needed to “educate” the AI system on what to look for and how to determine if a part is good or bad. Can an algorithmic equation be used effectively to unearth defective parts? Yes! And AI and Machine Learning are doing a whole lot more to increase efficiency in areas beyond manufacturing as well.
So, what should ABC Company do with the training examples after the AI system has been trained? To the extent that the system will need to be retrained in the future, the training examples should be kept. Also, if they are needed to keep the AI system running (if the system needs to refer to good and bad samples for comparisons, i.e.), the training examples should be retained as well.
If a regulator wants to review how the system functions, you will want to be able to show how the system was trained and why you know it is doing the job it was trained to do. In the HR context, if an AI tool is assisting in the resume culling process to find the right candidate, the way in which the system was trained could be the focus of a discrimination claim. The company will want both the training examples and evidence of the process used to demonstrate that the system doesn’t discriminate.
What Happens when Information Volumes Grow?
The AI and Machine Learning processes sometimes create huge volumes of information as part of the process. But does all that information need to be retained? When you are determining what – if any – of the AI process’s informational output should be retained and for how long (two complicated questions), you need to assess the business utility of the content as well as any legal obligation to retain the information. This requires an upfront analysis of the business need for the information and what laws dictate that a record of the process is retained. In that regard, not all information output must be considered a “Record” for long term retention. In the case of the widgets, if multiple images are obtained to ensure the parts in production have passed, an analysis of business needs could become critical in weighing the cost of retaining every image obtained.
So, part of the informational output of the AI or Machine Learning process may be records while other output will not rise to the level of a record requiring retention. Usually, the company can decide what records of the business process they want to retain, but that too can be a complicated question. In any event, it is likely not necessary to retain all information as a record of the new business process. Getting a handle on this issue will require working through the various business and legal issues with the lawyers, business folks and IT professionals. Again, a team approach will get the company to the full-bodied right answer.
Whenever technology creates new information, the company should consider if there are any information ownership issues. Say for example, as part of the manufacturing line renovation project, ABC Company plans on installing smart monitoring tools to manage electricity utilization, and smart line vibration technology that will seek to maximize the stability of the manufacturing line so that the end-product remains consistently produced over time. Each of the monitoring devices are an Internet of Things (IoT), which means that they will be connected to the network and send data in real time to a centralized server. Many times, this IoT will be a cloud-based service. Assuming the server or service is owned by the maker of the monitoring equipment company, will ABC Company have access to the information (beyond its immediate use in adjusting equipment, etc.)? Perhaps more importantly, who owns the data that came from the manufacturing line monitoring tools? Who will get to use that information and how can they use it? Can the monitoring equipment company sell the data that came from ABC Company’s factory? Can they use it to improve the quality of the monitoring tools they might provide to other widget companies? You get the point. For every new stream of information, the company needs to understand who owns the information, what the access is, and the use your company will have of the information. Waiting until the process is up and running is too late to address ownership of information issues. Negotiate ownership, access, use and privacy issues up front in the contract for a more predictable and less painful result.
Consider Privacy and Information Security
Like all business processes that create or store information, consideration should be given to ensuring private information remains private, securing and locking down information as needed, and protecting company intellectual property and trade secrets. It is important to avoid unintended and unaccounted for data collection. For example, if a camera is capturing images of a manufacturing process, will it also capture images of a human operator? Are there additional data privacy considerations that need to be made? Also be aware that every time a new piece of technology or network connected device is added to a business process, that may be another way for your company systems to be hacked, exposed, exploited, and pilfered.
For every technology applied to a business process, there is information output that must be managed. And for all informational output that requires management, there are questions that need lawyers, business leaders, and technology and information professionals to weigh in. In that sense AI, Machine Learning, IoT and the application of any new technology is a team sport.
 IDC. “Digital Transformation (DX).” https://www.idc.com/itexecutive/research/dx
 Randolph A. Kahn, Niki Nolan, James Beckmann. “When Algorithms Inherited the Earth, How They Learned to Discriminate and What You Can Do About It.” April 17 2020. https://businesslawtoday.org/2020/04/algorithms-inherited-earth-learned-discriminate-can/