Introduction

The rapid evolution of Artificial Intelligence (AI) and particularly Generative AI has opened up new opportunities, and prospects of development and inclusive growth. But, in the wrong hands, AI can unleash fraud, discrimination, disinformation, stifle healthy competition, disenfranchise workers, and even threaten national security. The United States of America, the European Union, and the United Kingdom have taken the first steps to regulate the development of AI with a strong focus on data privacy, transparency, accountability, security, and ethics.

Here is a quick overview of the key regulations being implemented in these three regions, highlighting the main points to note.

The European Union’s Artificial Intelligence Act

The European Parliament adopted the Artificial Intelligence Act in March 2024, which will be fully applicable 2 years after entry into force. The objective of this Act is to standardize a technology-neutral definition for AI for future reference. Furthermore, the Act aims to ensure that AI systems within the EU are safe, transparent, traceable, non-discriminatory, environmentally friendly and monitored by people and not automation. The law uses a risk-based approach, with different requirements based on the level of risk. 

Risk level definition: It defines 2 levels of risk and states obligations for providers and users depending on the risk level:

• Unacceptable Risk AI Systems - These are considered to be harmful for people and will be banned:

  • Cognitive behavioral manipulation of people or vulnerable groups
  • Social scoring or segmentation of people based on behavior, personal characteristics or socio-economic status
  • Biometric identification and categorization
  • Real time and remote biometric identification such as facial recognition programs

  There are some exceptions and rules established for law enforcement agencies.

• High Risk AI Systems - AI systems that can negatively impact fundamental rights and / or safety of people:

  AI systems used in products covered by the EU’s product safety legislation, such as toys, aviation devices and systems, cars, medical devices and elevators.

  AI systems in specific areas that have to be registered with an EU database:

  • Systems used for managing or operating critical infrastructure
  • Systems used for educational and vocational training
  • Those used to employment, employee management and access to self -employment
  • Those that are involved with access to and utilization of essential private and public services and benefits
  • Law enforcement systems.
  • Systems involving migration, asylum, border control management
  • Those providing legal interpretation and application of laws.

  High-risk AI systems will have to be assessed before they can reach the market and will be assessed throughout their lifecycle. EU residents can file complaints with relevant national authorities.

Transparency requirements – While the Act does not classify Generative AI as high risk, it mandates transparency requirements and compliance with EU copyright laws:

• Disclosures that state the content was generated by AI
• Designing the model to stop it from generating illegal content
• Publishing summaries of copyrighted data used for training

Supporting Innovation – The Act aims to help startups and small to medium businesses leverage AI with opportunities to develop and train AI algorithms before public release. National authorities have to provide companies with suitable testing conditions that simulate real-world conditions.

United Kingdom’s Response to the White Paper Consultation on Regulating Artificial Intelligence

In February 2024, the UK Government announced its response to the 2023 whitepaper consultation on AI regulation. Its pro-innovation stance on AI follows an outcome-based approach with a focus on 2 key characteristics – adaptivity and autonomy – that will guide domain specific interpretation.

It provides preliminary definitions for 3 powerful AI systems that are integrated into downstream AI systems:

• Highly capable GPAI – large language models fall into this category. These are foundational models that can carry out a wide range of tasks. Their capabilities can range from basic to advanced and can even grow to outpace the most advanced models in use currently.
• Highly Capable Narrow AI- these can carry out a limited range of tasks within a specific field or domain. These can also meet or outpace the most advanced models in use today within those specific domains
• Agentic AI – this is an emerging subset of AI technology that can complete numerous sequential steps over long periods of time using tools like the Internet and narrow AI models.

It sets out five cross-sectoral principles for regulators to use when driving responsible AI design, development, and application:

• Safety, security, and robustness
• Appropriate transparency and explainability
• Fairness
• Accountability and Governance
• Contestability and Redress

The principles are to be implemented on the basis of three foundational pillars:

• Working with existing regulatory authorities and frameworks – UK will not be instituting a separate AI regulator. Instead existing regulatory offices such as the Information Commissioner's Office (ICO), Ofcom, and the FCA, will implement the five principles as they oversee their respective domains and use existing laws and regulations. They are expected to quickly implement the AI regulatory framework within their domains. Their strategy must include an overview of the steps taken to align their AI plans with the principles defined in the framework, an analysis of AI-related risks, and an overview of their ability to manage these risks.
• Creating a central function for risk monitoring and regulatory coordination – The UK has set up a central function within DSIT to monitor and evaluate AI risks and address any gaps in the regulatory environment. This is because AI opportunities and risks cannot be addressed in isolation.
• Foster innovation via a multi-agency advisory service – A multi-regulatory advisory service, the AI and Digital Hub, will be launched to help innovators ensure complete legal and regulatory compliance before they launch their products.

Blueprint for an AI Bill of Rights by the White House Office of Science and Technology Policy

The White House Office of Science and Technology Policy has formulated the Blueprint for an AI Bill of Rights with five principles to guide the design, use, and deployment of AI systems. The includes:

Safe and Effective Systems

• Diverse communities, stakeholders, and domain experts should be consulted during the development of automated systems so that concerns, risks, and possible impact of the systems can be better identified
• Extensive pre-deployment testing, risk identification and mitigation, and ongoing monitoring to ensure safety and effectiveness
• Automated systems must be designed to proactively protect the American public from any negative impact due to unintended uses or impact of the systems. This includes inappropriate or irrelevant use of data in the design, use, and deployment of these systems

Algorithmic Discrimination Protections

• This happens when automated systems contribute to differential and unfair treatment of people based on their race, color, ethnicity, gender, medical condition, sexual orientation, gender identity, religion, disability or any other classification protected by law
• Designers and developers have to take proactive and continuous steps to protect the American public from such discrimination and ensure that systems are designed to be equitable
• This must include proactive equity assessments as part of the system design, use of representative data, protection against proxies for demographic features, ensuring accessibility for people with disabilities, disparity testing and mitigation, and organizational oversight
• It also recommends independent evaluation and plain language reporting

Data Privacy

• Built-in measures to protect against abusive data practices and default measures to ensure individual agency over how personal data is collected and used
• Designers, developers, and deployers of such systems must secure individual consent regarding the collection use, transfer, access, and even deletion of personal data
• Consent collection mechanisms must be brief and in easily understood language
• Data pertaining to sensitive domains such as healthcare, education, criminal justice, and finance, must be used only for necessary functions and be protected by ethical review and use prohibitions
• The American public cannot be subjected to unchecked surveillance and such technologies must undergo stricter oversight with pre deployment assessment of possible negative impact
• Continuous surveillance cannot be used in education, work, housing, or in other contexts where the use of such surveillance technologies is likely to limit rights, opportunities, or access

Notice and Explanation

• People must know when an automated system is being used and understand how it impacts them
• This must be communicated via plain language documentation with clear description of how the system works and its outcomes
• People must know when an outcome impacting them was determined by an automated system even when that system was not the only input determining the outcome

Human Alternatives, Consideration, and Fallback

• People should have the option of connecting with people to remedy any problems and should be able to opt out of automated systems to engage with a person instead
• Engagement with humans should be accessible, equitable effective and managed well with adequate operator training. It should not put additional burden on the public
• Automated systems in sensitive domains must be customized to provide meaningful access for oversight and include human consideration for high risk or negative decisions

In addition to these federal guidelines, several states are also formulating their own regulations. 17 states (California, Colorado, Connecticut, Delaware, Illinois, Indiana, Iowa, Louisiana, Maryland, Montana, New York, Oregon, Tennessee, Texas, Vermont, Virginia and Washington) have enacted 29 bills on AI regulation over the last five years.

Stay Ahead with MetricStream

AI technologies are here to stay and the world has to learn to use them safely for the betterment of humanity. Regulations for AI development and use are critical to protect populations from bias, discrimination and breach of privacy. AI technologies are evolving at an unprecedented pace, and regulators across the world are following suit with quick updates or new frameworks. Organizations need automated compliance platforms to keep pace with this rapidly changing regulatory landscape.

MetricStream’s Compliance Management can simplify and fortify enterprise compliance initiatives amidst a rapidly changing regulatory landscape. Gain greater visibility into control effectiveness and quick issue remediation with streamlined:

• Mapping of regulations to processes, assets, risks, controls, and issues
• Identifying, prioritizing, managing, and monitoring areas of high compliance risk
• Performing control testing and monitoring
• Creating and communicating corporate policies
• Identifying, capturing, and managing regulatory updates
• Generating reports with drill-down capabilities

Even as compliance management is simplified and streamlined, it is important to have a mechanism in place to keep track of rapidly evolving regulations. MetricStream’s Regulatory Change Management platform is a centralized framework that can help organizations capture, curate, identify, extract, consolidate, and manage regulatory changes and updates sourced from diverse providers.

Find out more. Request a personalized demo today!

Introduction

With Asia-Pacific’s (APAC) economic growth surpassing expectations, businesses have much to be optimistic about. However, as regulations and risks in the region grow more numerous, the need for effective governance, risk, and compliance (GRC) has never been more pressing. APAC GRC professionals are being called upon to spot emerging risks, connect the dots, and help their organizations adapt swiftly to regulatory changes. GRC solutions that can help meet these demands at scale and speed will make all the difference.

I recently had the chance to host GRC Design Workshops in Malaysia and the Philippines in association with our strategic partners - HCLTech and Expleo respectively. The workshops, led by Michael Rasmussen, GRC Analyst & Pundit, GRC 20/20 Research, delved into a range of GRC areas, including the evolving risk and regulatory landscape in APAC, GRC challenges faced by organizations in the region, how technology and automation can help, and more.

Here are some of the key takeaways from the workshops, providing insights into the trends and opportunities likely to be encountered by GRC professionals as they gear up for the road ahead.

1. Constantly Changing Regulations

Keeping pace with regulatory change is no small feat. In the past three years alone, Singapore, Hong Kong, and Australia have either revised or issued new standards and guidelines around operational risk management and resilience.

Meanwhile, India enacted its first comprehensive data protection law in 2023 – the Digital Personal Data Protection (DPDP) Act, even as Japan substantially amended its own Act on the Protection of Personal Information (APPI), a year earlier.

Climate change too has been enveloped in a flurry of regulatory activity. Vietnam’s Law on Environmental Protection took effect in 2022, followed by Malaysia’s Energy Efficiency and Conservation Act in 2023.

2. Risks Galore

In addition to juggling regulations, APAC GRC professionals also have to navigate a growing variety of risks – including the Ukraine and Middle East conflicts that have strained global supply chains; extreme weather events like the floods in China and drought in India; the risks of deep fakes and misinformation associated with AI; and of course, the constant threat of a cyberattack. Incidentally, APAC experienced the highest year-on-year surge in weekly cyberattacks during Q1 2023, with an average of 1,835 attacks per organization.

Risks come from within the organization too – from changes to business objectives, structures, processes, employees, and technologies, as well as from the extended enterprise of suppliers, vendors, contractors, dealers, and distributors.

Getting these risks under control is key to strengthening organizational resilience and performance.

3. Connecting the Dots

If there’s anything we’ve learned over the past few years, it’s that everything is connected. A data breach in a third-party service provider’s system can disrupt entire supply chains, damage business reputations, trigger hefty regulatory penalties, and sometimes even shut down operations for days.

That’s why it’s so important to be able to see the big picture – to understand how risks impact and influence each other, how they affect compliance, and how they hinder or help the achievement of business objectives. 

GRC offers that perspective. It enables organizations to understand the road ahead more clearly, make better-informed decisions, and capitalize on the right opportunities at the right time. In other words, GRC shouldn’t be seen as an afterthought, but an enabler of the business.

Challenges and Roadblocks

APAC GRC professionals tell us that these are some of the GRC challenges they face:

• Data silos: Risk and compliance data is scattered across disparate systems and business functions. So, organizations don’t have a clear view of their GRC universe.
• Inefficient processes: GRC data is manually managed through spreadsheets, emails, and other cumbersome tools that slow down risk efforts and limit efficiency.
• Lack of forward-looking risk visibility: When an organization’s sights are only fixed on the rear-view mirror, they aren’t able to anticipate emerging risks. Issues are managed reactively rather than proactively.
• Limited agility: With manual and siloed GRC processes, organizations can’t adapt quickly to regulatory and business changes. Nor can they coordinate and integrate GRC across business functions.
• Forgetting the G in GRC: Many organizations forget that GRC begins with governance – i.e., the achievement of objectives. Whether it’s an enterprise objective or a process objective, that’s what risks and compliance should be measured against.

The GRC Playbook: Six Winning Practices

Here are six ways to overcome the above challenges, and create a truly world-class GRC program:

• Automate wherever possible: Toss out those spreadsheets, and unlock new efficiencies by streamlining and automating your GRC processes. With automation, you can monitor risk exposure and compliance status in real time, and respond more proactively when issues Also, automating routine GRC tasks frees up more time for your teams to focus on value adding and strategic activities like risk analysis.
• Build a single source of GRC truth: Break down silos, and unify all your GRC data in a single system of record. Enrich that data by integrating information from other systems like ERP platforms, social media, transaction systems, threat and vulnerability scanners, and regulatory content feeds. The idea is to have complete horizontal and vertical GRC visibility across your enterprise through one platform. This can help you make better-informed decisions that optimize risk-reward trade-offs.
• Understand risk interconnectedness: Map your GRC data in such a way that users understand the relationships between various risks, regulations, policies, controls, third parties, ESG (environmental, social, and governance) elements, strategic objectives, audits, incidents, and cases. Having a connected view of GRC will help you target your risk management efforts and resources in the right place, in the right way, at the right time.
• Foster risk awareness across teams: Bring together your risk managers, compliance professionals, and auditors on one platform where they can seamlessly collaborate and exchange GRC insights. Empower your front line with simple, intuitive GRC tools to capture issues and risks as they arise.
• Enable continuous control monitoring and regulatory horizon scanning: Chances are that you can’t manually monitor all your controls and regulatory changes all the time – even though you need to. So, choose a continuous control monitoring (CCM) tool that can automate the process. Go from periodic, sample-based testing models to always-on monitoring of full control populations. Couple that with regulatory change management software that can automatically capture alerts on proposed and anticipated legislation, as well as regulatory updates. So, you can adapt your compliance program faster.
• Use AI for richer insights: AI-powered analytics can unlock the full potential of your GRC and transactional data by connecting with multiple data sources, and drawing out insights faster. Use it to enable predictive and data-driven decision-making. You can even train AI models to identify risk and control deficiencies, patterns of over-testing and under-testing, and duplicate risks and controls that can be removed.

Transform your GRC program with MetricStream

MetricStream ConnectedGRC helps you build an automated, truly integrated, and collaborative approach to GRC. Reduce risk exposure with streamlined assessments and mitigation. Enable consistent compliance with robust control testing and reporting tools. Finally, achieve your objectives with ease using strong governance and policy management mechanisms.

MetricStream products are packed with best practice workflows, content, AI, and analytics to help you:

• Drive business growth and strategic differentiation through your GRC program
• Connect risk, compliance, audit, cybersecurity, and sustainability on one platform
• Improve GRC efficiency, reduce costs
• Protect your digital business from cyber risks and evolving threats
• Grow with purpose using ESG best practices

To learn how MetricStream can help you on your GRC journey, request a personalized demo today.