AI Impact Assessments – your new best friend!
No doubt you’re already familiar with the value Privacy Impact Assessments (PIAs) contribute to your privacy programme. They’re a key tool for really getting to grips with the key privacy issues in any new data-based project, product or initiative.
But have you met the PIA’s new, hotter friend – the Algorithmic Impact Assessment?
Just like a PIA, an Algorithmic or AI Impact Assessment (AIA) is all about systematically identifying potential risks and then working out appropriate ways to mitigate them. They are ideally done at the start of a new AI project and are a critical tool in your AI governance toolkit. They go further than a standard PIA, examining the entire algorithmic ecosystem — the data, the model and the outcomes.
Why do we need them?
Algorithms and AI systems, fuelled by data and guided by code, now shape our lives in all sorts of ways. They determine which cat videos grace our social media feeds, who receives a loan and which job applicants get an interview. And the potential for these systems to produce unfair, opaque and even dangerous outcomes means we need to understand what is going on under the hood so we can avoid harm to people and risk to organisations.
We know that Kiwis have particularly low trust in AI. AIAs can help your organisation adopt a more responsible approach to using AI by shining a light on the inner workings of these systems, helping to build trust and giving you a licence to continue innovating.
Meet the AIA Toolkit
Last year, Simply Privacy Principal Frith Tweedie was fortunate to be asked to help Statistics NZ Tatauranga Aotearoa (Stats NZ) design and develop an AIA Toolkit for government agencies. The purpose of the toolkit was to help the 29 signatories to the Algorithm Charter for Aotearoa New Zealand (the Charter) operationalise the Charter and meet their commitments under it.
The AIA Toolkit is designed to facilitate informed decision-making by government agencies on the benefits and risks of using AI and algorithms. After all, the stakes are high in the public sector – we don’t want a Kiwi version of Australia’s Robodebt debacle or the horror story that is the Dutch child welfare benefit scandal.
There are four components to the AIA Toolkit.
- Algorithm Threshold Assessment: to determine the need for a more in-depth assessment.
- AIA Questionnaire: a series of detailed questions about the algorithm and its potential impacts.
- AIA User Guide: a reference guide featuring explanations of key issues and case studies.
- AIA Report template: to help agencies articulate and summarise the key risks and controls.
The AIA Toolkit takes a risk-based and best practice approach to satisfying the Charter commitments, recognising that each agency will need to tailor the process and assessments in a way that’s most appropriate for its own role, context and risk profile. That means each agency is free to adopt the Toolkit – or aspects of them – as best suits its needs.
“So what” I hear the private sector people at the back saying….
This means the Toolkit can also be tailored for use in the private sector. Those in the business world get to skip over the public sector commitments, while still being able to avail themselves of key questions and guidance on key issues like algorithmic bias, transparency, explainability, safety and the big questions around training data and AI development and procurement.
After all, it’s not like business use of AI is risk-free – just ask Apple Card, Samsung, Air Canada, Workday and the lawyers who used ChatGPT to help draft their legal submissions…
And you’ll probably find the User Guide pretty helpful when it comes to understanding the various risks that can exist with algorithms and AI systems beyond the privacy issues you may already be more familiar with.
Initial feedback on the AIA Toolkit from government agencies has been really positive, with representatives commenting that the materials are thorough and useful. Many of them are already incorporating relevant aspects into their existing assessment frameworks.
So maybe it’s time for you to get to know AIAs a little better too?
If you’d like to find out more about what an AIA is, when you might need one and whether it needs to be separate from your trusty PIA (a whole other topic in itself), then please get in touch for a chat. You might also be interested in the IAPP AI Governance Professional training that we’re offering again in June.
*Image generated by AI – see how much fun it is to do an “Impact Assassment”?!