Shadow AI in Sustainability Teams (and How to Govern It) | George Diplas & Martin Sieg

So maybe we can start with George first, and you can tell us in which most companies treat AI governance like a compliance break.

So maybe share with our audience what does governance look like when it speeds up adoption, and what are the two or three rules that make teams move faster, not slower?

Yeah, absolutely.

And that's an excellent question because it's something that even prior to working with movement with my experience as a lawyer, many times anything that crashes into a legal department or IT, that can very much be seen as a break.

However, what I have seen and what I now know is that governance should not slow down good use of AI.

In fact, it should make the safe path obvious enough that teams can actually move.

And that's the key to good governance.

So I think it's a mistake to treat AI governance as a permission system, which is I think what the default is.

Whereas what it should do is the exact opposite.

It should create that safe path, make it obvious enough.

And that way, once the tools are approved and everyone knows what data they can use and what outputs need review and what needs to be escalated, well, then things actually move faster.

and that starts with that bedrock of good governance um and that leads to good adoption and then once you have good adoption well now now you're moving right so it's the opposite of an actual break if you're doing it properly so to answer that second part of your question what are a couple of rules that i think would make this a reality is first and foremost um People need to know what the approved tools are and the approved use cases.

If people don't know where it's allowed and where it's not allowed, right away, that's a break.

And that leads to other issues, which I'm assuming we're going to talk about as well.

And then the second rule would be there has to be clear data rules because when it comes into a real problem is when There aren't data rules because that's where you run into issues with regulatory frameworks, compliance frameworks, privacy issues.

And if you have those clear data rules from the outset, then once again, not a break anymore.

Then people know what they can and can't do.

And then if I would add maybe a third rule

there,

it's those review standards have to be based on actual risk and be very real and operational, not just sort of generic.

So if there's actual risks that can be flagged, then they have to be flagged early on.

And then once again, that makes it not a break anymore.

Now people have that clear pathway, they feel safe, and that governance actually can speed up adoption.

I like that.

I never even really thought about, obviously, does the tools have to be actually approved because anybody can run amok with any tools, especially when they're being used.