Responsibility for AI errors lies with organizations

Stacy Shi

Organization management should be held ultimately responsible for errors in artificial intelligence systems, said Privacy Commissioner Ada Chung Lai-ling at the launch of a model framework for AI applications yesterday.

The framework suggests companies establish an internal governance committee consisting of management and interdisciplinary personnel - to provide guidance and oversight for the procurement and application of AI systems.

"The framework can nurture the healthy development of AI in Hong Kong, facilitate the SAR's development into an innovation and technology hub and propel the expansion of the digital economy not only in the SAR but also the Greater Bay Area," Chung said.

The privacy watchdog introduced the framework as noting a significant increase in the use of AI in Hong Kong workplaces, citing a Productivity Council survey that nearly half of local organizations will adopt AI tools within this year - up from 30 percent in 2023.

Chung also said the adoption of generative AI poses more privacy risks among other emerging technologies, including tendencies to collect excessive data or use data from different sources for personal identification. "For example, employees may provide confidential customer data to chatbots, which AI may retain for answering future user queries," she said.

"But users often do not fully understand how their data will be used by AI, and companies may face the risk of data breaches if they don't handle data security well."

To provide advice to organizations that intend to adopt AI systems for handling personal data in order to minimize privacy risks, the framework also covers recommended measures in four areas - establish AI strategies, risk assessment, system implementation and management, and communication with stakeholders.

Institutions are advised to conduct comprehensive risk assessments to systematically identify, analyze and evaluate the risks involved in the procurement, use and management of AI systems, and human employees should intervene whenever necessary to prevent improper output or decisions by AI - especially when processing high-risk data.

"If the use of the AI system involves the collection of biometric data, of course that would be a high-risk scenario. And if the AI system is to provide recommendations on the granting of credit to individuals or institutions, that would also be a high-risk scenario," Chung added.

She also reminded organizations to continuously monitor AI and formulate contingency measures against hacking attacks, and suspend the use of AI in serious scenarios.

Chung described the framework as a guide that provides internationally recognized recommendations and best practices for institutions, adding that users can be sure that their practices are lawful when they follow the guidelines.

Also, the PCPD carried out spot checks on the use of AI by 28 enterprises from last August to February with no suspected violation found, Chung said, adding more random checks will be conducted.

stacy.shi@singtaonewscorp.com