AI v HI? Our Consulting Director, Kevin Else, discusses the popular topic of AI and what to consider.
I recently had the pleasure of speaking at the LegalTech in Leeds Conference, regarding the challenges of securing legal data when digitally transforming a legal company.
However, the hot topic on most people’s lips was the potential use of AI to assist legal firms in creating a more automated and digital method of, (to take a phrase from one of the other speakers), access to justice.
Let’s clear a few things up first. There are over 900 products listed as AI tools, a number of which are well established and mature products, but aimed at a specific function or set of tasks. You are almost certainly using a product already that has a degree of machine learning, which makes decisions on information it holds about you. It’s how Facebook rates posts for you to see, or Amazon highlights products that you may be interested in. What has happened in the last year, is more open access to tools that use high volumes of collected data and are not specific to particular functions, and that’s not just OpenAI’s ChatGPT.
I am old enough to remember the debate that occurred when it was feared robots would replace all manual tasks, which would lead to mass unemployment. While some jobs where lost, others were created.
So, why do I need to talk about this from an information security point of view? There are two main areas of concern.
Data
The data used by these new tools tends to be invalidated. OpenAI gathers most of its information to make decisions from open data sources across the internet and from the information provided to it in the original query. And of course, we all trust the information on the internet don’t we!! It also leads the possible miss use of data published on the internet. Just because it is on the net doesn’t mean it’s copyright free.
Consent
The other major concern is, (which I spoke about in a recent article where I discussed the data privacy concerns around how the data is used), if the person the information relates to has given consent for it to be used in that way. There is also the concern that an automated decision may have an adverse effect on the person involved. The Information Commissioner’s Office has rules, although not that specific, on how automated decisions which affect “the wellbeing or financial status” of the person the decision is being made about. This could lead to a potential fine.
Considerations
Like all tools, AI has its place. But like all tools it can be used badly. It is dependent on the quality of the information it has. Would you feed confidential data into an open-source tool over which you have no governance or control? Would you allow a piece of software to decide if you should prevent someone from getting advice, a loan, medical treatment?
Before any data is entered into an environment you do not control, you need to carry out an impact assessment, both for business data (Business Impact Assessment) and a personal data point of view (Data Privacy Impact Assessment).
Don’t forget to include the HI in your AI planning.