By Steve Macmillan, Managing Director, Protocol Policy

Generative artificial intelligence (GenAI) is now part of our evolving technology landscape. The recent proliferation of this technology means organisations of all sizes can access a range of business efficiency tools they could previously only dream of.

From chatbots capable of responding to complex customer inquiries through to smart software that tweaks supply chains based on real-time consumer demand, the use cases are endless.

GenAI has the potential to revolutionise many organisational processes. However, beyond the hype there’s a lot at stake from a risk, security and privacy perspective, so it’s important for organisations to ensure they use any AI technology in a secure, responsible and ethical manner, and in compliance with regulations.

Implementing effective IT security policies

IT policies provide a framework for addressing challenges, ensuring compliance, managing risks and harnessing the benefits of emerging technologies, while maintaining stability and security within an organisation.

Some examples of the role that IT policies play include:

• Security – IT policies play a crucial role in an evolving technology landscape. They help to establish security protocols and best practices to protect an organisation’s data, systems and infrastructure, and outline the rules for user access, data encryption, password management and more to mitigate security risks
• Managing risk – technology changes can introduce risks. IT policies address risk assessment, mitigation and contingency planning in order to minimise the impact of any potential disruptions
• User guidelines – IT policies establish guidelines for employees on how to effectively and responsibly use applications and tools
• Data management – IT policies define data collection, storage, processing, and sharing requirements, ensuring that data is handled consistently and responsibly, while maintaining integrity and privacy
• Compliance – the laws and regulations governing technology and data use change over time. IT policies that are kept up to date ensure that an organisation stays compliant with relevant laws or industry-specific regulations, helping to avoid legal issues and potential fines.

Policy considerations

A comprehensive policy framework that adequately addresses the use of AI within an organisation will provide guidance for the general user population, management and technical staff. In taking a holistic view one should consider existing IT policies that may require reviewing and updating, examples being access control, information management, software management, legal compliance and acceptable use, to name a few.

Implementing or updating policies to effectively mitigate the potential risks of using AI within your organisation may appear to be a daunting task. The good news is that the policies and any supporting content can be put in place using existing IT frameworks, standards, and the input of experienced personnel. Organisations should also support users with awareness training and guideline documentation.

Bringing it together at Buckinghamshire

In 2020, five councils were merged to form Buckinghamshire Council. From previous experience across the five councils, it was recognised that in some cases policy maintenance work was reactive, and it wasn’t uncommon for a staff member to raise a query about a policy which highlighted that the content was out of date, or not in line with technological advances.

The ICT team for the newly-formed council didn’t have an internal team of policy writers. However, it was key that the IT policy content for the council could be revised on an ongoing basis to remain relevant. The same would apply with regards to cross referencing the policies to relevant international standards. Trying to adopt and modify a selection of existing policy material would require a lot of time from a review and redrafting perspective.

The stakeholders determined that a new suite of policies should be developed and agreed that using policy management as a service (PMaaS) would help the ICT Team quickly develop and deliver policies that were fit for purpose for the new entity.

The project was concluded in eight weeks. The policy management as a service offering provides Buckinghamshire Council with a good foundation of policies that are referenced to standards applicable to the new council. Under the subscription model, the content in the premium version is kept up to date by PPS’ policy experts, ensuring ongoing audit and best practice alignment.

Richard Smith, IT Cyber Security Manager, Buckinghamshire Council, said: “We have embedded the PMaaS into our own learning management portal, linked to mandatory training to help us deliver the policy to all employees. With the advancement in the use of data by employees across the organisation, using PMaaS, we can be assured that our policies remain up to date and in line with international best practices.”

***

Sarah Stephenson, Business Development Consultant, Protocol Policy Systems, will be hosting a HQN event on 4 December, on AI in housing – risk vs opportunity? To find out more and book your place, please click here.