Case Studies

The corporation’s contracts, policies, disclosures, and governance documents had largely been developed before generative AI became part of everyday business operations. As AI adoption expanded across procurement, operations, technology, HR, sales, and customer-facing workflows, important governance questions were not consistently addressed:

• Could employees enter confidential information into public AI tools?

• Could vendors use enterprise or customer data to train or improve AI models?

• Who owns AI-assisted outputs, prompts, structured data, and derivative improvements?

• Do existing warranties, indemnities, and liability provisions address AI-generated outputs?

• When is human review required for high-risk or customer-facing use cases?

• Are privacy, cybersecurity, audit, retention, and oversight provisions sufficient for AI-enabled workflows?

These issues created more than a document-management problem. They affected the company’s ability to demonstrate board-level oversight, audit committee readiness, investor confidence, and defensible risk management.

The participating leadership teams recognised that the principal AI risk was not necessarily technical failure. It was the possibility that directors and senior executives could be held responsible for an AI deployment without having the knowledge or framework required to question how it operated.

Technical teams were discussing model capabilities, parameters, and performance. The boardroom, General Counsel, and risk function needed to assess a different set of issues: liability, copyright, personal-data protection, vendor accountability, and internal ownership.

A leading educational institution was procuring a custom AI software solution to personalise student learning and automate administrative workflows. The proposed vendor terms appeared to give the vendor broad rights to use institutional data, including sensitive student records and proprietary research—to train or improve its own commercial models.