What is the BEST way for an IT governance board to establish standards of behavior for the adoption of artificial intelligence (Al)?

The most effective and primary role of an IT governance board is to provide strategic direction and ensure that enterprise objectives are achieved. Directing the creation and approval of a formal ethical use policy is the most comprehensive and authoritative way to establish standards of behavior. This policy serves as the foundational document that formally articulates the organization's principles, values, and rules regarding AI. It provides the basis from which all other control activities, such as training, contract clauses, and updates to other policies, are derived, ensuring a consistent and top-down approach to AI governance.

B. Reviewing and updating the data privacy policy is a necessary but insufficient action. AI ethics extend beyond data privacy to include issues like bias, transparency, and accountability.

C. Including ethics clauses in vendor contracts is a tactical control to manage third-party risk. The internal standards must be established first before they can be enforced externally.

D. Including ethics in training is a crucial step for awareness and implementation, but it serves to communicate existing standards, not to establish them initially.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 1: Governance of Enterprise IT

Section 1.5

"IT Governance Framework." This section emphasizes that the governance body is responsible for directing the creation of policies to guide the enterprise. An ethical use policy for AI is a prime example of this directive role.

2. ISACA

COBIT® 2019 Framework: Governance and Management Objectives (2018). Governance Objective EDM01

"Ensured Governance Framework Setting and Maintenance." This objective details the board's responsibility to "Evaluate

direct and monitor the enterprise governance system." Directing the creation of a policy for a new technology like AI falls squarely within this practice.

3. ISACA

"Artificial Intelligence: An Audit and Assurance Framework" White Paper (2023). Section 2

"AI Governance." The paper states

"An AI ethical framework should be established to guide the development and use of AI systems... This framework should be translated into policies and procedures that are communicated to all relevant stakeholders." This confirms that establishing a policy or framework is the foundational step.