Chapter Summary: Ethics, Governance, and Risk¶
Key Takeaways¶
-
Permission levels must match actual risk: The three-mode framework—Auto, Approved-Tools, Ask-Every-Time—gives you operational language. Klarna's agent handled 2.3 million conversations autonomously, then adjusted toward human-hybrid. A European bank's fraud system had a 99.7% false positive rate. Start new systems in Ask-Every-Time. Earn autonomy through documented reliability.
-
Governance must enable, not restrict: Organizations with mature frameworks deploy AI 40% faster. IBM's AI Ethics Board (since 2019) and JPMorgan's Operating Committee mandate (2025) show what works: Three Lines of Defense, clear escalation thresholds, and distributed accountability. Teams spend 56% of time on governance with manual processes—structure beats overhead.
-
The seven AI risks compound each other: Air Canada's chatbot invented a policy—$812.02 tribunal award. iTutorGroup's hiring AI rejected applicants over 55—$365,000 settlement. 23.77 million secrets leaked through AI in 2024. Hallucination becomes compliance violation. Bias becomes legal liability. Organizations with proactive controls achieve 60-70% lower incident response costs.
-
Audit trails are insurance, not overhead: Five logging layers—user, AI, system, business, compliance—with one goal: due diligence you'd be comfortable explaining in court. Deloitte's AI system produced errors on an AU$442K government contract; inadequate governance meant partial refund and public reporting. Seven-phase incident response when things go wrong.
-
Regulatory compliance is a moat, not a burden: EU AI Act penalties reach 7% of global turnover for prohibited practices. Full compliance requires 32-56 weeks. Colorado, Illinois, and NYC laws already in force. Building to the strictest standard now creates buffer for regulations that don't exist yet.
Next: Staying Ahead