The extraordinary turbulence surrounding AI security is likely to have a profound impact on board governance of health care companies, both as to its overarching agenda and to director oversight obligations. This, given the extensive commitment by many such companies to AI implementation in operations, administration, research and patient care.
The public drumbeat of developments involving unpredictable and uncontrollable AI agents first emerged in July with news of the OpenAI-Hugging Face data breach. They gained momentum with Bill Gates’ lengthy Aug. 26 essay warning that the world was dramatically unprepared to deal with the transition to the AI era, in all of its complex dimensions. A similar warning, as to the security of the global banking sector, was issued the following week by the head of G-20’s financial stability board. Then, more recently, came the apocalyptic projections from two prominent AI researchers.
These were followed by the 3,800-word Sept. 12 essay from Anthropic’s CEO and co-founder, Dario Amodei, PhD, recommending a pause in efforts to improve the capabilities of AI models, in order to address signs that the technology was beginning to exceed the ability of its developers to understand and manage it. The next day, the senior executives of several competing AI labs (including Elon Musk and Sam Altman) endorsed Amodei’s warning. All in all, a chaotic several months for a technology so heavily embedded into the health care sector.
Doomsday projections and the like don’t fit neatly within the established governance framework for addressing red flags of enterprise risk. They’re not like traditional compliance concerns or operational challenges; there’s no ready playbook for how the board should respond. Nevertheless, these recent warnings come from prominent industry leaders. The flags they are waving appear bright enough to put the board on notice of possible extraordinary trauma, and to prompt some form of good-faith response. And that response might incorporate some of the following measures:
1. Role awareness: Board effectiveness in this situation is grounded in confirmation of its specific oversight role for the organization’s use of technology: how management applies it, and reasoned, good-faith board decisions regarding its use. The goal is not to micromanage AI strategies, but rather to keep a finger on the operational pulse.
2. Stability: Intense media focus of the AI doomsday predictions and related risks has fueled an understandable level of public concern and confusion. The board can support management efforts to address these concerns by maintaining a stable profile that reflects a balance of attentiveness, reassurance and responsiveness.
3. Engagement: The current disruptive environment calls on the board to increase its level of situational awareness. This could be manifested in increased familiarity with the relevant developments and their impact on the company; enhanced monitoring of management’s responsive plan; and soliciting the perspectives of technology, research and medical experts.
4. Constructive skepticism: The board should consider applying increased scrutiny to both the validity of apocalyptic claims and predictions on the one hand, and of management strategies with respect to AI investment and deployment on the other hand. Established projections of AI’s promise to the company should be revisited.
5. Listening tour: The board may wish to encourage management to actively seek, and incorporate into its responsive strategies, the relevant perspectives of its principal constituents; e.g., its stockholders/sponsors, consumers, workforce, vendors and those living in the communities in which it operates.
6. The corporate voice: The board may also consider exercising the corporate social voice in connection with emerging proposals for technology regulation. Such consideration would include what it perceives to be in the best interests of the company, the perspectives of its internal and external constituencies, and the risk/reward balance associated with public advocacy.
7. Other advocacy: Value can be achieved from board – directed efforts by management to pursue legally permissible forms of advocacy on AI control risks with or through its elected state and federal legislative representatives, peer organizations, trade associations and other similar conduits. This, especially with the emergence of multiple legislative and regulatory proposals to address AI risks.
8. Trust and confidence: The board should request management’s perspective on how the current chaos may impact the perspectives of its practitioners, employees and consumers on the continued reliability and benefits of AI; will developments damage public trust and workforce confidence in the technology?
9. Compliance implications: Consistent with its compliance oversight obligations, the board should work with management to monitor the impact on corporate compliance, cybersecurity and AI governance mechanisms that may be prompted by new state or federal legislative or regulatory responses to the current environment.
10. Strategic management monitoring: The board may request management to monitor the impact of emerging security concerns and potential responses to those concerns on the AI-related elements of the organization’s strategic plan. This is particularly with respect to a potential development pause, possible regulation and consumer backlash.
The current, volatile and complex discussion about AI safety requires the attention of health care boards. To be sure, there are no clear best practices on how governance is expected to respond to existential enterprise risks such as uncontrollable AI models. Nevertheless, meaningful efforts to become informed on the issues in play and to consider targeted responses will enhance the board’s status as a valued strategic advisor to management as this extraordinary discussion continues.
Mr. Peregrine is a retired corporate governance attorney. He is a fellow of both the American College of Governance Counsel and the American Health Law Association.
