Risk reduction, not paralysis: How to manage risk without killing innovation

Most AI compliance programs include a requirement to “minimize risks,” a critical goal. But unless your organization can clearly define acceptable residual risk, your compliance plan can quickly devolve from mitigating risk to eliminating risk – along with any benefits.

Trying to eliminate risk completely will bring any AI rollout, even ones that are operationally and morally sound, to a grinding halt. To help responsibly reduce risk and responsibly adopt AI, risk minimization needs guardrails, standards, and tools.

To get started, your company can take these steps:

First, decide whether any risk at all is worth it for your institution. There is tremendous pressure to adopt AI for the sake of adopting AI. But adoption motivated by the fear of not having a splashy AI announcement will not generate results, improve outcomes, or otherwise deliver on AI’s promise. Fear of being left behind can lead to the wrong incentives to pilot and adopt AI tools. This creates risks of its own: overburdened procurement teams, rushed contracting, “death by pilot” (reducing the effectiveness of every pilot and exhausting the IT team), rushed trainings that lead to human error, and insufficient security safeguards because teams are told to “get it done,” to name just a few.

Second, flip the script. Instead of thinking about reducing risks, come at the question from the other perspective – accept that risks will remain, and articulate what level of risk is acceptable for your organization.

This is not unprecedented in healthcare. For example, human subjects research involves experimentation, and it would be nearly impossible to conduct research if risks had to be eliminated. Ethical boards that oversee risk begin with the assumption that ongoing risk is expected and accepted. The acceptable level of risk is established by the alternatives and the extent of the benefit, among other things.

Third, consider two categories of risk: How likely is it that AI will not perform as expected? And what is the impact of this vulnerability, malfunction, or other unexpected result?

At some point, there will be diminishing returns from risk reduction. In healthcare, this is apparent in the way that entities regulated by HIPAA conduct their required risk analyses. Sometimes, if a risk is likely to occur but the impact would be minimal – and further reducing it would diminish functionality or increase costs – an assessor will determine that it’s not reasonable to require continued risk reduction.

Fourth, define risk categories up front and identify the factors that raise or lower risk, creating a clear decision-making matrix. Assessing every new technology from scratch will exhaust your compliance team and produce inconsistent results.

Again, the research context provides a useful model. In human subjects research, there is a category deemed “minimal risk.” The criteria for minimal risk (not no risk) are set out in advance (in some cases by regulation) in clear and straightforward standards. Those studies receive a streamlined review, freeing reviewers to focus on more complex cases. Over time, ethical review boards have identified factors that tend to increase risk (e.g., enrolling vulnerable populations such as prisoners, children, or pregnant women) or reduce it (e.g., testing a drug with extensive clinical data for a new indication). These factors guide deliberations.

Finally, take a multi-layered approach, combining technical mitigation, human resources, and follow-through strategies. In higher-risk situations, this can be especially effective.

Technical risk mitigation leans on a model’s built-in guardrails (such as escalation triggers to warn of potential user harm) and AI “judges” – essentially AI managers overseeing the work of the model.

Human resources involves investing in and supporting the humans who will oversee the tool in its various uses. Merely having a human “in the loop” checking the box or passively observing isn’t enough. People must actively monitor the tool, treat it as a tool rather than an operative decision-maker, and feel empowered to verify or overrule it. People should be accountable for how the tool is used (scaled for the tool’s role) and should receive the training, AI literacy, and workflow support to use the tool safely.

Follow-through means actively monitoring the tool post deployment, conducting audits and double checks, and monitoring for known hazards such as hallucinations, degradation, and drift. In certain cases, working with an independent third party to evaluate your risk reduction strategy can confirm that your approach is commercially reasonable or identify additional risk mitigation tactics. You do not need to do this alone.

AI has tremendous promise. Under the right circumstances, its benefits can justify an appropriate level of residual risk. To get there, your institution should adopt AI for the right reasons, align on an acceptable risk tolerance, articulate the actual risks and their associated impact, identify factors that raise or lower those risks, and then adopt a multi-prong mitigation model from pre-deployment to post-deployment monitoring.

As with any compliance exercise, muscle memory builds over time. Investing in checklists, risk stratification, documentation tools, and look-back reviews will identify patterns that inform your institution’s risk approach, maximize consistency, and identify opportunities for course correction.