We invite you to read the opinion piece by our Director of New Technologies and AI, Juan Pablo González, on the challenge of Artificial Intelligence governance in Chile.
The Chilean regulatory environment is undergoing a dynamic process for organizations that are on the verge of assuming new obligations, particularly regarding personal data (although there is discussion about postponing the law’s entry into force by one year).
Likewise, at the national level, a bill on AI systems is currently under consideration, with announcements from the Executive Branch regarding a forthcoming substitute bill to replace the text currently under review. Notwithstanding this, the lack of regulation in this area has not prevented organizations from moving forward with incorporating various AI systems into their internal processes; therefore, establishing “AI governance” within organizations has become a strategic issue.
Furthermore, various studies have indicated that AI has evolved from a tool designed to support human decision-making—for example, in drafting documents, analyzing information, or automating specific tasks—toward an environment in which AI agents can execute processes, interact with other systems, use tools, coordinate tasks, and make decisions within bounded contexts. For this reason, the risk would no longer be limited to erroneous recommendations but would extend to the interactions these systems have with other systems and, consequently, to the potential consequences of those interactions.
In this regard, one of the first steps an organization should take is to adopt best practices such as the ISO/IEC 42001 standard on AI management systems. Like any management system, this standard uses the “Plan-Do-Check-Act” methodology, and the initial step would be to analyze existing AI systems. This helps define the scope of what is to be “governed,” as it clearly identifies stakeholders and, consequently, the parties that will participate, establishing clear roles and responsibilities. In this process, support from senior management is key to ensuring that this analysis is not confused with a survey or inventory of the company’s IT systems, nor is it relegated to the IT department, but rather is addressed as a cross-functional matter throughout the organization.
Based on this process, developing an AI policy within the organization that establishes strategic guidelines—and which can subsequently be implemented through protocols or procedures—will ensure that it is aligned not only with internal processes but also with the business strategy. Similarly, clearly identifying the risks associated with AI usage will enable the design of controls (technical and organizational measures) that can effectively mitigate those risks. Undoubtedly, one of the key actions will be to train the team, not only in the development or operation of this technology, but—and especially—in its day-to-day uses within the organization. This will help reduce phenomena such as “Shadow AI”—that is, the use of AI technologies that are not being tracked by the organization and that can clearly “amplify” risk in this area.
It is also important to have a third-party review (whether internal or independent). This allows for the identification of the effectiveness of measures already designed that, in their implementation, require adjustments. If there is a discrepancy between what was designed and what is being implemented, this review will help reassess priorities and expectations regarding the use of AI, especially with a focus on the continuous improvement of the AI management system.
In conclusion, given the uncertainty surrounding national regulations on this matter, self-regulation becomes a powerful ally for developing internal policies and, above all, specific actions that ensure these measures align with other governance models that may exist within the organization, thereby avoiding the creation of multiple thematic subcommittees that address this issue in a fragmented manner.
Furthermore, effective risk management is essential, especially when incorporating AI agents into certain internal processes. In addition, it is necessary to integrate any personal data protection and cybersecurity initiatives the organization may be undertaking to reduce siloed work. Finally, it is essential that management teams understand the responsibilities and limitations associated with the use of AI systems, particularly those that have not been authorized by the organization.
Column written by:
Juan Pablo González | Director of New Technologies and AI | jgonzalez@az.cl
