HOW ONYINYE LYDIA ABUO IS REDEFINING DATA GOVERNANCE FOR RESPONSIBLE AI IN REGULATED INDUSTRIES
Onyinye Lydia Abuo says AI should be able to respond to three simple questions before it gets anywhere near a customer decision or into a regulated organisation. Where is the data source? Who answers for it? And can the affected person ask “Why?” She has witnessed projects coming in with a sharp demonstration but no solutions to any of their problems, and that is where a lot of enthusiasm for AI has simply fizzled out, either the projects are sent back for rework or complaints and a quiet walk away.
There’s a simple reason why she’s in a rush. AIs are infiltrating the world of lending, fraud detection, customer service and risk scoring, and if it’s a regulated business, it’s not a bad film recommendation. It’s a rejected loan, an account that got stuck or a customer who was mistakenly identified as a risk. Nigeria’s Data Protection Act 2023 provides a statutory rights, which includes protection for individuals subject to automated decisions. Abuo’s argument is that you can’t have a law that the institution does not know. She believes that data governance cannot be viewed as a standalone discipline from responsible AI. It is data governance at the time of machine start up to make or shape decisions.
She begins with Question #1: From where does the data come? The model based on past data contains past data gaps. An entrepreneur who has a slim data file, or an applicant from a location the institution hasn’t been to and has no idea about, might just be missing from the data that educated the machine concerning what a great applicant looks like. So she says, ‘The governance should start with a truthful audit; what information is available, how it came about, its reliability and its age’. In her opinion, any data collected for one purpose and then re-used for a different purpose is where trust is breached as the customer was not aware of the second use.
The second question is related to ownership. In every dataset and every model, she says, there should be a named person who is responsible for it, not a committee of which no one knows. This is more important as institutions purchase AI into vendor products, instead of developing it. A regulator or a customer will have no answer of the “vendor’s model”. She wants to be able to read the terms of the contracts in advance and know at what point someone else viewed and what would be done if something went wrong, not after it’s in place and running in the business.
The third question that she believes is one that is not asked very often, which is: Can the person get an explanation and can that decision be rescinded? If an institution can’t explain to a customer in simple terms the reason for an automated decision, then it isn’t ready to use AI. An outcome should be communicated to frontline staff without the need for a data scientist to be there with them. Someone with the power to override the system must be reachable and be able to use that power. It’s oversight on paper if a person is only allowed to click “agree”.
This in practice becomes habits and not slogans. She prefers impact assessments prior to deployment, and categorization of the uses of AIs according to risk, so that a chatbot that answers inquiries during opening hours wouldn’t be asked to undergo the same scrutiny as a system that determines who gets credit. She thinks that approval is not the end of the process of oversight, but the beginning, since models change as the information they are based on changes. A fair and accurate system at start-up can drift and nobody will be attuned to that drift unless someone is tasked with doing so. Post launch monitoring, including clear thresholds on when to pause and/or retrain, is part of initial plan and budget.
She also has a fear of governance as the office of ‘no’. It works, she feels, when it’s at the design table with the project, not at the meeting where the project is launched. It will be so much cheaper than having to rebuild at the end of the day, and it will make it clear to the business that the intent is to have a safe and secure system going live. Teams with governance as a partner bring problems to the fore, while teams with governance as an obstacle learn to conceal them.
This isn’t easy for her. The demand for AI governance skills is still at a low point while the urge to demonstrate the use of AI is high, training methods employed for vendors’ models can be obscure. In many institutions the data is uneven because there was no intention to collect data for analysis purposes in older data types. Smaller organisations don’t have the personnel to be able to do any of this at length. The person who has the job of data protection officer must be independent, and be able to say an uncomfortable thing without fear of repercussions. Otherwise the governance is just gilding the lily.
Suppose that you are a loan officer at a branch office, and across the table from you is a small manufacturer. There is a system that has generated some score and the owner wants to know why? If the officer is able to tell where the data is from, who owns the model and how to challenge the result, then the institution has done its job. Otherwise, it will not be responsible no matter how much technology is put into it. The measure for Onyinye Abuo is this conversation, and not the policy document.
