Governance of Generative Artificial Intelligence for Companies

1. Problem Statement

Generative Artificial Intelligence (GenAI), particularly Large Language Models (LLMs), has rapidly integrated into organizations, often outpacing the development of adequate governance structures. While existing AI governance frameworks exist, they fail to address the unique characteristics of GenAI, creating a significant gap in organizational risk management and value realization.

The paper identifies several unique properties of GenAI that render traditional governance insufficient:

• Bottom-up Adoption: Employees can access foundation models (e.g., ChatGPT) independently, bypassing centralized IT controls and creating "shadow AI" deployments.
• Output Opacity and Hallucinations: GenAI produces complex, convincing artifacts (text, code, images) that may contain factual errors or "hallucinations," which are difficult to detect and assess compared to traditional deterministic software outputs.
• Prompt Sensitivity and Jailbreaking: Minor changes in input prompts can drastically alter outputs, and models are susceptible to "jailbreaking" (bypassing safety measures).
• Foundation Model Paradigm: The reliance on pre-trained, massive models (often hosted externally) introduces risks regarding data privacy, intellectual property (IP) leakage, and lack of control over model training data.
• Blurring Roles: End-users effectively become developers through prompt engineering and customization (e.g., Custom GPTs), complicating accountability and responsibility lines.

The core research question is: How can the specific properties of GenAI be captured by a governance framework for organizations?

2. Methodology

The authors employed a specific theorizing review approach (Leidner, 2018) to develop a gap-filling conceptualization. They extended the taxonomy development process proposed by Nickerson et al. (2013) by introducing a Conceptual-to-Conceptual (c2c) iteration.

• Data Collection: A literature search was conducted on AISnet, Google Scholar, and arXiv.org (2021–2026) using keywords like "governance," "generative AI," and "LLMs."
• Iterative Process:
  1. Empirical-to-Conceptual (e2c): An initial set of characteristics was derived deductively from the reviewed literature.
  2. Conceptual-to-Conceptual (c2c): The initial findings were mapped against existing AI governance frameworks (e.g., NIST AI RMF, Schneider et al., 2022) and specific GenAI properties to identify gaps and refine dimensions.
  3. Narrative Expansion: Additional narrative searches were conducted to incorporate emerging concepts such as "corporate value alignment," "adaptive governance," and technical mechanisms.
• Outcome: The process resulted in a comprehensive framework structured around five dimensions: Antecedents, Scope, Governance Mechanisms, Targets, and Consequences.

3. Key Contributions: The GenAI Governance Framework

The paper proposes a novel framework that expands the scope of AI governance to specifically address GenAI. The framework is structured into five dimensions:

A. Antecedents (Pre-existing Conditions)

Conditions that influence the adoption of governance:

• Internal: Organizational culture, AI capability, task structure (knowledge work vs. routine), and strategy.
• External: Country-specific regulations (e.g., EU AI Act), language nuances affecting model performance, industry-specific risks (e.g., healthcare vs. creative), and provider usage policies.

B. Scope (Objects of Governance)

The framework defines four distinct scopes, with a critical addition of "People":

1. Data: Includes unstructured/multi-modal data, data sources (human vs. AI-generated), provenance, and distribution.
2. Model: Covers training methods (self-supervised, RLHF), customization (fine-tuning vs. prompting), alignment, and vulnerabilities (hallucinations, jailbreaking).
3. System: Focuses on architecture (orchestration, RAG), autonomy levels, and human-AI interaction interfaces.
4. People (Novel Dimension): Explicitly includes stakeholders ranging from developers to end-users. It recognizes that end-users act as "supervisors" and "prompt engineers," bearing responsibility for output quality and ethical alignment.

C. Governance Targets (Measurable Properties)

Specific goals for each scope:

• Data: Quality (timeliness, correctness), diversity, security (preventing extraction attacks), and lineage.
• Model: Lifecycle management, explainability (XAI), efficiency, safety, and alignment with human/organizational intent.
• System: Resilience, accountability (traceability of actions), and transparency.
• People: Attitude (critical but positive), skills (prompt engineering, ethical assessment), and awareness of limitations.
• Organization: Cross-functional alignment, cost-benefit trade-offs, and harmonization with inter-organizational ecosystems.

D. Governance Mechanisms (Levers to Impact Targets)

Three categories of mechanisms are proposed:

1. Structural: Roles (e.g., Ethics Officer), committees, and decision-rights allocation (vertical vs. horizontal regulation).
2. Procedural: Strategies for risk management, policies (e.g., acceptable use), contractual agreements (licenses like RAIL), and adaptive monitoring to keep pace with rapid technological changes.
3. Relational & Technical: Training, social transparency (learning from peers), and technical controls (guardrails, watermarking, automated auditing, and human-in-the-loop validation).

E. Consequences (Outcomes)

Effective governance leads to:

• Performance: Efficiency gains, improved customer satisfaction, and revenue growth.
• Risk Mitigation: Reduced IP leakage, legal compliance, and reputational damage.
• Cultural Impact: Positive employee attitudes, reduced uncertainty, and better alignment with corporate values.

4. Results and Significance

• Gap Filling: The framework successfully addresses the limitations of prior AI governance models by explicitly integrating the "People" dimension and the dynamic, bottom-up nature of GenAI adoption.
• Practical Guidance: It offers a structured approach for companies to balance the trade-offs between innovation (e.g., productivity gains) and risk (e.g., hallucinations, data leaks).
• Adaptive Governance: The paper emphasizes the need for adaptive governance due to the rapid evolution of both technology and regulation. Static policies are insufficient; mechanisms must evolve alongside model capabilities.
• Business Alignment: Unlike purely regulatory frameworks, this model is designed to help organizations unlock business value while managing specific GenAI risks like prompt sensitivity and emergent behaviors.

5. Limitations and Future Work

The authors acknowledge that the framework is conceptual and relies on a literature review, which may lag behind the fastest-moving technical developments. They note that future research is needed to:

• Empirically validate the framework in organizational settings.
• Detail the operationalization of technical mechanisms (e.g., specific metrics for fairness or provenance).
• Investigate the long-term impacts of GenAI on workforce dynamics and organizational structures.

Conclusion: The paper provides a foundational, business-oriented framework that redefines AI governance for the GenAI era, shifting from a purely technical or compliance-focused view to a holistic approach that integrates people, processes, and adaptive mechanisms to manage the unique risks and opportunities of generative models.