UN AI Resolution, EU AI Act, and Cloud Security Alliance's Recent Efforts: White Paper on AI Organizational Responsibility for Core Security

Updated 5/8/24.

In a world where artificial intelligence (AI) is rapidly becoming an integral part of our lives, ensuring its secure and responsible development and deployment is more critical than ever. The Cloud Security Alliance (CSA) has taken a significant step forward in this direction with the release of its white paper titled "CSA AI Organizational Responsibilities - Core Security Responsibilities." The document is now available for public download, and readers are encouraged to provide their valuable feedback.

The publication of this white paper comes at a time when the international community is increasingly recognizing the need for responsible AI governance. The European Union has recently passed the AI Act, setting a global standard for AI regulation. Moreover, on March 21, 2024, the United Nations General Assembly adopted a resolution on AI, backed by more than 120 Member States, emphasizing the importance of governing AI responsibly and ethically.

CSA's white paper complements these efforts by offering actionable responsibility items in data security, model security, and AI vulnerability management. The document proposes six cross-cutting considerations for each item: measurement, establishing quantifiable metrics to assess AI security practices; RACI model, clarifying roles and responsibilities; continuous monitoring, implementing robust monitoring and reporting mechanisms; high-level implementation strategy, integrating AI security into the software development lifecycle; access control mapping, defining and enforcing access controls; and reference regulatory framework, aligning with industry standards and best practices.

The white paper is the result of a collaborative effort by industry leaders and researchers in AI security. Ken Huang, Co-Chair of the CSA AI Organizational Responsibilities Working Group and the Chief Editor of Springer's book "Generative AI Security: Theories and Practices," emphasizes the document's role as a potential roadmap for organizations to embrace secure AI practices and implement core security responsibilities in AI development. "This white paper serves as a potential guide for organizations to navigate the complex landscape of AI security," Huang states. "By providing clear, actionable responsibility items and cross-cutting considerations, we aim to empower enterprises to develop and deploy AI systems in a secure and responsible manner."

Nick Hamilton, Co-Chair of the CSA AI Organizational Responsibilities Working Group and the head of GRC at OpenAI, highlights the significance of the RACI model introduced in the white paper, stating that it is a starting point for accountability and informed decision-making in AI development and deployment. "The RACI model is a powerful tool for ensuring that all stakeholders understand their roles and responsibilities in the AI development process," Hamilton explains. "By establishing clear lines of accountability and fostering informed decision-making, organizations can mitigate risks and build trust in their AI systems."

Sean Wright, Co-Chair of the CSA AI Organizational Responsibilities Working Group and CISO of AvidXchange, stresses the importance of continuous monitoring in maintaining the security and reliability of AI systems. "As AI systems evolve and adapt over time, it is essential to have robust monitoring and reporting mechanisms in place," Wright emphasizes. "Continuous monitoring enables organizations to detect and respond to potential security incidents promptly, ensuring the ongoing integrity and reliability of their AI systems."

Chris Kirschke, Co-Chair of the CSA AI Organizational Responsibilities Working Group and the Owner of Generative AI Security at Albertsons Companies, praises the white paper's alignment with industry standards, enabling organizations to navigate the complexities of AI governance with confidence. "By aligning with established frameworks such as the NIST AI Risk Management Framework and the CSA Cloud Controls Matrix, this white paper provides organizations with a solid foundation for implementing secure AI practices," Kirschke notes. "This alignment helps organizations to integrate AI security seamlessly into their existing risk management processes and compliance efforts."

Jerry Huang, one of the lead authors of the white paper and an Engineering Fellow at Kleiner Perkins, with previous experience in AI and security at TikTok, Glean, and Roblox, emphasizes the importance of quantifiable metrics in measuring core security responsibilities, particularly given the rapid innovation in generative AI. "As generative AI continues to advance at an unprecedented pace, it is essential for organizations to establish clear, measurable criteria for assessing the effectiveness of their AI security practices," Huang explains. "This white paper lays the groundwork for ongoing efforts to develop and refine these metrics, ensuring that security measures keep pace with the evolving technology landscape."

Caleb Sima, Chair of the CSA AI Safety Initiative, underscores the white paper's significance in equipping enterprises with the knowledge and tools to prioritize security and responsibility in AI development and deployment. "The CSA AI Organizational Responsibilities for Core Security white paper is a valuable tool for organizations looking to harness the power of data and models used in AI while maintaining the highest standards of security and responsibility," Sima asserts. "By providing a well designed framework for addressing core AI security challenges, this document prioritizes the safety and well-being of their stakeholders."

We invite you, our readers, to actively participate in shaping this important conversation by downloading the "CSA AI Organizational Responsibilities - Core Security Responsibilities" white paper and providing your insights and feedback. To learn more about the Cloud Security Alliance's ongoing efforts to promote secure and responsible AI, visit the CSA website here.