‘AI’ Business Model – With many components flowing into the AI domain (cost, data, E&C, people, value, strategy, duplication of everything, etc.), I’ve started to think about splitting out ‘AI’ from the operating model and putting it into a separate legal entity. This way, I could manage a) risk and compliance, b) cost, c) resource allocation, d) governance, e) IP, f) revenue generation, etc. Of course, this isn’t new in general, but I’m especially interested in how this approach could help with the ongoing challenge of ensuring compliance with data privacy and regulations related to LLMs and data access/usage over time. My question: Is anyone else thinking about this, or has anyone already done it? I know there are examples in the literature, but I wanted to float this here for general comments and discussion.

2k viewscircle icon1 Upvotecircle icon2 Comments
Sort by:
Head, Software Engineering, Cloud and Digital Transformation4 months ago

In my opinion as we start to adopt and embrace AI into our business, it does need to be separate initiative with budget. Carving out separate business entity, would be more for safeguarding the company. We will still have compliance and data privacy issues which needs to be addressed one way or other.

Director, Enterprise Architecture in Services (non-Government)4 months ago

I suppose the obvious answer as to whether or not this is a good idea is the good old "it depends". My company has not allowed any AI tools for general purpose use and requires a documented use case for even using something as benign as O365 Copilot. But they also invested some $ in standing up an AI CoE - which is still in its infancy, with the goal of trying to deduplicate effort in leveraging AI in various domains. I have noticed that the use cases I have seen so far focus in the non revenue-generating areas of the business. They are all looking for ways to get more done with less. The revenue-generating functions thrive on relationships in maritime, so the play for AI in the BD and sales functions are minimal at this time.

Lightbulb on1

Content you might like

Inadvertent data breach/leak (e.g., careless user causing accidental breach)51%

Negligent data breach (e.g., user willfully ignoring policy but not malicious)43%

Malicious data breach (e.g., user willfully causing harm)4%

View Results

Always required – Security must formally review and approve every change request.12%

Required for security-impacting changes – Security reviews only changes flagged as having potential security implications. Please comment : Who decides which changes require security review and which do not ? Is this determination manual or automated? How do you avoid gaps or oversights in this process ?76%

Not required – Security does not review changes submitted CAB/RAB by other teams. 10%

Risk-based or automated – Security involvement is determined by a tiered model or automated risk scoring within ITSM.2%

View Results