Embedding ethical AI risks in public sector risk management practice An explorative analysis using the Three Lines of Defense risk management model

Abstract

Artificial intelligence (AI) adoption by public sector organizations (PSOs) introduces various ethical risks stemming from a lack of integrating human values into AI design. Addressing these ethical risks is a complex collective responsibility among designers, developers, risk experts, and public sector managers. Embedding these risks in existing risk management practices is crucial for responsible AI adoption, as emphasized by the legal requirements of the EU AI Act. However, the responsibility for managing these ethical risks is often unclear. Public sector organizations face unique challenges due to the complex, uncertain, and rapidly evolving nature of AI technologies, further complicating the management of ethical risks. This paper explores using the Three Lines of Defense (TLoD) risk management model to understand and address these ethical risks in public sector AI adoption. The TLoD model structures risk management across three lines: operational management, risk oversight and compliance, and internal audit. This framework helps to distribute and integrate the collective responsibility for ethical AI risk management within public sector organizations, emphasizing alignment and collaboration among different actors. Through an exploratory study involving a survey and semi-structured interviews with professionals responsible for AI-related risk management in Dutch public sector organizations, we assess the TLoD model’s usefulness in addressing ethical AI risks. The study examines the challenges and opportunities in applying the TLoD model to manage ethical risks and identifies the potential gaps in responsibility and oversight. The findings suggest that while the TLoD model offers a valuable lens for distributing risk management responsibilities, there are limitations in addressing the emergent and complex nature of ethical risks in AI adoption.