Framework for improving risk management practices for generative ai in Kazakhstani SMES

Abstract

Generative Artificial Intelligence (GenAI) tools have become increasingly ubiquitous not only in everyday lives of the public, but also in business functions of companies since the introduction of commercial GenAI powered conversational assistants. Unregulated use of GenAI applications in organizations may bring a range of unwanted consequences, which is especially true in environments where risk management practices are mostly informal. To manage the risks arising from the use of GenAI tools, the appropriate framework must be set in place. However, existing AI governance frameworks prove to be too sophisticated and unnecessarily complex for smaller and more agile companies. Therefore, the current study presents the “Lean” framework for managing risks pertaining to the application of GenAI tools in day-to-day operations of Small and Medium-sized Enterprises (SMEs) in Kazakhstan, where it was shown that risk management practices are mostly undocumented and informalized. To construct the framework, the methodology was divided into three stages: audit and scouting to grasp the situation around GenAI in Kazakhstani SMEs due to lack of research, framework synthesis, feedback and verification to assess the practicality of the framework. The results have shown that the GenAI risk management practices in SMEs are highly informal and non-compliant to common privacy and security standards, as well as new government regulations. The framework was designed to be practical and easily applicable in everyday business operations. The responses from the participants at the final stage indicated positive feedback, showcasing practicality and potential of the proposed “Lean” framework.