Pavol Adamka from Eximbanka’s Marketing and Communications Department, in a commentary for TREND.sk, reflects on the risks of using artificial intelligence in organizations and the need to establish clear rules that will allow for the safe utilization of its potential while maintaining control over sensitive data and decision-making processes.
Artificial intelligence made its way into organizations faster than the rules governing its use. Employees often began using the available tools for writing, analysis, or working with documents before companies had decided what was permitted and what was not. The question, therefore, is no longer whether AI is being used in a company, but whether the organization has a clear understanding of which tools its employees are using, what data they are working with, and who is responsible for the results.
It is precisely this loss of oversight that ranks among the greatest practical risks of AI use in business. An employee may use a high-quality and readily available tool, but the organization may not know what information is being entered into it, where the data is being processed, or whether the result is reliable enough for further use. For companies and institutions handling sensitive data, the consequences can include not only errors but also security or reputational issues.
A simple ban is not the solution. AI is becoming a common work tool, and organizations need to create an environment in which employees can use it safely. The key is to know which tools are permitted, what they are used for, what data they can process, and who is responsible for their use.
Equally important is the principle of human responsibility. AI can prepare background materials, summarize information, or assist with analysis, but it should not create the illusion that the technology is responsible for the outcome. If the output is used in decision-making or shared outside the organization, it must be verified by a person who is accountable for its content.
Eximbanka, which handles sensitive information about export contracts, business partners, and clients’ financial situations, has adopted a similar approach. Experience gained from setting up its own system has shown that when implementing AI, it is essential to be clear on three key issues: which tools can be used, what data they can process, and who is responsible for their outputs. Only the combination of these three elements gives an organization real control over the use of the technology. At Eximbanka, therefore, individual systems are subject to registration and risk assessment, and outputs intended for further use or directed outside the bank are subject to review by the responsible employee.
However, the policy alone is not enough in practice. If an organization considers a certain way of working with AI to be unacceptable, it must also be able to enforce compliance with the rules through technical means. Otherwise, compliance relies solely on the individual discipline of users. The difference between a procedure being prohibited and the system technically preventing it can be crucial when it comes to protecting sensitive data.
The European AI Act and the international standard ISO/IEC 42001 also provide a framework for similar arrangements today. Regulations establish obligations and work with risk levels, while the standard helps create a management system—from responsibilities and risk assessments to regular reviews. Training people remains an integral part of this, because even the best rules won’t help if employees don’t understand why they exist. Good AI governance shouldn’t shut the door on technology. Its role is to enable the organization to use AI on a larger scale without losing control over its data, processes, and decisions.
Source: TREND.sk