Toward AI Governance: Identifying Best Practices and Potential Barriers and Outcomes

Information Systems Frontiers (2023) 25:123–141
https://doi.org/10.1007/s10796-022-10251-y
Toward AI Governance: Identifying Best Practices and Potential

Barriers and Outcomes
Emmanouil Papagiannidis1 · Ida Merete Enholm1 · Chirstian Dremel1 · Patrick Mikalef1 · John Krogstie1
Accepted: 27 January 2022 / Published online: 20 April 2022

© The Author(s) 2022
Abstract
In recent years artificial intelligence (AI) has been seen as a technology with tremendous potential for enabling companies
to gain an operational and competitive advantage. However, despite the use of AI, businesses continue to face challenges
and are unable to immediately realize performance gains. Furthermore, firms need to introduce robust AI systems and miti-
gate AI risks, which emphasizes the importance of creating suitable AI governance practices. This study, explores how AI
governance is applied to promote the development of robust AI applications that do not introduce negative effects, based on
a comparative case analysis of three firms in the energy sector. The study illustrates which practices are placed to produce
knowledge that assists with decision making while at the same time overcoming barriers with recommended actions leading
to desired outcomes. The study contributes by exploring the main dimensions relevant to AI’s governance in organizations
and by uncovering the practices that underpin them.
Keywords AI governance · AI data governance · AI challenges and outcomes · Performance gains · Competitive advantage
1 Introduction and deployed AI solutions to automate their processes,

increase efficiency and reduce costs (Frank et al., 2019;
As businesses adopt Artificial Intelligence (AI), they are Gregory et al., 2020). To achieve these goals, AI governance
faced with new value propositions, but they also have to is essential. According to Butcher and Beridze (2019), AI
deal with new challenges, such as reducing the gap between governance “can be characterized as a variety of tools, solu-
intent and action(Amershi et al., 2019; Enholm et al., 2021; tions, and levers that influence AI development and applica-
Mishra & Pani, 2020). Artificial intelligence has been per- tions”. Yet, further research is needed to better determine
ceived as a tool with which we can layer many different how AI Governance can be introduced into a company and
functions or as a solution to problems that are beyond the whether AI governance can assist a company in achieving
ability of traditional applications to solve. (Smuha, 2019). In its objectives.
order to gain a competitive advantage over their competitors While AI has the potential to generate business value in
(Raisch & Krakowski, 2021), businesses have implemented terms of performance, productivity and effectiveness, it is
not autonomous, as it works in concert with human capa-
* Emmanouil Papagiannidis bilities (Zhang et al., 2021). Consequently, organizational
[email protected] capabilities are the results of combining and deploying
Ida Merete Enholm multiple complementary resources within a firm to achieve
[email protected] competitive advantage (Mikalef & Gupta, 2021). When
Chirstian Dremel a firm optimizes its firm-level resources and adopts AI
[email protected] technological innovations, it can enhance its transformed
Patrick Mikalef projects' business value which drives business value and
[email protected] impacts performance (Wamba-Taguimdje et al., 2020).
John Krogstie Simultaneously, the AI algorithms can be considered per-
[email protected] formative in the sense that they assist in decision-making,
the extent to which their use can form organizational pro-
1
Norwegian University of Science and Technology, cesses, or even take autonomous decisions (Faraj et al.,
Trondheim, Norway
13
Vol.:(0123456789)
124 Information Systems Frontiers (2023) 25:123–141
2018; Grønsund & Aanestad, 2020) that leads to new the competition. Lastly, we proposed a model where we
organization capabilities through AI. The use of AI, for discussed challenges, recommended actions, and desired
instance, could create more substantial customer acquisi- outcomes.
tion or higher customer lifetime value and lower operating The rest of the paper is structured as follows. The sub-
costs or reduce credit risk. sequent section presents the background of this study and
The main goal of this work is to analyze AI governance the relevant work in the domains of technology governance,
when designing and implementing AI applications in order and then specifically focuses on AI governance practices.
to achieve organizational goals. In particular, this study Section 3 details the methodology that is applied for gath-
examines how AI Governance helps top-level managers ering and analyzing the data. In Sect. 4, we present each
achieve their goals by introducing robust systems that auto- case separately followed by a cross-case analysis. The paper
mate processes and enhancing tasks that traditionally were concludes with a discussion of the findings and limitations
done by intuition or simple data analysis without negatively in Sect. 5, where we interpret and analyze the data.
impacting employees. The main challenge for adopting AI
in organizational operations is that AI technologies vary in
scope and complexity, hindering familiarity, especially for 2 Background
non-technical employees (Holmstrom, 2021). Hence, it is
crucial to define actions for overcoming barriers and chal- 2.1 IT and Information Governance
lenges (technical and non-technical) to align AI applications
to the organization’s objectives. As an example, employees IT governance is an area of corporate governance that falls
might resist new technologies due to fears of being replaced under the responsibility of the board of executives and
by AI. Based on the results, companies will be able to gain focuses on the implementation and transformation of IT to
a better understanding of how AI technologies are used, meet current and anticipated business and client needs and
identifying focal points and mechanisms of value genera- is broader than IT management, which refers to the man-
tion (e.g., augmentation or automation of decision-making agement of existing IT services and internal supply of IT
or processes) and what challenges AI technologies present (Saunders et al., 2020; Wilkin & Chenhall, 2010). In other
to organizations. Hence, we argue that AI value realization words, IT Governance is a formal way to align IT strategy
is not yet fully understood and called for and specific gov- with business strategy. Governance frameworks for IT pro-
ernance practices may help in doing. This study, therefore, vide a structure (who is governed, what is governed, how
builds on the following research questions: is governed) for ensuring that IT investments support busi-
ness objectives (Tiwana et al., 2013). Through embracing IT
RQ1. Which practices underpin AI Governance? Governance, organizations can achieve measurable results
RQ2. What are the antecedents and effects of AI Govern- towards their strategies and goals. However, implementing
ance? a comprehensive IT governance program requires a lot of
time and effort (Debreceny, 2013).
To answer the research question, we collected data In the digital era, information governance has an even
through a multi-case study, conducting interviews with more central role, as it promotes a more purposeful path to
multiple respondents within three companies in the energy obtaining information. (Cath, 2018). Research previously
sector. The interview questions focused on methodologies conducted in similar areas sought to answer questions like
companies currently use, mechanisms and processes used what information governance practices are firms adopting
in AI application development, the collection of data, and and what are the effects of information governance on per-
the consequences of AI application in decision making (AI formance. According to a study conducted by Intel (Tallon
risk). During this multi-case study, employees from vari- et al., 2013a, b), Big data governance policies achieved the
ous departments were interviewed, primarily the business main goal of maximizing business value while minimizing
department and the IT department since these two depart- technical and organizational risks related to data privacy
ments play a crucial role when developing an AI application. (Tallon et al., 2013a, b). Furthermore, research studies
We also built on secondary data sources, such as reports and have been conducted and supported by empirical evidence
internal documents, which help to explore AI governance on developing AI capabilities by creating a unique set of
dimensions and practices as well as compare, triangulate resources that can effectively leverage investments and gen-
and verify results. Among the outcomes of the study, AI erate business value that leads to competitive advantage
was found to be most helpful for (1) reducing maintenance (Mikalef & Gupta, 2021).
costs, (2) increasing flexibility and robustness of the devel- In their empirical research, Tallon and colleagues (Tal-
opment process, (3) improving confidence in the results lon et al., 2013a, b) discovered that Information governance
and final products, and (4) gaining a competitive edge over is associated with a range of intermediate or process-level
13
Information Systems Frontiers (2023) 25:123–141 125
benefits and many of these intermediate effects could pos- the years to create a united workflow that has software engi-
sibly affect firm-level performance. The authors suggest a neering processes and offers insights about several essential
need for extending structures and practices employed in IT engineering challenges that an organization may face in cre-
governance and to decompose information governance into ating large-scale AI solutions for the marketplace. Accord-
a range of structural, procedural, and relational practices. In ing to their findings, AI governance consists of three main
this paper, the structural, procedural, and relational practices aspects: (1) discovering, managing, and versioning the data
are used as the main dimensions to explain how to govern required for machine learning applications is more complex
information and boost firm performance (Appendix). than a typical software application, (2) the required skills
for building models and customizing them can vary based
2.2 Governance of AI Projects on the project, and (3) AI components might be difficult to
manage if distinct modules, as well as models, exhibit non-
While IT governance intends to manage IT assets, hard- monotonic error behavior. The European Commission’s and
ware and software components, that assist in establishing Singapore governments’ principles see AI governance as a
the automation of well-defined tasks, data governance aims way to promote Trustworthy AI through guidelines. Based
to manage data assets as facts having value or potential on these guidelines, a framework has been created that offers
utility that are documented (Fadler & Legner, 2021). Fur- guidance on fostering and securing ethical and robust AI.
thermore, sophisticated forms of analytics involve artificial Further, the guidelines aim to go beyond the ethical prin-
intelligence and automated decision-making, requiring new ciples by guiding how such principles can be operational-
roles and responsibilities, but also leading to new risks. Gov- ized in sociotechnical systems (Smuha, 2019). Fairness and
ernance should therefore not be limited to the content, but explicability are key principles that an AI application must
should also include its analysis, as AI should be considering have, which can be achieved by governing data, reducing
a dynamic frontier of computing (Berente et al., 2021). In bias and collecting diverse data. Hence, AI can be trusted
addition to IT and data governance, analytics governance when making suggestions or taking decisions. Meanwhile,
mechanisms are needed to overcome challenges, such as the AI should be human-centric by safeguarding the well-being
alignment among business users and analytics practitioners and safety of individuals. This calls for human oversight over
(Fadler & Legner, 2021). AI increasingly influences many AI with human agents making decisions and holding them-
aspects of society, from healthcare and marketing to human selves accountable. As a result, it is argued that in the exist-
rights. Allowing the development of AI applications that ing literature researchers investigate IT governance and data
are not under any supervision could be harmful (Chatterjee governance and they suggested frameworks or procedures
et al., 2020; Mishra & Pani, 2020); thus, it is important to for improving performance or minimizing risks caused by
promote a trustworthy AI that is lawful (complying with AI. There is, however, a gap in AI governance, which deals
laws and regulations), ethical (ensuring ethical principles with both IT governance and data governance, and has a
and values) and robust (from a technical and social per- direct relationship with AI (Mikalef et al., 2020). Therefore,
spective). For example, the use of AI in healthcare poses the literature would benefit from an investigation into how
various issues, including a loss of privacy in health infor- AI governance can increase organizational performance,
mation, diminished human oversight in decision-making, while at the same time neglecting negative consequences
and increasing prejudice across the board (Johnson et al., of AI use.
2021; Trocin et al., 2021b). Governing AI projects can be
interpreted differently depending on the perspective of dif- 2.3 Typologies of AI Organizational Value
ferent individuals and algorithmic management should be
a concern. Because of the extent to which algorithms and The value of AI in organizations varies based on the sector
the institutional frameworks allow them to get acquire man- and the organization's activity(Collins et al., 2021). Machine
agement jobs to define AI's impact on key organizational learning (ML) technologies reduce the cost of repetitive,
processes such as delegation, coordination, and decision- time-consuming tasks while it enhances automation and
making (Holmström & Hällgren, 2021). assists with predicting events or trends. But these technolo-
In contrast, researchers from Microsoft (Amershi et al., gies also have the ability to bring societal inequalities into
2019) approach AI governance from a technical perspec- organizational processes (Teodorescu et al., 2021). Lebovitz
tive, while European Commission (EC) (Smuha, 2019) et al. (2021) discovered a knowledge gap between AI and
and Singapore principles approach AI governance from a specialists in their research, allowing managers to better
human-and ethics-centric perspective. To extend this point, understand the risks and benefits of each technology. When
researchers at Microsoft (Amershi et al., 2019) have a deep the underlying information is unknown, their research dem-
focus on the technical aspects of AI. They emphasized the onstrates the dangers of using ground truth labels objectively
best practices that Microsoft teams have implemented over in ML models; thus, the organization value that AI offers
13
has some constrains. Furthermore, in a multi-method study sources and methods through the convergence of informa-
that comprised an analytical model, experimental testing, tion. In terms of transferability, the firms have common traits
and a simulation study, Fügener et al. (2021) investigated and operations, but they have some key differences in their
how AI counsel effects complementarities between people business strategy. Dependability was achieved by being con-
and AI, concentrating on what humans know that an AI does sistent in the analysis process and being in line with the
not (unique human knowledge). They observed that human accepted standards. Finally, confirmability was achieved
judgments converge on similar responses, which enhances by conducting interviews with different employees in the
individual accuracy. Individual unique human knowledge same firm who have key positions and belong to the same
decreases when the group's overall individual accuracy or different departments. What is more, data were analyzed
improves (Fügener et al., 2021). Nonetheless, as revealed in and coded independently by three authors bringing various
a two-year ethnographic study (Van den Broek et al., 2021) insights and points of view so that the authors could iden-
when AI economic value could not be easily realized, human tify similarities and differences in their results, creating a
engagement in the development phases remained crucial. comprehensible and coherent framework. Hence, in order to
Despite the researchers' objective to keep domain experts develop a theory based on empirical data, it was necessary
"out of the loop," they observed that developers and experts to establish three iterations of data analysis.
collaborated to create a new hybrid practices that merged
ML with domain experience (Van den Broek et al., 2021). 3.1 Case Selection
Finally, when it comes to the introduction and deployment
of AI, senior executives with a comprehensive understand- The selection process of the cases was conducted based on
ing of the technologies have a direct positive effect on their the common characteristics in respect to industry, use of
organizations’ overall strategic direction and goals resulting AI systems, size of development teams and cultural envi-
in long-term economic benefits (Li et al., 2021). ronment. All firms operate in the same industry and have
similar capabilities in terms of collecting, analyzing and
interpreting data for making business decisions. The most
3 Methodology common perspective among the selected firms is that AI
must be developed, expanded and adopted in the following
AI Governance in both the public sector and private sector years as it will be crucial for gaining or maintaining their
is a set of practices that still have not been consolidated. competitive advantage over rivals or new companies enter-
The inadequate empirical data on mechanisms and pro- ing the frame and seeking a piece of the pie. Also, the nature
cedures that firms deploy led us to engage this research of AI projects undertaken by firms indicates that they face
using an exploratory, comparative case study approach similar challenges, so they require similar solutions. Com-
that boosts generalizability while at the same time giving paring the selected companies is fair because (1) they are all
room for extending theory via cross-case analyses (Ramesh allocated in Norway, (2) they have similar AI teams in terms
et al., 2017). As AI will receive more attention in the fol- of size and experience, although the size of the companies
lowing years because of the numerous challenges it poses, ranges, and (3) their cultural differences are limited. There-
we sought revelatory cases that throw light on the phenom- fore, choosing these three firms from the industry allows us
enon for the purpose of gaining a better understanding of to compare the cases for commonalities and key differences
it (Lewis et al., 2011). In addition, there is no established and spot how AI Governance has been implemented. Also, a
framework or theoretical model that is commonly accepted generalized and standardized framework would assist com-
by the industry and describes in detail the overall govern- panies and the state in adopting AI and planning ahead for
ance firms should adopt. For carrying out our multiple case the resources, infrastructure and necessary processes that are
studies, we followed established guidelines for case study required. In Table 1, the cases are presented with an over-
research as illustrated by Baskarada (2014), Stewart (2012) view of their size, revenue and AI strategy that they follow
and Eisenhardt (1989). Also, we make use of the Informa- or plan to follow in the upcoming years.
tion value chain schema to facilitate the interplay between
people, processes and technologies over the information 3.2 Data Collection
value chain, as proposed by Abbasi et al. (2016).
Trustworthiness in the evaluation process and the find- Conducting interviews is an excellent mechanism for gath-
ings themselves were of the utmost importance; thus, we ering information, especially when the researcher does not
enhanced the research methodology by strengthening credi- have a priori guiding theory or assumptions (Qu & Dumay,
bility, dependability, transferability and confirmability (Kor- 2011). Also, interviews can be used to refine a theory or
stjens & Moser, 2018; Sikolia et al., 2013). To ensure valid- understand a phenomenon (Tallon et al., 2013a, b). As
ity in our findings, we used triangulation across multiple shown in the background section, previous researchers
13
Table 1 Overview of companies

Company A Company B Company C
Country Norway Norway Norway

Sector Energy Energy Energy
Employees 200 530 100
Turnover 2020 180 million dollars 260 million dollars 23 million dollars
AI Vision Use AI to become one of the top players in the Use AI to increase flexibility and business Create AI products that are
market capabilities customer oriented and
boosts customer value
AI Technologies Both cloud and local ML pipelines combined ML pipelines combined with intelligence dash- ML pipelines combined
with intelligence dashboards – Python, boards – Python, Grafana, Power BI with intelligence
Grafana dashboards – Python,
Grafana, Tableau
decompose information governance into a range of struc- and in some cases, quick telephone calls where necessary
tural, procedural, and relational practices, which could be in order to provide some extra information. We described
used as part of our baseline to understand how to build prac- ideal candidates for interview as employees that (1) have
tices that enable AI Governance. A case study approach is a key position in the firm, for example, managers and
chosen because it allows for in-depth analysis using inter- leading developers, (2) have a good understanding of AI
views as generating method for collecting data. By exploring technologies and (3) have contributed to the overall devel-
these data, new knowledge can be generated allowing for opment of AI either through their domain knowledge or
meaningful insights that explain similar situations (Oates, their software development skills. A total of 15 individuals
2005). Also, the research is qualitative as it involves the use were interviewed, including both domain and technical
of qualitative data, which can be used to understand and experts who have worked in their current positions for at
explain the research question (Michael, 1997), as it involves least one year, but have relative experience of at least five
the use of experiences, beliefs, and attitudes of the key years. This means they are experienced, and they gained
respondents through the semi-structured interviews (Wynn a solid understanding of AI development over time. Fur-
& Williams, 2012). thermore, participants shared how they understand spe-
Every case was initiated by contacting the human cific issues, according to their own thoughts and in their
resources department or those who should have been able own words (Pessoa et al., 2019) as members of either the
to handle this type of communication, for instance, man- business department or the IT department, as input from
agers. A brief introduction was sent via email to establish both departments is needed in order to understand how AI
an understanding of the purpose of this research project governance is designed. Table 2 shows information about
Table 2 Responders’ role and Firm Respondent Role Years in firm Interview time
length of interviews
A 1 Chief AI officer 3 90 min
2 AI Software Developer 3 55 min
3 Machine Learning Engineer 3 45 min
4 AI Software Developer 3 43 min
5 Project Manager 4 49 min
B 1 Data Analyst 9 49 min
2 Head of AI department 1 25 min
3 Head of Data Analytics department 4.5 59 min
4 Digitalization Engineer 10 55 min
5 Head of Digitalization department 2 43 min
C 1 Data Scientist 2 65 min
2 Head of Analytics department 3 60 min
3 Operation Manager 3 60 min
13
the interviews, such as the firm candidates’ number and NVivo, where open and axial coding were applied, and
their current position. categories were formed based on the notation process
The interviews formed on open-ended questions that led (coding). NVivo has an add-on module called “NVivo
to interesting conversations, where the interviewees had the Collaboration Cloud” allowing teams to collaborate by
opportunity to adopt their questions based on the answers or storing projects securely in the cloud. Two of the writers
even ask questions that were not part of the interview guide- had an “administrator” role while the rest had a “work-
lines. Before each interview, we explained to each inter- space owner” role, so it was convenient to store, upload
viewer individually what we hope to accomplish through and update our project files. Each writer was responsible
the interviews and what we expect to be the outcome of for updating his content to the cloud and the administra-
our research, while at the same time we encourage them tors reviewed the changes, but not the content, in case
to add anything they believe is relevant or that we missed something went entirely wrong; for example, unintention-
during the interviews. The questions were split into three ally deletion of a file. If the administrators were satisfied,
categories: then a merge was performed and everybody could work
on the updated version of the project. Backup files were
1. The business value and the organizational context where part of the process in case we lost our work or needed to
we try to see how AI grew over time. go back to a previous version, so at the end of each week,
2. The data management where the interviewees were a backup process was in place and the files were stored
explaining how their firm deals with data services and independently of NVivo.
governance practices. In the first iteration, we tried to identify all the concepts
3. The control and technical aspects focused on control related to AI Governance and the adopted practices by the
processes and mechanisms that ensured AI systems were firms. Initially, there were 200 descriptive codes, such as,
acting upon set goals. “working with domain experts” and “domain experts lead
projects” but after an iteration the number was reduced to
Each interview lasted approximately 55 min on average, 95, since many codes were merged into a more appropri-
with the range being between 25 and 90 min via Zoom, ate coding name such as “domain experts take lead of a
which was used to record each session and then the audio project to ensure quality of the final product”, where the
was transcribed using Otter AI. The audio files were tran- combined codes become abstract.
scribed in a verbatim way so that the text remains identical to The next logical step was to apply axial coding, where
the audio, meaning that all raw data are transparent, and the the main nodes that have been coded were procedural,
findings and results could be reproduced and tracked down relational, structural, AI development and AI challenges.
rigorously. As part of the process, we had to go through the In addition, comments and observations from different
text and the audio to make sure everything was looking good transcripts were combined to identify commonalities and
since we wanted our text to match the audio and the only patterns in the processes used when creating and deploying
way to guarantee that was by checking all results manually. AI systems that assist firms minimize AI risks. Grouping
In addition, we used related data publicly available on the comments and observations, known as axial coding
the company’s site (e.g., annual reports, vision and firm (Charmaz, 2014), allowed for better interpretations since
structure) because we consider them to have merit in our the employees could refer to the same concept with simi-
research. These documents served both as validations for our lar terminology, depending based on their technical skills,
findings as well as information that we did not have prior to knowledge, experience and position in the firm. In order
the interviews, assisting us to obtain a better understanding to obtain a high level of confidence, researchers validated
of the vision, objectives and regulations of each company. findings by examining reports, public information and
presentations related to this research and focused on the
3.3 Data Analysis and Theory Building AI aspects (Table 3).
Once all cases had been adequately analyzed, and the
A narrative analysis is followed for analyzing the content researchers had reached consensus, a cross-case analysis
from the interviews as the stories and experiences shared by was performed. In the course of the discussion, we identi-
employees are used to answer the research questions. fied a number of patterns that were either similar or dif-
As a first step, we went through the interview tran- ferent and explored the reasons behind them through open
scripts and commented on our initial thoughts by writing discussion, trying to establish consistency and cohesion,
memos. Although memos are usually used at the beginning arguing which interpretation seems most reasonable to our
of a text analysis, we continued to use them for updating goal and how AI Governance is created among these cases
our thoughts and interpretations or even adding new ideas. and which practices companies should adopt or introduce.
The generated transcripts were imported into the software
13
Table 3 Nodes and possible items under each node

Dimension Definition
Procedural Practices associated with data migration, system messages, documentation and processes for expansion, dynamic
model selection, pipeline evaluation, human and AI interaction, data quality sources
Relational Practices that deal with employees and communicating goals, domain experts, AI education for employees
Structural Practices associated with IT, optimization and automation, AI automation, ML pipelines, data access
AI culture Understanding of AI capabilities, AI-phobia, Trust issues against AI
AI architecture Development best practices, cloud infrastructure, unified tools
Legal regulations GDPR, legal constrains of AI use
Domain challenges Data challenges, domain knowledge, external challenges
Adoption problems Fear of losing position
Competitive Advantage Developing unique AI strategy, keep AI knowledge in house
Flexibility Cloud services boost flexibility
Cost maintenance Minimize costs from various operations
Scaling up AI assists in scaling up without needing more resources
Superior AI results Internal AI teams can give high value through solutions that are targeted in a specific problem and not generalized
4 Case Analysis As part of its strategy, the company developed an AI

team internally and adopted or utilized cutting-edge AI
4.1 Within Case Analysis technologies and techniques more extensively. A small
group of recently hired developers forms the AI depart-
All cases have some commonalities in their characteris- ment and becomes part of the business development and
tics and practices. Firstly, all the cases operate in the same innovation team of the company. Among the reasons
industry and have overlapping areas of operation. Secondly, for that decision was the belief that the company cannot
development best practices were followed such as the use maintain a competitive advantage without using AI in the
of Git, documentation and containerization platforms like upcoming years, and eventually, larger corporations will
Docker. Thirdly, data privacy (GDPR) is not a genuine con- absorb them. The AI team brought value to the firm by
cern (expect in the last case) since their data mainly consists forecasting energy consumption, assisting in decision-
of environmental data that anyone could access or buy, while making for the end-users and automating repetitive tasks.
legal regulations restrict them to using AI in specific areas, As a result, performance was boosted and maintenance
for instance they are not allowed to speculate on prices. costs were down.
Lastly, the set-up goals mainly concern reducing costs and Control of key domain knowledge was one of the main
forecasting energy demands. concerns for firm. Company A did not want to give away
domain knowledge to external partners, who offer special-
ized AI products, since they could build and sell similar
4.1.1 Company A AI products to their rivals:
“If we help them (the software company) develop
Company A is a Norwegian company in the energy sec- their software, they will take this software where
tor using environmentally friendly production and energy- we provide the data, we provide domain knowledge
related services. The main focus is on the areas of hydro- and sell it to everyone, especially to our rivals”.
power production and wind power production, meaning the (Respondent 1, Company A)
center of attention is on developing renewable solutions that
supports positive societal development. The company trades The development team aimed for automation and flex-
in different markets by forecasting how much energy is pro- ibility but they did not want to develop the entire soft-
jected to be consumed each day known as intraday, while ware from scratch since it would be time-consuming to do
being actively involved in planning for hydropower plants. everything. At the same time, they did not prefer to use
Hydropower plants are a controlled energy source that the software of other companies, so they decided to develop
owners can decide how much energy they want to produce, the intelligence that runs on top of cloud services (boost-
compared to wind energy that is affected by environmen- ing flexibility at the same time) despite the fact that using
tal variables. In this sense, optimization plays a key role.AI cloud services was challenging in the beginning:
contributes to the reduction of predictive maintenance costs, “The real challenge was not to deploy a single model
which is challenging in Norway due to its harsh weather but a whole cascade of models that were dynami-
conditions, especially during winter.
13
cally selected between each other”. (Respondent 3, something fails, because things fail much more often
Company A) than you would think”. (Respondent 2, Company A)
Standardization and unification of AI technologies was an Domain experts manage the projects as their knowledge
issue because the team is consisted of people from different and expertise are needed at each step of the development
backgrounds and with different skills creating obstacles in phase. For example, their insights could determine, which
AI development. The problem occurred because each mem- data should be needed for the machine learning models. In
ber of the team had his preferences about which tools and addition, domain experts help with the creation of meaning-
style should use during development time, making it difficult ful dashboards that are responsible for alerting information
to exchange or understand others’ code since the system was to employees, explaining historical data and assisting in
not unified. The team decided through internal workshops decision making for end users. At the same time, develop-
to unify the used tools (e.g., programming languages, data- ers focused on alerting errors and failures, for instance, if a
bases) while creating a shared vocabulary through collabora- data stream stopped delivering data. Another way to ensure
tive wiki pages: robust outcomes after deployment was to test the models
against real-time datasets. Through This, they were able
“We were responsible for our own code. There was no
to make adjustments to the models, obtain a better under-
code sharing, there were no shared tools that people
standing of the data, and improve the overall quality of the
can use amongst each other as a team, because every-
system:
one else was doing their own thing”. (Respondent 2,
Company A) “When an incident happens, usually the ones who have
developed the system and some stakeholders from the
In the beginning, data was exchanged through Excel
rest of the organization, they sit down and sort of meet
files. These files were not secure, and at the same time they
… and they questioned what happened, what was the
realized that they could not scale up, so APIs were used to
consequences, and then the developers go into find out
replace Excel files. The necessary data was collected through
the reasons for that”. (Respondent 5, Company A)
vendors, so it was possible to compare data and ensure high
quality outcomes for the trained models. To increase secu- Due to radical changes in processes and operations AI
rity, data access was only possible through intranet, but the training for end-users was more than necessary. All these
company did not define clear data management roles, mak- changes caused human agents to feel phobic when interact-
ing the data request process time consuming: ing with the machine, as they had the overall watch and
check periodically that everything is in working order. From
“You're getting data from somewhere, and the data for
the employees’ point of view, these automations raised con-
some reason, you don't have access at that particular
cerns as they saw themselves being automated and driven
time. And that that's something that pops up multi-
away from their posts, which could result in unemployment:
ple time. You can of course, try to get around, having
some to wait a bit, and you know, retry”. (Respondent “People get scared of the fact that we will automate
4, Company A) them away. So, we had a hard environment. We
started talking about why we need the people here,
Multiple steps were taken into consideration to achieve
their domain knowledge … so we had regular meetings
robustness and reliability. To govern the process of data
explaining what AI can do and not”. (Respondent 1,
cleaning and model evaluation, ML pipelines were cre-
Company A)
ated in the cloud. This made it easier to oversee the overall
process and apply quantifiable metrics on the ML results. To summarize, company A built AI capabilities to auto-
Also, domain experts participated in the evaluation so they mate procedures and assist with decision-making by using
can provide their insights and feedback to make the model cloud services, ML pipelines and domain experts to under-
outputs reliable and trustworthy. Rather than increase profit stand data and the outcomes of models. Flexibility, produc-
margins, the model outputs emphasize reducing errors, tivity, and reduction of costs were the immediate effects that
because Company A places higher priority on prediction the company saw as positive results allowing them to remain
safety instead of profitability. In case of failure, local sys- a competitive player while achieving their set up goals of
tems (ML pipelines) were ready to support decision-making, their overall AI strategy.
ensuring a reliable and robust system that could always gen-
erate output and assists employees with their everyday tasks:
4.1.2 Company B
“You still need to have an option to run them, not on
the cloud solution itself, but on your local system. So Company B is a Norwegian renewable company that focuses
basically, we do have these kinds of processes, in case on customers' needs by producing and distributing clean and
13
renewable energy. The company’s management believes that “We have used this technology started with basic AI …
future energy consumption will differ from what it is today using more machine learning and neural networks and
in many ways. Energy customers will produce their own so on and that has only been around for two years, but it
energy and they will want to have the opportunity to com- was a strategic decision”. (Respondent 5, Company B)
bine this with smart energy solutions, meaning that the cus- “It's always a question of cost them money… so that's,
tomer will more than ever be at the centre of attention where maybe that's why we use Excel for many processes,
he will play a small but still significant role in the production because it's, it's very easy to set up and when you have
of energy. The firm understood that the adoption of AI is set up something that works, and you have to pay in
vital for creating new products and services that will make order to replace it”. (Respondent 4, Company B)
them a leading provider of competence services.
Another challenge that the developers faced came from
Data analysts performed data surveys to evaluate which
employees who refused to use the new technologies as they did
data they think to be the finest and most suited for their pur-
not trust the results or even oppose the change. Although the
poses. Within the last five years, the firm has hired a couple
AI works as assistance in most cases and helps with decision
of analysts with machine learning experience and they have
making, the employees could not accept that a new member
begun developing AI models in conjunction with domain
of the firm that has no experience in their field could improve
experts. To build the AI capabilities data were gathered
their work significantly:
internally and externally from various vendors as it needed
to verify and ensure the quality of the data since it is crucial “I've got some feedback from people that “you can't
for the AI models: come here and tell me what to, how to do it. I worked
here for 20 years with the same thing”. So, they are
“We have a data survey, to make sure that we have the
there are scared of me doing their job better, I think”.
right data for what we think would do the job. And
(Respondent 3, Company B)
then we build the model”. (Respondent 1, Company B)
Nevertheless, when people start using the applications, they
Reducing maintenance costs and errors, as well as creat-
misunderstand the AI capabilities. End-users had unrealistic
ing flexible systems that can scale, were all top priorities.
expectations of what the model could or should predict, and
Initially, the team used cloud services, but they were not
the developers spent many hours explaining what a statisti-
flexible enough, or at least to their liking, so they moved
cal output is and how the model actually make predictions.
to influx databases that allow storing and retrieving time
Furthermore, they elaborated on what is possible and what is
series data. By contrast, a containerization platform like
not doable, which took a long time for the end-users to digest
Docker was adopted from the start to let developers to pack-
all these new information and the training process lasted for
age applications into containers. Thus, these standardized
months.
executable components boosted flexibility and the cloud
Last but not least, the data administrator is a straightforward
services were put aside. With the help of the IT department
process because there are only two roles primarily, one admin-
help new tools and processes were introduced to detect early
istrator who can perform all actions (e.g., write and read), and
problems and warnings by using different types of sensors.
one reader who can only read specific data as part of their
Based on these inputs, autoregressive (AR) models were
work. This simplicity in roles and the fact that they do not deal
developed to detect anomalies in the system, saving time and
with private data in their applications led to the decision to not
effort, which means fewer maintenance costs in the long run:
have a dedicated employee responsible for data management.
“We have audio surveillance, to monitor and detect To sum up, company B uses AI as a tool for prediction for
early problems with just sound and then we have the identifying market opportunities and reducing maintenance
AI model. It is listening to the sound and try to detect costs. To accomplish this, a small team of AI developers was
early warnings”. (Respondent 4, Company B) formed, who introduced new technologies and processes with
“We had a cost of around two million a year and it has data from various vendors. The complexity of the system was
been reduced to around ten thousand a year, almost kept low to prevent high development costs while the end-
nothing”. (Respondent 3, Company B) users were introduced to AI capabilities to enable them to trust
and adopt AI in their daily work.
Nevertheless, it is expensive to add many features and
takes a lot of time to develop. Despite the use of ML appli-
4.1.3 Company C
cations with neural networks, all the applications are con-
sidered to be weak AI (AI that is limited to a narrow task).
Company C is a firm that identifies itself as climate-con-
Because of that the company still uses conventional and tra-
scious, where they assist their customers through digital
ditional ways in parallel with AI, while they plan to replace
technologies to reduce energy consumption. Their services
them over time in the future:
13
cover many aspects such as charging devices and heating “If they need to access that data, they will need to
in the home, which is appealing for many people as their request it from their supervisor for example. And then
services assist in saving a considerable amount of money it depends on the type of data that you use, what data
every month. Company C realized that there was a big you get access to, but I would say like data scientists
gap in the market since energy-producing companies did and developers usually we get access to basically eve-
not offer any customized services. Hence, they decided to rything because we work on everything.” (Respondent
adopt AI practices to build the necessary capabilities to 1, Company C)
create customized applications for each client. A direct
The AI applications focus on specific needs, which usu-
effect was that customers came with constructive feedback
ally involve forecasting ancillary services, customer needs
driving the firm to become even more efficient and build-
(AI assistants) and reducing maintenance costs by minimiz-
ing new services that were highly demanded:
ing business risks at the same time. To ensure trustworthi-
“Every time a customer approaches with a question, ness and confidence in their provided services, the team
we take those questions. And let's say a customer just has implemented ways for explaining AI decisions (XAI)
comes and says like, I would like to control my water which allow customer service employees to communicate
boiler at home, and I can't, and I am spending a lot of efficiently with customer requests that involved AI decisions
money on this. So, I would like you to improve that.” or AI suggestions:
(Respondent 1, Company C)
“The machine taking decisions and that the customer
Building these AI capabilities though would be impos- wondering why the machine took the decision and ask-
sible if the company did not follow best development ing support for this. And then we need to tell them
practices. In addition, cloud services are used to cover why the machine took this decision.” (Respondent 1,
areas that the members of the development team have no Company C)
expertise or the time to develop:
It is worth mentioning that Company C never experienced
“We would need to build our own data centers, which any problems related to AI fear since all employees have a
is completely out of our expertise, we would need good understanding of what AI can offer and how it helps
to hire people and know how to distribute the load, them in their everyday lives. Two could be the main reasons
then you need to secure your data etc.” (Respondent for that. Firstly, employees have an extensive onboarding
1, Company C) training process and secondly, people who applied to the
company are aware that the firm uses extensive AI products;
To ensure robustness, the development team has created
thus, work candidates have prior knowledge of AI technol-
procedures that covers extensively any AI behavior change
ogy and AI products or are willing to embrace AI.
and when the timeline that these changes are allowed to be
published, for example, not before a big event, in produc-
4.2 Between Case Analysis
tion to avoid AI failures. AI unit tests are also in place to
ensure the system's outputs are reliable. To gather the data
The interviewees talked about how their company trans-
for their AI models, Company C uses APIs from different
formed over the years and the necessary steps that were
vendors. As previously mentioned, the firm uses private
taken in order to expand and maintain a competitive advan-
data, so a dedicated team was formed to deal with privacy
tage, while minimizing AI risks. In Table 4 there is a sample
issues by introducing procedures during the data transfor-
of the grouped observations that are generated based on the
mation and data storage phases:
interviews.
“We have a team in the company that it's exclusively
focused on privacy, and how to comply with the reg- 4.2.1 Procedural
ulations.” (Respondent 1, Company C)
As far as the procedural practices are concerned, all firms
Nevertheless, data roles and data management were
aimed to build new capabilities using external software.
not always in the spotlight as almost all employees could
Algorithms, trading strategies and machine learning pipe-
access data since the company’s size was small. The
lines are developed by the internal AI teams, using platforms
growth in numbers led to the decision of introducing data
from third partners, keeping domain knowledge in house.
management roles and restrictions on the data types and
situations under which employees can access data. This “We try to build all by ourselves. We do not want third
was accomplished through data-gates where employ- parties to build what we can because they can use the
ees had to ask for permission from the supervisor of the same software for different purposes”. (Respondent 2,
system: Company C)
13
Table 4 Nodes and grouped observations (sample) based on the interviews

Node Observations Code
Procedural Having a backup [offline] AI model is recommended Backup offline ML pipelines

Use AI platforms mostly for deploying models Build intelligence on top of
external AI services
Correct the source data not the cleaning process Data quality sources
understand concepts not just data Data quality sources
Create dashboards for monitoring actions and results Enable human—AI interaction
Create AI products that do one task Create weak AI applications
Ensemble models to maximize the output Dynamic model selection
Relational Onboard training processes AI education for employees
Operators should understand what the model is (and not) capable of predicting AI education for employees
Read data from different vendors to increase quality of model Data vendors
Domain experts take lead of a project to ensure quality of the final product Domain experts lead projects
Hire external consultants to predict the value of the project or help with specific cloud technolo- AI consultants
gies
Explain to customers AI decisions Explainable AI
Structural Automate operations that take place 24–7 AI Automation
Repetitive and boring tasks should be automated AI Automation
AI solutions that focus on a very specific problem perform much better than generalized AI solu- Locus of AI strategy
tions
Allocate required resources and create plan for AI development Locus of AI strategy
Access data through intranet for security reasons Intranet data access
No clear roles who is responsible for data management Data ownership responsibilities
Data transformation process has been standardized ML pipelines
For all projects, data governance, data quality and data 4.2.2 Structural
security are common elements to ensure quality and secu-
rity. All firms attempted to fix potential issues in the data As for the structural practices, AI strategy for current or
sources, through data collection corrections and the use of feature development projects seems to be the centre for
APIs, instead of extending their cleaning process: top managers as they need to design products that focus on
specific needs, while adding business value. Also, manag-
“We do not do much cleaning of the data; we are
ers need to allocate the right resources and plan precisely
focusing on getting it right.” (Respondent 4, Com-
as the costs and timelines for AI projects do not follow the
pany B)
usual software projects:
The evaluation of ML pipelines was a continuous pro-
“We need to plan and decide how long it takes, these
cess that took place at different points of the pipeline for
are the resources that we need to do it, and this is
ensuring robustness and quality. The outcomes of the pipe-
the plan, and then we will go through a decision.”
lines were AI products that are considered to be weak AI,
(Respondent 1, Company A)
executing singular tasks or providing with suggestions for
decision making (AI assistants). Nevertheless, the end- Managers had to separate the nice to have features that
users had to follow the AI suggestions intuitively and use were often requested by either clients or employees. Oth-
their domain knowledge to fill gaps that AI was not capa- erwise, these requests could delay considerably the project
ble of. In addition, intelligence systems should include and skyrocket the cost of development leading the project’s
notification systems, error detection and decision-making failure. A note of caution is that AI development is usually
tools. By doing so, firms measure the credibility of their more expensive than traditional software development:
systems and evaluate the performance gained through
“It depends on the available resources and time; it
KPIs:
is really costly to add a lot of AI functionality. We
“We need to always monitor the quality measures and would definitely like to have them, but it is not fea-
always be on our toes and improve that.” (Respond- sible”. (Respondent 3, Company C)
ent 4, Company B)
13
Managers could estimate the for building a pipeline based as they experienced it, was handled by many workshops and
on the project specifications. It is common in AI projects to internal meetings.
reuse parts of one pipeline for another, which reduces the
“We explain to them that we are going to help them;
overall development time considerably. At the same time,
we're not going to automate them away, and I talked
pipelines provide confidence in the quality of the end result
quite a lot about this, when I explain sort of what we
as the final product is robust, easily maintainable and extend-
were doing and how it was going to work. So, taking
able for new features.
away this fear that we were coming from the outside as
“We have all kinds of pipeline, for example, usually, aliens and our work is to identify patterns (basically) it
we have basic, like getting the data as a first step and helped a lot”. (Respondent 1, Company A)
we do some preprocessing. Then we do feature selec-
What is more, AI teams explained what AI is all about
tion, building different models, compare the perfor-
and how it works because most employees who started using
mance etc.”. (Respondent 6, Company A)
AI as assistant in their decision-making processes misun-
Data management practices consider mostly securing derstood very often AI’s ability to predict certain patterns
data, using secure databases and intranet access, and creat- (especially true when AI models were updated):
ing a few roles for data access, where usually there are two
“You need to ensure that model operates in a way that
types of roles, (1) developers with full access and (2) end-
the operators understand and they agree with how it
users with access to specific data:
was developed … allow an operator to make changes
“There is a there is a shift now. So, if you work with to the decision, what you often see is that the perfor-
data, you will get access to that data ... before every- mance gets much worse.” (Respondent 6, Company A)
thing was open …, and we needed to implement these
restrictions.” (Respondent 1, Company C) 4.2.4 Enablers and inhibitors
Firms encounter various enablers and inhibitors when they

4.2.3 Relational innovate their business model. One of the main enablers for
AI governance is unification in the choice of technologies
In all cases, domain experts were involved in all develop- and infrastructure because there are different tools for devel-
ment phases for two reasons. Firstly, their domain knowl- oping AI products. For example, Company A had legacy
edge was crucial to the success of the project, and secondly, code written in different programming languages making
they led the projects as project managers. Also, with the help compatibility among applications an issue. The need to
of AI developers they built notifications systems, by declar- unify and standardize the set of used tools was more than
ing which notifications should be sent via email and which a necessity:
should be displayed in dashboards:
“Developers were programming in MATLAB or
“If something (bad) happens, we get a warning to our Python, and everyone was doing their own thing”.
email. Then we can find the bugs or look more on tools (Respondent 4, Company A)
and see what happened in there and fix it.” (Respond-
Furthermore, it became essential to increase the speed
ent 6, Company A)
of models and scale up because the company increased the
External AI consultants assisted only at the beginning, amount of data while creating new intelligence based on the
and they were only called on in rare cases when the devel- data. These changes were boosting efficiency and employees
opment team was unsure how to proceed with a particular liked automation that lifted the heavy load of the work:
project:
“One of the big changes and additions that everyone
“We had consultants for cloud services that we weren’t started programming, and automating stuff is that we
familiar with and for some ML optimizations”. went fully on cloud in all our systems, and it ena-
(Respondent 3, Company B) bled us really be very flexible with our resources”.
(Respondent 2, Company A)
Lastly, establishing an AI culture inside the firm through
extensive training was not an easy process, especially true AI culture promotes the acceptance of AI, meaning that
for the two first cases. Employees did not trust the outcomes, employees use and trust AI. The lack of AI understanding
sometimes they described the recommendations as naive, could lead to AI phobia, which is a huge inhibitor when
and most importantly, employees saw AI and automation as digital transformation process is in place. Another inhibi-
a way of losing their status and position. This direct threat, tor could be lack of domain knowledge or lack of data for
13
creating business intelligence. On top of that legal regula- 5 Discussion

tions forbid certain uses of AI, for example, the prediction
of energy prices. In this study, we set out to explore the underlying activities
that comprise an organization’s AI governance. Specifi-
cally, we built on the prior distinction between structural,
4.2.5 Outcomes relational, and procedural dimensions of governance in
order to understand how organizations are planning around
The outcomes were similar in all cases. That could be their AI deployments. Through a multi-case study of three
because their desired goals were similar. The need for organizations that have been using AI for several years, we
reducing maintenance costs and forecasting energy con- conducted a series of interviews with key respondents and
sumption were the top priorities since most of the business identified a set of activities that were relevant under each
value come from these two outcomes: of the three dimensions, as well as challenges they faced
“It is similar in other industries. It is said that they during deployments of AI and how they managed to over-
are estimating, based on big data, that reduction in come them. Our analysis essentially points out the various
maintenance costs is about 20%—30%”. (Respondent obstacles that AI governance is oriented to overcoming,
4, Company B) and the mechanisms employed to operationalize them.
Specifically, we find that the obstacles that are identi-
Flexibility and robustness were products of the develop- fied during the process of deploying AI are observable
ment process as their AI systems have to be able to adapt at different phases and concern different job roles. When
and estimate market trends. As an example is Company C, it comes to difficult management responsibilities that a
which strives to understand its customers’ habits so it can business owner must do, AI solutions can always provide
adapt to each one, while at the same time, AI decisions a variety of responses and probabilities for each of these
should be robust and non-costly for the customer to use: alternatives. However, AI lacks the ability to make deci-
“If there is a break, and someone wants to charge sions in specific contexts. To make the ultimate decision,
his car, and then start heating up… in an hour that a business owner or manager must employ intuition to
price is high, then the cost would be pretty high… reconcile the choices provided by AI (Kar & Kushwaha,
the customers is going to be angry.” (Respondent 2, 2021). In addition, they span various levels of analysis,
Company C) from the personal, such as fear of AI and reluctance of
employees to adopt it, to organizational-level ones, such
This superiority in results, boosts confidence in decisions as organizational directives on how to comply with laws
and the potential customer value is high, especially for firms and regulations. What is more, the study reveals not only
that have a more direct relationship with their clients. As a that AI governance is a multi-faceted issue for organiza-
result, companies gain a significant competitive advantage tions but that it spans multiple levels, therefore requiring
over the competition as they can reduce the overall product a structured approach when it is deployed. In addition, dif-
cost and provide clients with exceptional services that adopt ferent concerns emerge at different phases of AI projects,
in their specific needs. so AI governance also encapsulates a temporal angle in its
Table 5 shows challenges and recommended actions that formation and deployment.
firms faced and followed collectively in order to achieve The significance of governing AI can be critical in
desired outcomes. attaining digital innovation. The firms we looked at were
A proposed model is constructed based on the foregoing leveraging AI to help them reinvent their operations.
discussion. Our model (Fig. 1), which includes the struc- Instead of having an information collection approach,
tural, procedural, and relational components as key compo- these firms followed an information analysis approach.
nents, illustrates the techniques that companies have used Information analysis refers to the opportunity of develop-
over the last five years. Enablers include existing AI culture ing unbiased approaches for evidence-based data analysis
and architecture within a company, whereas inhibitors are (Trocin et al., 2021a), where AI can foster digital process
mostly legal constraints, domain challenges, high develop- and service innovation as companies did in this study.
ment costs, and AI-phobia. Companies that seek to use AI Also, AI has the potential to foster a digital innovation
should ensure that these problems have been examined and process by developing new and evidence-based approaches
addressed in advance, since numerous impediments can lead for data collection (Mariani & Nambisan, 2021). First, it
to failure and waste of company resources. The model's most enables organizations to modify particular parameters to
essential results are a competitive advantage, cost reduction, appeal to a wider audience when content is released online,
and dependable AI systems, all of which are critical to any and second, it allows them to gather online behavioral
business's success, particularly in competitive marketplaces.
13
Table 5 Challenges, recommended actions and desired outcomes

Challenges Recommended actions Outcomes
Development AI cloud is challenging to build Offline recommendation system Boost flexibility

Develop intelligence on top of external
platforms
AI development does not follow neces- Standardized executable components Robustness
sarily traditional software develop- Unify technological tools Reduce amount of workload
ment Create shared libraries
Prediction techniques vary based on Allow human interaction in high Robustness
sector uncertainty to prevent high AI bias
Lack of data Choose AI algorithms based on data Boost flexibility
volume and data types Robustness
Generate data from existing data
Read data from different sources
Buy data from vendors using APIs
Lack of domain knowledge by AI Allow domain experts to lead Save money and time
developers Robustness
Employees Misunderstand of AI capabilities AI training to understand what the Better communication between depart-
models can do and what cannot do ments
Easier adoption of AI
Employees do not adopt AI AI training to understand how to use Better communication between depart-
the new technologies ments
Employee’s fear losing their position AI training to explain why their exper- Better communication between depart-
because of AI tise cannot be replaced ments
Different vocabulary for different AI training to be familiar with differ- Better communication between depart-
departments ent terms and processes ments
Create different dashboards for differ- Easier adoption of AI
ent concepts Measure performance
Value Classical optimization tools are still Automate operations that Save money and time
better than AI models 1. take place 24–7 Scaling up becomes easier
2. there is a 1–1 correlation between Reduce amount of workload
workload and number of employees
3. are repetitive and boring document
code and process
Hard to predict effort and costs Avoid nice to have features as they Save money and time
will delay the whole process con- Scaling up becomes easier
siderable
use KPIs to quantify performance
External environment Giving out knowledge to external Develop intelligence on top of external Maintain competitive advantage
partners platforms instead of using external
solutions
Distance with third parties can affect Develop internal AI team to speed up AI Development is focused on your
development processes considerably specific problem not to a generic
solution
maintain competitive advantage
Legal constrains and GDPR Create clear data management roles Security
data and store it for a set period of time (e.g. one year) in and opportunities for digital transformation and innova-
accordance with GDPR regulations (Trocin et al., 2021a). tion. For example, the United Kingdom intends to employ
It is worth mention that emotional intelligence is not part health information technology and execute proposals for
of these systems although understanding how people deal a national learning health and care system as a result of
with emotional challenges is crucial for AI systems to a serious public health shock. Hence, each UK country's
emulate human reasoning (Luong et al., 2021). Finally, digital health and care strategy should be re-evaluated in
the COVID-19 pandemic has introduced new challenges light of the pandemic's lessons (Sheikh et al., 2021).
13
Fig. 1 Proposed model
5.1 Research Implications organizational effects and resulted in added business value.

In this article, it is argued that although it is important to
This study contributes to IS literature. Despite the consider- adopt AI, it is equally vital to create the necessary processes
able debate in the scientific community about what is con- and mechanisms for developing and aligning AI applica-
sidered AI and how companies should incorporate AI in tions with the requirements of the business environment.
their everyday operations, we tried to understand the pro- One of the main challenges we identify is that AI govern-
cesses firms use to govern AI. However, not all companies ance requires continuous adaptation and modification as
have managed to build AI solutions that have had significant new data emerges or conditions change, for instance how
13
employees perceive AI. Thus, there is a form of ephemer- otherwise, time and resources might be wasted, which
ality which places an increased focus on establishing pro- could be invested in other projects that would add more
cesses, mechanisms, and structures to ensure that it is func- business value.
tioning as required and that it aligns well with the goals of Firms should use AI for automating tasks that are repet-
the organization. itive, which is appreciated by employees since they do not
Furthermore, there is a multitude of angles that a firm want to do monotonous work, but at the same time man-
can approach AI governance; for instance, companies in agers should have extended conversations with employ-
this study tried to create ML pipelines and interactive dash- ees of other departments ensuring them that AI will not
boards, but not all of them had a real focus on explainability replace them (AI education). This could be crucial for the
of the results since they are still in early stages and focus on company’s internal stability as people might lose trust in
parts that they believe are more urgent. In the industry there the leadership, they might leave the company taking their
is a recent article by Microsoft, which focuses primarily on expertise with them or resist using new technologies and
the technical aspects of workflow implementation, outlining try to undermine the value of AI.
the key phases in the lifecycle of machine learning applica- Lastly, firms can use dashboards as an effective way to
tions (Amershi et al., 2019). Yet, this research concentrates allow communication between human and machine. Dash-
on the development challenges and the practical solutions boards are a great information management tool that is
a firm could follow to build an AI through solid and effec- used to track KPIs, metrics, and other essential data points
tive organizational practices. In this sense, AI governance relevant to a business. That way the black-box nature of
in this article is not seen as a process but as a set of impor- models and AI in general can be less problematic because
tant aspects that need to be considered when designing and the use of data visualizations simplifies complex data sets
deploying practices and mechanisms, in order to ensure that and provides end-users useful information that can affect
the main challenges are overcome successfully and that AI business performance. In other words, humans will be able
applications are operating as planned. Our proposed model to evaluate results and detect any outliers or anomalies in
suggests that although there are inhibitors and barriers and processed data. This in turn facilitates greater transpar-
despite the different ways of approaching AI governance, ency and a more direct way of revising the models used
it offers positive outcomes, if best practices are followed, to analyze data.
and this study identified specific procedural, structural and
relational components that are necessary for achieving this.
Our exploratory work opens up a discussion about what 5.3 Limitations and Future Research
AI governance comprises of, and how it can be dimensioni-
lized. Furthermore, it explores the link between the chal- In the current work, we investigate how to govern AI, which
lenges such governance practices help overcome, and the practices should be adopted and how to minimize AI risks.
actors and practices they involve. This stream of research is However, there are certain limitations that characterize this
particularly important in the value-generation of AI-based research. First, the data are collected through interviews with
applications, as it paints a more detailed about how rela- companies that do not require extensive use of sensitive data;
tive resources are leveraged in the quest for business value thus, there might be bias in our data or provide an incom-
(Mikalef et al., 2019). In addition, the work sheds some light plete picture of the entire challenges around relevant prac-
on the process-view of AI deployments by opening up the tices. Second, while we conducted several interviews with
dialogue about the different phases of AI deployments and key employees within the organizations, our data collection
the unique challenges faced within each of these. was based on a snapshot in time and may not accurately
reflect the complete breadth of practices. Lastly, all cases
are from the same sector. Hence, generalizability could be
5.2 Practical Implications an issue that should be taken into consideration.
As future research, it would be interesting to gather more
Based on the findings, a firm needs to incorporate new empirical data through interviews, from firms that belong to
procedures when adopting AI in order to maintain an different sectors, and theorize the notion of AI governance
advantage over the competition and boost efficiency. A from a positivist perspective, which could be tested with
unified system is required for building AI pipelines, which empirical data on the antecedents and their effects. It would
is consistent with the tools that developers use. Hence, the also be beneficial for the field to know which resources firms
system will be more robust as it will be easier to main- deploy most in order to achieve their organizational goals
tain and improve different components of the system. In and how they govern these resources to boost their perfor-
addition, managers should create procedures that employ- mance, and how AI governance practices impact specific
ees are aware of and follow and give clear guidelines; types of resources.
13
Appendix 10. Have you quantified decision bias in your company’s

model predictions?
Interview Guidelines 11. Could you describe the infrastructure of your system?
Introduction Control and Technical Aspects
1. What is your current role and background in the com- 1. What types of data do you collect? How do you ensure
pany? to use data and AI algorithms such that they are in line
with your organizational objectives?
Business value/organizational context 2. Are there any procedures or processes for managing the
data you use in your organization (for AI purposes)?
1. Could you mention briefly the history behind AI use in 3. Where is data stored? How is it shared etc.? (In what
your company? How long it took you to adopt AI (time- cloud service are data stored?)
line)? 4. Do you specify, monitor and evaluate the (i) behavior
2. How did (i) the use of AI grow over time, (ii) how did and (ii) outcomes of your AI systems and potentially
the AI team grow over time (iii) how did the value/effec- the combination with human decision-makers? Which
tiveness of AI grow over time? actions are taken upon this?
3. Are there any changes brought by AI that you did not 5. Which control processes and mechanisms are in place
anticipate? to ensure that AI systems are acting upon your set
4. Do you plan to use AI in other aspects of your company? goals? Does this differ depending on the use cases?
5. Do you prioritize reducing risks or potential margin 6. What processes do you have to ensure robustness?
profits and why? 7. Do you develop any kind of internal AI software
framework?
Dealing with Data 8. What development practices do you follow as a team?
9. Did you try to incorporate external AI software?
1. Do you deal with Data Privacy? 10. What practices have you adopted to ensure scalability?
1. If yes, how do you do that?

2. If not, why not? Acknowledgements Acknowledgements have been removed for the
purposes of the review process.
2. How do you handle data? Funding Open access funding provided by NTNU Norwegian Univer-
3. Could you describe the cleaning process? sity of Science and Technology (incl St. Olavs Hospital - Trondheim
4. Do you use cloud services? University Hospital).
1. If yes, then what type of server do you have? Declarations

2. What about external services like Azure?
Conflict of Interest We declare that:
No funding was received for conducting this study. Also, the authors
5. How are your organization’s models audited for secu- have no financial or proprietary interests in any material discussed in
rity or privacy vulnerabilities? this article.
6. Do you follow any best practices for Trustworthy AI?
Open Access This article is licensed under a Creative Commons Attri-
1. If yes, which one? bution 4.0 International License, which permits use, sharing, adapta-
tion, distribution and reproduction in any medium or format, as long
2. If not, why not? as you give appropriate credit to the original author(s) and the source,
provide a link to the Creative Commons licence, and indicate if changes
7. Which people have access to your AI features? were made. The images or other third party material in this article are
Describe the main roles. included in the article's Creative Commons licence, unless indicated
otherwise in a credit line to the material. If material is not included in
8. Have you established any governance practices? For the article's Creative Commons licence and your intended use is not
example, have you defined roles and responsibilities? permitted by statutory regulation or exceeds the permitted use, you will
9. Who is in charge of the data management and what need to obtain permission directly from the copyright holder. To view a
were the requirements for that position? copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
13
References Johnson, M., Albizri, A., & Harfouche, A. (2021). Responsible

Artificial Intelligence in Healthcare: Predicting and Preventing
Insurance Claim Denials for Economic and Social Wellbeing.
Abbasi, A., Sarker, S., & Chiang, R. H. (2016). Big data research
Information Systems Frontiers, 1–17. https://doi.org/10.1007/
in information systems: Toward an inclusive research agenda.
s10796-021-10137-5.
Journal of the Association for Information Systems, 17(2), 3–32.
Kar, A. K., & Kushwaha, A. K. (2021). Facilitators and Barriers of
https://doi.org/10.17705/1jais.00423.
Artificial Intelligence Adoption in Business–Insights from Opin-
Amershi, S., Begel, A., Bird, C., DeLine, R., Gall, H., Kamar, E.,
ions Using Big Data Analytics. Information Systems Frontiers,
Nagappan, N., Nushi, B., & Zimmermann, T. (2019). Software
1–24.
engineering for machine learning: A case study. 2019 IEEE/ACM
Korstjens, I., & Moser, A. (2018). Series: Practical guidance to qualita-
41st International Conference on Software Engineering: Software
tive research. Part 4: Trustworthiness and publishing. European
Engineering in Practice (ICSE-SEIP).
Journal of General Practice, 24(1), 120–124.
Baskarada, S. (2014). Qualitative Case Study Guidelines. The Quali-
Lebovitz, S., Levina, N., & Lifshitz-Assaf, H. (2021). Is AI ground
tative Report, 19(40), 1–25. https://ssrn.com/abstract=2559424.
truth really “true”? The dangers of training and evaluating AI
Berente, N., Gu, B., Recker, J., & Santhanam, R. (2021). Managing
tools based on experts’ know-what. Management Information
artificial intelligence. MIS Quarterly, 45(3), 1433–1450. https://
Systems Quarterly, 45(3), 1501–1526. https://doi.org/10.25300/
doi.org/10.25300/misq/2021/16274.
misq/2021/16564.
Butcher, J., & Beridze, I. (2019). What is the state of artificial intel-
Lewis, M. O., Mathiassen, L., & Rai, A. (2011). Scalable growth in IT-
ligence governance globally? The RUSI Journal, 164(5–6), 88–96.
enabled service provisioning: A sensemaking perspective. Euro-
Cath, C. (2018). Governing artificial intelligence: ethical, legal
pean Journal of Information Systems, 20(3), 285–302.
and technical opportunities and challenges. The Royal Society
Li, J., Li, M., Wang, X., & Thatcher, J. B. (2021). Strategic directions
Publishing.
for AI: The role of CIOs and boards of directors. MIS Quarterly,
Charmaz, K. (2014). Constructing grounded theory. Sage.
45(3), 1603–1644. https://doi.org/10.25300/misq/2021/16523.
Chatterjee, S., Ghosh, S. K., & Chaudhuri, R. (2020). Knowledge man-
Luong, T. T., Sivarajah, U., & Weerakkody, V. (2021). Do agile man-
agement in improving business process: an interpretative frame-
aged information systems projects fail due to a lack of emotional
work for successful implementation of AI–CRM–KM system in
intelligence? Information Systems Frontiers, 23(2), 415–433.
organizations. Business Process Management Journal.
Mariani, M. M., & Nambisan, S. (2021). Innovation analytics and digi-
Collins, C., Dennehy, D., Conboy, K., & Mikalef, P. (2021). Artifi-
tal innovation experimentation: the rise of research-driven online
cial intelligence in information systems research: A systematic
review platforms. Technological Forecasting and Social Change,
literature review and research agenda. International Journal of
172, 121009.
Information Management, 60, 102383.
Michael, D. M. (1997). Qualitative Research in Information Systems.
Debreceny, R. S. (2013). Research on IT governance, risk, and value:
MIS Quarterly Executive, 21(2), 241–242.
Challenges and opportunities. Journal of Information Systems,
Mikalef, P., & Gupta, M. (2021). Artificial intelligence capability:
27(1), 129–135.
Conceptualization, measurement calibration, and empirical study
Eisenhardt, K. M. (1989). Building theories from case study research.
on its impact on organizational creativity and firm performance.
Academy of Management Review, 14(4), 532–550.
Information & Management, 58(3), 103434.
Enholm, I. M., Papagiannidis, E., Mikalef, P., & Krogstie, J. (2021).
Mikalef, P., Fjørtoft, S. O., & Torvatn, H. Y. (2019). Developing an
Artificial intelligence and business value: A literature review.
artificial intelligence capability: A theoretical framework for
Information Systems Frontiers, 1–26.
business value. International conference on business information
Fadler, M., & Legner, C. (2021). Toward big data and analytics govern-
systems, Seville, Spain.
ance: redefining structural governance mechanisms. Proceedings
Mikalef, P., Boura, M., Lekakos, G., & Krogstie, J. (2020). The role of
of the 54th Hawaii International Conference on System Sciences,
information governance in big data analytics driven innovation.
Faraj, S., Pachidi, S., & Sayegh, K. (2018). Working and organizing in
Information & Management, 57(7), 103361. https://doi.org/10.
the age of the learning algorithm. Information and Organization,
1016/j.im.2020.103361.
28(1), 62–70.
Mishra, A. N., & Pani, A. K. (2020). Business value appropriation
Frank, M. R., Autor, D., Bessen, J. E., Brynjolfsson, E., Cebrian, M.,
roadmap for artificial intelligence. VINE Journal of Information
Deming, D. J., Feldman, M., Groh, M., Lobo, J., & Moro, E.
and Knowledge Management Systems, 51(3), 353–368. https://d oi.
(2019). Toward understanding the impact of artificial intelli-
org/10.1108/vjikms-07-2019-0107.
gence on labor. Proceedings of the National Academy of Sciences,
Oates, B. J. (2005). Researching information systems and computing.
116(14), 6531–6539.
Sage.
Fügener, A., Grahl, J., Gupta, A., & Ketter, W. (2021). Will humans-
Pessoa, A. S. G., Harper, E., Santos, I. S., & Gracino, M. C. D. S.
in-the-loop become borgs? Merits and pitfalls of working with AI.
(2019). Using reflexive interviewing to foster deep understanding
Management Information Systems Quarterly (MISQ)-Vol, 45(3),
of research participants’ perspectives. International Journal of
1527–1556. https://doi.org/10.25300/misq/2021/16553.
Qualitative Methods, 18, 1609406918825026.
Gregory, R. W., Henfridsson, O., Kaganer, E., & Kyriakou, H. (2020).
Qu, S. Q., & Dumay, J. (2011). The qualitative research interview.
The role of artificial intelligence and data network effects for cre-
Qualitative Research in Accounting & Management, 8(3), 238–
ating user value. Academy of Management Review, 46(3), 534–
264. https://doi.org/10.1108/11766091111162070.
551. https://doi.org/10.5465/amr.2019.0178.
Raisch, S., & Krakowski, S. (2021). Artificial intelligence and man-
Grønsund, T., & Aanestad, M. (2020). Augmenting the algorithm:
agement: The automation–augmentation paradox. Academy of
Emerging human-in-the-loop work configurations. The Journal
Management Review, 46(1), 192–210.
of Strategic Information Systems, 29(2), 101614.
Ramesh, B., Cao, L., Kim, J., Mohan, K., & James, T. L. (2017). Con-
Holmstrom, J. (2021). From AI to digital transformation: The AI readi-
flicts and complements between eastern cultures and agile meth-
ness framework. Business Horizons.
ods: An empirical investigation. European Journal of Information
Holmström, J., & Hällgren, M. (2021). AI management beyond the
Systems, 26(2), 206–235.
hype: exploring the co-constitution of AI and organizational con-
Saunders, C., Benlian, A., Henfridsson, O., & Wiener, M. (2020). IS
text. AI & Society, 1–11.
Control & Governance. M. Quarterly.
13
Sheikh, A., Anderson, M., Albala, S., Casadei, B., Franklin, B. D., Emmanouil (Manos) Papagiannidis is a doctoral student in the Depart-
Richards, M., Taylor, D., Tibble, H., & Mossialos, E. (2021). ment of Computer Science. He previously earned a B.Sc. in Applied
Health information technology and digital innovation for national Informatics from the University of Macedonia (UOM), an M.Sc. in
learning health and care systems. The Lancet Digital Health, 3(6), Computer Science from the University of Newcastle, and an M.Sc. in
383–396. https://doi.org/10.1016/s2589-7500(21)00005-4. Data Science from the University of Newcastle. Manos has also worked
Sikolia, D., Biros, D., Mason, M., & Weiser, M. (2013). Trustwor- as a software developer in Greece (Athens) and the United Kingdom
thiness of grounded theory methodology research in information (Newcastle), where he built websites, managed systems, and improved
systems Proceedings of the Eighth Midwest Association for Infor- or fixed existing code by adding new features and introducing new
mation Systems Conference, Illinois. technologies.
Smuha, N. A. (2019). The eu approach to ethics guidelines for trustwor-
thy artificial intelligence. Computer Law Review International, Ida Merete Enholm works as a full-stack developer in Oslo (Norway)
20(4), 97–106. building digital solutions for a variety of customers. She has received
Stewart, J. (2012). Multiple-case study methods in governance-related her M.Sc. in Computer Science from the Norwegian University of Sci-
research. Public Management Review, 14(1), 67–82. ence and Technology (NTNU). Her Master’s Thesis was focused on
Tallon, P. P., Ramirez, R. V., & Short, J. E. (2013a). The informa- responsible governance of AI.
tion artifact in IT governance: Toward a theory of information
governance. Journal of Management Information Systems, 30(3), Christian Dremel is a “Alain Bensoussan” Fellow at the Norwegian
141–178. University of Science and Technology, lecturer at the University of
Tallon, P. P., Short, J. E., & Harkins, M. W. (2013b). The Evolution of Bamberg, and senior research fellow at the University of St.Gallen. In
Information Governance at Intel. MIS Quarterly Executive, 12(4), practice and academia, he addresses sociotechnical aspects of digital
189–198. transformation, digital innovation, and the strategic use of informa-
Teodorescu, M. H., Morse, L., Awwad, Y., & Kane, G. C. (2021). tion systems. His research has been published in journals such as the
Failures of fairness in automation require a deeper understanding Information & Management, MIS Quarterly Executives (MISQE),
of human-ml augmentation. MIS Quarterly, 45(3), 1483–1500. Electronic Markets and Technology Forecasting and Social Change,
https://doi.org/10.25300/misq/2021/16535. and presented at conferences such as the International Conference on
Tiwana, A., Konsynski, B., & Venkatraman, N. (2013). Information Information Systems (ICIS) and the European Conference on Informa-
technology and organizational governance: The IT governance tion Systems (ECIS).
cube. Journal of Management Information Systems, 30(3), 7–12.
Trocin, C., Hovland, I. V., Mikalef, P., & Dremel, C. (2021a). How Patrick Mikalef is an Associate Professor in Data Science and Infor-
Artificial Intelligence affords digital innovation: A cross-case mation Systems at the Department of Computer Science. In the past,
analysis of Scandinavian companies. Technological Forecasting he has been a Marie Skłodowska-Curie post-doctoral research fellow
and Social Change, 173, 121081. working on the research project “Competitive Advantage for the Data-
Trocin, C., Mikalef, P., Papamitsiou, Z., & Conboy, K. (2021b). driven Enterprise” (CADENT). He received his B.Sc. in Informatics
Responsible AI for digital health: a synthesis and a research from the Ionian University, his M.Sc. in Business Informatics for Utre-
agenda. Information Systems Frontiers, 1–19. cht University, and his Ph.D. in IT Strategy from the Ionian University.
Van den Broek, E., Sergeeva, A., & Huysman, M. (2021). When the His research interests focus the on strategic use of information systems
machine meets the expert: an ethnography of developing AI for and IT-business value in turbulent environments. He has published
hiring. MIS Quarterly, 45(3), 1557–1580. https://doi.org/10. work in international conferences and peer-reviewed journals includ-
25300/misq/2021/16559. ing the Journal of Business Research, British Journal of Management,
Wamba-Taguimdje, S.-L., Wamba, S. F., Kamdjoug, J. R. K., & Wanko, Information and Management, Industrial Management & Data Systems,
C. E. T. (2020). Influence of artificial intelligence (AI) on firm and Information Systems and e-Business Management.
performance: The business value of AI-based transformation pro-
jects. Business Process Management Journal, 26(7), 1893–1924. John Krogstie (1967) holds a PhD (1995) and a MSc (1991) in infor-
https://doi.org/10.1108/bpmj-10-2019-0411. mation systems from the Norwegian University of Science and Tech-
Wilkin, C. L., & Chenhall, R. H. (2010). A review of IT governance: nology (NTNU), where he is currently a full professor in informa-
A taxonomy to inform accounting information systems. Journal tion systems at the computer science department (IDI). At IDI he was
of Information Systems, 24(2), 107–146. Department Head 2017-2021. His research interests are information
Wynn, D., Jr., & Williams, C. K. (2012). Principles for conducting systems modelling, information systems engineering, quality of mod-
critical realist case study research in information systems. MIS els and modelling languages, neuro-conceptualization, eGovernment,
Quarterly, 36(3), 787–810. https://doi.org/10.2307/41703481. sustainable smart cities and sustainable digitalization in general. He
Zhang, D., Pee, L., & Cui, L. (2021). Artificial intelligence in E-com- has published more than 350 refereed papers in journals, books and
merce fulfillment: A case study of resource orchestration at Ali- archival proceedings since 1991.
baba’s Smart Warehouse. International Journal of Information
Management, 57, 102304.
Publisher's Note Springer Nature remains neutral with regard to

jurisdictional claims in published maps and institutional affiliations.
13
Information Systems Frontiers is a copyright of Springer, 2023. All Rights Reserved.

Toward AI Governance: Identifying Best Practices and Potential Barriers and Outcomes

Uploaded by

Copyright:

Available Formats

Toward AI Governance: Identifying Best Practices and Potential Barriers and Outcomes

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Toward AI Governance: Identifying Best Practices and Potential Barriers and Outcomes

Uploaded by

Copyright:

Available Formats

Information Systems Frontiers (2023) 25:123–141

Toward AI Governance: Identifying Best Practices and Potential

Accepted: 27 January 2022 / Published online: 20 April 2022

1 Introduction and deployed AI solutions to automate their processes,

Table 1 Overview of companies

Country Norway Norway Norway

Table 3 Nodes and possible items under each node

4 Case Analysis As part of its strategy, the company developed an AI

Table 4 Nodes and grouped observations (sample) based on the interviews

Procedural Having a backup [offline] AI model is recommended Backup offline ML pipelines

Firms encounter various enablers and inhibitors when they

creating business intelligence. On top of that legal regula- 5 Discussion

Table 5 Challenges, recommended actions and desired outcomes

Development AI cloud is challenging to build Offline recommendation system Boost flexibility

Fig. 1 Proposed model

5.1 Research Implications organizational effects and resulted in added business value.

Appendix 10. Have you quantified decision bias in your company’s

Introduction Control and Technical Aspects

1. If yes, how do you do that?

1. If yes, then what type of server do you have? Declarations

References Johnson, M., Albizri, A., & Harfouche, A. (2021). Responsible

Publisher's Note Springer Nature remains neutral with regard to

You might also like

4 Case Analysis As part of its strategy, the company developed an AI

creating business intelligence. On top of that legal regula- 5 Discussion

5.1 Research Implications organizational effects and resulted in added business value.