# Responsible AI Governance: A Systematic Literature Review

> Source: https://arxiv.org/pdf/2401.10896
> Pages: 8

---

Responsible AI Governance: A Systematic Literature Review Amna Batool CSIRO’s Data61 Melbourne, Australia amna.batool@data61.csiro.au Didar Zowghi CSIRO’s Data61 Melbourne, Australia didar.zowghi@data61.csiro.au Muneera Bano CSIRO’s Data61 Melbourne, Australia muneera.bano@data61.csiro.au ABSTRACT As artificial intelligence transforms a wide range of sectors and drives innovation, it also introduces complex challenges concerning ethics, transparency, bias, and fairness. The imperative for integrat- ing Responsible AI (RAI) principles within governance frameworks is paramount to mitigate these emerging risks. While there are many solutions for AI governance, significant questions remain about their effectiveness in practice. Addressing this knowledge gap, this paper aims to examine the existing literature on AI Governance. The focus of this study is to analyse the literature to answer key questions: WHO is accountable for AI systems’ governance, WHAT elements are being governed, WHEN governance occurs within the AI development life cycle, and HOW it is executed through various mechanisms like frameworks, tools, standards, policies, or models. Employing a systematic literature review methodology, a rigorous search and selection process has been employed. This effort resulted in the identification of 61 relevant articles on the subject of AI Governance. Out of the 61 studies analysed, only 5 provided complete responses to all questions. The findings from this review aid research in formulating more holistic and compre- hensive Responsible AI (RAI) governance frameworks. This study highlights important role of AI governance on various levels spe- cially organisational in establishing effective and responsible AI practices. The findings of this study provides a foundational basis for future research and development of comprehensive governance models that align with RAI principles. KEYWORDS Artificial Intelligence, AI Governance, responsible AI 1 INTRODUCTION Artificial intelligence (AI) has emerged as one of the most important technologies in many businesses and has grown to be an integral part of our society [ 1 ]. However, the risks and negative effects of AI are growing with its widespread application in a variety of sectors, such as autonomous cars [ 2 ], healthcare [ 3 ], finance [ 4 ], and other areas. There are different repositories 1 2 on AI incident databases that contains over 2000 AI incidents. Responsible AI refers to developing, deploying, and utilizing AI in order to ensure it is developed and used in a manner that aligns with human values, societal norms, legal standards, and mitigates potential risks and negative consequences associated with it, such as bias, discrimination, and lack of transparency [ 1 ], [ 5 ], [ 6 ]. In order to deal with the AI risks, ethical use of AI has become an essential demand [ 7 ]. As a result, governmental and international 1 https://incidentdatabase.ai 2 https://www.aiaaic.org/aiaaic-repository organisations, including the European Commission 3 , the Organ- isation for Economic Co-operation and Development [OECD] 4 , Australian government 5 , professional bodies (the Institute of Elec- trical and Electronics Engineers [IEEE]), and various companies have published their ethical AI principles and guidelines [8], [9]. The effort goes beyond just technical concerns and includes the development of strong AI governance solutions and techniques, which are considered essential for directing responsible use of AI technology, striking a balance between innovation and ethical be- haviour, and avoiding unforeseen effects [ 10 ]. Ethics principles and guidelines must be embedded in AI systems through proper AI governance techniques [ 11 ]. AI governance can be understood as encompassing a set of regulations, methods, procedures, and technological mechanisms utilized to guarantee that an organisa- tion’s utilization of AI technologies is consistent with its strategies, goals, and principles [ 10 ]. This encompasses adhering to legal re- quirements and upholding the ethical AI principles adopted by the organisation [ 10 ]. There have been numerous research studies done on proposing different AI governance solutions to govern AI systems [ 12 ], including the ECCOLA method for the governance of ethical and trustworthy AI systems [ 13 ], [ 14 ], the framework for AI governance proposed for AI safety domains [ 15 ], a governance model for the AI application in healthcare sectors [ 3 ]. However, there are multiple challenges, including transparency, explainability, and accountability of algorithms in AI governance, that need to be addressed [ 16 ], [ 17 ]. In addition to these challenges, AI governance also faces diversity and inclusion issues such as lack of fairness, poor reliability, lack of inclusive solutions, and so on [ 18 ]. Gover- nance is recognised to be the least focused area in AI Diversity and Inclusion [19]. To study the many facets of this developing discipline, this re- search paper dives into the topic of responsible AI governance. The establishment of structures and procedures at various levels—team, organisation, and industry, to make sure the development and im- plementation of AI systems adhere to ethical principles in line with AI governance patterns for responsible AI can be referred to as responsible AI governance [ 1 ]. An approach referred to as 3W1H (Who, What, When, and How) has been adopted in this study to analyse the existing AI governance solutions from the literature. In this approach, 3W covers three questions: who is governing (stakeholders), what should be governed (humans, data, system, or process), as proposed by Zowghi and da Rimini [ 6 ], and when is it being governed (i.e. at what stage of AI development life cycle)? 1H covers: How is AI being governed (i.e. frameworks, standards, regu- lations, or policies, etc. A comprehensive analysis of literature using 3 https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai 4 https://oecd.ai/en/ai-principles 5 https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics- framework/australias-ai-ethics-principles arXiv:2401.10896v1 [cs.CY] 18 Dec 2023

<!-- Page 2 -->

Amna Batool, Didar Zowghi, and Muneera Bano Figure 1: Methodology Overview 3W1H approach is presented in this paper, and the categorisation of key elements from 3W1H questions is covered under different layers of governance from the study by Lu et al. [ 1 ]: team-level, organisation-level, industry-level, national-level, and international- level, which are explained later in this paper. This study aims to summarize and synthesize current AI gov- ernance solutions (i.e. frameworks, tools, models, and policies), examine challenges in existing AI governance solutions, and offer insights based on the answers to the 3W1H questions. The main contributions of this study are: (1) A comprehensive analysis of 61 research papers selected from the academic literature has been presented, (2) The challenges or limitations of existing AI gover- nance solutions are also presented, and (3) The categorisation of key elements from 3W1H questions are presented under five levels of governance. This paper is organised as follows: Section two presents the research methodology along with research questions and data ex- traction. Section three presents the data analysis of the 3W1H approach carried out on 61 selected studies and the categorisation of AI governance solutions under five AI governance levels. The research results, where the answers to the research questions are added, are in Section 4. Section five concludes the study with future work. 2 RESEARCH METHODOLOGY This section presents the methodology followed in conducting this systematic literature review (SLR) following the guidelines estab- lished by Kitchenham et al. [ 20 ]. Figure 1 presents the methodology steps followed and is explained below: Research Questions : The following research questions have guided this systematic review: • RQ1: What governance frameworks, models, tools, and Poli- cies (regulations, ethics principles, or guidelines etc) for AI are offered in the literature? • RQ2: Which target AI application domains are considered in the existing AI governance approaches/solutions? • RQ3: What are the limitations and challenges of AI gover- nance discussed in the literature? Search Strategy : The keywords used to search for the articles in search engines and digital libraries are: ((AI OR artificial intelli- gence) AND (governance)) Inclusion and Exclusion Criteria : A wide range of search engines and digital libraries have been used to identify the relevant articles. Then, the inclusion criteria of year of publication and rele- vance were applied. The articles published in English between 2013 to 2023 in Google Scholar, Scopus, Science Direct, IEEE, and ACM were considered while determining inclusion criteria. Moreover, the papers relevant to the research focus were considered for inclu- sion, while book chapters, reports, and documentary articles were excluded. Papers that meet the relevance criteria were included in this study. All other papers that did not fit these requirements were omitted. Consequently, publications focusing on such topics as environmental governance, climate change, ecology, etc., were excluded. Screening and Selection : Guidelines for Systematic Litera- ture Review established by Kitchenham et al. [ 20 ] mainly focus on empirical and primary studies. Considering the limited number of empirical and primary studies on AI governance, the research scope was extended to include non-empirical and secondary stud- ies. This approach enabled the coverage of a broader spectrum of knowledge on the topic. To aid clarity and provide insightful analy- sis, this systematic review has distinctly categorised and presented these varying types of research for the readers. The screening pro- cess resulted in 2918 academic papers, and the selection process ended with the selection of 225 articles. Out of 225 resulting articles, 61 studies were selected (both Empirical - E and Non-Empirical - N) for this literature study after applying forward and backward snowballing and are added to this link 6 . Data Extraction First, the year of publication of the selected collection of studies is determined. The studies’ publication year is shown in Figure 2, which indicates that, out of the 61 papers, the greatest number of studies (27) were published in 2023, and the lowest number (4) in 2018. It has been noted that since 2018, AI governance has received much attention and is an increasingly prevalent topic today. Regarding citations, Figure 3 shows that 4 studies obtained 51 to 100 citations, while 10 papers received more than 100 citations throughout the past ten years covered for this SLR. As the selected set of 61 studies contains both empirical (E) and non-empirical (N) research 7 . Figure 4 presents the number of empirical studies 19, including case study papers, qualitative studies, survey and workshop-based studies, etc., and non-empirical studies 42, which are literature/background studies and discussions on existing literature on AI governance. 3 DATA ANALYSIS This section presents the data analysis of 61 selected studies through the 3W1H approach and also presents the categorisation of stake- holders based on "Who is governing?" and artefacts based on "How is it governed?" under five levels of AI governance. 6 https://github.com/amnacsiro/SLR-AI-Governance/tree/main 7 https://github.com/amnacsiro/SLR-AI-Governance/tree/main

<!-- Page 3 -->

Responsible AI Governance: A Systematic Literature Review Figure 2: Publication Year of Selected Set of Studies Figure 3: Citations 3.1 3W1H Approach: The 3W1H approach consists of questions, Who, What, When, and How, which have been explored for the selected set of 61 studies using thematic analysis. This analysis involved a comprehensive examination of the literature to identify recurring themes related to AI governance. "Who" focuses on the stakeholders (key AI over- sight roles) who should be involved in governing to oversee if AI complies with standards or regulations for responsible AI. These stakeholders include responsible research and innovation officers, data management scientists, AI governance committee members etc. Next, "What" covers the four pillars of the AI ecosystem, which are humans, data, processes, and systems. The selection of these four pillars is grounded in a thorough review of the existing literature and a consideration of the fundamental elements that constitute the AI ecosystem [ 6 ]. Aligning with Zowghi and da Rimini’s study [6], each pillar is further explained below. • Humans: Acknowledging the centrality of human involve- ment in AI development and deployment, this pillar encom- passes stakeholders (operational AI practitioners) involved in the day-to-day technical implementation and operational aspects of AI projects, such as AI developers, AI designers, etc. From the previous question, "Who is governing?", which includes key AI oversight roles, this pillar is linked with a focus on observing "Who is governing whom?", which means whether key AI oversight roles are governing oper- ational AI practitioners for ensuring that AI systems they are developing adhere to ethical standards and regulatory requirements. • Data: This pillar emphasizes the importance of responsible data acquisition, processing, and utilization. Effective AI governance requires a focus on data quality, privacy, and security to mitigate biases and promote fair and transparent AI decision-making. • Process: The AI practices involved in AI development and deployment that are overseen by stakeholders to guaran- tee they comply with ethical standards, legal requirements, and organisational goals are included in the ’Process’ pillar. For instance, if the stakeholders involved in the preceding question on "Who is governing?", are taking responsibil- ity for governing the pre-development, during, and post- development processes of AI systems development. • System: This pillar encompasses the AI systems, which should be governed in consideration of their robustness, interpretability, and accountability to guarantee their re- sponsible and reliable operation. Next, "When" represents the four development stages of AI to which the particular governance solutions should be applied. The four stages of AI development are: the initial stage (planning, ap- proval, and data collection), design, development (build models, verify, and validate), and deployment (monitor, and use), in align- ment with established frameworks and guidelines from organisa- tions such as NIST [ 21 ], OECD [ 22 ]. Lastly, the "How" explores the artefacts of governance solutions for AI , such as policies, ethics principles, tools or frameworks, standards, laws, regulations, mod- els, etc. 3.1.1 Comprehensive analysis of 3W1H:. Figure 5 and Figure 6 present a comprehensive analysis of 3W1H, applied to all 61 papers, with the paper IDs representing E as empirical studies and N as non- empirical studies from a total of 61 studies. Out of 61 studies, only five [N15], [N26], [N29], [E45], and [E47] had all of the questions in 3W1H answered; these studies are indicated in grey in figure 5 and figure 6. There are a significant number of studies (20 out of 61) focused on answering the question of "how" AI should be governed (figure 6) while neglecting other aspects such as "who" should be responsible for governance and "at what stage" of the AI develop- ment life cycle. It has been observed that 11 studies (figure 5) have answered to the question "Who is governing?" where the studies [N8] and [E37] added that national and international governance coordinating committee members should be in charge of governing the AI systems; the study [N15] mentioned multiple parties should be in charge of governing data at the design, development, and deployment stages of the AI life cycle. However, this study [N15] has not specifically mentioned the names of the parties. The re- maining studies (figure 5) have mentioned the multi-disciplinary steering committee ([E45]), the data management group ([N26] [N29]), and AI scientists as high level expert groups ([N2] [N3]) as stakeholders who should be responsible for governing data, pro- cesses, or systems under the AI ecosystem. It has been analysed that under the question "What is being governed?," not a single study out of 61 has mentioned the human pillar to be considered to

<!-- Page 4 -->

Amna Batool, Didar Zowghi, and Muneera Bano (a) Empirical Studies (b) Non-Empirical Studies Figure 4: Research Methods: Empirical Studies (a) Non-Empirical Studies (b) Figure 5: 3W1H Analysis: Who, What, and When be governed, and only one study [N21] mentioned that responsible research and innovation officers should take responsibility for gov- erning the processes of AI development and deployment. On the other hand, 11 studies (figure 5) mentioned data pillar that should be governed, and 9 studies (figure 5) mentioned that AI systems should be governed. There are three studies common in both pillars of data and systems, i.e., [N29], [E46], and [E47]. Before the analy- sis of the question "How is it governed?," is presented, it has been observed that nine studies (figure 5) have mentioned the different AI development stages at which governance should be done under the question "When is being governed?". For example, the study [N10] mentioned that governance of AI should be done at the initial (planning, approval, and data collection), design and deployment (monitoring and use) stages. There are two studies [N32 and E53] that mentioned that governance of AI should be done at all stages of the AI development life cycle. It is important for an organisation to know who should be responsible of governing what, and when. If it is unclear to an organisation which stakeholders they should ask to take responsibility for governing AI at various AI development stages, it is hard to reduce the risks associated with AI and ethics. If an organisation is not sure exactly what they need to govern—data, systems, processes, or humans— how can such an organisation reduce bias, establish accountability, fairness, transparency, etc.? It has been noted that nine studies (figure 6, under Ethics) out of 61, have concentrated on developing ethical principles (fairness, pri- vacy, safety), rules, or guidelines to assist organisations in running ethical governance for their AI systems. Three of the five ([N15], [N26], [N29], [E45], and [E47]) studies which has given answers to all questions of Who, What, When, and How, have proposed various ethical principles and a set of guidelines for governing AI systems and data ([N15], [E45], and [E47]). Four studies [N15], [N26], [N29], and [E47] mentioned that their proposed ethical principles, and guidelines are to govern data in the AI ecosystem and one study [E45] presents a governance solution to regulate the AI system. It

<!-- Page 5 -->

Responsible AI Governance: A Systematic Literature Review Figure 6: 3W1H: How is it governed? has been analysed that two studies [N29] and [E47] have mentioned that their proposed solution is to govern data as well as systems. This means data and systems are receiving more attention than processes and humans (figure 5). The limited focus on processes and humans in these studies suggests a potential gap in the current discourse surrounding AI governance, highlighting the need for more comprehensive consideration of ethical principles and guide- lines that encompass the entire AI development life cycle, including the human dimension and associated processes. 3.2 AI Governance Levels Inspired by the pattern catalogue proposed by Lu et al. [ 1 ], the stake- holders found under the question "Who is governing?" in this paper are classified under the five groups, which are shown in Figure 7. Similarly, AI governance solutions found under the question "How is it governed?" are grouped under team-level, organisation-level, and industry-level governance. National-level and international- level governance are also added and used for further categorisation, as shown in Figure 8. It has been observed that the highest number (19) (figure 8), of AI governance solutions are categorised under organisational-level governance. Out of these 19 organisational-level governance, only 4 [N15] [N29] [E45] [E47] had answers to all questions in 3W1H, which means that they are clear on who should be responsible for regulating the AI through these solutions and at what development stage. Unfortunately, the remaining 15 studies do not offer complete solutions to AI governance to develop and deploy AI responsibly. It has also been analysed that eight AI governance solutions are categorised as national-level governance and two solutions are categorised under international-level governance. Unfortunately, none of these solutions, whether at the national or international level, have provided with complete 3W1H questions. Figure 7: Stakeholder Classification It’s important to recognise that, alongside organisational gover- nance, the collaboration between national and international gover- nance plays a pivotal role [ 23 ]. Coordinating national bodies with international efforts enables the formulation of best AI governance solutions, ensuring responsible behaviour and ethical standards in the global AI landscape [23]. 4 RESEARCH RESULTS This section presents the results and findings of each research ques- tion. RQ1: What governance frameworks, models, tools, and Poli- cies (regulations, ethics principles, or guidelines) for AI are offered in the literature? Table 1 presents the frameworks for AI governance proposed in the literature along with their paper IDs (E Empirical studies, N:

<!-- Page 6 -->

Amna Batool, Didar Zowghi, and Muneera Bano Figure 8: AI Governance Levels AI Governance Frameworks Paper ID Risk Management Framework: AI Ethics, AI Society, and AI Law and Regulations. N3 Media-AI Governance Framework: automating data processing and capture, automating content creation, automating content moderation, and automating communication. N13 Framework to incorporate stakeholders along with AI risks, AI gains, and AI decisions. N29 System-Level Framework with modular building blocks for efficient AI governance in financial services. N32 Fusion Fuzzy Multiple Rule-Based Decision-Making Framework. N56 Table 1: AI Governance Frameworks Non-Empirical studies). Five studies have proposed frameworks as a solution to regulate artificial intelligence systems. However, it has been observed from 3W1H analysis (Figure 5 and 6) that only one article [N29] out of five studies on AI governance frame- works has added answers to all questions of Who, What, When, and How. It is essential to inform organisations about who should be involved in governing AI through these frameworks and at which development stages as shown in the study by Sidorova and Saeed [ 24 ]. It has also been noted that only one study (N3) has focused on AI ethics (fairness, transparency, accountability) in its proposed framework, while the remaining four studies have proposed frame- works focusing on incorporating stakeholders in governance stages, system-level frameworks to enhance governance processes in the fi- nancial sector, and governing data in the media and communication sector, among others. It is essential to put a focus on AI ethics while proposing frameworks for governing AI to make AI responsible. If AI ethics, regulations, or responsible AI principles are ignored by researchers while proposing solutions to govern AI, then it is hard to achieve solutions that make AI ethical and responsible [25]. AI Governance Models Paper ID Model consists of four different components: fairness, transparency, trustworthiness, and accountability. N10 Domain specific Model consists of three different components: adaptiveness and competence, reliability and transparency, and responsibility and accountability. N12 System-Level Governance Model for data governance within BDAS - Big Data Algorithmic Systems. N26 Dimensional AI Governance Model consists of different AI dimensions, including structural, relational, and procedural. E44 Table 2: AI Governance Models Table 2 presents the AI governance models proposed in the lit- erature. Four studies have proposed AI governance models, and two [N10] and [N12] of the models have focused on AI ethics prin- ciples, including fairness, transparency, accountability, reliability, and so on. Only one paper [N26] of these four has answered all questions in 3W1H. The remaining three have only proposed the models without taking into consideration how important it is to know who should be responsible for regulating AI through their proposed models and at which AI development stages. It has been analysed that only two studies [N25] and [E53] have discussed and proposed AI governance tools. Study [N25] has dis- cussed "artificial discretion,” which can be used as a tool of AI governance that helps public managers think about the implica- tions of AI as they decide whether and how to deploy it. The second study [E53] has discussed ECOOLA, a tool that consists of ethical principles to be used to regulate AI systems. The research identified an accountability gap in ECOOLA, which was addressed through the adoption of information governance practices in ECOOLA to make its information robust. It has also been analysed that none of the studies on AI governance tools have provided all the answers to questions in 3W1H except on "how." Ethics principles, standards, or regulations play a vital role in making AI responsible [ 26 ], and using ethics principles in gov- ernance practices helps contribute to responsible AI governance. Table 3 shows the studies (9) that have proposed different ethics principles and guidelines for the governance of AI to develop and deploy AI ethically and responsibly. There are four studies [N2], [N6], [N15], and [N21] that have proposed different ethics princi- ples and ethics pillars to put focus on responsible AI governance. Similarly, there are three studies [N31], [N35], and [E46] that have focused on policies that can assist organisations in mitigating the risks of privacy, safety, and transparency issues. The remaining two studies [E45] and [E47] have proposed different sets of guidelines, and one of these studies, i.e., [E45], has discussed operationalizing guidelines through different practices of value stream. It has also been analysed that three studies [N15], [E45], and [E47] of these nine have answered all questions in 3W1H.

<!-- Page 7 -->

Responsible AI Governance: A Systematic Literature Review Policies (regulations, ethics principles, or guidelines) for AI Governance Paper ID Ethics Principles proposed. N2 Ethics Pillars proposed. N6 Ethical Values Ethical Principles: Ethical Values; Ethical Principles; Guide; Ethical Norms. N15 ETHNA: Ethical governance of AI research and innovation. N21 Policy Infrastructure: design, develop, implement, and evaluate policies. N31 Policy Recommendations for privacy, safety, etc. risks. N35 Value stream practices, to operationalize the guidelines. E45 Policy Recommendations to support GDHP member countries. E46 AI Governance Guidelines proposed. E47 Table 3: AI Governance Policies To summarise, while frameworks, models, tools, or policies are proposed, there is a need for enhanced clarity, particularly on ethi- cal principles and the involvement of stakeholders at different AI development stages. The prevalence of policies in the literature un- derscores their pivotal role in fostering responsible AI. Emphasising comprehensive details on regulatory roles and development stages is crucial for ensuring effective governance and accountability in responsible AI governance. RQ2: Which target AI application domains are considered in the existing AI governance approaches/solutions? The AI governance frameworks, models, tools and policies dis- cussed above have been analysed further to explore the AI appli- cation domains where these governance solutions are targeted to apply. Figure 9 presents the results of the AI application domains to clearly demonstrate which domain has been targeted more and which one has been less focused. It has been analysed that the most common AI application domains targeted in the current AI governance solutions are healthcare and robotics. The results (Fig. 9) show that 10 of the research studies on frameworks, models, tools, and policies has targeted healthcare as the application do- main. Robotics is targeted in three studies. Other domains include banking, media and communication, academia, and so on. There are 25 studies that have not specified the application domains. It is necessary to do research on defining the AI application domains in order to make it obvious which application domains may utilise which AI governance frameworks, models, tools, and policies. RQ3: What are the limitations and challenges of AI gover- nance discussed in the literature? AI governance solutions are required in order to mitigate the risks associated with AI, such as bias, discrimination, lack of trans- parency, and unintended harmful impacts [ 5 ] [ 6 ]. But there are challenges associated with AI governance solutions as well, which are discussed in the literature and are presented in table 4. Ethical Figure 9: AI Application Domains Challenges of AI Governance Paper ID Ethical challenges (fairness, transparency, privacy, trust) N4, N9 E40, E49 N60 Legal-regulatory challenges (human-centric concerns) N4, E40 E41 Technical challenges (biases and harms) N4 Societal and Economic Challenges N5, E40 Table 4: Challenges of AI Governance challenges, including fairness, transparency, privacy, and trust, are the most discussed in AI governance according to the literature [N4], [N9], [E40], [E49], and [N60]. Lack of human involvement in current AI governance approaches makes the AI system less human-centric [N4] [E40] [E41]. It is important to keep human- centric concept in mind while proposing solutions to regulate AI systems as it assist in building trust in AI technology and mitigate issues of discrimination, fairness, and bias [N4] [E40] [E41]. The AI governance challenges added in table 4 are essential to consider while proposing an AI governance solution. The complex AI ethical issues covered by almost all of the studies have yet to be resolved through highly appropriate AI governance practises. The current AI governance frameworks, models, tools, and policies do cover the risk layer to mitigate the different risks associated with the application of artificial intelligence in different domains and make AI responsible [ 24 ], [ 27 ], [ 28 ]. However, there are still challenges in completely addressing these ethical concerns as shown in table 4. The next section concludes the paper with highlights of future work. 5 CONCLUSION AND FUTURE WORK In conclusion, this systematic literature review of 61 selected stud- ies achieves its objectives by providing a comprehensive summary of current AI governance solutions, including frameworks, tools, models, and policies. The challenges within existing AI governance solutions are also presented in this paper, emphasizing the preva- lent focus on ethical considerations such as fairness, transparency, privacy, and trust. The 3W1H analysis reveals a critical gap in ad- dressing "who," "when," and "what" aspects of AI governance in a

<!-- Page 8 -->

Amna Batool, Didar Zowghi, and Muneera Bano holistic manner, with a disproportionate emphasis on the "how." Only 5 studies of 61 have provided all the answers to questions in 3W1H. The analysis has also revealed that the highest number of governance solutions are under organisational-level governance. While ethical principles play a vital role, there is a call for enhanced clarity, especially in stakeholder involvement at different AI de- velopment stages. The findings emphasize the imperative for AI governance solutions to address not only risks but also crucial eth- ical aspects, promoting responsible and effective governance in the dynamic landscape of artificial intelligence. This underscores the need for future AI governance solutions to align closely with RAI principles, fostering a holistic and principled approach to the governance of artificial intelligence. As part of future work, an extended analysis is delving into grey literature, including white papers, reports, and company AI gov- ernance frameworks. This exploration aims to extract additional insights, contributing to a more nuanced understanding of respon- sible AI governance and enriching the discourse on AI governance practices, their implications, and ethical considerations. REFERENCES [1] Qinghua Lu, Liming Zhu, Xiwei Xu, Jon Whittle, Didar Zowghi, and Aurelie Jacquet. Responsible ai pattern catalogue: A collection of best practices for ai governance and engineering. ACM Computing Surveys , 2022. [2] Christoph Lütge, Franziska Poszler, Aida Joaquin Acosta, David Danks, Gail Gottehrer, Lucian Mihet-Popa, and Aisha Naseer. Ai4people: Ethical guidelines for the automotive sector–fundamental requirements and practical recommen- dations. International Journal of Technoethics (IJT) , 12(1):101–125, 2021. [3] Sandeep Reddy, Sonia Allan, Simon Coghlan, and Paul Cooper. A governance model for the application of ai in health care. Journal of the American Medical Informatics Association , 27(3):491–497, 2020. [4] Joseph Lee. Access to finance for artificial intelligence regulation in the financial services industry. European Business Organization Law Review , 21:731–757, 2020. [5] Australia’s National Artificial Intelligence Centre. Responsible ai. https://www. csiro.au/en/work-with-us/industries/technology/national-ai-centre, 2023. Ac- cessed: November 2023. [6] Didar Zowghi and Francesca da Rimini. Diversity and inclusion in artificial intelligence, 2023. [7] Thilo Hagendorff. The ethics of ai ethics: An evaluation of guidelines. Minds and machines , 30(1):99–120, 2020. [8] Jessica Fjeld, Nele Achten, Hannah Hilligoss, Adam Nagy, and Madhulika Sriku- mar. Principled artificial intelligence: Mapping consensus in ethical and rights- based approaches to principles for ai. Berkman Klein Center Research Publication , (2020-1), 2020. [9] Anna Jobin, Marcello Ienca, and Effy Vayena. The global landscape of ai ethics guidelines. Nature machine intelligence , 1(9):389–399, 2019. [10] Matti Mäntymäki, Matti Minkkinen, Teemu Birkstedt, and Mika Viljanen. Putting ai ethics into practice: the hourglass model of organizational ai governance. arXiv preprint arXiv:2206.00335 , 2022. [11] Corinne Cath. Governing artificial intelligence: ethical, legal and technical opportunities and challenges. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences , 376(2133):20180080, 2018. [12] Vasiliki Koniakou. From the “rush to ethics” to the “race for governance” in artificial intelligence. Information Systems Frontiers , 25(1):71–102, 2023. [13] Mamia Agbese, Hanna-Kaisa Alanen, Jani Antikainen, Halme Erika, Hannakaisa Isomaki, Marianna Jantunen, Kai-Kristian Kemell, Rebekah Rousi, Heidi Vainio- Pekka, and Ville Vakkuri. Governance in ethical and trustworthy ai systems: Extension of the eccola method for ai ethics governance using garp. e-Informatica Software Engineering Journal , 17(1):230101, 2023. [14] Mamia Agbese, Hanna-Kaisa Alanen, Jani Antikainen, Erika Halme, Hannakaisa Isomäki, Marianna Jantunen, Kai-Kristian Kemell, Rebekah Rousi, Heidi Vainio- Pekka, and Ville Vakkuri. Governance of ethical and trustworthy al systems: Research gaps in the eccola method. In 2021 IEEE 29th International Requirements Engineering Conference Workshops (REW) , pages 224–229. IEEE, 2021. [15] Matthijs M Maas. Innovation-proof global governance for military artificial intelligence?: How i learned to stop worrying, and love the bot. Journal of International Humanitarian Legal Studies , 10(1):129–157, 2019. [16] Stefan Larsson and Fredrik Heintz. Transparency in artificial intelligence. Internet Policy Review , 9(2), 2020. [17] Joshua A Kroll. Outlining traceability: A principle for operationalizing account- ability in computing systems. In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency , pages 758–771, 2021. [18] Denise Carter. Regulation and ethics in artificial intelligence and machine learn- ing technologies: Where are we now? who is responsible? can the information professional play a role? Business Information Review , 37(2):60–68, 2020. [19] Rifat Ara Shams, Didar Zowghi, and Muneera Bano. Ai and the quest for diversity and inclusion: a systematic literature review. AI and Ethics , pages 1–28, 2023. [20] Barbara Kitchenham, O Pearl Brereton, David Budgen, Mark Turner, John Bailey, and Stephen Linkman. Systematic literature reviews in software engineering–a systematic literature review. Information and software technology , 51(1):7–15, 2009. [21] AI RMF Knowledge Base. https://airc.nist.gov/AI_RMF_Knowledge_Base/AI_ RMF. Accessed: December 10, 2023. [22] OECD. Artificial Intelligence in Society, 2019. Accessed: December 10, 2023. [23] Wendell Wallach and Gary E Marchant. An agile ethical/legal model for the international and national governance of ai and robotics. Association for the Advancement of Artificial Intelligence , 2018. [24] Anna Sidorova and Kashif Saeed. Incorporating stakeholder enfranchisement, risks, gains, and ai decisions in ai governance framework. 01 2022. [25] Fang-I Liao, Sonia Adelaine, Mastaneh Afshar, and Bruce W. Patterson. Gov- ernance of clinical ai applications to facilitate safe and equitable deployment in a large health system: Key elements and early successes. Frontiers in Digital Health , 4:931439, August 2022. [26] Roger Clarke. Principles and business processes for responsible ai. Computer Law & Security Review , 35(4):410–422, 2019. [27] Bernd W Wirtz, Jan C Weyerer, and Benjamin J Sturm. The dark sides of artificial intelligence: An integrated ai governance framework for public administration. International Journal of Public Administration , 43(9):818–829, 2020. [28] Mehmet B Unver. Governing fiduciary relationships or building up a gover- nance model for trust in ai? review of healthcare as a socio-technical system. International Review of Law, Computers & Technology , pages 1–29, 2023.
