While I’m the youngest President in Chartered Accountants Ireland’s history, it’s still over twenty years since I sat Leaving Cert Accounting. Despite this passage of time, I studied the same syllabus, frozen in time since the 1990s, as the students who received their results today. Juxtapose this stasis with the absolute transformation of the accountancy profession in the last twenty years and you can see the mismatch. Add to this the fact that the Irish accountancy profession made a €19.8 billion contribution to the Irish economy in 2022, supporting over 83,000 jobs in Ireland and generating €1.8 billion in tax revenues, and the mismatch starts to have significant material impact. Back to the 90s Senior cycle is where most young people first interact with accounting as a subject, and the passage of time has not been kind to it. Students effectively need to “unlearn” much of what they learn at senior cycle and learn the subject anew at third level and in their professional training. The need for companies to provide reliable and transparent information beyond financial metrics has increased exponentially in the last decade, and the dated syllabus does not reflect the work that accountants do, and will do, in a modern economy. I want to acknowledge the work teachers around the country do to bring it to life for students, but they are nonetheless bound by the syllabus. We work closely with Leaving Cert students through our online second level accounting programme Boot Camp which now runs in every county in Ireland. Feedback from teachers we speak to indicates that in some cases, students were more attracted to Business at Leaving Cert as they saw Accounting as requiring a particular skillset, i.e. needing to ‘be good at maths’ to perform well in it. In speaking to our ACA students, many pursued accounting at third level despite, not because of, their experience at second level. Perception is critical. Chartered Accountant Ireland research among Gen Z respondents shows a clear gap in terms of how accounting is perceived by school leavers versus those who had commenced their professional training. Terms such as challenging, numbers-based, and boring were used by the former, dropping dramatically among the latter when they engage with a modern curriculum with the latest advances in technology and emerging accounting practices. Impact on the talent pipeline Anecdotally, the talent pipeline problem is clear right across the profession, from practices of all size to industry, resulting in attraction and retention challenges. It is driven by a huge increase in competition for talent from non-accounting roles; but also, this gap in perception of what accountants do. The accountancy profession is fundamental to Ireland’s economic prosperity. Our members support SMEs the length and breadth of the island, as well as playing a critical role in supporting investment from all corners of the world to Ireland. There is continued strong growth in demand for the services of the profession, but this demand can only be met if there is a strong pipeline of talent coming through, and this begins with our Leaving Cert students. I would say to students getting their exam results, employer demand for accountants is extremely strong. Salary levels for qualified accountants reflect this demand and the vitally important roles that accountants perform in all organisations. This demand continues to grow and so too does the range of opportunities. Reform is on the way This Institute has been engaged with the Department of Education for some time on the need to reform the Leaving Cert Accounting syllabus. Earlier this year we took our place on the National Council for Curriculum and Assessment’s Leaving Cert Accounting development group. We are now in the redevelopment process, but this change is so long overdue, and the rate at which the profession is innovating and transforming is in sharp contrast to the lack of agility over the last couple of decades at Department level in keeping pace.   It is envisaged that a revised specification for Leaving Cert Accounting will be introduced in schools from September 2026. It will provide a much-needed opportunity to ensure that the subject is relevant for students beyond second level education. And this is critical, as accountants are found across most business functions now, they are no longer confined to finance teams. There is an increased demand in industry roles, business process transformation, data analytics, regulatory technology, Fintech, compliance, risk management and ESG reporting. Senior cycle accounting of the future will feed a pipeline of students through the many entry routes into the profession, whether as school leavers or graduates, to meet this demand. So, the syllabus needs to reform, and then keep reforming. Remarkably, even with all the flaws of the current syllabus, accounting is the second most popular subject in the business suite for students in senior cycle and between 12-14% of students have been choosing the subject annually. It is exciting to imagine what a reformed syllabus could do to attract the best and brightest of our future business leaders.

“Auto Enrolment has been talked about for decades – now it is finally happening.” The words of Social Protection Minister Heather Humphreys after the Automatic Enrolment Retirement Savings System Bill passed through the Houses of the Oireachtas. Ireland is one step closer to catching up with every other OECD country that already has some form of auto-enrolment. It might be finally happening, but when is less clear. Momentum is needed to avoid the work of the last two decades being squandered. Two-thirds of Chartered Accountants Ireland’s members work in business, many of whom will be required to put such a scheme in place for their employees. The most recent formal communication from government suggests a start date sometime in 2025. And yet, putting in place the infrastructure to facilitate a system of pensions auto-enrolment is a mammoth task, and the list of outstanding deliverables at Department level is concerning before it even comes time for businesses to act. Hurdles to clear The legislative hurdle has now been cleared, but the Department of Social Protection has only in recent weeks appointed a company to build and run the new system. We are encouraged to see they have chosen a company that has a record of success in building the UK equivalent. We urge the Department to now expedite the appointment of a firm to manage the underlying investments. In recent weeks, it was reported that the Department of Finance has raised concerns that the auto enrolment legislation has been framed in a way that will force the regulator to apply a lower standard of oversight than that imposed on firms in the private pensions market. Other details also need to be clarified. In recent months, this Institute has requested such clarity in several areas. Many employers with staff who are likely to come within the remit of auto-enrolment will already have occupational pension schemes in place. To avoid the administrative complexity of setting up and operating a second staff pension scheme under auto enrolment, such employers may instead offer to extend participation in their current pension scheme to currently non-pensionable employees. However, if even just one of these employees refused to join the staff scheme in favour of being automatically enrolled, the employer would still be compelled to undertake the cost of setting up and operating a second scheme. We also sought more information around the meaning of “employee”, defined in the legislation as “a person in receipt of emoluments”. Such a definition would extend to individuals already in full-time pensionable employment who also undertake additional work who will therefore be required to contribute to a second pension scheme. Communication is going to be key The government’s recent SME package put a premium on the importance of consultation and dialogue with SMEs and other groups before introducing new legislation or policy affecting them. Auto enrolment is an opportunity to put this into practice. The government now needs to publish a road map and stick to it. While feedback was invited as part of an initial public consultation in 2018, since then only a very basic four-page guidance note for employers has been issued by government. To gain and maintain momentum, extensive and continuous stakeholder engagement is needed - not least with employers and payroll providers, upon whom the successful operation of the new system will be largely dependent. In a survey of small businesses conducted by Chartered Accountants Ireland, almost 90% felt that businesses had not been adequately informed of the steps needed to be taken by them to comply with pensions auto-enrolment in time for an early 2025 start date. Interestingly, three quarters of those surveyed will be required to introduce the new pension scheme, and for many this will be alongside their existing occupational pensions. Businesses need to see what the journey to implementation will look like. In a high-cost environment, this will give much needed reassurance and help to allay concerns. What is a realistic timeline? In its pre-legislative scrutiny report on the Bill introducing auto-enrolment, the Joint Committee on Social Protection recommended a two-year lead-in period, following the Bill being signed into law, to allow sufficient time for implementation. Payroll providers have been consistent in highlighting the need for an initial pilot phase to facilitate testing of the new system and to allow sufficient time to assimilate auto enrolment with current payroll systems. Neither of these fit into a 2025 implementation timeline. If officials truly want auto-enrolment to be a success, this timeline should be revisited and a 2026 or beyond start date announced. They may wish to avoid yet another postponement to the launch of auto enrolment but what should really matter here is getting it done right and giving businesses a chance to adapt. This additional time needs to be wisely used, by facilitating ongoing dialogue between departments, third party partners in implementation, and the many business groups and stakeholders who have walked this long road to auto enrolment.

As people across the world condemn the attack by Russia on Ukraine, they also want to show their support through donations and using their influence for humanitarian intervention. Professional accountants will find themselves in positions of influence with many stakeholders including clients, employers, employees, and local communities.  Níall Fitzgerald, Head of Ethics and Governance outlines some practical considerations for accountants and business leaders in this context:    Fundraising for humanitarian or other reliefs People and organisations are looking to help the millions of Ukrainians displaced by the invasion by donating directly or running fundraiser events. Be aware of fraud risk and recommend controls that ensure the safeguard of any monies raised and that they are used for the purpose for which they were raised. Ensure the necessary licences are obtained for any public fundraising activity. Be clear on the purpose for the funds and how they will be channelled to the beneficiaries. Ensure compliance with national charity law and check that charitable donations are only made to a properly registered charity in your jurisdiction. Social media Understandably, many people and corporates are sharing their views on Russia's  invasion of Ukraine via social media. The distinction between when a view is a personal view or that of the organisation where a person works is not always clear. If you are an officer of a company, e.g. a director, chief executive, or the public relations officer, and you are commenting on a matter related to your area of responsibility, then it is very difficult to separate your view from the corporate view. For this reason, many organisations will have clear corporate social media policies in place and that is the first reference point if in doubt. However, before reacting to a colleague's personal post, it is important to also consider their right to hold and express an opinion. There can be a cultural aspect to this within an organisation, especially where respect, tolerance, diversity and inclusion, and psychological safety are highly valued. The specific circumstances of the person expressing the view might also be taken into account, for example their emotional proximity to the issue.  Developing corporate positions Many organisations are using their influence for good by publicly denouncing the invasion of Ukraine, with some going further to withdraw from investments and business operations in Russia, and any dealings with Russian state-owned entities. These decisions are not always the most straightforward to implement. Legal and other expert advice should be sought to consider how an organisation can address contractual obligations, restructure, and relocate operations. Many Russian citizens are against the actions of the Russian Government, and Russian employees, contractors, etc., should receive fair treatment and not be discriminated against. Reporting progress and being transparent on these positions, including any setbacks, is very important as corporates will be held to account by stakeholders and members of the public to honour their commitments. Careful thought should be given before making any wide-sweeping statements. The global economy, with its complex interconnected markets, creates practical difficulties when seeking to divest of everything connected to Russia.   Whistleblowing and speaking up Clearly defined and well-communicated whistleblowing and speaking-up policies and procedures can increase an organisation’s awareness of any weaknesses in it’s internal controls and practices relating to sanctions, anti-money and anti-bribery and corruption compliance. Communicating to employees the organisation’s position in relation to this crisis and reminding them about whistleblowing and speaking-up policies and procedures, promotes a safe environment in which individuals feel comfortable to raise any concerns about the organisation’s actions, or inactions. Corporate reporting While the scale of the impact of this crisis on organisations will differ, it will dwarfed by the impact on millions of Ukrainians. Organisations have important social obligations and responsibilities to corporate stakeholders. Accountants should ensure transparency and accountability in corporate reporting by highlighting the impact of the crisis on the organisation’s operations, asset valuations and exposure to liabilities. Examples of the sources of this impact include: supply-chain disruption; the cost of ceasing operations in Russia or the conflict/invasion zones; rising commodity prices; inaccessibility of certain markets due to trade or travel restrictions; difficulty maintaining required levels of capital reserves; and loss of key customers. Accountants will have a central role in collecting, measuring, and reporting the necessary information and ensuring it is reported in accordance with legal and regulatory requirements and relevant reporting frameworks. They should also understand the limitations to their expertise and call for the involvement of experts where necessary. Directors and senior management will need to consider expert advice when making highly judgemental decisions on values and estimates and in determining the future implications for the organisation.    Boundaries between personal life and professional life Negative emotions, such as anger and fear, increase the risk of self-defeating behaviours. The developing situation in Ukraine will understandably evoke such emotions in many. In this context, it is useful to refer to guidance issued by the CCAB bodies, in July 2021, to help accountants consider and distinguish if their personal behaviour could be viewed as conduct that might discredit the profession. While the facts and circumstances of every situation will differ, the CCAB guidance provides some examples of such behaviours, including the use of seriously offensive or threatening language causing distress, or threatening behaviour, towards a client or a member of the public outside of the work environment.  This non-exhaustive list of considerations may need to be reconsidered as the crisis in Ukraine develops. In many situations, increasing ethical awareness or the ability to address an ethical dilemma requires reflection. Professional accountants may find it useful to refer to, or circulate to professional accountancy staff, the Chartered Accountants Ireland Ethics Quick Reference Guide available from our Ethics Resource Centre. This article was adapted for members overseas from an article written by Níall Fitzgerald on the Institute’s Ethics Resource Centre.

Background The Department of Children, Equality, Disability, Integration and Youth (the Department) has recently issued a document1 “Guidance Note for Core Funding Reporting Requirements Transitional Arrangements Year 1 and 2” (“the Department Guidance Note”) to entities providing childcare and early education services regarding the transitional arrangements for the application for funding under a new funding model called ‘Together for Better’.  These transitional arrangements will be in place for the next two reporting periods (years ended 31 August 2023 and 31 August 2024). Reporting regime This reporting regime includes a requirement that the childcare service providers (“client”) engage a professional accountant to submit a document called an ‘Income and Expenditure Template. CCAB-I have made the Department aware of the potential cost implications for an accountant providing this service to their client.  The following matters should be noted: The report is to cover expenses incurred on a cash basis for the year ended 31 August. The requirement is for expenditure incurred in the relevant period only, no accruals or prepayments. Income will be pre-populated in the online platform. Where your client has a different year end, time apportionment is not permitted. Important considerations for CCAB-I members CCAB-I has engaged with the Department over a number of months to discuss the nature and extent of work expected and the respective responsibilities of the client and the professional accountant and, in particular, the concerns regarding the request for the professional accountant to submit the report (as set out in the Department Guidance Note) on behalf of a client. There was positive engagement and much, but not all, of the feedback by CCAB-I on the process was reflected and incorporated into the final guidance. However, given the type of engagement, CCAB-I are making members aware of the potential issues and extant guidance which our members may consult. The Department Guidance Note sets out the responsibility for the data included in the report. See section 2 of the Guidance Note: “The Service Provider is responsible for fully complying with all financial transparency requirements in accordance with their Core Funding contractual obligations. The accountant relies on information provided by the Service Provider, who is responsible for disclosing all relevant information.” The Service Provider/client will make an online declaration on the platform provided by the Department that they have authorised a professional accountant2 to make the submission for them.  CCAB-I members are reminded of the relevant Code of Ethics issued by their professional body.  Independence The Department Guidance Note3 defines an accountant as someone who: "(a) has been admitted as, and is, a member of a prescriber accountancy body, (b) is currently practicing in the profession of accountant, (c) is not and never has been a principal officer or employee, or an owner or part owner, of the licensee in respect of whom he or she is preparing an accountant’s report, and (d) is maintaining such minimum level of professional indemnity insurance as is required by the prescribed accountancy body concerned." .Members should be cognisant of any conflicts with other engagements they may undertake for their clients.  When you are the Auditor  Where the accountant is the statutory auditor the Ethical Standard for Auditors (Ireland)4 applies and Section 5.129 prohibits the audit firm providing accounting services where the services would involve the firm undertaking part of the role of management or initiating transactions.  "S 1.24           In the case of a statutory audit, non-audit services shall not be provided that involve playing any part in management decision-taking of an entity relevant to an engagement. The firm shall not accept any engagement which includes the provision of services where it is probable that an objective, reasonable and informed third party would conclude that the firm or a covered person was playing a part in management decision-taking.  5.128          The provision of accounting services by the firm to an entity relevant to an engagement creates threats to the integrity, objectivity and independence of the firm and covered persons, principally self-review and management threats, the significance of which depends on the nature and extent of the accounting services in question and the level of public interest in the entity. 5.129            The firm shall not provide accounting services to an entity relevant to an engagement where: (a) the entity is a listed entity, relevant to an engagement by the firm, or a significant affiliate of such an entity; or (b) for any other entity: those accounting services would involve the firm undertaking part of the role of management, or initiating transactions; or the services are anything other than of a routine or mechanical nature, requiring little or no professional judgment.” When you are not the Auditor We recommend that members read the Department Guidance Note1 and that an appropriate letter of engagement and representation letter are in place where they undertake these engagements.  Members should refer to guidance documents issued by Chartered Accountants Ireland.  TA 06/2023 Grant Claims5 and the International Standard on Related Service ISRS 4400 (Revised) Agreed-Upon Procedures Engagements6 which give guidance on engagement acceptance and continuance and some general advice on agreeing the terms of engagement.  1 https://earlyyearshive.ncs.gov.ie/downloads/download-corefunding/   2 A professional accountant is defined as a member of a Prescribed Accountancy Body that comes within the supervisory remit of IAASA, •              Chartered Accountants Ireland. (CAI) •              Association of Chartered Certified Accountants (ACCA) •              CPA Ireland (CPA) •              Chartered Institute of Management Accountants (CIMA)  3 See Section of Guidance Note for Core Funding Reporting Requirements Transitional Arrangements Year 1 and 2. 4 https://iaasa.ie/wp-content/uploads/docs/media/IAASA/Documents/audit-standards/Ethical-Standard-Consultation/Ethical_Standard_Nov_2020_updated_June_3.pdf 5 https://www.charteredaccountants.ie/chariot/account/ta/TA06_2023.html 6 https://www.iaasb.org/publications/international-standard-related-services-isrs-4400-revised  

The Department for the Economy unveiled an ambitious plan to boost the Northern Ireland economy in 2021, but will it be up to scratch? Professor Anne Marie Ward, Dr Esmond Birnie and Dr Stuart Henderson crunch the numbers to find out if the 10x Economy vision can deliver. Some argue that the Northern Ireland (NI) economy has strong potential given its apparent unique trade position as a halfway house between Europe and Britain, combined with the Department for the Economy’s (DfE) ‘10x Economy’ policy, which targets innovation, inclusion and sustainability. Yet, despite experiencing 25 years of peace, NI continues to suffer from political uncertainty and lower economic productivity relative to Britain and the Republic of Ireland (ROI). Moreover, ongoing uncertainties associated with Brexit continue to dampen potential foreign direct investment, which has been vital to the strong economy in ROI. It is against this backdrop that the DfE introduced a new growth policy in May 2021 aimed at achieving a 10-times better economy (‘10x economy’) by 2030.  The 10x vision is underpinned by objectives grouped into three pillars—innovation, inclusive growth and sustainability—and focuses on six priority sectors:  1. Agricultural technology (agritech); 2. Life and health sciences; 3. Advanced manufacturing and engineering; 4. Financial services and financial technology (fintech); 5. Software (including cybersecurity); and 6. Screen and low carbon.   The data The Northern Ireland Economic Trade Statistics (NIETS) is a new dataset that provides details on trade between NI and Britain for the first time. We have analysed this dataset, which covers the period 2014–2020 and comprises a sample of enterprises that are VAT or PAYE registered and trade in NI.  Approximately 5,000 to 7,000 enterprises respond to the survey annually. As part of our research, we examined the 10x priority sectors over the period 2014–2020.  Data on financial services and fintech are not included in the dataset and due to GDPR issues, we had to merge some of the 10x priority areas, ending up with four 10x sectors:  • Agritech;  • Health and life sciences; • Advanced manufacturing (including low carbon); and  • Software and screen.  Approximately 11.4 percent of the total sample is classified as being 10x. Here is a summary of our findings. Growth in sales and gross value added (GVA) As shown in Table 1, the 10x sectors of the NI economy were relatively resilient from 2014–2020 as total Gross Value Added (GVA) increased over the period, though agritech was negatively impacted by COVID-19.  Performance of the non-10x sectors improved over the period 2014–2019, as evidenced by increased total GVA (except traditional manufacturing, which declined by 20.35%). Most non-10x sectors were adversely impacted by COVID-19, however, except manufacturing and ‘other’ production.  Productivity Productivity is measured by the ratio sales per employment and GVA per employment. As illustrated in Figure 1, for 2014–2020, the wholesale and retail sector had the highest sales per employment, followed by agritech and other production. Other production has the highest GVA per employment, followed by construction, health and life sciences and software and screen. Agritech has the second lowest GVA per employment. External sales behaviour A country’s wealth is influenced by its ability to attract funds from external markets. To determine how NI is doing, we investigated the trade behaviour of NI enterprises using four ratios, which reflect the percentage of overall sales each business undertakes with Britain, ROI, the rest of the European Union (REU) and the rest of the World (ROW). The average percentage for each year (2014–2020) for the whole sample is provided in Table 2.  The most important external market is Britain, accounting for on average 11.75 percent of sales, followed by ROI (6.18%), ROW (2.69%) and REU (1.74%). Generally, the percentage of total sales to these external markets increased steadily over the period 2014–2019 and declined in 2020, coinciding with COVID-19. Patterns in the percentage of total sales to the four markets are further analysed by sector over the period 2014–2020 in Figures 2 to 5. Sectoral differences are evident. Generally, non-10x enterprises (the six to the left-hand side of each figure) are less engaged with external markets relative to 10x enterprises (the four to the right-hand side of each figure).   Differences in the relative importance of markets is also observed across sectors. For example, the ROI market is most important to the agritech sector (Figure 3), and the ROW market is most important to the health and life sciences sector (Figure 5), probably indicative of sales to the US. This sector is also very active in markets in the REU (Figure 4).  Note: When interpreting these results, be aware that the data is based on the largest enterprises in NI and the authors had to design their own 10x categories based on Standard Industrial Classification codes.   Will it work? The number of enterprises in NI that can be classed as ‘10x’ increased over the period from 619 in 2014 to 723 in 2020. They are contributing GVA to the economy and, importantly, most of their turnover is to external markets, which is beneficial for a small regional economy where local demand is limited.  These enterprises seem to be resilient, with little change in behaviour observed in the period after Brexit, and, with the exception of agritech, they continued to grow despite COVID-19 (though the data was only available for 2020).  In theory, the DfE’s ambitions are laudable. Cluster approaches have proven successful in other countries, including ROI, where foreign-owned high-tech enterprises pay higher wages, invest in R&D for future growth and have high exports.  Moreover, the vision of sustainable growth and prosperity for all (levelling up) aligns with more holistic concepts of economic growth that account for social and environmental concerns alongside economic prosperity.  There are concerns, however. This is an ambitious undertaking that will take time to implement. The 2030 target set by the DfE is tight, the support structures to fuel 10x growth are not yet fully established, ‘10x’ is not yet fully defined, ‘place’ is not yet fully defined and hence the data are not (yet) available to enable 10x to be identified and analysed by place.  This will hinder the ability to foster clusters and build networks, which are important for innovation. Also, change will be difficult due to existing established structures.  For example, most policy and government action is managed through Local Government Department (LGD) level structures. However, clusters of enterprises may cross LGD boundaries, complicating a joined-up approach.  In addition, economic and social development is not only managed by the DfE; many other bodies such as central government and local government departments, business networks and educational establishments, are involved. Role for accountants Accountants can play an important role in the success of the DfE’s policy and the future of the NI economy. Accountancy firms are present in most towns across the region. Accountants are part of local business networks and have first-hand knowledge of entrepreneurship and innovation within communities.  Moreover, accountants are well-equipped to facilitate the creation of priority clusters and expanding networks that enable local businesses to connect and grow both within and beyond their communities. This will be good for communities and for the accountancy profession.   *Note: The tables and diagrams in this article are from the authors’ full report, available on the Northern Ireland Statistics and Research Agency website. Professor Anne Marie Ward, FCA, is Professor of Accounting at Ulster University; Dr Esmond Birnie is Senior Economist at Ulster University; and Dr Stuart Henderson is a Lecturer in Financial Services at Ulster University.

The explosive growth of AI has transformative potential but also raises critical privacy concerns that must be addressed, writes Pat Moran The world of artificial intelligence (AI) took a massive leap forward with the emergence of ChatGPT in November 2022. Since then, there has been a surge in the design and implementation of AI use cases across industries such as healthcare, retail, financial services, manufacturing and others. While the emergence of AI is transformative, this powerful tool is not without its challenges, particularly the profound privacy concerns it raises. As organisations eagerly harness the potential of AI, it is vital to know the associated privacy risks, such as: Data collection and breaches – As AI models evolve, their training datasets will likely grow, increasing the risk of personal and special category data being included. These datasets must be stored and processed securely while training AI systems. Algorithmic bias and discrimination – Biased algorithms may inadvertently perpetuate biases and lead to decisions that could negatively impact certain groups of people without the organisation’s intention to discriminate. Data subject requests – Once the AI systems are trained and deployed, responding to certain data subject requests becomes increasingly difficult. Transparency – As AI systems become commonplace in organisations, users will increasingly unknowingly interact with these systems, including instances where users are affected by automated decision-making. Regulatory requirements and industry standards – Even though AI is considered a novel technology, there are existing and upcoming regulations and standards that define and guide its usage. Organisations must demonstrate compliance with these regulations and standards to maintain customer trust and meet procurement standards in the market. Misuse of personal data in AI-enabled cyberattacks – Malicious actors have begun leveraging personal data such as audio clips and deep-fake content for advanced phishing attempts and other scams. Inaccurate responses – It is common for generative AI programs to respond based on probabilities identified within the data sets used to train the AI instead of actual, accurate data points. This can result in inaccurate responses and may cause issues if users do not verify the authenticity of the system’s responses. Organisational changes for AI To successfully traverse the concerns listed above while developing and integrating AI systems, organisations should consider the following best practices: AI governance: The teams involved in developing AI governance should be interdisciplinary, including teams in AI development, legal, privacy, information security, customer success and others. Privacy by design: The foundation of responsible AI lies in the concept of ‘privacy by design’, which states that data protection and privacy considerations must be implemented throughout the development lifecycle for any AI system. This includes incorporating privacy-enhancing technologies, ensuring appropriate security, compliance with regulatory requirements and other privacy-specific principles. Some AI systems have a ‘black box’-like nature, which makes it harder to detect and fix ethical, privacy and regulatory issues once deployed, increasing the need for privacy by design. Further, there might be other processes that pose too high a risk to move towards automation through AI and will require controls such as “a human in the loop”. Transparency: Users must be provided with clear and transparent communication in the form of privacy notices and other means including: confirmation that AI systems are used to process their data (including details of automated decision-making, if present); how their data is collected and processed; how long it will be stored; an outline of their rights, etc. The information helps users provide informed consent and builds trust in AI systems as well as the organisation. Fairness: An important step is to perform regular audits of AI systems to test their performance and ensure no bias or discrimination against users. The review should include the automated decision-making algorithm, and the process by which the algorithm makes decisions should be transparent and explainable. Data management: Ensure data ingested by the AI system during training is lawfully obtained, high-quality, and rigorous vetting and anonymisation have been performed. Technologies such as pseudonymisation or data aggregation should be implemented to ensure compliance with data minimisation and retention privacy principles. Up-to-date records of processing activities should also be maintained to ensure data is managed effectively throughout its lifecycle. Remember, organisations cannot use publicly available data to train AI systems without a valid lawful basis. Risk management, compliance and information security: A risk-based approach, including a data protection impact assessment, should be implemented to assess the level of risk involved before AI systems are deployed. The organisation should also sign off on the risk levels, controls and mitigations. AI compliance monitoring should be incorporated into the organisational, regulatory compliance programme or privacy programme. The wider organisational information security programme should include AI systems and their underlying data to prevent data breaches and malicious attacks. Technical and organisational measures such as encryption, data masking, password management, access controls and network security should be implemented. Employee training: As AI is a new technology, employees must be trained periodically on responsible AI usage. Training should include the privacy impact of AI systems, compliance with data protection regulations while using AI, misuse of personal data in AI-enabled cyberattacks and how to guard against it, and data protection best practices. Conclusion The advent of AI may be compared to the invention of the combustion engine. While organisations can move faster, they will also require stronger brakes. These brakes may address these multifaceted concerns, which necessitates a holistic approach, combining technological innovation, ethical practices, user empowerment and regulatory adherence. Organisations’ responsibility will be to innovate and ensure that innovation aligns with the values of privacy, ethics and user trust. Pat Moran is the Leader of Cybersecurity Practice at PwC.