OECD updates its AI Principles to cover generative AI

The OECD AI Principles are the first intergovernmental standard on AI, and on 3 May 2024 the OECD Ministerial Council Meeting adopted revisions to the Principles originally adopted in 2019. The update responds to recent developments in AI technologies, notably the emergence of general-purpose and generative AI.

What it is

The OECD AI Principles are the first intergovernmental standard on AI, composed of five values-based principles and five recommendations for policymakers. They were initially adopted in 2019 and promote AI that is innovative and trustworthy and that respects human rights and democratic values. As of the 2024 update, there are 47 adherents to the Principles, including the EU.

What it requires

The revisions address safety concerns so that if AI systems risk causing undue harm or exhibit undesired behaviour, mechanisms exist to override, repair or decommission them safely. They also reflect the growing importance of addressing mis- and disinformation and safeguarding information integrity in the context of generative AI. The update emphasises responsible business conduct throughout the AI system lifecycle, involving cooperation with suppliers of AI knowledge and resources, AI system users, and other stakeholders. It clarifies what information about AI systems constitutes transparency and responsible disclosure. The Recommendation also contains definitions of an AI system and its lifecycle that are used in legislative and regulatory frameworks in the European Union, Japan and the United States.

What security leaders should do

Security leaders operating across multiple jurisdictions can use the OECD definitions of an AI system and its lifecycle as a common reference point when mapping obligations under the EU AI Act and other national frameworks, since those regimes draw on the same OECD definitions. Because the updated Principles put explicit weight on robustness, security and safety, including mechanisms to override, repair or decommission AI systems that behave unexpectedly, teams should confirm that incident response and model rollback procedures exist for production AI systems. Given the Principles' new emphasis on accountability and traceability across datasets, processes and decisions, security leaders should ensure logging and provenance records are retained to support analysis of an AI system's outputs.