STRUCTURES AND PROCEDURES

Clear work processes for the use of digital technologies

It is important to establish clear work processes for the use of digital technologies, ensuring that employees are aware of the rules relating to using digital technologies with integrity. They should also be aware of relevant legislation and regulations. A risk assessment focused on integrity risks in the digital domain can help employers identify digital vulnerabilities within their organisation. Digital technologies have become indispensable in some work processes. Can an organisation still function without digital technologies if these prove to carry unacceptably high risks? For this final question, see also Chapter 3.1 Leadership and strategy.

Legislation and regulations relating to digital technologies are changing rapidly. It is therefore important to check whether the organisation’s structures and procedures are still in compliance with the most recent legislation and regulations in the field of digitalisation. Examples include European guidelines on data security to prevent data breaches. The organisation must comply with privacy legislation, such as the GDPR, when using digital technologies for data collection and processing. Sometimes, the legislator offers organisations a flexible legal framework, known as a ‘regulatory sandbox’, so that they can experiment with using new technologies without having to meet all the strict requirements of existing laws and regulations.

TIPS

  • Digital technologies can entail integrity risks relating to specific roles within the organisation. Update the overview of sensitive roles in relation to the use of, and access to, specific digital systems within the organisation.
  • Assess the risk level associated with AI use in the organisation according to the AI Act. Check whether the organisation’s work processes comply with the requirements of this European Regulation and adjust the organisation’s procedures accordingly.
  • Be aware that breaches of European legislation such as the AI Act may result in heavy fines.

POINTS TO CONSIDER

  1. How can employees handle data in the organisation with integrity? How are these practices embedded in work processes?
  2. Does the organisation’s current structure encourage employees to use digital technologies with integrity? For example, do employees only have access to documents they are authorised to view?
  3. How do the organisation’s current procedures take account of rapid changes in the digital domain? What control mechanisms are in place to prevent individuals within or outside the organisation from being disproportionately affected by the use of digital technologies?
  4. What is the legal basis for the use of digital technologies, particularly AI systems and the decisions these systems make within the organisation?
  5. What would be the impact of the possible failure or malfunction of digital systems? What integrity risks arise if digital technologies within the organisation stop functioning? To what extent is it possible to stop using certain digital technologies if the system produces undesirable effects or incorrect results?