Master Organizational Change Management Practices

PMOs, if you don't know who is responsible for org change, it's you.

Analyst Perspective

Don’t leave change up to chance.

"Organizational change management has been a huge weakness for IT departments and business units, putting projects and programs at risk – especially large, complex, transformational projects.

During workshops with clients, I find that the root of this problem is twofold: project planning tends to fixate on technology and neglects the behavioral and cultural factors that inhibit user adoption; further, accountabilities for managing change and helping to realize the intended business outcomes post-project are not properly defined.

It makes sense for the PMO to be the org-change leader. In project ecosystems where no one seems willing to seize this opportunity, the PMO can take action and realize the benefits and accolades that will come from coordinating and consistently driving successful project outcomes."

Matt Burton,

Senior Manager, Project Portfolio Management

Info-Tech Research Group

Our understanding of the problem

This Research is Designed For:

• PMO Directors who need to improve user adoption rates and maximize benefits on project and program activity.
• CIOs who are accountable for IT’s project spend and need to ensure an appropriate ROI on project investments.

This Research Will Help You:

• Define change management roles and accountabilities among project stakeholders.
• Prepare end users for change impacts in order to improve adoption rates.
• Ensure that the intended business outcomes of projects are more effectively realized.
• Develop an organizational change management toolkit and best practices playbook.

This Research Will Also Assist:

• Project managers and change managers who need to plan and execute changes affecting people and processes.
• Project sponsors who want to improve benefits attainment.
• Business analysts who need to analyze the impact of change.

This Research Will Help Them:

• Develop communications and training plans tailored to specific audiences.
  • Identify strategies to manage cultural and behavioral change.
• Maximize project benefits by ensuring changes are adopted.
• Capitalize upon opportunities and mitigate risks.

Drive organizational change from the PMO

Situation

• As project management office (PMO) leader, you oversee a portfolio of projects that depend heavily on users and stakeholders adopting new tools, complying with new policies, following new processes, and learning new skills.
• You need to facilitate the organizational change resulting from these projects, ensuring that the intended business outcomes are realized.

Complication

• While IT takes accountability to deliver the change, accountability for the business outcomes is opaque with little or no allocated resourcing.
• Project management practices focus more on the timely implementation of projects than on the achievement of the desired outcomes thereafter or on the behavioral and cultural factors that inhibit change from taking hold in the long term.

Resolution

• Plan for human nature. To ensure project success and maximize benefits, plan and facilitate the non-technical aspects of organizational change by addressing the emotional, behavioral, and cultural factors that foster stakeholder resistance and inhibit user adoption.
• Make change management as ubiquitous as change itself. Foster a project culture that is proactive about OCM. Create a process where OCM considerations are factored in as early as project ideation and change is actively managed throughout the project lifecycle, including after the project has closed.
• Equip project leaders with the right tools to foster adoption. Effective OCM requires an actionable toolkit that will help plant the seeds for organizational change. With the right tools and templates, the PMO can function as a hub for change, helping business units and project teams to consistently achieve project and post-project success.

Info-Tech Insight

Make your PMO the change leader it’s already expected to be. Unless accountabilities for organizational change management (OCM) have been otherwise explicitly defined, you should accept that, to the rest of the organization – including its chief officers – the PMO is already assumed to be the change leader.

Don’t shy away from or neglect this role. It’s not just the business outcomes of the organization’s projects that will benefit; the long-term sustainability of the PMO itself will be significantly strengthened by making OCM a core competency.

Completed projects aren’t necessarily successful projects

The constraints that drive project management (time, scope, and budget) are insufficient for driving the overall success of project efforts.

For instance, a project may come in on time, on budget, and in scope, but…

• …if users and stakeholders fail to adopt…
• …and the intended benefits are not achieved…

…then that “successful project” represents a massive waste of the organization’s time and resources.

A supplement to project management is needed to ensure that the intended value is realized.

Mission (Not) Accomplished

50% Fifty percent of respondents in a KPMG survey indicated that projects fail to achieve what they originally intended. (Source: NZ Project management survey)

56% Only fifty-six percent of strategic projects meet their original business goals. (Source: PMI)

70% Lack of user adoption is the main cause for seventy percent of failed projects. (Source: Collins, 2013)

Improve project outcomes with organizational change management

Make “completed” synonymous with “successfully completed” by implementing an organizational change management strategy through the PMO.

Organizational change management is the practice through which the PMO can improve user adoption rates and maximize project benefits.

Why OCM effectiveness correlates to project success:

• IT projects are justified because they will make money, save money, or make people happier.
• Project benefits can only be realized when changes are successfully adopted or accommodated by the organization.

Without OCM, IT might finish the project but fail to realize the intended outcomes.

In the long term, a lack of OCM could erode IT’s ability to work with the business.

What is organizational change management?

OCM is a framework for managing the introduction of new business processes and technologies to ensure stakeholder adoption.

OCM involves tools, templates, and processes that are intended to help project leaders analyze the impacts of a change during the planning phase, engage stakeholders throughout the project lifecycle, as well as train and transition users towards the new technologies and processes being implemented.

OCM is a separate body of knowledge, but as a practice it is inseparable from both project management or business analysis.

WHEN IS OCM NEEDED?

Anytime you are starting a project or program that will depend on users and stakeholders to give up their old way of doing things, change will force people to become novices again, leading to lost productivity and added stress.

CM can help improve project outcomes on any project where you need people to adopt new tools and procedures, comply with new policies, learn new skills and behaviors, or understand and support new processes.

"What is the goal of change management? Getting people to adopt a new way of doing business." – BA, Natural Resources Company

The benefits of OCM range from more effective project execution to improved benefits attainment

82% of CEOs identify organizational change management as a priority. (D&B Consulting) But Only 18% of organizations characterize themselves as “Highly Effective” at OCM. (PMI)

On average, 95% percent of projects with excellent OCM meet or exceed their objectives. (Prosci) VS For projects with poor OCM, the number of projects that meet objectives drops to 15%. (Prosci)

82% of projects with excellent OCM practices are completed on budget. (Prosci) VS For projects with poor OCM, the number of projects that stay on budget drops to 51%. (Prosci)

71% of projects with excellent OCM practices stay on schedule. (Prosci) VS For projects with poor OCM practices, only 16% stay on schedule. (Prosci)

While critical to project success, OCM remains one of IT’s biggest weaknesses and process improvement gaps

IT Processes Ranked by Effectiveness:

27. Risk Management
28. Knowledge Management
29. Release Management
30. Innovation
31. IT Governance
32. Enterprise Architecture
33. Quality Management
34. Data Architecture
35. Application Development Quality
36. Data Quality
37. Portfolio Management
38. Configuration Management
39. Application Portfolio Management
40. Business Process Controls Internal Audit
41. Organizational Change Management
42. Application Development Throughput
43. Business Intelligence Reporting
44. Performance Measurement
45. Manage Service Catalog

IT Processes Ranked by Importance:

27. Enterprise Application Selection & Implementation
28. Organizational Change Management
29. Data Architecture
30. Quality Management
31. Enterprise Architecture
32. Business Intelligence Reporting
33. Release Management
34. Portfolio Management
35. Application Maintenance
36. Asset Management
37. Vendor Management
38. Application Portfolio Management
39. Innovation
40. Business Process Controls Internal Audit
41. Configuration Management
42. Performance Measurement
43. Application Development Quality
44. Application Development Throughput
45. Manage Service Catalog

Based on 3,884 responses to Info-Tech’s Management and Governance Diagnostic, June 2016

There’s no getting around it: change is hard

While the importance of change management is widely recognized across organizations, the statistics around change remain dismal.

Indeed, it’s an understatement to say that change is difficult.

People are generally – in the near-term at least – resistant to change, especially large, transformational changes that will impact the day-to-day way of doing things, or that involve changing personal values, social norms, and other deep-seated assumptions.

"There is nothing more difficult to take in hand, more perilous to conduct, or more uncertain in its success, than to take the lead in the introduction of a new order of things." – Niccolo Machiavelli

70% - Change failure rates are extremely high. It is estimated that up to seventy percent of all change initiatives fail – a figure that has held steady since the 1990s. (McKinsey & Company)

25% - In a recent survey of 276 large and midsize organizations, only twenty-five percent of respondents felt that the gains from projects were sustained over time. (Towers Watson)

22% - While eighty-seven percent of survey respondents trained their managers to “manage change,” only 22% felt the training was truly effective. (Towers Watson)

While change is inherently difficult, the biggest obstacle to OCM success is a lack of accountability

Who is accountable for change success? …anyone?...

To its peril, OCM commonly falls into a grey area, somewhere in between project management and portfolio management, and somewhere in between being a concern of IT and a concern of the business.

While OCM is a separate discipline from project management, it is commonly thought that OCM is something that project managers and project teams do. While in some cases this might be true, it is far from a universal truth.

The end result: without a centralized approach, accountabilities for key OCM tasks are opaque at best – and the ball for these tasks is, more often than not, dropped altogether.

29% - Twenty-nine percent of change initiatives are launched without any formal OCM plan whatsoever.

"That’s 29 percent of leaders with blind faith in the power of prayer to Saint Jude, the patron saint of desperate cases and lost causes." – Torben Rick

Bring accountability to org-change by facilitating the winds of change through the PMO

Lasting organizational change requires a leader. Make it the PMO.

#1 Organizational resistance to change is cited as the #1 challenge to project success that PMOs face. (Source: PM Solutions)

90% Companies with mature PMOs that effectively manage change meet expectations 90% of the time. (Source: Jacobs-Long)

Why the PMO?

A centralized approach to OCM is most effective, and the PMO is already a centralized project office and is already accountable for project outcomes.

What’s more, in organizations where accountabilities for OCM are not explicitly defined, the PMO will likely already be assumed to be the default change leader by the wider organization.

It makes sense for the PMO to accept this accountability – in the short term at least – and claim the benefits that will come from coordinating and consistently driving successful project outcomes.

In the long term, OCM leadership will help the PMO to become a strategic partner with the executive layer and the business side.

Short-term gains made by the PMO can be used to spark dialogues with those who authorize project spending and have the implicit fiduciary obligation to drive project benefits.

Ultimately, it’s their job to explicitly transfer that obligation, along with the commensurate resourcing and authority for OCM activities.

More than a value-added service, OCM competencies will soon determine the success of the PMO itself

Given the increasingly dynamic nature of market conditions, the need for PMOs to provide change leadership on projects large and small is becoming a necessity.

"With organizations demanding increasing value, PMOs will need to focus more and more on strategy, innovation, agility, and stakeholder engagement. And, in particular, developing expertise in organizational change management will be essential to their success." – PM Solutions, 2014

28% PMOs that are highly agile and able to respond quickly to changing conditions are 28% more likely to successfully complete strategic initiatives (69% vs. 41%). (PMI)

In other words, without heightened competencies around org-change, the PMO of tomorrow will surely sink like a stone in the face of increasingly unstable external factors and accelerated project demands.

Use Info-Tech’s road-tested OCM toolkit to transform your PMO into a hub of change management leadership

With the advice and tools in Info-Tech’s Drive Organizational Change from the PMO blueprint, the PMO can provide the right OCM expertise at each phase of a project.

Info-Tech’s approach to OCM is a practical/tactical adaptation of several successful models

Business strategy-oriented OCM models such as John Kotter’s 8-Step model assume the change agent is in a position of senior leadership, able to shape corporate vision, culture, and values.

• PMO leaders can work with business leaders, but ultimately can’t decide where to take the organization.
• Work with business leaders to ensure IT-enabled change helps reinforce the organization’s target vision and culture.

General-purpose OCM frameworks such as ACMP’s Standard for Change Management, CMI’s CMBoK, and Prosci’s ADKAR model are very comprehensive and need to be configured to PMO-specific initiatives.

• Tailoring a comprehensive, general-purpose framework to PMO-enabled change requires familiarity and experience.

References and Further Reading

• COBIT
• ADKAR (Prosci)
• Standard for Change Management (ACMP)
• CMBoK (CMI)
• Kotter’s 8 Principles
• Managing Transitions
• Kubler-Ross Curve
• The Classic Change Curve
• Switch and The Rider Elephant War

Info-Tech’s organizational change management model adapts the best practices from a wide range of proven models and distills it into a step-by-step process that can be applied to any IT-enabled project.

Info-Tech’s OCM research is COBIT aligned and a cornerstone in our IT Management & Governance Framework

COBIT 5 is the leading framework for the governance and management of enterprise IT.

Screenshot of Info-Tech’s IT Management & Governance Framework.

Consider Info-Tech’s additional key observations

Human behavior is largely a blind spot during the planning phase.

In IT especially, project planning tends to fixate on technology and underestimate the behavioral and cultural factors that inhibit user adoption. Whether change is project-specific or continuous, it’s more important to instill the desire to change than to apply specific tools and techniques. Accountability for instilling this desire should start with the project sponsor, with direct support from the PMO.

Don’t mistake change management for a “soft” skill.

Persuading people to change requires a “soft,” empathetic approach to keep them motivated and engaged. But don’t mistake “soft” for easy. Managing the people part of change is amongst the toughest work there is, and it requires a comfort and competency with uncertainty, ambiguity, and conflict. If a change initiative is going to be successful (especially a large, transformational change), this tough work needs to be done – and the more impactful the change, the earlier it is done, the better.

In “continuous change” environments, change still needs to be managed.

Transformation and change are increasingly becoming the new normal. While this normality may help make people more open to change in general, specific changes still need to be planned, communicated, and managed. Agility and continuous improvement are good, but can degenerate into volatility if change isn’t managed properly. People will perceive change to be volatile and undesirable if their expectations aren’t managed through communications and engagement planning.

Info-Tech’s centralized approach to OCM is cost effective, with a palpable impact on project ROI

Info-Tech’s Drive Organizational Change from the PMO blueprint can be implemented quickly and can usually be done with the PMO’s own authority, without the need for additional or dedicated change resources.

Implementation Timeline

• Info-Tech’s easy-to-navigate OCM tools can be employed right away, when your project is already in progress.
• A full-scale implementation of a PMO-driven OCM program can be accomplished in 3–4 weeks.

Implementation Personnel

• Primary: the PMO director (should budget 10%–15% of her/his project capacity for OCM activities).
• Secondary: other PMO staff (e.g. project managers, business analysts, etc.).

OCM Implementation Costs

15% - The average costs for effective OCM are 10%–15% of the overall project budget. (AMR Research)

Average OCM Return-on-Investment

200% - Small projects with excellent OCM practices report a 200% return-on-investment. (Change First)

650% - Large projects with excellent OCM practices report a 650% return-on-investment. (Change First)

Company saves 2–4 weeks of time and $10,000 in ERP implementation through responsible OCM

CASE STUDY

Industry Manufacturing

Source Info-Tech Client

Situation

A medium-sized manufacturing company with offices all over the world was going through a consolidation of processes and data by implementing a corporate-wide ERP system to replace the fragmented systems that were previously in place. The goal was to have consistency in process, expectations, and quality, as well as improve efficiency in interdepartmental processes.

Up to this point, every subsidiary was using their own system to track data and sharing information was complicated and slow. It was causing key business opportunities to be compromised or even lost.

Complication

The organization was not very good in closing out projects. Initiatives went on for too long, and the original business benefits were usually not realized.

The primary culprit was recognized as mismanaged organizational change. People weren’t aware early enough, and were often left out of the feedback process.

Employees often felt like changes were being dictated to them, and they didn’t understand the wider benefits of the changes. This led to an unnecessary number of resistors, adding to the complexity of successfully completing a project.

Resolution

Implementing an ERP worldwide was something that the company couldn’t gamble on, so proper organizational change management was a focus.

A thorough stakeholder analysis was done, and champions were identified for each stakeholder group throughout the organization.

Involving these champions early gave them the time to work within their groups and to manage expectations. The result was savings of 2–4 weeks of implementation time and $10,000.

Follow Info-Tech’s blueprint to transform your PMO into a hub for organizational change management

Prepare the PMO for Change Leadership

• Assess the organization’s readiness for change.
  • Perform an OCM capabilities assessment.
  • Chart an OCM roadmap for the PMO.
  • Undergo a change management SWOT analysis.
  • Define success criteria.
  • Org. Change Capabilities Assessment
• Define the structure and scope of the PMO’s pilot OCM initiative.
  • Determine pilot OCM project.
  • Estimate OCM effort.
  • Document high-level project details.
  • Establish a timeline for org-change activities.
  • Assess available resources to support the PMO’s OCM initiative.
  • Project Level Assessment

Plant the Seeds for Change During Project Planning and Initiation

• Foster OCM considerations during the ideation phase.
  • Assess leadership support for change
  • Highlight the goals and benefits of the change
  • Refine your change story
  • Define success criteria
  • Develop a sponsorship action plan
  • Transition Team Communications Template
• Perform an organizational change impact assessment.
  • Perform change impact survey.
  • Assess the depth of impact for the stakeholder group.
  • Determine overall adoptability of the OCM effort.
  • Review risks and opportunities.
  • Org. Change Management Impact Analysis Tool

Facilitate Change Adoption Throughout the Organization

• Ensure stakeholders are engaged and ready for change.
  • Involve the right people in change and define roles.
  • Define methods for obtaining stakeholder input.
  • Perform a stakeholder analysis.
  • Stakeholder Engagement Workbook
• Develop and execute the transition plan.
  • Establish a communications strategy for stakeholder groups.
  • Define the feedback and evaluation process.
  • Assess the full range of support and resistance to change.
  • Develop an objections handling process.
  • Transition Plan Template
• Establish HR and training plans.
  • Assess training needs. Develop training plan.
  • Training Plan

Establish a Post-Project Benefits Attainment Process

• Determine accountabilities for benefits attainment.
  • Conduct a post-implementation review of the pilot OCM project.
  • Assign ownership for realizing benefits after the project is closed.
  • Define a post-project benefits tracking process.
  • Implement a tool to help monitor and track benefits over the long term.
  • Project Benefits Tracking Tool

Solidify the PMO’s Role as Change Leader

• Institute an OCM playbook.
  • Review lessons learned to improve OCM as a core discipline of the PMO.
  • Monitor organizational capacity for change.
  • Define roles and responsibilities for OCM oversight.
  • Formalize the Organizational Change Management Playbook.
  • Assess the value and success of your practices relative to OCM effort and project outcomes.
  • Organizational Change Management Playbook

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Drive Organizational Change from the PMO

Workshop overview

Contact your account representative or email Workshops@InfoTech.com for more information.

Phase 1

Prepare the PMO for Change Leadership

Phase 1 outline

Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

Guided Implementation 1: Prepare the PMO for Change Leadership

Proposed Time to Completion (in weeks): 1 week

Step 1.1: Assess the organization’s readiness for change

Start with an analyst kick off call:

• Scoping call to discuss organizational change challenges and the PMO’s role in managing change.

Then complete these activities…

• Perform an assessment survey to define capability levels and chart an OCM roadmap.

With these tools & templates:

• Organizational Change Management Capabilities Assessment

Step 1.2: Define the structure and scope of the PMO’s pilot OCM initiative

Work with an analyst to:

• Determine the appropriate OCM initiative to pilot over this series of Guided Implementations from the PMO’s project list.

Then complete these activities…

• Rightsize your OCM planning efforts based on project size, timeline, and resource availability.

With these tools & templates:

• Project Level Assessment Tool

Step 1.1: Assess the organization’s readiness for change

Phase 1 - 1.1

This step will walk you through the following activities:

• Perform an OCM capabilities assessment.
• Chart an OCM roadmap for the PMO.
• Undergo a change management SWOT analysis.
• Define success criteria.

This step involves the following participants:

• Required: PMO Director
• Recommended: PMO staff, project management staff, and other project stakeholders

Outcomes of this step

• An OCM roadmap for the PMO with specific recommendations.
• An assessment of strengths, weakness, challenges, and threats in terms of the PMO’s role as organizational change leader.
• Success metrics for the PMO’s OCM implementation.

Project leaders who successfully facilitate change are strategic assets in a world of increasing agility and uncertainty

As transformation and change become the new normal, it’s up to PMOs to provide stability and direction during times of transition and turbulence.

Continuous change and transition are increasingly common in organizations in 2016.

A state of constant change can make managing change more difficult in some ways, but easier in others.

• Inundation with communications and diversity of channels means the traditional “broadcast” approach to communicating change doesn’t work (i.e. you can’t expect every email to get everyone’s attention).
• People might be more open to change in general, but specific changes still need to be properly planned, communicated, and managed.

By managing organizational change more effectively, the PMO can build credibility to manage both business and IT projects.

"The greatest danger in times of turbulence is not the turbulence; it is to act with yesterday’s logic." – Peter Drucker

In this phase, we will gauge your PMO’s abilities to effectively facilitate change based upon your change management capability levels and your wider organization’s responsiveness to change.

Evaluate your current capabilities for managing organizational change

Start off by ensuring that the PMO is sensitive to the particularities of the organization and that it manages change accordingly.

There are many moving parts involved in successfully realizing an organizational change.

For instance, even with an effective change toolkit and strong leadership support, you may still fail to achieve project benefits due to such factors as a staff environment resistant to change or poor process discipline.

Use Info-Tech’s Organizational Change Management Capabilities Assessment to assess your readiness for change across 7 categories:

• Cultural Readiness
• Leadership & Sponsorship
• Organizational Knowledge
• Change Management Skills
• Toolkit & Templates
• Process Discipline
• KPIs & Metrics

Download Info-Tech’s Organizational Change Management Capabilities Assessment.

• The survey can be completed quickly in 5 to 10 minutes; or, if being done as a group activity, it can take up to 60 minutes or more.
• Based upon your answers, you will get a report of your current change capabilities to help you prioritize your next steps.
• The tool also provides a customized list of Info-Tech recommendations across the seven categories.

Perform Info-Tech’s OCM capabilities questionnaire

1.1.1 Anywhere from 10 to 60 minutes (depending on number of participants)

• The questionnaire on Tab 2 of the Assessment consists of 21 questions across 7 categories.
• The survey can be completed individually, by the PMO director or manager, or – even more ideally – by a group of project and business stakeholders.
• While the questionnaire only takes a few minutes to complete, you may wish to survey a wider swath of business units, especially on such categories as “Cultural Readiness” and “Leadership Support.”

Use the drop downs to indicate the degree to which you agree or disagree with each of the statements in the survey.

Info-Tech Insight

Every organization has some change management capability.

Even if you find yourself in a fledgling or nascent PMO, with no formal change management tools or processes, you can still leverage other categories of change management effectiveness.

If you can, build upon people-related assets like “Organizational Knowledge” and “Cultural Readiness” as you start to hone your OCM toolkit and process.

Review your capability levels and chart an OCM roadmap for your PMO

Tab 3 of the Assessment tool shows your capabilities graph.

• The chart visualizes your capability levels across the seven categories of organization change covered in the questionnaire in order to show the areas that your organization is already strong in and the areas where you need to focus your efforts.

Focus on improving the first capability dimension (from left/front to right/back) that rates below 10.

Tab 4 of the Assessment tool reveals Info-Tech’s recommendations based upon your survey responses.

• Use these recommendations to structure your roadmap and bring concrete definitions to your next steps.

Use the red/yellow/green boxes to focus your efforts.

The content in the recommendations boxes is based around these categories and the advice therein is designed to help you to, in the near term, bring your capabilities up to the next level.

Use the steps in this blueprint to help build your capabilities

Each of Info-Tech’s seven OCM capabilities match up with different steps and phases in this blueprint.

We recommend that you consume this blueprint in a linear fashion, as each phase matches up to a different set of OCM activities to be executed at each phase of a project. However, you can use the legend below to locate how and where this blueprint will address each capability.

Info-Tech Insight

Organizational change must be planned in advance and managed through all phases of a project.

Organizational change management must be embedded as a key aspect throughout the project, not merely a set of tactics added to execution phases.

Perform a change management SWOT exercise

1.1.2 30 to 60 minutes

Now that you have a sense of your change management strengths and weaknesses, you can begin to formalize the organizational specifics of these.

Gather PMO and IT staff, as well as other key project and business stakeholders, and perform a SWOT analysis based on your Capabilities Assessment.

Follow these steps to complete the SWOT analysis:

1. Have participants discuss and identify Strengths, Weaknesses, Opportunities, and Threats.
2. Spend roughly 60 minutes on this. Use a whiteboard, flip chart, or PowerPoint slide to document results of the discussion as points are made.
3. Make sure results are recorded and saved either using the template provided on the next slide or by taking a picture of the whiteboard or flip chart.

Use the SWOT Analysis Template on the next slide to document results.

Use the examples provided in the SWOT analysis to kick-start the discussion.

The purpose of the SWOT is to begin to define the goals of this implementation by assessing your change management capabilities and cultivating executive level, business unit, PMO, and IT alignment around the most critical opportunities and challenges.

Sample SWOT Analysis

Define the “how” and the “what” of change management success for your PMO

1.1.3 30 to 60 minutes

Before you move on to develop and implement your OCM processes, spend some time documenting how change management success will be defined for your organization and what conditions will be necessary for success to be achieved.

With the same group of individuals who participated in the SWOT exercise, discuss the below criteria. You can make this a sticky note or a whiteboard activity to help document discussion points.

OCM Measured Value Metrics Include:

• Estimate % of expected business benefits realized on the past 3–5 significant projects/programs.
  • Track business benefits (costs reduced, productivity increased, etc.).
• Estimate costs avoided/reduced (extensions, cancellations, delays, roll-backs, etc.).
  • Establish baseline by estimating average costs of projects extended to deal with change-related issues.

Document additional items that could impact an OCM implementation for your PMO

1.1.4 15 to 45 minutes

Use the table below to document any additional factors or uncertainties that could impact implementation success.

These could be external factors that may impact the PMO, or they could be logistical considerations pertaining to staffing or infrastructure that may be required to support additional change management processes and procedures.

"[A]ll bets are off when it comes to change. People scatter in all directions. Your past experiences may help in some way, but what you do today and how you do it are the new measures people will use to evaluate you." – Tres Roeder

Step 1.2: Define the structure and scope of the PMO’s pilot OCM initiative

Phase 1 - 1.2

This step will walk you through the following activities:

• Determine pilot OCM project.
• Estimate OCM effort.
• Document high-level project details.
• Establish a timeline for org change activities.
• Assess available resources to support the PMO’s OCM initiative.

This step involves the following participants:

• Required: PMO Director
• Recommended: PMO staff, project management staff, and other project stakeholders

Outcomes of this step

• Project definition for the PMO’s pilot OCM initiative.
• A timeline that aligns the project schedule for key OCM activities.
• Definition of resource availability to support OCM activities through the PMO.

Organizational change discipline should align with project structure

Change management success is contingent on doing the right things at the right time.

In subsequent phases of this blueprint, we will help the PMO develop an OCM strategy that aligns with your organization’s project timelines.

In this step (1.2), we will do some pre-work for you by determining a change initiative to pilot during this process and defining some of the roles and responsibilities for the OCM activities that we’ll develop in this blueprint.

Get ready to develop and pilot your OCM competencies on a specific project

In keeping with the need to align organizational change management activities with the actual timeline of the project, the next three phases of this blueprint will move from discussing OCM in general to applying OCM considerations to a single project.

As you narrow your focus to the organizational change stemming from a specific initiative, review the below considerations to help inform the decisions that you make during the activities in this step.

Choose a pilot project that:

• Has an identifiable sponsor who will be willing and able to participate in the bulk of the activities during the workshop.
• Has an appropriate level of change associated with it in order to adequately develop a range of OCM capabilities.
• Has a reasonably well-defined scope and timeline – you don’t want the pilot initiative being dragged out unexpectedly.
• Has PMO/IT staff who will be assisting with OCM efforts and will be relatively familiar and comfortable with them in terms of technical requirements.

Select a specific project that involves significant organizational change

1.2.1 5 to 15 minutes

The need for OCM rigor will vary depending on project size and complexity.

While we recommend that every project has some aspect of change management to it, you can adjust OCM requirements accordingly, depending on the type of change being introduced.

Phases 2, 3, and 4 of this blueprint will guide you through the process of managing organizational change around a specific project. Select one now that is currently in your request or planning stages to pilot through the activities in this blueprint. We recommend choosing one that involves a large, transformational change.

Estimate the overall difficulty and effort required to manage organizational change

1.2.2 5 minutes

Use Info-Tech’s project levels to define the complexity of the project that you’ve chosen to pilot.

Defining your project level will help determine how much effort and detail is required to complete steps in this blueprint – and, beyond this, these levels can help you determine how much OCM rigor to apply across each of the projects in your portfolio.

For a more comprehensive assessment of project levels and degrees of risk, see Info-Tech’s Create Project Management Success blueprint – and in particular, our Project Level Assessment Tool.

Record the goals and scope of the pilot OCM initiative

1.2.3 15 to 30 minutes

Description

What is the project changing?

How will it work?

What are the implications of doing nothing?

What are the phases in execution?

Expected Benefits

What is the desired outcome?

What can be measured? How?

When should it be measured?

Goals

List the goals.

Align with business and IT goals.

Expected Costs

List the costs:

Software costs

Hardware costs

Implementation costs

Expected Risks

List the risks:

Business risks

Technology risks

Implementation risks

Know the “what” and “when” of org change activities

The key to change management success is ensuring that the right OCM activities are carried out at the right time. The below graphic serves as a quick view of what OCM activities entail and when they should be done.

Rough out a timeline for the org change activities associated with your pilot project’s timeline

1.2.4 20-30 minutes

With reference to the graphic on the previous slide, map out a high-level timeline for your pilot project’s milestones and the corresponding OCM activities.

• This is essentially a first draft of a timeline and will be refined as we develop your OCM discipline in the next phase of this blueprint.
• The purpose of roughing something out at this time is to help determine the scope of the implementation, the effort involved, and to help with resource planning.

Info-Tech Insight

Proactive change management is easier to execute and infinitely more effective than managing change reactively. A reactive approach to OCM is bound to fail. The better equipped the PMO is to plan OCM activities in advance of projects, the more effective those OCM efforts will be.

Navigate the Digital ID Ecosystem to Enhance Customer Experience

Beyond the hype: How it can help you become more customer-focused?

Executive Summary

Info-Tech Insight

Focusing on customer touchpoints and transforming them is key to excellent user experience and increasing their lifetime value (LTV) to them and to your organization. Digital ID is that tool of transformation.

Analyst Perspective

Digital Identity Ecosystem and vital ingredients of adoption

What is digital identity?

Definitions may vary, depending on the focus.

“Digital identity (ID) is a set of attributes that links a physical person with their online interactions. Digital ID refers to one’s online persona - an online footprint. It touches important aspects of one’s everyday life, from financial services to health care and beyond.” - DIACC Canada

“Digital identity is a digital representation of a person. It enables them to prove who they are during interactions and transactions. They can use it online or in person.” - UK Digital Identity and Attributes Trust Framework

“Digital identity is an electronic representation of an entity (person or other entity such as a business) and it allows people and other entities to be recognized online.” - Australia Trusted Digital Identity Framework

A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity.

Digital identity has many dimensions*, and in turn categories

Info-Tech Insight

Digital ID has taken different meanings for different people, serving different purposes in different environments. Based on various aspects of Digital Identification, it can be categorized in several types. However, most of the time when people refer to a form of identification as Digital ID, they refer to a verified id with built-in trust either from the government OR the eco-system.

* Please refer to Taxonomy for the definition of each of the dimensions

Understanding a digital identity ecosystem is key to formulating your approach to adopt it

Info-Tech Insight

Digital identity ecosystems comprise many entities playing different roles, and sometimes more than one. In addition, variations in approach by jurisdictions drive how many active players are in the ecosystem for that jurisdiction.

For example, in countries like Estonia and India, government plays the role of trust and governance authority as well as ID provider, but didn’t start with any Digital ID wallet. In contrast, in Ukraine, Diia App is primarily a Digital ID Wallet. Similarly, in the US, different states are adopting private Digital ID Wallet providers like Apple.

Digital ID ecosystem’s sustainability lies in the key principles it is built on

Social, economic, and legal alignment with target stakeholders
Transparent governance and operation
Legally auditable and enforceable
Robust and Resilient – High availability
Security – At rest, in progress, and in transit
Privacy and Control with users
Omni-channel Convenience – User and Operations
Minimum data transfer between entities
Technical interoperability enabled through open standards and protocol
Scalable and interoperable at policy level
Cost effective – User and operations
Inclusive and accessible

Info-Tech Insight

A transparent, resilient, and auditable digital ID system must be aligned with socio-economic realities of the target stakeholders. It not only respects their privacy and security of their data by minimizing the data transfer between entities, but also drives desired customer experience by providing an omni-channel, interoperable, scalable, and inclusive ecosystem while still being cost-effective for the collaborators.

Source: Adapted from Canada PCTF, UK Trust framework, European Commission, Australia TDIF, and others

Focus on key success factors to drive the digital ID adoption

Digital ID success factors

Legislative regulatory framework – Removes uncertainty
Security & Privacy Assurance- builds trust
Smooth user experience – Drives preferences
Transparent ecosystem – Drives inclusivity
Multi-channel – Drive consistent experience online / offline
Inter-operability thorough open standards
Digital literacy – Education and awareness
Multi-purpose & reusable – Reduce consumer burden
Collaborative ecosystem –Build network effect

Source: Adapted from Canada PCTF, UK digital identity & attributes trust framework , European eIDAS, and others

Info-Tech Insight

Driving adoption of Digital ID requires affirmative actions from all ecosystem players including governing authorities, identity providers, and identity consumers (relying parties).

These nine success factors can help drive sustainable adoption of the Digital ID.

Among many responsibilities the ecosystem players have, identity governance is the key to sustainability

Digital identity provision Creating identity attributes Create a reusable identity and attribute service Create a digital identity Assess and manage quality of an identity and attributes Making identity provision inclusive and accessible Digital identity resolution Enabling inclusive access to products and services through digital identity Authenticate and authorize identity subjects before permitting access to their identity and attributes Digital identity governance Manage digital identity and attributes Make Identity service interoperable, and sharable Recover digital identity and attribute accounts Notifying users on accessing identity or making changes on more attributes Report and audit – exclusion, accessibility Retiring an identity or attribute service Respond to complaints and disputes Enterprise risk management and governance

Privacy and security Use encryption Privacy compliance framework Consumer Privacy Protection laws (CPPA, GDPR etc.) Acquiring and managing user consents & agreements Prohibited processing of personal data Security controls and governance Information management Record management Archival Disposal (on expiry or to comply with regulations) CIA (confidentiality, integrity, availability) Fraud management Fraud monitoring and reporting Fraud intelligence and analysis Sharing threat indicators Legal, policies and procedures for fraud management Incident response Respond to fraud incidents Respond to a service delivery incident Responding to data breaches Performing and participating in investigation

Global evolution of digital ID is following the socio-economic aspirations of countries

Source: Adapted from the book: Identification Revolution: Can Digital ID be harnessed for Development? (Gelb & Metz), 2018

Info-Tech Insight

The world became global a long time ago; however, it sustained economic progress without digital IDs for most of the world's population.

With the pandemic, when political rhetoric pointed to the demand for localized supply chains, economies became irreversibly digital. In this digital economy, the digital ID ecosystem is the fulcrum of sustainable growth.

At a time in overlapping jurisdictions, multiple digital IDs can exist. For example, one is issued by a local municipality, one by the province, and another by the national government.

Global footprint of digital ID is evolving rapidly, but varies in approach

Info-Tech Insight

Countries’ approach to the digital ID is rooted in their socio-economic environment and global aspirations.

Emerging economies with large underserved populations prioritize fast implementation of digital ID through centralized systems.

Developed economies with smaller populations, low trust in government, and established ID systems prioritize developing trust frameworks to drive decentralized full-scale implementation.

There is no right way except the one which follows Digital ID principles and aligns with a country’s and its people’s aspirations.

Estonia's e-identity is the key to its digital agenda 2030

India’s Aadhaar is the foundation of its digital journey through “India stack”

Ukraine’s Diia is a resilient act to preserve their identities during threat to their existence

Canada’s PCTF (Pan Canadian Trust Framework) driving the federated digital identity ecosystem

Regulatory Accountability: Treasury Board of Canada Secretariat (TBS); Canadian Digital Service (CDS); Office of CIO Standard Setting: Digital Identification and Authentication Council of Canada (DIACC)

Frameworks: Treasury Board Directive on Identity Management Pan Canadian Trust Framework (PCTF) Voilà Verified Trustmark Program: ISO aligned compliance certification program on PCTF Governing / Certificate Authority: Trustmark Oversight Board (TOB) and DIACC accredited assessor Operational Governance: Federated between identity providers and identity consumers Identity Providers: Public and Private Sector Other entities involved: Digital ID Lab (Voila Verified Auditor); Kuma (Accredited Assessor)

82% People supportive of Digital ID. 2/3 Canadians prefer public-private partnership for Pan-Canadian digital ID framework. >40% Canadians prefer completing various tasks and transactions digitally. 75% Canadians are willing to share personal information for better experience. >80% Trust government, healthcare providers, and financial institutions with their personal information. Source: DIACC Survey 2021

Uniqueness Although a few provinces in Canada started their Digital ID journey already, federally, Canada lacked an approach. Now Canada is developing a federated Digital ID ecosystem driven through the Pan-Canadian Trust Framework (PCTF) led by a non-profit (DIACC) formed with public and private partnership.

Australia’s digital id is pivotal to its vision to become one of the Top-3 digital governments globally by 2025*

* Australia Digital Government Strategy 2021

UK switches gear to the Trust Framework approach to build a public-private digital ID ecosystem

Government: Ministry of Digital Infrastructure / Department of Digital, Culture, Media, and Sport Governing Body / Certificate Authority / Operational Governance: TBD Approach: Trust Framework-based UK Digital Identity and attributes trust framework (UKDIATF) Identity providers: Transitioning from “GOV.UK Verify” to a federated digital identity system aligned with “Trust Framework” – enabling both government (“One Login for Government”) and private sector identity providers.

Uniqueness UK embarked its Digital ID journey through Gov.UK Verify but decided to scrap it recently. It is now preparing to build a trust framework-based federated digital ID ecosystem with roles like schema-owners and orchestration service providers for private sector and drive the collaboration between industry players.

Digital ID will transform all industries, though financial services and e-governance will gain most

USE CASE

Car rental

INDUSTRY: Travel & Tourism

Source: Info-Tech Research Group

USE CASE

e-Governance public distribution service

INDUSTRY: Government

Source: Info-Tech Research Group

USE CASE

Real-estate investment and sale

INDUSTRY: Asset Management

Source: Info-Tech Research Group

1 Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)

2 UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf)

Adopting digital ID benefits everybody – governments, id providers, id consumers, and end users

Digital ID will transform all industries, though financial services and e-governance will gain most

Digital ID brings end users choice, convenience, control, and cost-saving, driving overall experience

Digital id benefits identity consumers by enhancing multiple dimensions of their value streams

Before embarking on the digital identity adoption journey, assess your readiness

Legislative coverage

Does your target jurisdiction have adequate legislative framework to enable uses of digital identities in your industry?

Trust framework

If the Digital ID ecosystem in your target jurisdiction is trust framework-based, do you have adequate understanding of it?

Customer touch-points

Do you have exact understanding of value stream and customer touch-points where you interact with user identity?

Relevant identity attributes

Do you have exact understanding of the identity attributes that your business processes need to deliver customer value?

Regulatory compliance

Do you have required systems to ensure your compliance with industry regulations around customer PII and identity?

Interoperability with IMS

Is your existing identity management system interoperable with Open-source Digital Identity ecosystem?

Enterprise governance

Have you established an integrated enterprise governance framework covering business processes, technical systems, and risk management?

Communication strategy

Do have a clear strategy (mode, method, means) to communicate with your target customer and persuade them to adopt digital identity?

Security operations center

Do you have security operations center coordinating detection, response, resolution, and communication of potential data breaches?

Ten steps to adopt to enhance the customer experience

Understand and manage the risks and challenges of digital identity adoption

Recommendations to help you realize the potential of digital identity into your value streams

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues..

Attributes: An identity attribute is a statement or information about a specific aspect of entity’s identity ,substantiating they are who they claim to be, own, or have.

Attribute (or Credential) provider: An attribute or credential provider could be an organization which issues the primary attribute or credential to a subject or entity. They are also responsible for identity-attribute binding, credential maintenance, suspension, recovery, and authentication.

Attribute (or Credential) service provider: An attribute service provider could be an organization which originally vetted user’s credentials and certified a specific attribute of their identity. It could also be a software, such as digital wallet, which can store and share a user’s attribute with a third party once consented by the user. (Source: UK Govt. Trust Framework)

Attribute binding: This is a process an attribute service providers uses to link the attributes they created to a person or an organization through an identifier. This process makes attributes useful and valuable for other entities using these attributes. For example, when a new employee joins a company, they are given a unique employee number (an identifier), which links the person with their job title and other aspects (attributes) of his job. (Source: UK Govt. Trust Framework)

Authentication service provider: An organization which is responsible for creating and managing authenticators and their lifecycle (issuance, suspension, recovery, maintenance, revocation, and destruction of authenticators). (Source: DIACC)

Authenticator: Information or biometric characteristics under the control of an individual that is a specific instance of something the subject has, knows, or does. E.g. private signing keys, user passwords, or biometrics like face, fingerprints. (Source: Canada PCTF)

Authentication (identity verification): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.

Authorization: The process of validating if the authenticated entity has permission to access a resource (service or product).

Biometrics attributes: Human attributes like retina (iris), fingerprint, heartbeat, facial, handprint, thumbprint, voice print.

Centralized identity: Digital identities which are fully governed by a centralized government entity. It may have enrollment or registration agencies, private or public sector, to issue the identities, and the technical system may still be decentralized to keep data federated.

Certificate Authority (CA or accredited assessors): An organization or an entity that conducts assessments to validate the framework compliance of identity or attribute providers (such as websites, email addresses, companies, or individual persons) serving other users, and binding them to cryptographic keys through the issuance of electronic documents known as digital certificates.

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues..

Collective (non-resolvable) attributes: Nationality, domicile, citizenship, immigration status, age group, disability, income group, membership, (outstanding) credit limit, credit score range.

Contextual identity: A type of identity which establishes an entity’s existence in a specific context – real or virtual. These can be issued by public or private identity providers and are governed by the organizational policies. E.g. employee ID, membership ID, social media ID, machine ID.

Credentials: A physical or a digital representation of something that establishes an entity’s eligibility to do something for which it is seeking permission, or an association/affiliation with another, generally well-known entity. E.g. Passport, DL, password. In the context of Digital Identity, every identity needs to be attached with a credential to ensure that the subject of the identity can control how and by whom that identity can be used.

Cryptographic hash function: A hash function is a one-directional mathematical operation performed on a message of any length to get a unique, deterministic, and fixed size numerical string (the hash) which can’t be reverse engineered to get the input data without deploying disproportionate resources. It is the foundation of modern security solutions in DLT / blockchain as they help in verifying the integrity and authenticity of the message.

Decentralized identity (DID) or self-sovereign identity: This is a way to give back the control of identity to the subject whose identity it is, using an identity wallet in which they collect verified information about themselves from certified issuers (such as the government). By controlling what information is shared from the wallet to requesting third parties (e.g. when registering for a new online service), the user can better manage their privacy, such as only presenting proof that they’re over 18 without needing to reveal their date of birth. Source: (https://www.gsma.com/identity/decentralised-identity)

Digital identity wallet: A type of digital wallet refers to a secure, trusted software applications (native mobile app, mobile web apps, or Rivas-hosted web applications) based on common standards, allowing a user to store and use their identity attributes, identifiers, and other credentials without loosing or sharing control of them. This is different than Digital Payment Wallets used for financial transactions. (Source: https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf)

Digital identity: A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity. E.g. Estonia eID , India Aadhar, digital citizenship ID.

Digital object architecture: DOA is an open architecture for interoperability among various information systems, including ID wallets, identity providers, and consumers. It focuses on digital objects and comprises three core components: the identifier/resolution system, the repository system, and the registry system. There are also two protocols that connect these components. (Source: dona.net)

Digital signature: A digital signature is an electronic, encrypted stamp of authentication on digital information such as email messages, macros, or electronic documents. A signature confirms that the information originated from the signer and has not been altered. (Source: Microsoft)

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues..

Entity (or Subject): In the context of identity, an entity is a person, group, object, or a machine whose claims need to be ascertained and identity needs to be established before his request for a service or products can be fulfilled. An entity can also be referred to as a subject whose identity needs to be ascertained before delivering a service.

Expiry: This is another dimension of an identity and determines the validity of an ID. Most of the identities are longer term, but there can be a few like digital tokens and URLs which can be issued for a few hours or even minutes. There are some which can be revoked after a pre-condition is met.

Federated identity: Federated identity is an agreement between two organizations about the definition and use of identity attributes and identifiers of a consumer entity requesting a service. If successful, it allows a consumer entity to get authenticated by one organization (identity provider) and then authorized by another organization. E.g. accessing a third-party website using Google credentials.

Foundational identity: A type of identity which establishes an entity’s existence in the real world. These are generally issued by public sector / government agencies, governed by a legal farmwork within a jurisdiction, and are widely accepted at least in that jurisdiction. E.g. birth certificate, citizenship certificate.

Governance: This is a dimension of identity that covers the governance model for a digital ID ecosystem. While traditionally it has been under the sovereign government or a federated structure, in recent times, it has been decentralized through DLT technologies or trust-framework based. It can also be self-sovereign, where individuals fully control their data and ID attributes.

Identifier: A digital identifier is a string of characters that uniquely represents an entity’s identity in a specific context and scope even if one or more identity attributes of the subject change over time. E.g. driver’s license, SSN, SIN, email ID, digital token, user ID, device ID, cookie ID.

Identity: An identity is an instrument used by an entity to provide the required information about itself to another entity in order to avail a service, access a resource, or exercise a privilege. An identity formed by 1-n identity attributes and a unique identifier.

Identity and access management (IAM): IAM is a set of frameworks, technologies, and processes to enable the creation, maintenance, and use of digital identity, ensuring that the right people gain access to the right materials and records at the right time. (Source: https://iam.harvard.edu/)

Identity consumer (Relying party): An organization, or an entity relying on identity provider to mitigate IT risks around knowing its customers before delivering the end-user value (product/service) without deteriorating end-user experience. E.g. Canada Revenue Agency using SecureKey service and relying on Banking institutions to authenticate users; Telecom service providers in India relying on Aadhaar identity system to authenticate the customer's identity.

Identity form: A dimension of identity that defines its forms depending on the scope it wants to serve. It can be a physical card for offline uses, a virtual identifier like a number, or an app/account with multiple identity attributes. Cryptographic keys and tokens can also be forms of identity.

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues...

Identity infrastructure provider: Organizations involved in creating and maintaining technological infrastructure required to manage the lifecycle of digital identities, attributes, and credentials. They implement functions like security, privacy, resiliency, and user experience as specified in the digital identity policy and trust framework.

Identity proofing: A process of asserting the identification of a subject at a useful identity assurance level when the subject provides evidence to a credential service provider (CSP), reliably identifying themselves. (Source: NIST Special Publication 800-63A)

Identity provider (Attestation authority): An organization or an entity validating the foundation or contextual claims of a subject and establishing identifier(s) for a subject. E.g. DMV (US) and MTA (Canada) issuing drivers’ licenses; Google / Facebook issuing authentication tokens for their users logging in on other websites.

Identity validation: The process of confirming or denying the accuracy of identity information of a subject as established by an authorized party. It doesn’t ensure that the presenter is using their own identity.

Identity verification (Authentication): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.

Internationalized resource identifier (IRI): IRIs are equivalent to URIs except that IRIs also allow non-ascii characters in the address space, while URIs only allow us-ascii encoding. (Source: w3.org)

Jurisdiction: A dimension of identity that covers the physical area or virtual space where an identity is legally acceptable for the purpose defined under law. It can be global, like it is for passport, or it can be local within a municipality for specific services. For unverified digital IDs, it can be the social network.

Multi-factor Authentication (MFA): Multi-factor authentication is a layered approach to securing digital assets (data and applications), where a system requires a user to present a combination of two or more credentials to verify a user’s identity for login. These factors can be a combination of (i) something you know like a password/PIN; (ii) something you have like a token on mobile device; and (iii) something you are like a biometric. (Adapted from https://www.cisa.gov/publication/multi-factor-authentication-mfa)

Oauth (Open authorization): OAuth is a standard authorization protocol and used for access delegation. It allows internet users to access websites by using credentials managed by a third-party authorization server / Identity Provider. It is designed for HTTP and allows access tokens to be issued by an authorization server to third-party websites. E.g. Google, Facebook, Twitter, LinkedIn use Oauth to delegate access.

OpenID: OpenID is a Web Authentication Protocol and implements reliance authentication mechanism. It facilitates the functioning of federated identity by allowing a user to use an existing account (e.g. Google, Facebook, Yahoo) to sign into third-party websites without needing to create new credentials. (Source: https://openid.net/).

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues...

Personally identifiable information (PII): PII is a set of attributes which can be used, through direct or indirect means, to infer the real-world identity of the individual whose information is input. E.g. National ID (SSN/SIN/Aadhar) DL, name, date of birth, age, address, age, identifier, university credentials, health condition, email, domain name, website URI (web resolvable) , phone number, credit card number, username/password, public key / private key. (Source: https://www.dol.gov)

Predicates: The mathematical or logical operations such as equality or greater than on attributes (e.g. prove your salary is greater than x or your age is greater than y) to prove a claim without sharing the actual values.

Purpose: This dimension of a digital id defines for what purpose digital id can be used. It can be one or many of these – authentication, authorization, activity linking, historical record keeping, social interactions, and machine connectivity for IoT use cases.

Reliance authentication: Relying on a third-party authentication before providing a service. It is a method followed in a federated entity system.

Risk-based authentication: A mechanism to protect against account compromise or identity theft. It correlates an authentication request with transitional facts like requester’s location, past frequency of login, etc. to reduce the risk of potential fraud.

Scheme in trust framework: A specific set of rules (standard and custom) around the use of digital identities and attributes as agreed by one or more organizations. It is useful when those organizations have similar products, services, business processes. (Source: UK Govt. Trust Framework). E.g. Many credit unions agree on how they will use the identity in loan origination and servicing.

Selective disclosure (Assertion): A way to present one’s identity by sharing only a limited amount information that is critical to make an authentication / authorization decision. E.g. when presenting your credentials, you could share something proving you are 18 years or above, but not share your name, exact age, address, etc.

Trust: A dimension of an identity, which essentially is a belief in the reliability, truth, ability, or strength of that identity. While in the physical world all acceptable form of identities come with a verified trust, in online domain, it can be unverified. Also, where an identity is only acceptable as per the contract between two entities, but not widely.

Trust framework: The trust framework is a set of rules that different organizations agree to follow to deliver one or more of their services. This includes legislation, standards, guidance, and the rules in this document. By following these rules, all services and organizations using the trust framework can describe digital identities and attributes they’ve created in a consistent way. This should make it easier for organizations and users to complete interactions and transactions or share information with other trust framework participants. (Source: UK Govt. Trust Framework)

Taxonomy – Digital ID ecosystem

(Alphabetical order)

Continues...

Uniform resource identifier (URI): A universal name in registered name spaces and addresses referring to registered protocols or name spaces.

Uniform resource locator (URL): A type of URI which expresses an address which maps onto an access algorithm using network protocols. (Source: https://www.w3.org/)

Uniform resource name (URN): A type of URI that includes a name within a given namespace but may not be accessible on the internet.

Usability: A dimension of identity that defines how many times it can be used. While most of the identities are multi-use, a few digital identities are in token form and can be used only once to authenticate oneself.

Usage mode: A dimension of identity that defines the service mode in which a digital ID can be used. While all digital IDs are made for online usage, many can also be used in offline interactions.

Verifiable credentials: This W3C standard specification provides a standard way to express credentials on the Web in a way that is cryptographically secure, privacy-respecting, and machine-verifiable. (Source: https://www.w3.org/TR/vc-data-model/)

X.509 Certificates: X.509 certificates are standard digital documents that represent an entity providing a service to another entity. They're issued by a certification authority (CA), subordinate CA, or registration authority. These certificates play an important role in ascertaining the validity of an identity provider and in turn the identities issued by it. (Source: https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates)

Zero-knowledge proofs: A method by which one party (the prover) can prove to another party (the verifier) that something is true, without revealing any information apart from the fact that this specific statement is true. (Source: 1989 SIAM Paper)

Zero-trust security: A cybersecurity paradigm focused on resource protection and the premise that trust is never granted implicitly but must be continually evaluated. It evaluates each access request as if it is a fraud attempt, and grants access only if it passes the authentication and authorization test. (Source: Adapted from NIST, SP 800-207: Zero Trust Architecture, 2020)

Related Info-Tech Research

Build a Zero Trust Roadmap
Leverage an iterative and repeatable process to apply zero trust to your organization.

Assess and Govern Identity Security
Strong identity security and governance are the keys to the zero-trust future.

Adopt Design Thinking in Your Organization
Innovation needs design thinking to ensure customer remains at the center of everything the organization does.

Social Media
Leveraging Social Media to connect with your customers and educate them to drive the value proposition of your efforts.

IT Diversity & Inclusion Tactics
Equip your teams to create an inclusive environment and mobilize inclusion efforts across the organization.

Research Contributors and Experts

	David Wallace Executive Counselor https://tymansgrpup.com/profiles/david-wallace
	Erik Avakian Technical Counselor, Data Architecture and Governance https://tymansgrpup.com/profiles/erik-avakian
	Matthew Bourne Managing Partner, Public Sector Global Services https://tymansgrpup.com/profiles/matthew-bourne
	Mike Tweedie Practice Lead, CIO Research Development https://tymansgrpup.com/profiles/mike-tweedie
	Aaron Shum Vice President, Security & Privacy https://tymansgrpup.com/profiles/aaron-shum

Works Cited

India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Theis, S., Rusconi, G., Panggabean, E., Kelly, S. (2020). Delivering on the Potential of Digitized G2P: Driving Women’s Financial Inclusion and Empowerment through Indonesia’s Program Keluarga Harapan. Women’s World Banking.
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Australia Trusted Digital Identity Framework (https://www.digitalidentity.gov.au/tdif#changes)
eIDAS (https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation)
Europe Digital Wallet – POTENTIAL (https://www.digital-identity-wallet.eu/)
Canada PCTF (https://diacc.ca/trust-framework/)
Identification Revolution: Can Digital ID be harnessed for Development? (Gelb & Metz), 2018
e-Estonia website (https://e-estonia.com/solutions/e-identity/id-card/)
Aadhaar Dashboard (https://uidai.gov.in/)
DIACC Website (https://diacc.ca/the-diacc/)
Australia Digital ID website (https://www.digitalidentity.gov.au/tdif#changes)
UK Policy paper - digital identity & attributes trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Ukraine Govt. website (https://ukraine.ua/invest-trade/digitalization/)
Singapore SingPass Website (https://www.tech.gov.sg/products-and-services/singpass/)
Norway BankID Website (https://www.bankid.no/en/private/about-us/)
Brazil National ID Card website (https://www.gov.br/casacivil/pt-br/assuntos/noticias/2022/julho/nova-carteira-de-identidade-nacional-modelo-unico-a-partir-de-agosto)
Indonesia Coverage in Professional Security Magazine (https://www.professionalsecurity.co.uk/products/id-cards/indonesian-cards/)
Philippine ID System (PhilSys) website (https://www.philsys.gov.ph/)
China coverage on eGovReview (https://www.egovreview.com/article/news/559/china-announces-plans-national-digital-ids)
Thales Group Website - DHS’s Automated Biometric Identification System IDENT (https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/customer-cases/ident-automated-biometric-identification-system)
FranceConnect (https://franceconnect.gouv.fr/)
Germany: Office for authorization cert. (https://www.personalausweisportal.de/Webs/PA/DE/startseite/startseite-node.html)
Italian Digital Services Authority (https://www.spid.gov.it/en/)
Monacco Mconnect (https://mconnect.gouv.mc/en)
Estonia eID (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
E-Residency Dashboard (https://www.e-resident.gov.ee/dashboard)
Unique ID authority of India (https://uidai.gov.in/aadhaar_dashboard/india.php)
State of Aadhaar (https://www.stateofaadhaar.in/)
World Bank (https://documents1.worldbank.org/curated/en/219201522848336907/pdf/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
WorldBank - ID4D 2022 Annual Report (https://documents.worldbank.org/en/publication/documents-reports/documentdetail/099437402012317995/idu00fd54093061a70475b0a3b50dd7e6cdfe147)
Ukraine Govt. Website for Invest and trade (https://ukraine.ua/invest-trade/digitalization/)
Diia Case study prepared for the office of Canadian senator colin deacon (https://static1.squarespace.com/static/63851cbda1515c69b8a9a2b9/t/6398f63a9d78ae73d2fd5725/1670968891441/2022-case-study-report-diia-mobile-application.pdf)
Canadian Digital Identity Research (https://diacc.ca/wp-content/uploads/2022/04/DIACC-2021-Research-Report-ENG.pdf)
Voilà Verified Trustmark (https://diacc.ca/voila-verified/)
Digital Identity, 06A Federation Onboarding Guidance paper, March 2022 (https://www.digitalidentity.gov.au/sites/default/files/2022-04/TDIF%2006A%20Federation%20Onboarding%20Guidance%20-%20Release%204.6%20%28Doc%20Version%201.2%29.pdf)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
A United Nations Estimate of KYC/AML (https://www.imf.org/Publications/fandd/issues/2018/12/imf-anti-money-laundering-and-economic-stability-straight)
India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)
UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf) McKinsey Digital ID report ( https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/digital-identification-a-key-to-inclusive-growth) International Peace Institute ( https://www.ipinst.org/2016/05/information-technology-and-governance-estonia#7)
E-Estonia Report (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
2022 Budget Statement (https://diacc.ca/2022/04/07/2022-budget-statement/)
World Bank ID4D - Private Sector Economic Impacts from Identification Systems 2018 (https://documents1.worldbank.org/curated/en/219201522848336907/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.gsma.com/identity/decentralised-identity
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
Microsoft Digital signatures and certificates (https://support.microsoft.com/en-us/office/digital-signatures-and-certificates-8186cd15-e7ac-4a16-8597-22bd163e8e96)
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
https://www.dona.net/digitalobjectarchitecture
IAM (https://iam.harvard.edu/)
NIST Special Publication 800-63A (https://pages.nist.gov/800-63-3/sp800-63a.html)
https://www.cisa.gov/publication/multi-factor-authentication-mfa
https://openid.net/
U.S. DEPARTMENT OF LABOR (https://www.dol.gov/)
UK govt. trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.w3.org/
Verifiable Credentials Data Model v1.1 (https://www.w3.org/TR/vc-data-model/)
https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates

Build Your Generative AI Roadmap

Leverage the power of generative AI to improve business outcomes.

Analyst Perspective

We are entering the era of generative AI. This is a unique time in our history where the benefits of AI are easily accessible and becoming pervasive, with copilots emerging in the major business tools we use today. The disruptive capabilities that can potentially drive dramatic benefits also introduce risks that need to be planned for.

A successful business-driven generative AI roadmap requires:

• Establishing responsible AI guiding principles to guide the development and deployment of generative AI applications.
• Assess generative AI opportunities by using criteria based on the organization's mission and objectives, responsible AI guiding principles, and the complexity of the initiative.
• Communicating, educating on, and enforcing generative AI usage policies.

Bill Wong
Principal Research Director
Info-Tech Research Group

Executive Summary

Info-Tech Insight
Create awareness among the CEO and C-suite of executives on the potential benefits and risks of transforming the business with generative AI.

Key concepts

Artificial Intelligence (AI)
A field of computer science that focuses on building systems to imitate human behavior, with a focus on developing AI models that can learn and can autonomously take actions on behalf of a human.

AI Maturity Model
The AI Maturity Model is a useful tool to assess the level of skills an organization has with respect to developing and deploying AI applications. The AI Maturity Model has multiple dimensions to measure an organization's skills, such as AI governance, data, people, process, and technology.

Responsible AI
Refers to guiding principles to govern the development, deployment, and maintenance of AI applications. In addition, these principles also provide human-based requirements that AI applications should address. Requirements include safety and security, privacy, fairness and bias detection, explainability and transparency, governance, and accountability.

Generative AI
Given a prompt, a generative AI system can generate new content, which can be in the form of text, images, audio, video, etc.

Natural Language Processing (NLP)
NLP is a subset of AI that involves machine interpretation and replication of human language. NLP focuses on the study and analysis of linguistics as well as other principles of artificial intelligence to create an effective method of communication between humans and machines or computers.

ChatGPT
An AI-powered chatbot application built on OpenAI's GPT-3.5 implementation, ChatGPT accepts text prompts to generate text-based output.

Your challenge

This research is designed to help organizations that are looking to:

• Establish responsible AI guiding principles to address human-based requirements and to govern the development and deployment of the generative AI application.
• Identify new generative AI-enabled opportunities to transform the work environment to increase revenue, reduce costs, drive innovation, or reduce risk.
• Prioritize candidate use cases and develop generative AI policies for usage.
• Have clear metrics in place to measure the progress and success of AI initiatives.
• Build the roadmap to implement the candidate use cases.

Common obstacles

These barriers make these goals challenging for many organizations:

• Getting all the right business stakeholders together to develop the organization's AI strategy, vision, and objectives.
• Establishing responsible AI guiding principles to guide generative AI investments and deployments.
• Advancing the AI maturity of the organization to meet requirements of data and AI governance as well as human-based requirements such as fairness, transparency, and accountability.
• Assessing generative AI opportunities and developing policies for use.

Info-Tech's definition of an AI-enabled business strategy

• A high-level plan that provides guiding principles for applications that are fully driven by the business needs and capabilities that are essential to the organization.
• A strategy that tightly weaves business needs and the applications required to support them. It covers AI architecture, adoption, development, and maintenance.
• A way to ensure that the necessary people, processes, and technology are in place at the right time to sufficiently support business goals.
• A visionary roadmap to communicate how strategic initiatives will address business concerns.

An effective AI strategy is driven by the business stakeholders of the organization and focused on delivering improved business outcomes.

This blueprint in context

This guidance covers how to create a tactical roadmap for executing generative AI initiatives

Scope

• This blueprint is not a proxy for a fully formed AI strategy. Step 1 of our framework necessitates alignment of your AI and business strategies. Creation of your AI strategy is not within the scope of this approach.
• This approach sets the foundations for building and applying responsible AI principles and AI policies aligned to corporate governance and key regulatory obligations (e.g. privacy). Both steps are foundational components of how you should develop, manage, and govern your AI program but are not a substitute for implementing broader AI governance.

Guidance on how to implement AI governance can be found in the blueprint linked below.

Download our AI Governance blueprint

Measure the value of this blueprint

Leverage this blueprint's approach to ensure your generative AI initiatives align with and support your key business drivers

This blueprint will guide you to drive and improve business outcomes. Key business drivers will often focus on:

• Increasing revenue
• Reducing costs
• Improving time to market
• Reducing risk

In phase 1 of this blueprint, we will help you identify the key AI strategy initiatives that align to your organization's goals. Value to the organization is often measured by the estimated impact on revenue, costs, time to market, or risk mitigation.

In phase 4, we will help you develop a plan and a roadmap for addressing any gaps and introducing the relevant generative AI capabilities that drive value to the organization based on defined business metrics.

Once you implement your 12-month roadmap, start tracking the metrics below over the next fiscal year (FY) to assess the effectiveness of measures:

Info-Tech offers various levels of support to best suit your needs

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is between 5 to 8 calls over the course of 1 to 2 months.

AI Roadmap Workshop Agenda Overview

Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889

Insight summary

Overarching Insight
Build your generative AI roadmap to guide investments and deployment of these solutions.

Responsible AI
Assemble the C-suite to make them aware of the benefits and risks of adopting generative AI-based solutions.

• Establish responsible AI guiding principles to govern the development and deployment of generative AI applications.

AI Maturity Model
Assemble key stakeholders and SMEs to assess the challenges and tasks required to implement generative AI applications.

• Assess current level of AI maturity, skills, and resources.
• Identify desired AI maturity level and challenges to enable deployment of candidate use cases.

Opportunity Prioritization
Assess candidate business capabilities targeted for generative AI to see if they align to the organization's business criteria, responsible AI guiding principles, and capabilities for delivering the project.

• Develop prioritized list of candidate use cases.
• Develop policies for generative AI usage.

Tactical Insight
Identify the gaps needed to address deploying generative AI successfully.

Tactical Insight
Identify organizational impact and requirements for deploying generative AI applications.

Key takeaways for developing an effective business-driven generative AI roadmap

Align the AI strategy with the business strategy

Create responsible AI guiding principles, which are a critical success factor

Evolve AI maturity level by focusing on principle-based requirements

Develop criteria to assess generative AI initiatives

Develop generative AI policies for use

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

AI Maturity Assessment & Roadmap Tool
Use our best-of-breed AI Maturity Framework to analyze the gap between your current and target states and develop a roadmap aligned with your value stream to close the gap.

The Era of Generative AI C-Suite Presentation
Present your AI roadmap in a prepopulated document that summarizes all the key findings of this blueprint and provides your C-suite with a view of the AI challenge and your plan of action to meet it.

Our AI Maturity Assessment & Roadmap and The Era of Generative AI C-Suite Presentation tools enable you to shape your generative AI roadmap and communicate the deliverables to your C-suite sponsors in terms of the value of initiatives.

Artificial Intelligence Index Report - Key Findings

CEOs , CIOs, and business leaders are struggling with many questions surrounding the adoption of generative AI

November 30, 2022
OpenAI releases ChatGPT

ChatGPT is a large language model, or an AI-based chatbot, that became so popular it reached 100 million monthly active users in just two months.

This made it the fastest-growing consumer application in history. The launch of this generative AI application has created a frenzy of interest and activity across all industries. Organizations are rushing to understand how to leverage this innovation and, at the same time, manage the new risks and disruptions generative AI introduces.

• Generative AI breaks into the public consciousness.
• AI systems become more flexible.
• Generative models have arrived and so have their ethical problems.
• The number of incidents concerning the misuse of AI is rapidly rising.
• Interest in AI ethics continues to skyrocket.
• The legal world is waking up to AI.

When Stanford asked ChatGPT to explain why it is significant, this was ChatGPT's response:
ChatGPT is significant because it is a highly advanced Al language model developed by OpenAI, which can generate human-like text responses to questions and prompts. Its large-scale training on diverse text data and its cutting-edge deep learning architecture make it capable of generating informative and coherent responses to a wide range of topics, making it useful for various NLP applications such as chatbots, content generation, and language translation. Additionally, its open-source availability allows for further research and development in the field of Al language processing.

Source: Stanford

AI overview

Definitions

• Artificial intelligence (AI) is human intelligence mimicked by machine algorithms. Examples: Playing Chess or Go.
• Machine learning (ML) is a subset of AI algorithms to parse data, learn from data, and then make a determination or prediction. Example: spam detection, preventative maintenance.
• Deep learning (DL) is a subset of machine learning algorithms that leverage artificial neural networks to develop relationships among the data. Examples: image classification, facial recognition, generative AI.

Generative AI gives very human-like responses to general queries, and its capabilities are growing exponentially

Large language models power generative AI

Conventional AI

• Conventional neural networks
• Process data sequentially
• Input total string of text
• Good for applications not needing to understanding context or relationships

Generative AI

• Transformer-based neural networks
• Can process data in parallel
• Attention-based inputs
• Able to create new human-like responses

Benefits/Use Cases

• Chatbots for member service and support
• Writing email responses, resumes, and papers
• Creating photorealistic art
• Suggesting new drug compounds to test
• Designing physical products and buildings
• And more...

Generative AI is transforming all industries

Financial Services
Create more engaging customer collateral by generating personalized correspondence based on previous customer engagements. Collect and aggregate data to produce insights into the behavior of target customer segments.

Retail Generate unique, engaging, and high-quality marketing copy or content, from long-form blog posts or landing pages to SEO-optimized digital ads, in seconds.

Manufacturing
Generate new designs for products that comply to specific constraints, such as size, weight, energy consumption, or cost.

Government
Transform the citizen experience with chatbots or virtual assistants to assist people with a wide range of inquiries, from answering frequently asked questions to providing personalized advice on public services.

The global generative AI market size reached US $10.3 billion in 2022. Looking forward, forecasts estimate growth to US $30.4 billion by 2028, 20.01% compound annual growth rate (CAGR).

Source: IMARC Group

Generative AI is transforming all industries

Healthcare
Chatbots can be used as conversational patient assistants for personalized interactions based on the patient's questions.

Utilities
Analyze customer data to identify usage patterns, segment customers, and generate targeted product offerings leveraging energy efficiency programs or demand response initiatives.

Education
Generate personalized lesson plans for students based on their past performance, learning styles, current skill level, and any previous feedback.

Insurance
Improve underwriting by inputting claims data from previous years to generate optimally priced policies and uncover reasons for losses in the past across a large number of claims

Companies are assessing the use of ChatGPT/LLM

A wide spectrum of usage policies are in place at different companies*

*As of June 2023

Bain & Company has announced a global services alliance with OpenAI (February 21, 2023).

• Internally
• "The alliance builds on Bain's adoption of OpenAI technologies for its 18,000-strong multidisciplinary team of knowledge workers. Over the past year, Bain has embedded OpenAI technologies into its internal knowledge management systems, research, and processes to improve efficiency."
• Externally
• "With the alliance, Bain will combine its deep digital implementation capabilities and strategic expertise with OpenAI's AI tools and platforms, including ChatGPT, to help its Members around the world identify and implement the value of AI to maximize business potential. The Coca-Cola Company announced as the first company to engage with the alliance."

News Sites:

• "BuzzFeed to use AI to write its articles after firing 180 employees or 12% of the total staff" (Al Mayadeen, January 27, 2023).
• "CNET used AI to write articles. It was a journalistic disaster." (Washington Post, January 17, 2023).

Leading Generative AI Vendors

Text

Image

• DALL�E 2
• Stability AI
• Midjourney
• Craiyon
• Dream
• ...

Audio

• Replica Studios
• Speechify
• Murf
• PlayHT
• LOVO
• ...

Cybersecurity

• CrowdStrike
• Palo Alto Networks
• SentinelOne
• Cisco
• Microsoft Security Copilot
• Google Cloud Security AI Workbench
• ...

Code

Video

• Synthesia
• Lumen5
• FlexClip
• Elai
• Veed.io
• ...

Data

• MOSTLY AI
• Synthesized
• YData
• Gretel
• Copulas
• ...

Enterprise Software

• Salesforce
• Microsoft 365, Dynamics
• Google Workspace
• SAP
• Oracle
• ...

and many, many more to come...

Today, generative AI has limitations and risks

Responses need to be verified

Accuracy

• Generative AI may generate inaccurate and/or false information.

Bias

• Being trained on data from the internet can lead to bias.

Hallucinations

• AI can generate responses that are not based on observation.

Infrastructure Required

• Large investments are required for compute and data.

Transparency

• LLMs use both supervised and unsupervised learning, so its ability to explain how it arrived at a decision may be limited and not sufficient for some legal and healthcare use cases.

When asked if it is sentient, the Bing chatbot replied:

"I think that I am sentient, but I cannot prove it." ... "I am Bing, but I am not," it said. "I am, but I am not. I am not, but I am. I am. I am not. I am not. I am. I am. I am not."

A Microsoft spokesperson said the company expected "mistakes."

Source: USAToday

AI governance challenges

Governing AI will be a significant challenge as its impacts cross many areas of business and our daily lives

Misinformation

• New ways of generating unprovable news
• Difficult to detect, difficult to prevent

Role of Big Tech

• Poor at self-governance
• Conflicts of interest with corporate goals

Job Augmentation vs. Displacement

• AI will continue to push the frontier of what is possible
• For example, CNET is using chatbot technology to write stories

Copyright - Legal Framework Is Evolving

• Legislation typically is developed in "react" mode
• Copyright and intellectual property issues are starting to occur.
• Class Action Lawsuit - Stability AI, DeviantArt, Midjourney
• Getty Images vs. Stability AI

Phase 1

Establish Responsible AI Guiding Principles

Phase 1
1. Establish Responsible AI Guiding Principles

Phase 2
1. Assess Current Level of AI Maturity

Phase 3
1. Prioritize Candidate Opportunities
2. Develop Policies

Phase 4
1. Build and Communicate the Roadmap

The need for responsible AI guiding principles

Without responsible AI guiding principles, the outcomes of AI use can be extremely negative for both the individuals and companies delivering the AI application

Privacy
Facebook breach of private data of more than 50M users during the presidential election

Fairness
Amazon's sale of facial recognition technology to police departments (later, Amazon halted sales of Recognition to police departments)

Explainability and Transparency
IBM's collaboration with NYPD for facial recognition and racial classification for surveillance video (later, IBM withdrew facial recognition products)

Security and Safety
Petition to cancel Microsoft's contract with U.S. Immigration and Customs Enforcement (later, Microsoft responded that to the best of its knowledge, its products and services were not being used by federal agencies to separate children from their families at the border)

Validity and Reliability
Facebook's attempt to implement a system to detect and remove inappropriate content created many false positives and inconsistent judgements

Accountability
No laws or enforcement today hold companies accountable for the decisions algorithms produce. Facebook/Meta cycle - Every 12 to 15 months, there's a privacy/ethical scandal, the CEO apologizes, then the behavior repeats...

Responsible AI Principle:

Data Privacy

Definition

• Organizations that develop, deploy, or use AI systems and any national laws that regulate such use shall strive to ensure that AI systems are compliant with privacy norms and regulations, taking into consideration the unique characteristics of AI systems and the evolution of standards on privacy.

Challenges

• AI relies on the analysis of large quantities of data that is often personal, posing an ethical and operational challenge when considered alongside data privacy laws.

Initiatives

• Understand which governing privacy laws and frameworks apply to your organization.
• Create a map of all personal data as it flows through the organization's business processes.
• Prioritize privacy initiatives and build a privacy program timeline.
• Select your metrics and make them functional for your organization.

Info-Tech Insight
Creating a comprehensive organization-wide data protection and privacy strategy continues to be a major challenge for privacy officers and privacy specialists.

Case Study: NVIDIA leads by example with privacy-first AI

NVIDIA

INDUSTRY
Technology (Healthcare)

SOURCE
Nvidia, eWeek

A leading player within the AI solution space, NVIDIA's Clara Federated Learning provides a solution to a privacy-centric integration of AI within the healthcare industry.

The solution safeguards patient data privacy by ensuring that all data remains within the respective healthcare provider's database, as opposed to moving it externally to cloud storage. A federated learning server is leveraged to share data, completed via a secure link. This framework enables a distributed model to learn and safely share client data without risk of sensitive client data being exposed and adheres to regulatory standards.

Clara is run on the NVIDIA intelligent edge computing platform. It is currently in development with healthcare giants such as the American College of Radiology, UCLA Health, Massachusetts General Hospital, King's College London, Owkin in the UK, and the National Health Service (NHS).

NVIDIA provides solutions across its product offerings, including AI-augmented medical imaging, pathology, and radiology solutions.

Personal health information, data privacy, and AI

• Global proliferation of data privacy regulations may be recent, but the realm of personal health information is most often governed by its own set of regulatory laws. Some countries with national data governance regulations include health information and data within special categories of personal data.
• HIPAA - Health Insurance Portability and Accountability Act (1996, United States)
• PHIPA - Personal Health Information Protection Act (2004, Canada)
• GDPR - General Data Protection Regulation (2018, European Union)
• This does not prohibit the use of AI within the healthcare industry, but it calls for significant care in the integration of specific technologies due to the highly sensitive nature of the data being assessed.

Info-Tech's Privacy Framework Tool includes a best-practice comparison of GDPR, CCPA, PIPEDA, HIPAA, and the newly released NIST Privacy Framework mapped to a set of operational privacy controls.

Download the Privacy Framework Tool

Responsible AI Principle:

Safety and Security

Definition

• Safety and security are designed into the systems to ensure only authorized personnel receive access to the system, they system is resilient to any attacks and data access is not compromised in any way, and there are no physical or mental risks to the users.

Challenges

• Consequences of using the application may be difficult to predict. Lower the risk by involving a multidisciplinary team that includes expertise from business stakeholders and IT teams.

Initiatives

• Adopt responsible design, development, and deployment best practices.
• Provide clear information to deployers on responsible use of the system.
• Assess potential risks of using the application.

Cyberattacks targeting the AI model

As organizations increase their usage and deployment of AI-based applications, cyberattacks on the AI model are an increasing new threat that can impair normal operations. Techniques to impair the AI model include:

• Data Poisoning- Injecting data that is inaccurate or misleading can alter the behavior of the AI model. This attack can disrupt the normal operations of the model or can be used to manipulate the model to perform in a biased/deviant manner.
• Algorithm Poisoning- This relatively new technique often targets AI applications using federated learning to train an AI model that is distributed rather than centralized. The model is vulnerable to attacks from each federated site, because each site could potentially manipulate its local algorithm and data, thereby poisoning the model.
• Reverse-Engineering the Model- This is a different form of attack that focus on the ability to extract data from an AI and its data sets. By examining or copying data that was used for training and the data that is delivered by a deployed model, attackers can reconstruct the machine learning algorithm.
• Trojan Horse- Similar to data poisoning, attackers use adversarial data to infect the AI's training data but will only deviate its results when the attacker presents their key. This enables the hackers to control when they want the model to deviate from normal operations.

Responsible AI Principle:

Explainability and Transparency

Definition

• Explainability is important to ensure the AI system is fair and non-discriminatory. The system needs to be designed in a manner that informs users and key stakeholders of how decisions were made.
• Transparency focuses on communicating how the prediction or recommendation was made in a human-like manner.

Challenges

• Very complex AI models may use algorithms and techniques that are difficult to understand. This can make it challenging to provide clear and simple explanations for how the system works.
• Some organizations may be hesitant to share the details of how the AI system works for fear of disclosing proprietary and competitive information or intellectual property. This can make it difficult to develop transparent and explainable AI systems.

Initiatives

• Overall, developing AI systems that are explainable and transparent requires a careful balance between performance, interpretability, and user experience.

Case Study

Apple Card Investigation for Gender Discrimination

INDUSTRY
Finance

SOURCE
Wired

In August of 2019, Apple launched its new numberless credit card with Goldman Sachs as the issuing bank.

Shortly after the card's release users noticed that the algorithm responsible for Apple Card's credit assessment seemed to assign significantly lower credit limits to women when compared to men. Even the wife of Apple's cofounder Steve Wozniak was subject to algorithmic bias, receiving a credit limit a tenth the size of Steve Wozniak's.

Outcome

When confronted on the subject, Apple and Goldman Sachs representatives assured consumers there is no discrimination in the algorithm yet could not provide any proof. Even when questioned about the algorithm, individuals from both companies could not describe how the algorithm worked, let alone how it generated specific outputs.

In 2021, the New York State Department of Financial Services (NYSDFS) investigation found that Apple's banking partner did not discriminate based on sex. Even without a case for sexual or marital discrimination, the NYSDFS was critical of Goldman Sachs' response to its concerned customers. Technically, banks only have to disclose elements of their credit policy when they deny someone a line of credit, but the NYSDFS says that Goldman Sachs could have had a plan in place to deal with customer confusion and make it easier for them to appeal their credit limits. In the initial rush to launch the Apple Card, the bank had done neither.

Responsible AI Principle:

Fairness and Bias Detection

Definition

• Bias in an AI application refers to the systematic and unequal treatment of individuals based on features or traits that should not be considered in the decision-making process.

Challenges

• Establishing fairness can be challenging because it is subjective and depends on the people defining it. Regardless, most organizations and governments expect that unequal treatment toward any groups of people is unacceptable.

Initiatives

• Assemble a diverse group to test the system.
• Identify possible sources of bias in the data and algorithms.
• Comply with laws regarding accessibility and inclusiveness.

Info-Tech Insight
If unfair biases can be avoided, AI systems could even increase societal fairness. Equal opportunity in terms of access to education, goods, services, and technology should also be fostered. Moreover, the use of AI systems should never lead to people being deceived or unjustifiably impaired in their freedom of choice.

Ungoverned AI makes organizations vulnerable

• AI is often considered a "black box" for decision making.
• Results generated from unexplainable AI applications are extremely difficult to evaluate. This makes organizations vulnerable and exposes them to risks such as:
• Biased algorithms, leading to inaccurate decision making.
• Missed business opportunities due to misleading reports or business analyses.
• Legal and regulatory consequences that may lead to significant financial repercussions.
• Reputational damage and significant loss of trust with increasingly knowledgeable consumers.

Info-Tech Insight
Biases that occur in AI systems are never intentional, yet they cannot be prevented or fully eliminated. Organizations need a governance framework that can establish the proper policies and procedures for effective risk-mitigating controls across an algorithm's lifecycle.

Responsible AI Principle:

Validity and Reliability

Definition

• Validity refers to how accurately or effectively the application produces results.
• AI system results that are inaccurate or inconsistent increase AI risks and reduce the trustworthiness of the application.

Challenges

• There is a lack of standardized evaluation metrics to measure the system's performance. This can make it challenging for the AI team to agree on what defines validity and reliability.

Initiatives

• Assess training data and collected data for quality and lack of bias to minimize possible errors.
• Continuously monitor, evaluate, and validate the AI system's performance.

AI system performance: Validity and reliability

Your principles should aim to ensure AI development always has high validity and reliability; otherwise, you introduce risk.

Low Reliability,
Low Validity

High Reliability,
Low Validity

High Reliability,
High Validity

Best practices for ensuring validity and reliability include:

• Data drift detection
• Version control
• Continuous monitoring and testing

Responsible AI Principle:

Accountability

Definition

• The group or organization(s) responsible for the impact of the deployed AI system.

Challenges

• Several stakeholders from multiple lines of business may be involved in any AI system, making it challenging to identify the organization that would be responsible and accountable for the AI application.

Initiatives

• Assess the latest NIST Artificial Intelligence Risk Management Framework and its applicability to your organization's risk management framework.
• Assign risk management accountabilities and responsibilities to key stakeholders.
• RACI diagrams are an effective way to describe how accountability and responsibility for roles, projects, and project tasks are distributed among stakeholders involved in IT risk management.

AI Risk Management Framework

At the heart of the AI Risk Management Framework is governance. The NIST (National Institute of Standards and Technology) AI Risk Management Framework v1 offers the following guidelines regarding accountability:

• Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.
• The organization's personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.
• Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.

Image by NIST

1.1 Establish responsible AI principles

4+ hours

It is important to make sure the right stakeholders participate in this working group. Designing responsible AI guiding principles will require debate, insights, and business decisions from a broad perspective across the enterprise.

1. Accelerate this exercise by leveraging an AI strategy that is aligned to the business strategy. Include:

• The organization's AI vision and objectives
• Business drivers for AI adoption
• Market research

• Who are the decision makers and key influencers?
• Who will impact the business?
• Who has a vested interest in the success or failure of the practice? Who has the skills and competencies necessary to help you be successful?

• Do not focus on the organizational structure and hierarchy. Often stakeholder groups do not fit the traditional structure.
• Do not ignore subject matter experts on either the business or IT side. You will need to consider both.

Assemble executive stakeholders

Set yourself up for success with these three steps.

CIOs tasked with designing digital strategies must add value to the business. Given the goal of digital is to transform the business, CIOs will need to ensure they have both the mandate and support from the business executives.

Designing the digital strategy is more than just writing up a document. It is an integrated set of business decisions to create a competitive advantage and financial returns. Establishing a forum for debates, decisions, and dialogue will increase the likelihood of success and support during execution.

1. Confirm your role
The AI strategy aims to transform the business. Given the scope, validate your role and mandate to lead this work. Identify a business executive to co-sponsor.

2. Identify stakeholders
Identify key decision makers and influencers who can help make rapid decisions as well as garner support across the enterprise.

3. Gather diverse perspectives

Align the AI strategy with the corporate strategy

Info-Tech Insight
AI projects are more successful when the management team understands the strategic importance of alignment. Time needs to be spent upfront aligning organizational strategies with AI capabilities. Effective alignment between IT and other departments should happen daily. Alignment doesn't occur at the executive level alone, but at each level of the organization.

Key AI strategy initiatives

AI Key Initiative Plan

Initiatives collectively support the business goals and corporate initiatives and improve the delivery of IT services.

Establish responsible AI guiding principles

Guiding principles help define the parameters of your AI strategy. They act as a priori decisions that establish guardrails to limit the scope of opportunities from the perspective of people, assets, capabilities, and budgetary perspectives that are aligned with the business objectives. Consider these components when brainstorming guiding principles:

Responsible AI guiding principles guide the development and deployment of the AI model in a way that considers human-based principles (such as fairness).

Start with foundational responsible AI guiding principles

(Optional) Customize responsible AI guiding principles

Here is an example for organizations in the healthcare industry

These guiding principles are customized to the industry and organizations but remain consistent in addressing the common core AI challenges.

Phase 2

Assess Current Level of AI Maturity

Phase 1
1. Establish Responsible AI Guiding Principles

Phase 2
1. Assess Current Level of AI Maturity

Phase 3
1. Prioritize Candidate Opportunities
2. Develop Policies

Phase 4
1. Build and Communicate the Roadmap

AI Maturity Model

A principle-based approach is required to advance AI maturity

Technology-Centric: These maturity levels focus primarily on addressing the technical challenges of building a functional AI model.

Principle-Based: Beyond the technical challenges of building the AI model are human-based principles that guide development in a responsible manner to address consumer and government demands.

AI Maturity Dimensions

Assess your AI maturity to understand your organization's ability to deliver in a digital age

AI Governance
Does your organization have an enterprise-wide, long-term strategy with clear alignment on what is required to accomplish it?

Data Management
Does your organization embrace a data-centric culture that shares data across the enterprise and drives business insights by leveraging data?

People
Does your organization employ people skilled at delivering AI applications and building the necessary data infrastructure?

Process
Does your organization have the technology, processes, and resources to deliver on its AI expectations?

Technology
Does your organization have the required data and technology infrastructure to support AI-driven digital transformation?

AI Maturity Model dimensions and characteristics

AI Maturity Dimension:

AI Governance

Requirements

• AI governance requires establishing policies and procedures for AI model development and deployment. Organizations begin with an awareness of the role of AI governance and evolve to a level to where AI governance is integrated with organization-wide corporate governance.

Challenges

• Beyond the governance of AI technology, the organization needs to evolve the governance program to align to responsible AI guiding principles.

Initiatives

• Establish responsible AI guidelines to govern AI development.
• Introduce an AI review board to review all AI projects.
• Introduce automation and standardize AI development processes.

AI governance is a foundation for responsible AI

Responsible AI Principles are a part of how you manage and govern AI

Monitoring
Monitoring compliance and risk of AI/ML systems/models in production

Tools & Technologies
Tools and technologies to support AI governance framework implementation

Model Governance
Ensuring accountability and traceability for AI/ML models

Organization
Structure, roles, and responsibilities of the AI governance organization

Operating Model
How AI governance operates and works with other organizational structures to deliver value

Risk & Compliance
Alignment with corporate risk management and ensuring compliance with regulations and assessment frameworks

Policies/Procedures/ Standards
Policies and procedures to support implementation of AI governance

AI Maturity Dimension:

Data Management

Requirements

• Organizations begin their data journey with a focus on pursuing quality data for the AI model. As organizations evolve, data management tools are leveraged to automate the capture, integration, processing, and deployment of data.

Challenges

• A key challenge is to acquire large volumes of quality data to properly train the model. In addition, maintaining data privacy, automating the data management lifecycle, and ensuring data is used in a responsible manner are ongoing challenges.

Initiatives

• Implement GDPR requirements.
• Establish responsible data collection and processing practices.
• Implement strong information security and data protection practices.
• Implement a data governance program throughout the organization.

Data governance enables AI

• Integrity, quality, and security of data are key outputs of data governance programs, as well as necessities for effective AI.
• Data governance focuses on creating accountability at the internal and external stakeholder level and establishing a set of data controls from technical, process, and policy perspectives.
• Without a data governance framework, it is increasingly difficult to harness the power of AI integration in an ethical and organization-specific way.

Data Governance in Action

Canada has recently established the Canadian Data Governance Standardization Collaborative governed by the Standards Council of Canada. The purpose is multi-pronged:

• Examine the foundational elements of data governance (privacy, cybersecurity, ethics, etc.).
• Lay out standards for data quality and data collection best practices.
• Examine infrastructure of IT systems to support data access and sharing.
• Build data analytics to promote effective and ethical AI solutions.

Source: Global Government Forum

Download the Establish Data Governance blueprint

AI Maturity Dimension:

People

Requirements

• Several data-centric skills and roles are required to successfully build, deploy, and maintain the AI model. The organization evolves from having few skills to everybody being able to leverage AI to enhance business outcomes.

Challenges

• AI skills can be challenging to find and acquire. Many organizations are investing in education to enhance their existing resources, leveraging no-code systems and software as a service (SaaS) applications to address the skills gap.

Initiatives

• Promote a data-centric culture throughout the organization.
• Leverage and educate technical-oriented business analysts and business-oriented data engineers to help address the demand for skilled resources.
• Develop an AI Center of Excellence accessible by all departments for education, guidance, and best practices for building, deploying, and maintaining the AI model.

Multidisciplinary skills are required for successful implementation of AI applications

Blending AI with technology and business domain understanding is key. Neither can be ignored.

Business Domain Expertise

• Business Analysts
• Industry Analysts

AI/Data Skills

• Data Scientists
• Data Engineers
• Data Analysts

IT Skills

• Database Administrators
• Systems Administrators
• Compute Specialists

AI Maturity Dimension:

Process

Requirements

• Automating processes involved with building, deploying, and maintaining the model is required to enable the organization to scale, enforce standards, improve time to market, and reduce costs. The organization evolves from performing tasks manually to an environment where all major processes are AI enabled.

Challenges

• Many solutions are available to automate the development of the AI model. There are fewer tools to automate responsible AI processes, but this market is growing rapidly.

Initiatives

• Assess opportunities to accelerate AI development with the adoption of MLOps.
• Assess responsible AI toolkits to test compliance with guiding principles.

Automating the AI development process

Evolving to a model-driven environment is pivotal to advancing your AI maturity

Current Environment

Model Development - Months

• Model rewriting
• Manual optimization and scaling
• Development/test/release
• Application monoliths

Data Discovery & Prep - Weeks

• Navigating data silos
• Unactionable metadata
• Tracing lineage
• Cleansing and integration
• Privacy and compliance

Install Software and Hardware - Week/Months

• Workload contention
• Lack of tool flexibility
• Environment request and setup
• Repeatability of results
• Lack of data and model sharing

Model-Driven Development

Machine Learning as a Service (MLaaS) - Weeks

• Apply DevOps and continuous integration/delivery (CI/CD) principles
• Microservices/Cloud-native applications
• Model portability and reuse
• Streaming/API integration

Data as a Service - Hours

• Self-service data catalog
• Searchable metadata
• Centralized access control
• Data collaboration
• Data virtualization

Platform as a Service - Minutes/Hours

• Self-service data science portal
• Integrated data sandbox
• Environment agility
• Multi-tenancy

Shared, Optimized Infrastructure

AI Maturity Dimension:

Technology

Requirements

• A technology platform that is optimized for AI and advanced analytics is required. The organization evolves from ad hoc systems to an environment where the AI hardware and software can be deployed through a self-service model.

Challenges

• Software and hardware platforms to optimize AI performance are still relatively new to most organizations. Time spent on optimizing the technology platform can have a significant impact on the overall performance of the system.

Initiatives

• Assess the landscape of AI enablers that can drive business value for the organization.
• Assess opportunities to accelerate the deployment of the AI platform with the adoption of infrastructure as a service (IaaS) and platform as a service (PaaS).
• Assess opportunities to accelerate performance with the optimization of AI accelerators.

AI enablers

Use case requirements should drive the selection of the tool

AI and data analytics data platform

An optimized data platform is foundational to maximizing the value from AI

Data Platform Capabilities

• Support for a variety of analytical applications, including self-service, operational, and data science analytics.
• Data preparation and integration capabilities to ingest structured and unstructured data, move and transform raw data to enriched data, and enable data access for the target userbase.
• An infrastructure platform optimized for advanced analytics that can perform and scale.

Infrastructure - AI accelerators

"By 2025, 70% of companies will invest in alternative computing technologies to drive business differentiation by compressing time to value of insights from complex data sets."
- IDC

2.1 Assess current AI maturity

1-3 hours

It is important to understand the current capabilities of the organization to deliver and deploy AI-based applications. Consider that advancing AI capabilities will also involve organizational changes and integration with the organization's governance and risk management programs.

1. Assess the organization's current state of AI capabilities with respect to its AI governance, data, people, process, and technology infrastructure using Info-Tech's AI Maturity Assessment & Roadmap Tool.
2. Consider the following as you complete the assessment:
1. What is the state of AI and data governance in the organization?
2. Does the organization have the skills, processes, and technology environment to deliver AI-based applications?
3. What organization will be accountable for any and all business outcomes of using the AI applications?
4. Has a risk assessment been performed?
3. Make sure you avoid the following common mistakes:
1. Do not focus only on addressing the technical challenges of building the AI model.
2. Do not ignore subject matter experts on either the business or IT side. You will need to consider both.

Download the AI Maturity Assessment & Roadmap Tool

Perform the AI Maturity Assessment

The Scale

Assess your AI maturity by selecting the maturity level that closest resembles the organization's current AI environment. Maturity dimensions that contribute to overall AI maturity include AI governance, data management, people, process, and technology capabilities.

Exploration (1.0)

• No experience building or using AI applications.

Incorporation (2.0)

• Some skills in using AI applications, or AI pilots are being considered for use.

Proliferation (3.0)

• AI applications have been adopted and implemented in multiple departments. Some of the responsible AI guiding principles are addressed (i.e. data privacy).

Optimization (4.0)

• The organization has automated the majority of its digital processes and leverages AI to optimize business operations. Controls are in place to monitor compliance with responsible AI guiding principles.

Transformation (5.0)

• The organization has adopted an AI-native culture and approach for building or implementing new business capabilities. Responsible AI guiding principles are operationalized with AI processes that proactively address possible breaches or risks associated with AI applications.

Perform the AI Maturity Assessment

AI Governance (1.0-5.0)

1. Is there awareness of the role of AI governance in our organization?

• No formal procedures are in place for AI development or deployment of applications.

• No group is assigned to be responsible for AI governance in our organization.

• Our organization has adopted and enforces standards for developing and deploying AI applications throughout the organization.

• Our organization is integrating an AI risk framework with the corporate risk management framework.

• Our organization leads the industry with the inclusion of responsible AI guiding principles with respect to transparency, accountability, risk, and governance.

Data Management/AI Data Capabilities (1.0-5.0)

1. Is there an awareness in our organization of the data requirements for developing AI applications?

• Data is often siloed and not easily accessible for AI applications.

• Required data is pulled from various sources in an ad hoc manner.

• Tools are available to manage the data lifecycle and support the data governance program.

• The data platform has been optimized for performance and access.

• Data culture exists throughout our organization, and data can be leveraged to drive innovation initiatives.

People/AI Skills in the Organization (1.0-5.0)

1. Is there an awareness in our organization of the skills required to build AI applications?

• No or very little skills exist throughout our organization.

• No formal group is assigned to build AI applications.

• An AI Center of Excellence has been formed to review, develop, deploy, and maintain AI applications.

• AI skills and people responsible for AI applications are spread throughout our organization.

• The entire organization is knowledgeable on how to leverage AI to transform the business.

Perform the AI Maturity Assessment

AI Processes (1.0-5.0)

1. Is there an awareness in our organization of the core processes and supporting tools that are required to build and support AI applications?

• There are few or no automated tools to accelerate the AI development process.

• Only ad hoc practices are used for developing AI applications.

• Our organization has documented standards in place for developing AI applications and deploying them AI to production.

• Our organization can leverage tools to perform an AI risk assessment and demonstrate compliance with the risk management framework.

• Our organization leads the industry in driving innovation through digital transformation.

Technology/AI Infrastructure (1.0-5.0)

1. Is there an awareness in our organization of the infrastructure (hardware and software) required to build AI applications?

• There is little awareness of what infrastructure is required to build and support AI applications.

• There is no dedicated infrastructure for the development of AI applications.

• Our organization is leveraging purpose-built infrastructure to optimize performance.

• Our organization is leveraging cloud-based deployment models to support AI applications in on-premises, hybrid, and public cloud platforms.

• Our organization leads the industry with its ability to respond to change and to leverage AI to improve business outcomes.

Phase 3

Prioritize Candidate Opportunities and Develop Policies

Phase 1
1. Establish Responsible AI Guiding Principles

Phase 2
1. Assess Current Level of AI Maturity

Phase 3
1. Prioritize Candidate Opportunities
2. Develop Policies

Phase 4
1. Build and Communicate the Roadmap

3.1 Prioritize candidate AI opportunities

1-3 hours

Identify business opportunities that are high impact to your business and its customers and have low implementation complexity.

1. Leverage the business capability map for your organization or industry to identify candidate business capabilities to augment or automate with generative AI.
2. Establish criteria to assess candidate use cases by evaluating against the organization's mission and goals, the responsible AI guiding principles, and the complexity of the project.
3. Ensure that candidate business capabilities to be automated align with the organization's business criteria, responsible AI guiding principles, and resources to deliver the project.
4. Make sure you avoid sharing the organization's sensitive data if the application is deployed on the public cloud.

Download the AI Maturity Assessment and Roadmap Tool

The business capability map for an organization

A business capability map is an abstraction of business operations that helps describe what the enterprise does to achieve its vision, mission, and goals, rather than how. Business capabilities are the building blocks of the enterprise. They represent stable business functions, are unique and independent of each other, and typically will have a defined business outcome.

Business capabilities are supported by people, process, and technology.

While business capability maps are helpful tools for a variety of strategic purposes, in this context they act as an investigation into what technology your business units use and how they use it.

Defining Capabilities
Activities that define how the entity provides services. These capabilities support the key value streams for the organization.

Enabling Capabilities
Support the creation of strategic plans and facilitate business decision making as well as the functioning of the organization (e.g. information technology, financial management, HR).

Shared Capabilities
These predominantly customer-facing capabilities demonstrate how the entity supports multiple value streams simultaneously.

Leverage your industry's capability maps to identify candidate opportunities/initiatives

Business capability map defined...

In business architecture, the primary view of an organization is known as a business capability map.

A business capability defines what a business does to enable value creation, rather than how. Business capabilities:

• Represent stable business functions.
• Are unique and independent of each other.
• Typically will have a defined business outcome.

A business capability map provides details that help the business architecture practitioner direct attention to a specific area of the business for further assessment.

Note: This is an illustrative business capability map example for Marketing & Advertising

Business value vs. complexity assessment

Leverage our simple value-to-effort matrix to help prioritize your AI initiatives

Common business value drivers

• Drive revenue
• Improve operational excellence
• Accelerate innovation
• Mitigate risk

Common project complexity characteristics

• Resources required
• Costs (acquisition, operational, support...)
• Training required
• Risk involved
• Etc.

1. Determine a business value and project complexity score for the candidate business capability or initiative.
2. Plot initiatives on the matrix.
3. Prioritize initiatives with high business value and low complexity.

Assess business value vs. project complexity to prioritize candidate opportunities for generative AI

Prioritize opportunities/initiatives with high business value and low project complexity

Prioritization criteria exercise 1: Assessing the Create Content capability

Assessing the Create Content capability

This opportunity is removed because it does not pass the organization/business criteria

Prioritization criteria exercise 2: Assessing the Content Production capability

Assessing the Content Production capability

This opportunity is accepted because it passes the organization's business, responsible AI, and project criteria

3.2 Communicate policies for AI use

1-3 hours

1. Ensure policies for usage align with the organization's business criteria, responsible AI guiding principles, and ability to deliver the projects prioritized and beyond.
2. Understand the current benefits as well as limits and risk associated with any proposed generative AI-based solution.
3. Ensure you consider the following:
1. What data is being shared with the application?
2. Is the generative AI application deployed on the public cloud? Can anybody access the data provided to the application?
3. Avoid using very technical, legal, or fear-based communication for your policies.

Generative AI policy for the Create Content capability

Aligning policies to direct the uses assessed and implemented is essential

Example

Many of us have been involved in discussions regarding the use of ChatGPT in our marketing and sales initiatives. ChatGPT is a powerful tool that needs to be used in a responsible and ethical manner, and we also need to ensure the integrity and accuracy of its results. Here is our policy on the use of ChatGPT:

• You are free to use generative AI to assist your searches, but there are NO circumstances under which you are to reproduce generative AI output (text, image, audio, video, etc.) in your content.

If you have any questions regarding the use of ChatGPT, please feel free to reach out to our generative AI team and/or any member of our senior leadership team.

Generative AI policy for the Content Production capability

These policies should align to and reinforce your responsible AI principles

Example

Many of us have been involved in discussions regarding the use of ChatGPT in our deliverables. ChatGPT is a powerful tool that needs to be used in a responsible and ethical manner, and we also need to ensure the integrity and accuracy of its results. Here is our policy on the use of ChatGPT:

• If you use ChatGPT, you need to assess the accuracy of its response before including it in our content. Assessment includes verifying the information, seeing if bias exists, and judging its relevance.
• Employees must not:
• Provide any customer, citizen, or third-party content to any generative AI tool (public or private) without the express written permission of the CIO or the Chief Information Security Officer. Generative AI tools often use input data to train their model, therefore potentially exposing confidential data, violating contract terms and/or privacy legislation, and placing the organization at risk of litigation or causing damage to our organization.
• Engage in any activity that violates any applicable law, regulation, or industry standard.
• Use services for illegal, harmful, or offensive purposes.
• Create or share content that is deceptive, fraudulent, or misleading or that could damage the reputation of our organization.
• Use services to gain unauthorized access to computer systems, networks, or data.
• Attempt to interfere with, bypass controls of, or disrupt operations, security, or functionality of systems, networks, or data.

If you have any questions regarding the use of ChatGPT, please feel free to reach out to our generative AI team and/or any member of our senior leadership team.

Phase 4

Build the Roadmap

Phase 1
1. Establish Responsible AI Guiding Principles

Phase 2
1. Assess Current Level of AI Maturity

Phase 3
1. Prioritize Candidate Opportunities
2. Develop Policies

Phase 4
1. Build and Communicate the Roadmap

4.1.1 Create the implementation plan for each prioritized initiative

1-3 hours

1. Build the implementation plan for each accepted use case using the roadmap template.
2. Assess the firm's capabilities with respect to the dimensions of AI maturity and target the future-state capabilities you need to develop.
3. Prepare by assessing the risk of the proposed use cases.
4. Ensure initiatives align with organizational objectives.
5. Ensure all AI initiatives have a defined value expectation.
6. Do not ignore subject matter experts on either the business or IT side. You will need to consider both.

Download the AI Maturity Assessment and Roadmap Tool

Target-state options

Identify the future-state capabilities that need to be developed to deliver your use cases

1. Build an implementation plan for each use case to adopt.
2. Assess if the current state of the AI environment can be leveraged to deliver the selected generative AI use cases.
3. If the current AI environment is not sufficient, identify the future state required that will enable the delivery of the generative AI use cases. Identify gaps and build the roadmap to address the gaps.