Month: September 2024

Authored by Baker Tilly’s Jordan Anderson

As artificial intelligence (AI) continues to transform the way we live, work and interact with technology, Colorado has taken a significant step forward in the regulation of these systems. Signed into law by Governor Jared Polis on June 8, 2021, the Colorado AI Act [1] (also known as Senate Bill 24-205) is the first state-level comprehensive legislation in the U.S. that regulates the use of AI systems. The act aims to promote transparency, accountability and fairness in the development and deployment of AI systems while protecting the rights and interests of consumers and citizens.

Key provisions of the act

The act focuses primarily on “high-risk” AI systems, which are AI-based systems that, when deployed, make “consequential decisions.” Consequential decisions are decisions that have a material impact on consumers’ educational opportunity, employment, finance and lending, healthcare, housing, legal or government services.

Developer obligations

“Developers,” those that create or substantially modify a high-risk artificial intelligence system, must exercise reasonable care to protect consumers from any known or foreseeable risks of algorithmic discrimination arising from the use of their AI system. Additionally, “Developers” must make available the following documentation, disclosures and information to “Deployers” and other developers of the AI system:

A general statement describing the reasonably foreseeable uses and known harmful or inappropriate uses of the high-risk AI systemDocumentation disclosing: 
– High-level summaries of the type of data used to train the high-risk AI system 
– Known or reasonably foreseeable limitations of the AI system 
– The purpose of the AI system 
– Its intended benefits and uses 
– All other information necessary for a deployer to comply with the “Deployer’s” obligationsDocumentation describing: 
– How the AI system was evaluated for performance and mitigation of algorithmic discrimination 
– The data governance measures to cover the training datasets and measures used to examine the suitability of data sources including possible biases and appropriate mitigation 
– The intended outputs of the AI system 
– How the system should be used, not be used and be monitoredAny additional documentation that is reasonably necessary to assist the “Deployer” in understanding the outputs and monitor the performance of the AI system

Disclosures and notifications

“Developers” are obligated to disclose, on their website or in a public use-case inventory, a statement summarizing the types of high-risk AI that the developer has developed or modified and how the developer manages risks of algorithmic discrimination. Additionally, the “Developer” is required to keep these disclosures updated as the AI system is modified.

Within 90 days of a “Developer” discovering that a high-risk AI system has been deployed and has caused or is reasonably likely to have caused discrimination, they must inform the Colorado Attorney General and all known “Deployers” and “Developers” of the AI system.

Deployer obligations

“Deployers” are entities that do business in Colorado and deploy (e.g., implement or use with consumer impacts) a high-risk AI system. Like a “Developer,” a “Deployer” must exercise reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination and must notify consumers when they have deployed a high-risk AI system to make, or be a substantial factor in making, a consequential decision concerning a consumer. “Deployers” are required to disclose:

A description of the AI systemA description of the purpose of the AI systemThe nature of consequential decisions being madeInstructions on how to access details of the AI system on their websiteProvide information regarding the consumer’s right to opt out of the processing of personal data concerning the consumer for profilingMake available in a manner that is clear and readily available on their website, the types of high-risk AI systems deployed, how they manage known or foreseeable risks of algorithmic discrimination, and the nature, source and extent of information collected and used by the AI systemWithin 90 days of discovering that their high-risk AI system has caused or is reasonably likely to have caused discrimination, they must inform the Colorado Attorney General

Adverse decisions

When a “Deployer’s” high-risk AI system makes a consequential decision that its adverse to the consumer, the “Deployer” must:

Provide to the consumer a statement disclosing:

The principal reason or reasons for the consequential decision, including the degree and manner to which the AI system contributed to the decisionThe types and sources of data that were processed by the AI system in making the decisionProvide an opportunity for the consumer to correct any incorrect personal data and appeal the adverse decision and require human review

Additional disclosures to consumers

While the sections above refer specifically to high-risk AI systems, the following disclosures apply to any AI system that consumers interact with. “Deployers” of AI systems (that are not obvious to a reasonable person) must disclose that the system the consumer is interacting with is an AI system.

Enforcement by attorney general

The Colorado Attorney General has exclusive authority to enforce the act. “Developers” and “Deployers” that are faced with an enforcement action have an affirmative defense if both the following are true:

They discover and cure a violation of the act because of feedback, adversarial testing or “red teaming,” or internal review processes

They comply with the latest version of the NIST AI Risk Management Framework [2] or another nationally or internationally recognized risk management framework for AI systems, or any risk management framework designated by the attorney general.

Additional regulations

The attorney general may promulgate additional rules as necessary for the purpose of implementing and enforcing the act. These changes may include documentation and requirements for “Developers,” notifications to consumers, required disclosures and risk management and impact assessment policies and procedures.

Establishing risk management policies and program

A “Deployer” of a high-risk AI system must implement and maintain a risk management policy and program to govern the AI system that incorporates the principles, processes and personnel that the “Deployer” uses to identify, document and mitigate risks of algorithmic discrimination.

Acceptable risk management frameworks include the NIST AI Risk Management Framework [3], ISO/IEC 42001 [4] or other internationally recognized, substantially equivalent, risk management standards.

Impact assessment

Within 90 days of the act taking effect, a “Deployer” or third party contracted by the “Developer” must complete an impact assessment that is then repeated annually and whenever substantial modifications to high-risk AI systems occur. The impact assessment must include, at a minimum:

A statement disclosing the purpose, intended use cases and benefits afforded by the high-risk AI systemAn analysis of whether the deployment of the AI system poses any risks of algorithmic discrimination and the steps that have been taken to mitigate those risksA description of the categories of data the AI system processes as inputs and the outputs the AI system producesAny metrics used to evaluate the performance and limitations of the AI systemA description of any transparency measures taken to notify a user that the AI system is in useA description of post-deployment monitoring and user safeguards

Exemptions to high-risk AI policy

The “Deployer” employs fewer than 50 people

The “Deployer” does not use its own data to train the AI system

The AI system is used for its intended purpose

The “Deployer” makes available to consumers any impact assessment that the “Developer” of the AI system has completed

What should organizations do to prepare for compliance?

The act will take effect on Feb. 1, 2026, giving organizations two years to prepare for compliance. Organizations that operate in Colorado and leverage AI should consider the following steps to comply:

Appoint a team to lead AI compliance effortsConduct an inventory and assessment of existing and planned AI use cases and determine whether they meet the standard of a high-risk AI systemImplement an AI risk management framework, such as the NIST AI Risk Management Framework [5]Create and document the policies and procedures for disclosing, explaining and evaluating AI systems, and for addressing the feedback from the end user or consumerSet the foundation to conduct impact assessments by identifying the policies, processes and resources needed to orchestrate, conduct, document, analyze and monitor AI impactImplement and test the mechanisms and tools for providing the required documentation, disclosures and other required informationTrain and educate staff and stakeholders on the ethical and legal implications of AI systems, and on the best practices for designing and operating themMonitor and review AI systems regularly to adjust and improve as needed

Organizations that develop or deploy AI systems for use in Colorado should consider an AI Readiness Assessment to identify gaps in organizational preparedness and build a road map to achieve and maintain compliance with changing regulations.

What does this mean for companies outside of Colorado?

Although the legislation directly applies to organizations that do business in Colorado, the Colorado AI Act is landmark legislation that sets a precedent for other states to follow. Utah has enacted legislation that establishes liability for use of AI that violates consumer protection laws if not properly disclosed. Additionally, four other states (CA, IL, MA, OH) have active bills related to fair and responsible use of AI.

This policy proliferation reflects the growing awareness and concern about the potential impacts and risks of AI systems on society and individuals. Organizations with operations in affected states will need to align their AI practices with the state’s regulatory standards, potentially prompting a broader adoption of these guidelines to ensure consistency across their operations.

Finally, it is important to monitor the changing AI regulatory landscape, conduct regular risk and vulnerability assessments of AI systems and ensure governance is being applied across the organization.

How we can help

Ensuring your organization is properly equipped to adhere to incoming AI regulations will help save time, energy and resources by preventing retrospective efforts. Baker Tilly’s digital team can support your organization in defining an AI strategy, conducting readiness and impact assessments, designing and implementing an AI governance and risk management framework, or – if you already have things in place – implementing and scaling AI systems.

Contact a Baker Tilly specialist to learn more.

Whether you are a municipal government, agency, public or private business, identifying and acting on the opportunities at the intersections of waste, water and energy is how we can drive meaningful change.

Through our onsite services and total waste management offerings, we share our expertise at every level of the waste hierarchy – always aiming to help our customers reduce cost and increase sustainability.

Source Reduction & Reuse 

Through “waste to product” services, we determine if your waste stream can be resold as an input material for another industrial process – without any additional processing. 

Recycling

There are many industrial waste streams that can be partially recycled to be used again as input materials. Through specialized recycling services, Veolia can extract valuable raw materials through each of these processes. 

Energy Recovery 

Certain waste streams that cannot be recycled are candidates for energy recovery solutions, a process that turns waste streams into fuel products. Through fuel blending and engineered fuels, qualified waste streams can be used to replace fossil fuels in cement kilns. 

Treatment and Disposal

When no other options are available, waste should be disposed of safely and responsibly. Our incineration, stabilization and landfill services offer a stellar compliance record and the most advanced sustainability features. 

Learn more here 

In the fourth and final episode of the ESG Talk Climate Week series, Nancy Mahon, chief sustainability officer of the Estée Lauder Companies, joins host Alyssa Zucker to discuss the company’s approach to Scope 3 measurement and reporting. They cover the impact of consumer sustainability preferences and the unique challenges of leading sustainability efforts across a diverse portfolio of brands.

Listen Now

Looking for more? Subscribe to the ESG Talk podcast on Apple, Spotify, and YouTube.

ESG Talk is brought to you by Workiva, the world’s only unified platform for financial reporting, ESG, audit, and risk. Learn more at workiva.com.

Safeguarding our most precious resource

Water is one of the world’s most precious resources. Human beings drink about four liters a day alone, and water is critical for both agriculture and industry as well as sustaining life.

Ontario Clean Water Agency (OCWA) aims to be a “trusted water partner for life.” OCWA’s priority is to deliver water and wastewater services for the health and sustainability of communities. The agency treats water and wastewater, and provides other technical services for 750 client facilities in Ontario, Canada, including municipalities, First Nations, and commercial, industrial, government, and institutional clients.

OCWA’s municipal clients range in size from populations as large as 1.5 million in the Region of Peel, to as small as 2,400 in Moose Factory, a community located in Northern Ontario. This broad scope of experience enables the agency to solve any issues that may arise, no matter the size or type of treatment process in the province. As a result, the agency has grown its municipal client base every year over the past 30 years.

When the Canadian government imposed stricter requirements for monitoring water quality after the Walkerton crisis in May 2000, OCWA built a custom remote monitoring system. Remarkably, the homegrown solution met the agency’s needs for more than 20 years. By the 2020s, the agency needed to modernize. OCWA had three goals. One was converting data from various types of equipment in different plants into a standard format. Another was eliminating time-consuming compliance reporting required whenever network disruptions caused gaps in data. And finally, OCWA was interested in expanding its service portfolio to add value for customers.

Going the distance

OCWA met its goals with an industrial IoT solution built on Cisco industrial routers. Applications running on the routers transform each plant’s data into a standard format for compliance and business reporting, making costly custom work a thing of the past – a report written for one facility will work for all facilities. “It is powerful to standardize monitoring this way,” said Ciprian Panfilie, Director of Operational Systems at OCWA. “Instead of having a specialist for each facility, we built teams that provide specialized services to all facilities around the province, optimizing our approach.”

The solution also ensures OCWA is able to meet regulatory requirements and mitigate the risk of network outages that may create data gaps. If the link from a facility to OCWA’s offices is down, the router retains the data on its built-in storage, transferring it to the cloud once connectivity is restored. “We tried dozens of solutions, but only Cisco’s solution worked flawlessly,” Panfilie said.

As for expanding services, OCWA recently added a sophisticated energy management solution to its portfolio. The routers provide a standard network and cybersecurity template for energy management, enabling baselines, forecasts, and real-time energy management. Another area of service development is near real-time asset performance monitoring and predictive maintenance using LORAWAN sensors and gateways.

Looking ahead

Cisco’s industrial IoT solution is up and running in over 165 OCWA-monitored facilities to date and counting. By 2030, the agency expects to deploy the industrial IoT solution in the majority of its remotely monitored facilities and is exploring other long-term opportunities. Pending further pilot testing, some concepts may be running machine learning applications on the Cisco routers to predict and fix issues before they occur, such as out-of-bounds changes in wastewater effluent quality.

Learn more

Read the case studyCisco Catalyst IR1800 Rugged Series Routers

View original content here.

Originally published by the Mastercard Center for Inclusive Growth

Given that Colombia is the second-largest exporter of coffee, the mission of Azahar Coffee might seem a little counterintuitive: Keep as many Colombian beans in Colombia as possible. The rationale? Colombians deserve to drink the best coffee too.

As a small business built upon a reputation for fare that’s both on trend and fresh, Azahar needs to stay sharp to be able to compete in a growing market. Using artificial intelligence (AI) could help, by giving the café a way to use its own data to make smarter, more efficient business decisions. For example, by analyzing how many sandwiches are sold per day, it could eliminate waste by buying only as much as bread as is needed that day. Knowing which tables are busiest at which times could improve staffing, and analyzing how many people prefer oat milk over cow’s milk could help fine-tune dairy inventory.

These kinds of tools are already being adopted by large organizations. According to one recent study, about 42% of companies with more than 1,000 employees have already deployed AI to help their business. But barriers remain for smaller companies that don’t have the time or money to hire AI experts and build their own technology. To truly democratize AI, we need to find ways to make these tools more accessible to smaller businesses so they can compete in an evolving tech landscape.

Small businesses will need customized, easy-to-use, accessible solutions. Here are three that are being developed with support from Mastercard Strive.

Building chatbots to harness data

Azahar is part of a pilot program from Datasketch, a small social technology company that is democratizing data science to combat social inequality.

The program is bringing chatbot-enabled AI to small businesses in Bogotá. Existing data analytics services are out of reach for the 50,000 independent stores and restaurants in Bogotá that could benefit from using AI to simplify their data for better decision-making.

For years, these businesses have grappled with a significant challenge: how to harness the power of their data with limited resources. The corner café or local store often relies on gut instinct, basic spreadsheets or incomprehensible reports from the various digital platforms they use. Datasketch’s chatbot generates the insights small businesses need to get to the next level by working with models trained exclusively on a small company’s own data.

“If you’re a small business, you may have one software for payments, another for accounting and another for online sales,” says JP Marin Diaz, Datasketch’s founder. “We are able to integrate that data and put an AI chatbot interface on top of it so they can ask questions about their businesses in a simple way and get an answer based on the company’s data.”

For example, a manager at one of the Azahar cafés could ask, “How much milk should I buy for next week?” and get a simple answer based on complex analytics of café traffic, local preferences and seasonal sales. The tool gives Azahar and other small Colombian businesses a way to compete against bigger companies using the latest technology.

Empowering community business coaches with faster data insights

Building new ways for small businesses to use advanced data science can even have a ripple effect, improving the prospects for exponentially more entrepreneurs. Take Community Reinvestment Fund, USA (CRF), for example, which offers lending and technical solutions to help community finance organizations better support and grow the small businesses they serve.

In Chicago, CRF is working with Allies for Community Business (A4CB), which provides the capital, coaching and connections entrepreneurs need to grow stable businesses, which in turn create jobs and wealth in their communities. The partnership is bringing better insights to the small-business owners they work with.

CRF Insights, the latest technology innovation from CRF, enables A4CB advisers to sit down with small-business owners and, within a minute, compile a snapshot capturing two years of financial performance and health trends. Typically, this process could take up to two weeks and mean manually collecting financial statements, then doing the data entry and the modeling. CRF’s tools use open banking to automate this process, pulling financial data from multiple sources (bank accounts, payments systems, etc.) to present all the information in one easy-to-read dashboard.

Coaches then use those insights to help businesses set goals and benchmarks that can be tracked and measured over months and years. The system also responds to data insights, with the option to provide nudges and alerts to the coach. For instance, the platform can help advisers evaluate the impact of a marketing campaign or address demand spikes and suggest actions like a line of credit for inventory needs.

We shouldn’t expect, small business owners to be data scientists. We should build products and services for small business owners that help them make sense of their data, make better decisions, connect to resources at the right time, and better manage the overall financial performance of their businesses.

Patrick Davis

Senior vice president, technology & platform service, Community Reinvestment Fund

Helping small businesses compete on sustainability

It’s becoming increasingly clear that for small businesses to compete on a bigger stage, they’ll need to be able to measure and report their ESG (environmental, social and governance) risks, opportunities and impact. Doing so can lead to new business opportunities, given that the proportion of major organizations that require small-business owners to disclose ESG metrics is expected to reach 92% this year. But ESG measurement solutions can often be expensive and out of reach for many small businesses.

“Small businesses don’t have the capacity or the skills for this,” says Kimberley Abbott, founder of Vested Impact, a U.K.-based global company that leverages AI and 300 million science-based and other relevant data points to automatically assess and quantify the impact of companies and investments. “We need to meet small businesses where they are. Democratizing this technology is also about making sure the price is fair for everyone.”

In Europe, the Middle East, Africa and Latin America, Vested Impact, with support from Mastercard Strive, is developing an affordable small-business platform to measure a company’s impact in seconds. Their goal is to assess 1.2 million small businesses by the end of 2024. Their platform takes into account what the company does and where it does it, along with impactful data points, and measures the company’s impact against U.N. Sustainable Development Goal targets. The platform will be able to quickly create an impact report that small companies can then use as proof of the good work they are doing.

Ensuring everyone benefits from the AI revolution

These are just three examples of how AI can help level the playing field for small businesses. AI can also help these businesses attract and maintain customers, make marketing more targeted and efficient and increase cybersecurity. To make sure AI reaches small businesses will require involving them in the design process to ensure solutions are meeting real needs.

One way we’re helping to democratize AI is through the Artificial Intelligence to Accelerate Inclusion Challenge (AI2AI Challenge) — a partnership with data.org and Dasra to recognize organizations that offer innovative AI solutions that have demonstrated success and are ready to scale with additional funding and technical support.

Mastercard has joined forces with Create Labs and diverse global media partners to develop and pilot a new inclusive AI tool that delivers customized assistance to small-business owners.

The bottom line is that the AI revolution is here, and it’s up to all of us to ensure that everyone, everywhere can benefit. We need to be intentional about helping small businesses access AI technology and tools, whether that means creating easy-to-use chatbots, helping business coaches in underserved communities or bringing ESG measuring tools to businesses already doing good work. The power, resources and opportunities are there. It’s time to embrace them.

Learn more about Mastercard’s work in artificial intelligence.

Dorothy Pomerantz is a managing editor at Fitch Ink where she writes and edits stories for Mastercard Newsroom and beyond. She spent 15 years at Forbes Magazine where she was L.A. Bureau Chief.

Originally published by the Mastercard Center for Inclusive Growth

Follow the Mastercard Center for Inclusive Growth’s journey to advance equitable and sustainable economic growth and financial inclusion around the world by following us on LinkedIn and Instagram.