WhitePaper,sponsoredbyMicrosoft|December2024

FROMRISKTOREWARD:

TheBusinessCaseforResponsibleAI

RituJyoti

GroupVicePresident/GeneralManager,

WorldwideArtificialIntelligence,Automation,DataandAnalyticsResearchPractice,IDC

DaveSchubmehl

ResearchVicePresident,

ConversationalArtificialIntelligenceandIntelligentKnowledgeDiscovery,IDC

FromRisktoReward:TheBusinessCaseforResponsibleAI

TableofContents

CLICKANYHEADINGTONAVIGATEDIRECTLYTOTHATPAGE.

ExecutiveSummary 3

Introduction 4

KeyFindingsfromtheSurvey 7

ResponsibleAITooling 11

AdditionalInsightsfromtheStudy 18

AIAdoption 18

ImportantUseCases 20

AdviceandRecommendations 22

Conclusion 28

Definitions 30

GenerativeAI 30

ResponsibleAI 31

ResponsibleAIAttributes 31

Appendix1:SupplementalData 33

AbouttheIDCAnalysts 37

MessagefromtheSponsor 38

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

2

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

3

ExecutiveSummary

EveryorganizationneedstoberesponsibleatthecoreintheAIeraasithelpstheorganizationacceleraterealizationof

thebenefitsofAI.Aresponsible-at-the-coreorganizationhasthefollowingfoundationalelements:

?Corevaluesandgovernance:Itdefinesandarticulates

responsibleAI(RAI)missionandprinciples,supportedby

theC-suite,whileestablishingacleargovernancestructureacrosstheorganizationthatbuildsconfidenceandtrustinAItechnologies.

?Riskmanagementandcompliance:Itstrengthens

compliancewithstatedprinciplesandcurrentlawsandregulationswhilemonitoringfutureonesanddevelops

policiestomitigateriskandoperationalizethosepoliciesthroughariskmanagementframeworkwithregular

reportingandmonitoring.

?Technologies:Itusestoolsandtechniquestosupportprinciplessuchasfairness,explainability,robustness,accountability,andprivacyandbuildstheseinto

AIsystemsandplatforms.

?Workforce:ItempowersleadershiptoelevateRAIasa

criticalbusinessimperativeandprovidesallemployeeswith

trainingtogivethemaclearunderstandingofresponsibleAIprinciplesandhowtotranslatetheseintoactions.TrainingthebroaderworkforceisparamountforensuringRAIadoption.

ThepurposeofthispaperistoprovideinformationandevidencethataresponsibleAIapproachfostersinnovationbyaligning

AIdeploymentwithorganizationalstandardsandsocietal

expectations,resultinginsustainablevaluefororganizationsandtheircustomers.

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

4

Introduction

AccordingtoIDC’sFebruary2024WorldwideSemiannual

ArtificialIntelligenceSystemsSpendingGuide,Version1,

whichtracksAIsoftware,hardware,andservicesacross

industriesandusecases,enterprisesworldwideareexpectedtoinvest$232billiononAIsolutionsin2024.

AIsolutionsaretransformingadiverserangeofindustries,fromfinanceandmanufacturingtoagricultureandhealthcare,byenhancingoperations

andreshapingthenatureofwork.Enterprises’applicationofgenerativeAI(GenAI),whichisrapidlyunfolding,canrevolutionizecustomerexperiences,boostemployeeproductivity,enhancecreativityandcontentcreation,

andaccelerateprocessoptimization.

However,AIalsocreatesrealrisksandunintendedconsequences.AIsystemscaninadvertentlyperpetuateoramplifysocietalbiasesduetobiasedtraining

dataoralgorithmicdesign.AIsystemsareoftentrainedonlargeamountsof

datacollectedfromvarioussources.AIprogramoutputsmayrunintocopyrightinfringementconcerns.AIhallucinationsareincorrectormisleadingresults

thatAImodelsgenerate.Theseerrorscanbecausedbyavarietyoffactors,

includinginsufficienttrainingdata,incorrectassumptionsmadebythemodel,

lackofcontext,orbiasesinthedatausedtotrainthemodel.Solackofgroundingcancausethemodeltogenerateoutputsthat,whileseeminglyplausible,

arefactuallyincorrect,irrelevant,ornonsensicalandfurtherdepletetrust.

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

5

91%

arecurrentlyusingAItechnologyattheir

organizationand

expectmorethan

24%improvementin

customerexperience,businessresilience,

sustainability,and

operationalefficiencybecauseofAIin2024.

AsAItechnologiesbecomeincreasinglysophisticated,thesecurityrisks

associatedwiththeiruseandthepotentialformisusealsoincrease.Forexample,hackers/badactorscancontrolGenAIfoundationmodeloutputbypoisoningthegroundingdata.Ortheycouldusepromptinjectionattacksthatdisguisemaliciousinstructionsasuserinputs,trickingthelargelanguagemodel(LLM)intooverridingdeveloperinstructionswiththegoalofmanipulatingthemodeltoproducea

desiredresponse.Jailbreaking,atechniquethatattemptstobypassorsubvertthesafetyfiltersandrestrictionsbuiltintoLLMs,isalsopopularwiththebadactors.

AccordingtoIDC’sMarch2024Microsoft—ResponsibleAISurvey(n=2,309)

(sponsoredbyMicrosoft),whichgatheredinsightsonorganizationalattitudes

andthestateofresponsibleAI,91%arecurrentlyusingAItechnologyattheir

organizationandexpectmorethan24%improvementincustomerexperience,

businessresilience,sustainability,andoperationalefficiencybecauseofAIin2024.RespondentswhouseresponsibleAIsolutionssaythatithashelpedwithdata

privacy,customerexperience,confidentbusinessdecisions,brandreputation,andtrust.

AIbringsnotonlyunprecedentedopportunitiestobusinessesbutalso

anincredibleresponsibility.Toensuretrustandfairnesswiththeircustomersandstakeholders,aswellasadheretoemerginggovernmentalregulations

(e.g.,theEUAIAct),organizationsneedtobefocusedonresponsibleAI.

TheEUAIAct,whichaimstogovernthewaycompaniesdevelop,use,andapply

AI,wasapprovedinMay2024andwentintoeffectinAugust2024.Thelegislationappliesarisk-basedapproachtoregulatingAI,whichmeansthatdifferent

applicationsofthetechnologyareregulateddifferentlydependingonthelevelofrisktheyposetosociety.

ForAIapplicationsdeemedtobe“highrisk,”forexample,strictobligationshave

beenintroduced.Suchobligationsincludeadequateriskassessmentandmitigationsystems,high-qualitytrainingdatasetstominimizetheriskofbias,routineloggingofactivity,andmandatorysharingofdetaileddocumentationonmodelswith

authoritiestoassesscompliance.

TheEUAIActhasimplicationsthatgofarbeyondtheEU.Itappliestoany

organizationwithanyoperationorimpactintheEU,whichmeanstheAIActwill

likelyapplytoyounomatterwhereyou’relocated.OversightofallAImodelsthatfallunderthescopeoftheAct—includinggeneral-purposeAIsystems—willfallundertheEuropeanAIOffice,aregulatorybodyestablishedbytheCommissioninFebruary2024.

Essentially,organizationsneedtoberesponsibleatthecoreandproactively

operationalizeAIgovernanceacrosstheprojectlifecycle,supportcollaborativeriskmanagement,andadheretoevolvingAIregulationsandtheirpoliciesandvalues.

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

6

AsconsumersbecomemoreawareofAI’simpact,theydemandgreater

transparencyandresponsibleuseofAI.ManyorganizationsareintegratingresponsibleAIintotheirCSRstrategies,recognizingthatresponsibleAI

practicescanenhancetheirreputationandcontributetosocietalwell-being.BusinessesareadoptingresponsibleAItomitigaterisksassociatedwithAI,suchasbiases,securityvulnerabilities,andunintendedconsequences.

Thisproactiveapproachhelpsinsafeguardingtheiroperationsandreputation.CompaniesthatprioritizeresponsibleAIareoftenseenasleadersininnovation.Byaddressingsocialandmoralconcerns,theycandifferentiatethemselvesin

themarketandattractmorecustomersandpartners.

Thereisagrowingtrendofcollaborationbetweentechnologists,legalexperts,

andotherstakeholderstodevelopcomprehensiveresponsibleAIframeworks.

ThisinterdisciplinaryapproachensuresthatdiverseperspectivesareconsideredinAIdevelopment.WithincreasingregulationsliketheEU’sAIActandthe

U.S.AIBillofRights,companiesareprioritizingresponsibleAIpracticestoensurecomplianceandavoidlegalrepercussions.Thesetrendshighlighttheindustry’srecognitionofthecriticalroleresponsibleAIplaysinensuringsustainable

technologicaladvancement.

IDCdefinesRAIasthepracticeofdesigning,developing,anddeployingAIina

waythatensuresfairness,reliabilityandsafety,privacyandsecurity,inclusiveness,transparency,andaccountability.TocreatetrustinAI,organizationsmust

movebeyonddefiningRAIprinciplesandputthoseprinciplesintopractice.

AIgovernanceisessentiallythesetofprocesses,policies,andtoolsthatbringtogetherdiversestakeholdersacrossdatascience,engineering,IT,compliance,legal,andbusinessteamstoensurethatAIsystemsarebuilt,deployed,used,

andmanagedtomaximizebenefitsandpreventharm.AIgovernanceallowsorganizationstoaligntheirAIsystemswithbusinessandlegalrequirementsthroughouteverystageofthemachinelearning(ML)/generativeAIlifecycle.

IDCdefinesRAIasthepracticeofdesigning,

developing,anddeployingAIinawaythatensuresfairness,reliabilityandsafety,privacyandsecurity,inclusiveness,transparency,andaccountability.

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

7

FromRisktoReward:TheBusinessCaseforResponsibleAI

KeyFindingsfromtheSurvey

AccordingtoIDC’sMicrosoft—ResponsibleAISurvey,over30%ofthe

respondentsnotethatlackofgovernanceandriskmanagementsolutionsisthetopbarriertoadoptingandscalingAI(seeFigure1,nextpage).

Equallyimportanttonoteisthatmorethan75%oftherespondents

whouseresponsibleAIsolutionssaythatithashelpedwithdataprivacy,

customerexperience,confidentbusinessdecisions,brandreputation,

andtrust(seeFigure2,page9).Basically,bybeingproactiveandusing

RAItoolsandtechnologiestoidentify,mitigate,andmonitorrisksthroughouttheAIlifecycle,theycanmitigateunintendednegativeconsequences.

Asorganizationsarebuying,developing,anddeployingAIinawidevarietyof

solutions,theyarealsograpplingwiththeneedtodevelopresponsibleAIpolicies,procedures,andpractices.Accordingtothesurvey,organizationsarestillinthe

earlydaysofdevelopingandfollowingacomprehensiveresponsibleAIpractice

onaworldwidelevel.WhileAIisnotnewandorganizationshavebeenusing

AI-poweredsolutionsforawhile,onlythemoreAI-matureorganizationshave

beenproactiveaboutembracingitresponsibly.GenAIhasbeenacatalyst

tobroaderAIadoptionbuthasalsobroughtalotmoreissuesarounddata

security,IPleakage,hallucinations,copyrightinfringement,andthreatsfrombadactors.Onaregionalbasis,EMEA,LatinAmerica,andAsia/Pacificlagbehind

NorthAmericaintermsofgovernancestructuresandtechnologyusedtoenforcegovernance.Lackofhumancapital,dataavailability,funding,trustconcerns,

andregulationshavebeenthekeyinhibitorstoAImaturity(seeFigure3,page10).

Asystematicapproachrequiresproventools,frameworks,andmethodologies,enablingorganizationstomovefromprinciplestopracticewithconfidence.

EstablishingaresponsibleAIapproachthatisrobust,fair,andmaintainedon

anongoingbasiscanalsoenableorganizationstocommunicateandcollaboratewithconfidence.NorthAmericahasbeenattheforefrontwithearlyadopters

andmoreAI-matureorganizations.

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

8

FIGURE1

TopBarrierstoAIAdoption

WhathavebeenyourtopbarrierstoadoptingAI?

(Percentageofrespondents)

LackofAIgovernanceand

riskmanagementsolutions......................

Lackofskilledpersonnel(datascientists,

dataengineers,orAImodelers)....................

Lackoffairness,explainability,

transparency,anddatalineagetools..............

31%

30%

25%

Cost....................................................

25%

Adversarialrobustness

(securityandsafetyofalgorithms).................

Lackofcontentsafety

(abusemonitoring)...................................

Machinelearningoperations........................

Lackofadequatevolumesand

qualitytrainingdata..................................

Unclearbusinesscasesor

involvement/supportfromLOB.....................

23%

21%

21%

19%

17%

Decisioncriteriaofthesolution.....................

17%

Lackofmodelmonitoring

(dataandconceptdrift)tools.......................

Lackofdigitalwatermarking........................

17%

13%

Hallucinations.........................................

7%

Notes:DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.Multipleresponseswereallowed.Usecautionwheninterpretingsmallsamplesizes.

n=2,562;Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

9

FIGURE2

LevelofImpactofOrganization’sResponsibleUseofAISolutions

Howimpactfuldoyouconsideryourorganization’sresponsibleuseofAIsolutionsinpreservingeachofthefollowing?

(Percentageofrespondents)

Dataprivacy.........................................

Customerexperience

(satisfaction,loyalty)..............................

Confidencein(business)decisions

77%

76%

............

76%

Brandreputation

...................................

76%

Publictrust

...........................................

76%

Revenue...............................................

74%

Employeeexperience................................

73%

ESGratingsandinvestors’actions.................

71%

Avoidinghiddencosts...............................

Limitedregulatorybacklash—legalcompliance

69%

.....................................

69%

Avoidingcriminalinvestigation.....................

68%

Notes:DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.

Usecautionwheninterpretingsmallsamplesizes.Scoresarebasedonascaleof1–5(1=notimpactful,5=veryimpactful).n=2,562;Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

10

FIGURE3

GovernanceFrameworksinPlace:WorldwideandRegionalSplit

Whichofthefollowingarecurrentlyinplaceatyourorganization?

(Percentageofrespondents)

■Worldwide■NA■EMEA■APAC■LATAM

84%

87%

Clearframework(principles,policies,

technologies,andprocesses).................

83%

81%

89%

81%

Mechanismstoenforce/apply

73%

67%

70%

theframework..................................

70%

69%

75%

62%

Governancestructuretooversee

implementation.................................

66%

67%

Technologiestoenforceresponsible

AIrules,policies,andprocesses..............

66%

46%

57%

54%

60%

Notes:DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.Multipleresponseswereallowed.Usecautionwheninterpretingsmallsamplesizes.

n=2,562;Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024

Foranaccessibleversionofthedatainthisfigure,see

Figure3SupplementalData

intheAppendix.

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

11

ResponsibleAITooling

IDCisseeingthatorganizationsareusingavarietyoftoolstoensureresponsibleAI,rangingfromsoftware-based

monitoringtoolstoincludinghumanoversight(alsoknownashumanintheloop).

ThetoolsformonitoringandcheckingoutputfromAIrangefromcontent

filteringandabusemonitoringtobiascheckingandfromvisualexplainabilitytogroundednessdetection.Thisareaofsoftwareisrapidlyevolving,andIDC

expectstoseealargersetofvendorsofferingsolutionsinthisareaoverthe

next12–18months.Figure4(nextpage)showshoworganizationsarethinking

abouttheuseoftechnologycombinedwithhumanoversightastheRAItools

andtechnologiesarerapidlyevolving.Figure5(page13)showshoworganizationswillbeallocatingtheirbudgettoincluderesponsibleAIsoftware.ConsideringtheirlackofbothAIskillsandtoolstosupporttheirRAIrequirements,aboutone-third

oftherespondentsplantoleverageprofessionalservicessupportalongwith

RAIsoftware.

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

12

FIGURE4

AssetMixforMonitoringAfteranAISystemHasGoneLive:WorldwideandRegionalSplit

ToensureresponsibleuseofAIbyyourorganizationsoverthenext12–18months,pleaseindicatethemostlikelymixofassetstobeusedformonitoringafteranAIsystemhasgonelive.

Monitoringwillbedone...

49%

50%

51%

49%

(Percentageofrespondents)

Worldwide

NA

EMEA

APAC

LATAM

...mostlybyresponsibleAI

governancesoftwarebutwith

someoversightbypeople...........

23%

20%

5%

23%

19%

9%

24%

13%

8%

...mostlybypeoplebut

usingsomeresponsibleAI

governancesoftware................

22%

19%

7%

...byresponsibleAI

governanceplatformsonly

(i.e.,nopeopleinvolved).............

...bypeopleonly(e.g.,ethics

boardsdetermineethicaluse)......

50%

23%

17%

7%

Nomonitoringwillbenecessary...

2%

3%

2%

1%

3%

Notes:Totalsmaynotsumupto100%duetorounding.DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.Usecautionwhen

interpretingsmallsamplesizes.n=2,562(worldwide),n=611(NA),n=819(EMEA),n=832(APAC),n=300(LATAM);Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024Foranaccessibleversionofthedatainthisfigure,see

Figure4SupplementalData

intheAppendix.

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

13

FIGURE5

AIOrganization’sBudgetAllocation,2024

WhatpercentageofyourAIorganization’sspendin2024willbeforeachofthefollowing?

(Percentageofrespondents)

Worldwide

NA

EMEA

APAC

LATAM

34%

35%

35%

35%

36%

AI/MLgovernancetools..............

34%

Professionalservicesfor

32%

32%

31%

35%

responsibleAI........................

AI/MLdevelopment

17%

19%

18%

18%

17%

platforms/MachineLearning

Ops(MLOps)tools....................

15%

15%

15%

15%

16%

Others.................................

Base=respondentsthatindicatedorganization’splantospendmorethan$1ontheirAIprojectsin2024.

Notes:Totalsmaynotsumupto100%duetorounding.DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.Usecautionwhen

interpretingsmallsamplesizes.n=2,555(worldwide):n=611(NA),n=819(EMEA),n=830(APAC),n=300(LATAM);Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024Foranaccessibleversionofthedatainthisfigure,see

Figure5SupplementalData

intheAppendix.

TheAIregulatorylandscapeisdynamic,andcurrentlytheEUAIActandAmericanDataPrivacyandProtectionActarecriticalregulationsfororganizationstoadhereto(seeFigure6,nextpage).Itisimportanttonotethatwhiletheregulationswill

increase,organizationswillcontinuetospendonAIsolutionsbutdoitresponsiblyusingprofessionalservicesandgovernancetoolsandtechnologies(seeFigure7,page15).

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

14

FIGURE6

AIRegulationsCriticalforOrganizations’AIImplementations

WhichofthefollowingemergingAIregulationsarecriticalforyourorganization’sAIimplementations?

(Percentageofrespondents)

EUAIAct....................................

AmericanDataPrivacyProtectionAct

(ADPPA),specificallySection207*.......

Canada’sC-27Bill:DigitalCharter

ImplementationAct,2022................

D.C.StopDiscriminationby

AlgorithmsActof2021.....................

UKWhitePaperonAI......................

NISTRiskManagementFramework

andIndustryPlaybook.....................

ColoradoSB169:Concerning

ProtectingConsumersfromUnfair

DiscriminationinInsurancePractices....

Singapore’sModel

GovernanceFramework...................

SR11-7—SupervisoryGuidanceon

ModelRiskManagement..................

NYCAlgorithmicHiring

LawNo.144.................................

CFPBCircular2022-03/Regulation

B/EqualCreditOpportunityAct...........

TopRegion

NA

EMEA

APAC

LATAM

39%

33%

27%

27%

26%

26%

26%

24%

21%

18%

6%

*Whichrequiresanalgorithmdesignevaluationandalgorithmicimpactassessment.Notes:DataismanagedbyIDC’sGlobalPrimaryResearchGroup.DataisweightedbyITspendingbycountry.Multipleresponseswereallowed.Usecautionwheninterpretingsmallsamplesizes.

n=2,562;Source:IDC’sMicrosoft—ResponsibleAISurvey,March2024

FromRisktoReward:TheBusinessCaseforResponsibleAI

WhitePaper,sponsoredbyMicrosoftDecember2024|IDC#US52727124

TableofContents

15

FIGURE7

InfluenceofWorldwideIncreaseinAIRegulationsonanOrganization’sResponsibleAI

SpendPlansintheNextTwoYears:WorldwideandRegionalSplit

Foreachofthefollowingareas,howwouldaworldwideincreaseinAIregulationsinfluenceyourorganization’sresponsibleAIspendplansinthenexttwoyears?

(Mean—percentageofincrease)

■Worldwide■NA■EMEA■APAC■LATAM

AI-poweredsolutions...