Regulating AI: Creating a Robust AI Framework

I will use an easy Christmas analogy. Think of a Christmas tree and AI is the shiny star at the top of the tree. Do you put the star on first before you decorate the rest of the tree? or do you decorate the tree and then put on the star?

I think most (I think most…) will do the latter. You want the tree to look really good and then you top it off with the shiny thing. The same applies to your business and agentic AI – sort out the business first and get it operating efficiently with data and then top it off with the shiny AI star.

Build up to the star, not work down from it.

In this article, I want to delve into some of the mechanics which will enable you to have a successful implementation of AI across any business, leveraging insights from AI strategy consulting to ensure alignment with your goals. AI in all of its forms is extremely exciting, however it will be very easy for organisations to slip into unmanageable and costly implementations


What is an Robust AI Framework?

GenAI Architecture Slide

This will be a foreign concept to many, even users who regularly use AI in their personal lives or as part of their work. A framework is simply a supporting structure of an object and something which ensures that everything relating to that entity is controlled and managed through the defined parameters or architecture.

Having an Robust AI framework means that you as a business have taken measures to ensure that you have full visibility of how AI, including AI in cloud computing, is being used across the business. Without it you will risk it turning into the wild west.

The diagram above gives you a solid example of how we would like to structure AI within an organisation.

We want to:

  • Define all the input layers of data feeds
  • Ensure we have orchestration and monitoring over all the AI agents we have deployed
  • Have control over our Data Stores and Modelling
  • Know exactly what our output layer is doing and who/what is consuming the data, when leveraging ai for business intelligence to drive actionable insights.
  • Underpinning everything we have the oversight and controls to manage the whole implementation.

A focus area for me in Dufrain is to make all of this manageable. We as a business want to provide clarity and transparency over your AI agents with control, insights and reporting so you know exactly what is happening at all time. Watch this space.


Why do I need one?

My personal fear for many organisations is that we will end up in a world where we have ‘AI Agents for Agents Sake’, meaning that we have a proliferation of AI Agents which are either not delivering value or costing the business money through no requirement to have them.

Microsoft have released some major updates to Copilot, giving you Copilot studio, where you have an environment for exploring, building and deploying agents. It still has a long way to go before it is a complete environment, but it does make it incredibly easy to deploy basic Agents on top of some common data sources (Sharepoint etc). With this ease comes risk of creating more and more agents.


Good Data Ownership, Data Governance and Data Management

They key to everything is making sure you understand your data and the controls around it. It is quite hard to do and does take a program of work to really make it a success, but when it works it will reap benefits beyond an AI in cloud computing implementation.
Some key elements to consider in this space:

  • How advanced is the Data Literacy within the business?
  • Do the business employees understand the concept of data and its significance, as well as their roles in it’s handling?
  • Are all of your organisational policies and procedures in the state they should be?
  • How modern is your data architecture (are you on-premise, hybrid or full cloud)?
  • Do you have a lot of third party applications?
  • Do you lose revenue and time every year due to poor data quality?

Data Privacy: Creating an AI Agent Inventory

To comply with GDPR article 30, businesses are required to store accurate and up to date Information Asset Registers (IAR) and Records of Processing Activity (RoPA). IARs document all the critical pieces of data around the business and RoPAs document a deeper level of every process which involves customer or Personally Identifiable Information.

Deploying AI Agents is great, but they need to be recorded and we need to be able to evidence exactly what information they have access to and what they are doing with that information. If you don’t do this, you are putting your customers data at risk and exposing yourself to potential regulatory implications if something was to happen or surfaced in an audit, for example.

My advice here is to bake this early on into your build phases. Building a new product? add it to the inventories. Business case for a new AI Agent? add it to the inventories. You get the gist. The sooner you make it part of official process flows, the easier it will get.


Summary

Hopefully by now I have convinced you that you should be thinking about how to adopt AI before progressing any projects further. It might feel laborious, but with the risk which AI carries, the potential high costs and troublesome management, it is worth getting in place.

Remember, it can always be tweaked later. It is not a one and done activity, it can grow and scale as your knowledge increases.

Unsure which AI solution is the best fit for your business? Read our AI solutions for business blog for further insight into the available options. Interested in how data and AI is shaping the future? Read our data and AI trends in 2025 blog to find out more.

If you would like to discuss any of the above in more depth then please do reach out to Dufrain, we specialise in all of the foundations which will ensure a successful AI implementation.