Latest / The Road to Accountable AI / David Hardoon: You Can't Outsource Accountability

Transcript

David Hardoon: You Can't Outsource Accountability · The Road to Accountable AI

• 0:01
  David, welcome to The Road to Accountable AI.
• 0:03
  Thank you very much, Kevin.
• 0:04
  It's a pleasure to be here.
• 0:06
  You helped develop the Singapore government's approach to uh responsible AI at the Monetary Authority of Singapore, and then subsequently you've been in the private sector
• 0:16
  with two major financial services firms.
• 0:20
  What have you found is different from working on the government side versus in the private sector?
• 0:28
  Wow, no, great question to get off the bat.
• 0:31
  mean, obviously, when you're sitting in the government point of view, you have to take into consideration not just one single financial institutions.
• 0:39
  And actually, that's an important point to reference because it kind of brings us also to the other side of the fence as well.
• 0:44
  And then at the of the day, obviously, everyone does finance, there is certain different objectives, strategies, goals.
• 0:52
  And when we kind of craft that from a government point of view, government, excuse me, point of view,
• 0:57
  we need to think about how do we make sure that A, it's not overly prescriptive and allows ultimately for the context of an organization.
• 1:05
  And if I may, you would find quite repeatedly this concept of justifiability, as in it's not right off the bat a good or a bad thing, a right or wrong thing.
• 1:17
  It starts off with that question of, can you justify it?
• 1:21
  And can you contextualize it, let's say, to existing governance and government-based processes?
• 1:27
  And that's actually quite interesting because when we shifted, or I shifted to working within financial institutions, you kind of realize what that meant.
• 1:36
  Number one, as a highly regulated industry, there are already quite a number of governance uh type of committees from obviously cybersecurity, legal, truly governance data and so
• 1:48
  forth.
• 1:48
  So many times it's less of a question of how do we establish something new.
• 1:53
  But how do we now incorporate these underlying principles, these policies into the existing structures that are in play?
• 2:00
  And as I was alluding to earlier, it may differ from one institution to another.
• 2:04
  And then when really necessary, when there's a potential gap, how is that set up in a way that's relevant?
• 2:10
  Because policy is only as good as the paper it's written.
• 2:14
  It's about how you take it into fruition and its implementation.
• 2:19
  which really, really matters.
• 2:21
  And if I just say one last point is you don't know until you try.
• 2:25
  So there is a learning curve as well.
• 2:28
  Let me go back to the first thing that you said.
• 2:30
  What exactly is justifiability and how is it different from something like responsibility or ethics or accountability?
• 2:38
  I'm actually super excited you actually asked that question.
• 2:41
  Now, at the risk of being slightly controversial, I hope I'm not going to be, let me give you almost like a pedantic example.
• 2:48
  So let's take the usual question of discrimination, whereby obviously there's a concern that it's on the potential negative context of discrimination.
• 3:00
  Because obviously at of the day, that could be also positive from my perspective.
• 3:04
  Now, let me give you an example.
• 3:06
  You can take
• 3:06
  In the US, there is the point of view whereby sensitive type of attributes, gender, religion, et cetera, are purely prohibited, point blank.
• 3:13
  And similar other regulatory environments take the same kind of approach.
• 3:17
  But that then suddenly poses a problem.
• 3:19
  Why does it pose a problem?
• 3:20
  Because number one, when you're using type of AI algorithms, which go far beyond the traditional linear, low-dimensional, meaning we're only using one, two, three, four, five
• 3:31
  type of attributes, very rule-based, where you can
• 3:34
  arguably relatively easily delineate and identify when something goes wrong, you're now dealing with algorithms that have, well, gen.ai, millions of attributes.
• 3:44
  Quite candidly, you don't need to tell it a particular attribute for it to infer it.
• 3:50
  So now you see question number one is, actually, I may need that attribute potentially not to use it as part of a development process, but I need it as part of a verification.
• 3:59
  So you see, that's one dimension of justifiability.
• 4:02
  Another one, and again, purely hypothetical example, let's say um a maternity pregnancy-related insurance product.
• 4:10
  You kind of use certain types of attributes as part of that underlying process.
• 4:14
  So again, it's a justifiability.
• 4:16
  So think of it as almost as a three-tiered-based uh gate.
• 4:21
  The first one, as part of the process of building a solution within an organization, is can we justify to ourselves why are we doing it, what are we using, and what's the
• 4:30
  underlying purpose?
• 4:31
  Gate number one.
• 4:32
  Gate number two is just because you justify for yourself doesn't mean the regulator or the regulatory environment would accept it.
• 4:38
  It's justifying, like, look, this is why we're doing it.
• 4:41
  And then, of course, the ultimate litmus test is justifying it to the audience and the public because just because you say, I believe I can do it, just because the regulator
• 4:48
  said, well, it's OK, maybe your public doesn't accept it.
• 4:51
  So it is actually very, very important.
• 4:53
  Now, the problem with justifiability, and in fact, that was was uh feedback back to me when I was in the regular.
• 5:02
  And after we kind of circulated the guidelines and the policy was, but then David, it's not a black and white policy.
• 5:09
  mean, tell me what I need to do.
• 5:12
  Ironically, that was the point.
• 5:14
  It's like, I'm not going to tell you what to do.
• 5:16
  I'm going to tell you to think about it.
• 5:18
  It's about risk.
• 5:20
  It's about exposure.
• 5:21
  And as a final point, just to give an example, because I remember this was many years ago, we had two financial institutions that presented the use of AI with an HR.
• 5:29
  And again, a potentially highly sensitive environment.
• 5:32
  One was able to talk about that they're using AI in a very particular AI HR application and the rationale behind it, the reason behind it, and what is the intended consequences
• 5:42
  and outcomes that they're trying to do, and the governance associated.
• 5:46
  Well, another institution said, we thought about it, we looked about it, and yes, we know we can do it.
• 5:51
  We decided, no, it just doesn't fit into our narrative.
• 5:54
  So you see, that was the kind of I was alluding to in terms of it's not about a right or wrong.
• 5:58
  It's about is there a degree of
• 6:01
  relevance and then of course finally can you be transparent?
• 6:05
  Yeah.
• 6:06
  But what happens when those three tiers you talked about are in conflict?
• 6:09
  The company may have an economic rationale.
• 6:12
  This is justified because we can drive results from it.
• 6:15
  But we're concerned that the audience may be unhappy with it or something.
• 6:21
  Well, that's where, and again, in the financial sector, that's where the regulator kicks in.
• 6:25
  And in a way, in many situations, it's not just the financial regulator, you have a data regulator, you have, well, the representative from a social norm, which will come and say,
• 6:35
  well, I see you, I hear you, but no, you can't do.
• 6:39
  And again, let me give you a very concrete example.
• 6:41
  So I'm sitting right now in Singapore.
• 6:43
  And this is a story from actually for many, many years ago when the Singapore foreign minister of the French.
• 6:49
  And they were talking about how in the health sector, they collect a lot of demographic information as part of preemptive healthcare with respect to the risk of diabetes.
• 7:00
  And the French minister was mortified that they're collecting demographic and ethnic race information to provide.
• 7:07
  But he said, the reason we're doing is not to say that, Kevin, you're gonna have this and you need to do that.
• 7:12
  He's like, no, what we're seeing from analysis that you potentially have a high risk.
• 7:18
  please take that into consideration to make sure you have a healthy life.
• 7:22
  Now you see again, in one scenario, you could have, let's say, an insurance that said, OK, we justify it.
• 7:27
  But the environment says, sorry, no.
• 7:30
  We just simply don't accept it from a societal point of view.
• 7:33
  Whereas another one, they will say, no, it's OK, because it's aligned with some of the objectives.
• 7:38
  And by the way, Kevin, if I may say, this actually highlights one of the
• 7:42
  I don't want to use the word challenges, but the niches that is really, really important to realize when it comes to AI.
• 7:49
  AI, in the end of the day, is about information and insight and the management of it.
• 7:55
  And it's a representation of, ultimately, a society, a culture, a mode of operation, a behavior.
• 8:03
  This is something that when we craft policy, we need to be very, very careful, because sometimes you have the...
• 8:10
  The good intent of saying, no, this is a bad thing.
• 8:12
  You shouldn't do it.
• 8:14
  Again, if I may, let me give a concrete example.
• 8:18
  The EC, European Commission um AI Act.
• 8:22
  Just as one example, you have the four levels of risk from prohibited all the way to permissible.
• 8:28
  In prohibited, says, basically, if I overly summarize it, you should not use social scoring.
• 8:33
  The same uh as a policy, as an approach, you should not use for social scoring.
• 8:39
  Zoom to Southeast Asia where I'm sitting.
• 8:42
  You have very large sets of demographics, which never had a bank account, never had a debit card, never had a credit card, never had a loan.
• 8:50
  They are entirely outside the financial traditional system.
• 8:54
  uh There's arguably a shadow financial system.
• 8:57
  So if you now would come to me and say, well, David, I want a loan.
• 8:59
  I want to be part of this to elevate my status and my life.
• 9:04
  The only way I can create a proxy credit for you
• 9:08
  is by using alternative information with your consent and your understanding.
• 9:12
  But legally, that's the social score.
• 9:16
  Now you see my view and how I'm kind looking at it.
• 9:20
  Absolutely.
• 9:21
  And that makes some sense where the Singapore government can make policies for Singapore.
• 9:28
  for example, what discrimination means is different in a multi-ethnic uh jurisdiction like Singapore than maybe in Japan, and it manifests differently in the United States and so
• 9:38
  forth.
• 9:39
  But if you're in a multinational company, a bank that has operations all around the world, how do you deal with that?
• 9:46
  No, absolutely important question.
• 9:49
  And that's where it's really, really important having baselines within the organization.
• 9:54
  Before I even, again, whether it's my past life as a regulator or even as a consultant, obviously now within a financial institution, my very, very first question before you jump
• 10:05
  into applying uh AI, borderline policy to philosophy is what is your organizational stance from a
• 10:15
  culture point of view, from a vision perspective.
• 10:18
  And what you then find is that you leverage on that to enhance or leverage on from an AI point of view.
• 10:24
  So to your point, when you're dealing with a multinational, multi-jurisdictional organization, you will find that there'll be best practices, there'll be modes of conduct
• 10:34
  that are in the organization.
• 10:35
  So then it's very important that your AI applications are adherent to your conduct.
• 10:43
  your ethical stance, your sustainability on your underlying approach.
• 10:48
  I know it may sound the way I'm representing is like, but David, that sounds really simple, but that's ironically exactly many times my point.
• 10:55
  We complicate things sometimes because you're like, oh, but I can do this stuff.
• 10:58
  Yeah, absolutely.
• 11:00
  But just because you can doesn't mean you should.
• 11:03
  And the should is the guidelines that you've established yourself independently of AI.
• 11:12
  One more question about the Singapore MAS work.
• 11:15
  The FEAT principles in Singapore came out in, I believe, 2018, which is an eternity ago in AI years.
• 11:23
  So how well have they held up over time?
• 11:26
  And what have you seen in terms of the private sector engaging with those principles?
• 11:31
  Well, m you're absolutely right.
• 11:33
  It feels like an eternity when we release the Fanneth-Essex Accountability and Transparency principles.
• 11:38
  I would say, mean, perhaps two things that has been very interesting and has evolved.
• 11:43
  So number one is there's been an arguably a very positive adoption of, again, not necessarily these principles, but the baseline of what these principles are trying to
• 11:55
  represent.
• 11:55
  Because the message that if, I mean,
• 12:00
  Arguably at the point in time to the best of my knowledge this was the first financial regulator that actually issued AI related guidelines in the financial sector and it was a
• 12:09
  very uncommon way of doing it because actually was one page with 14 principles and it was very nondescriptive But that actually set the stage of how do you need to start thinking
• 12:21
  about AI?
• 12:22
  So there is a component of the development of it
• 12:26
  And thereby you think in terms of all the way down to data quality, methodology, testing, rigor, to the usage of AI.
• 12:34
  So you see my point.
• 12:35
  It kind of established that broader.
• 12:37
  And today you find quite more commonly and also within our institution the term AI safety, which it's not just the splitting of hairs.
• 12:45
  It's also a recognition that it's not just about AI governance, AI responsibility.
• 12:50
  It's also about cybersecurity of AI.
• 12:53
  It's also about
• 12:54
  legal risks of AI.
• 12:56
  We were talking about earlier conduct of, well, less about AI per se of conduct, but obviously the usage of people in terms of the conduct.
• 13:04
  Model risk management.
• 13:06
  So that's kind of what you've been finding that has been elevated across the, I guess, public sector.
• 13:12
  And to a certain extent, very much so from a regulatory regime in actually providing a lot more guidance, a lot more direction.
• 13:19
  And in some scenarios, know, sandboxes whereby
• 13:23
  there's an opportunity to kind of test it out when you're not quite sure what would be the potential outcome or the implications, and you want to have a slightly more monitored
• 13:34
  environment to do so.
• 13:37
  You recently joined Standard Chartered and I believe your title is head of AI enablement.
• 13:43
  What does that mean?
• 13:44
  Yeah, no.
• 13:46
  So I uh actually quite love the title now because it really literally is what it says on the tin.
• 13:52
  Ultimately, and to me, and I think to the organization, the vision is, well, maybe not quite the same as Word, but to some extent similar to that, whereby today you don't have a
• 14:02
  Word department.
• 14:04
  Everyone uses it.
• 14:05
  It's a fundamental capability and skill set.
• 14:09
  And that also if.
• 14:10
  not to obviously harp and go down the whole JNI term, but one thing that was genuinely beautiful about the introduction of it is it kind of broke the fourth dimension whereby it
• 14:21
  suddenly became easy to use AI.
• 14:23
  Beforehand, AI is this bunch of crazy folks in white coats sitting in dark rooms doing kind of math.
• 14:31
  So similarly, that goal and the ultimate objective is putting in place the principles, the methodologies, the foundational building blocks such that
• 14:40
  no matter who you are, all the way from a frontline user to someone who's more empowered in terms of engagement to obviously a developer, there is a capacity of doing it.
• 14:52
  Because one of the challenges, and I would like to believe across the more traditional industry, this may not be the case in the more startup and neural environments, maybe I
• 15:04
  can do it.
• 15:05
  So great, I have a team, I can do AI.
• 15:07
  I can build it, I can get it going, but it's just me.
• 15:10
  If it's the folks around the corner, they suddenly have the same struggles, it has to be the same investments, there's the same difficulties.
• 15:19
  So how do we go about approaching AI by saying, no, no, no, we want to building blocks that think of it as a uh public playground.
• 15:28
  We'll set the stage, we'll put some of the slides.
• 15:31
  So it's not just about me who's built it who can come in, but if you're saying, David, I'm ready, I want to do it, go right ahead, go about it.
• 15:38
  So that is it really is.
• 15:39
  It's about enabling others to be able to capitalize and benefit from the outcomes of AI.
• 15:46
  And in doing that, how do you get all those people in the organization to think about responsibility and governance?
• 15:53
  So one of the things that we've done, and again, I'm smiling because it's really, really, really great and important things to think about.
• 16:01
  And we thought about it.
• 16:02
  What we've done is we had AI safety.
• 16:04
  As I mentioned, we elevated the team, which we raised in place, which was focusing about responsible AI.
• 16:09
  And we actually called it, and there's a focus and a mandate of AI safety and AI talent combined.
• 16:16
  Why did we do that?
• 16:17
  Well, number one is we do need to think about AI talent.
• 16:20
  I mean, it is a career.
• 16:21
  It is a progress.
• 16:22
  uh
• 16:22
  training and enablement.
• 16:24
  And of course, I mean, it's working hand in hand with the training folks, learning and training, HR, et cetera, talent.
• 16:32
  But what it's also saying is that safety needs to be an embedded component of talent.
• 16:40
  It shouldn't be like, oh, Kevin, I'm going to train you to be a data scientist.
• 16:44
  And by the way, there's this course that you have to do or this video that you need to watch about governance.
• 16:50
  No, no, no, no, no.
• 16:51
  the two things have to come hand in hand from how you think about developing the consideration.
• 16:56
  And let me tell you, very honestly, a few decades ago, when I did my development and coding, if you would have asked me about discrimination and the potential, again,
• 17:08
  implication, very candidly, I wouldn't have thought about it.
• 17:13
  Not because I'm a bad person.
• 17:15
  It just wasn't there.
• 17:16
  But now, you see, is
• 17:18
  When it's been elevated to the point where by when you're educating, training someone, when they're going about it, it actually becomes a part of hygiene.
• 17:26
  Like, have you tested the distribution of your data?
• 17:28
  Have you considered the potential implication of key m attributes on the downstream?
• 17:34
  So you see, it's literally part of that process of learning how to code, how to test the underlying aspects, how to think about it from an MLOps point of view, from a monitoring.
• 17:44
  What does the accuracy mean?
• 17:46
  What is the case when my distribution has shifted?
• 17:48
  So you see, it's kind of breaking, I'll use again the term, the fourth dimension between I have this, which is talent and AI, and I have this, which is governance.
• 17:57
  We're saying, actually, it's one and the same.
• 18:00
  It's one of the same.
• 18:01
  Yes, it's policies.
• 18:03
  Yes, consideration.
• 18:04
  Yes, it's a rule book, because we must have one.
• 18:07
  But it's about, again, the implementation.
• 18:09
  It's about the execution.
• 18:11
  It's about the due diligence of actually rolling it out.
• 18:16
  How does that work in the gen AI era where it's not just a matter of say, know, model risk where models are interpretable, there's standard kinds of testing you can do.
• 18:27
  Now we've got these black boxes and they're probably models developed by a third party lab.
• 18:34
  So how do you train people the right way to address those issues?
• 18:37
  One thing that Jenny Ai has introduced, I'm kind of giggling in a bit, because my best friend called me up when Jenny Ai was introduced.
• 18:46
  She's a teacher.
• 18:47
  she says, you see, you're the reason I'm going to lose my job.
• 18:49
  I said, no, no, no, no.
• 18:51
  What it's actually done and introduced is if you teach the same way you've done before, then yeah, maybe.
• 18:56
  Because it's really more about memory recall.
• 18:59
  But now it's about critical thinking.
• 19:02
  It's about how you go about, I mean,
• 19:06
  I don't like the term prompt engineering.
• 19:08
  sounds a bit bleh.
• 19:09
  It's really about how you inquire.
• 19:13
  How do you interrogate knowledge?
• 19:15
  How do you...
• 19:17
  And that's actually a very important skill.
• 19:19
  mean, there's a big difference if you sit down in front of a prompt and say, write me a proposal.
• 19:24
  Yeah, it's gonna spit out something, but would you literally take that out and give it to your bosses or in front of a pitch deck?
• 19:32
  I mean, if you do...
• 19:33
  Well, all I'd say is good luck.
• 19:36
  Hahaha
• 19:37
  will find is people will sit down and they will spend time thinking about that support, that help.
• 19:44
  They will break it down into pieces.
• 19:46
  This is what I want.
• 19:46
  I can give an example.
• 19:47
  Something that I actually tell people a lot is when they do their prompt, to end it with literally ask me questions until I understand.
• 19:55
  So that, again, goes back to your question of what I think is really important in the gen AI generation of
• 20:04
  You really need to think about how you interact.
• 20:08
  really need to think about, just because you get an answer, don't take it to the bank.
• 20:13
  Think about it.
• 20:14
  Cross-reference it.
• 20:16
  Correlate it.
• 20:18
  Understand the implications.
• 20:19
  Verify.
• 20:19
  And then finally, apply your judgment.
• 20:23
  That is the most important part.
• 20:25
  Apply your judgment.
• 20:26
  Use it.
• 20:27
  Leverage the tool.
• 20:28
  But apply your judgment.
• 20:30
  All right, and that ties back into what you were saying where training and learning development is such an important piece here.
• 20:36
  Absolutely.
• 20:37
  Absolutely.
• 20:39
  What are the risks that you're most worried about, especially in a financial services context?
• 20:45
  What are the risks?
• 20:46
  Well, if you think about the risk is number one, the risks that we don't know, the unknowns, which is always the case.
• 20:54
  mean, that's the reality.
• 20:55
  And that's by the way, why we also did it as well.
• 20:57
  And I know other organizations have done it.
• 20:59
  We've established a research and innovation team because it's how do you address what you don't know?
• 21:03
  Well, you go poke and you start identifying.
• 21:07
  The second one, I mean, not to disappoint data.
• 21:12
  I mean, if anything,
• 21:15
  AI has reshined the light on this ancient old field called data governance.
• 21:22
  Just quality data, understanding the distribution.
• 21:25
  Like I gave an example.
• 21:26
  um If you look at payments data and you have a day when there's no payments, is that missing data or is that because no payments have been done?
• 21:34
  So you suddenly need to have a true, better, more thorough understanding of data, which again, is not new.
• 21:42
  from BCBS239, IvarS9, I mean, it's always been there.
• 21:47
  But it now really, really, really shines a light and goes, folks, you need to understand.
• 21:52
  Because even if there's error in data, by the way, or even if there's skewness in the data, you need to understand.
• 22:00
  And I'll give you an example.
• 22:01
  Again, the risk of being slightly controversial.
• 22:03
  But just for the sake of illustration, even when I was in the regulator, when we have debates about the potential risks,
• 22:10
  and the implications from data, we're like, OK, look at Europe.
• 22:13
  Europe, if you look at mortgage data, approximately the vast majority, at least back then, would be middle-aged white men.
• 22:19
  So obviously, I can't use it.
• 22:21
  I can't build models because the data is very biased.
• 22:23
  Well, hold on a second.
• 22:25
  The fact that you're able to identify that, that is actually fantastic because of what it means is you can, one, take the path of, OK, we can't build anything.
• 22:35
  Or you can say, no, we'll build something.
• 22:37
  But go back to justifiability.
• 22:40
  we will check because if the applicant is a middle-aged man, we will use the model.
• 22:44
  If they're not, we won't use the model.
• 22:48
  So you see, it really goes back to first principles.
• 22:52
  So ironically, that's the one which at times worries me more.
• 22:57
  And as a last point, if I may, I know there's a lot of or a lot of discussion about AI risks.
• 23:04
  And I think you'll find that there is some degree of
• 23:09
  not yet consensus, but more and more regulators are also kind of coming to realize this, is that actually in general, there isn't actually new risks.
• 23:18
  It's predominantly the risks that we have today.
• 23:22
  But now, just like AI is a function, you have a function on the risks.
• 23:29
  Some risks suddenly become extremely dangerous.
• 23:31
  serious example is, imagine you're giving lending of 50 bucks.
• 23:35
  So literally a microloan.
• 23:36
  In a traditional world,
• 23:38
  negligible.
• 23:39
  get, obviously, horrible if people default, horrible if a thing goes bad, but negligible from a risk management point of view.
• 23:45
  But if you suddenly have an AI algorithm that can literally issue out to 10 million people, yeah, that's going to become slightly systemic important.
• 23:52
  So that's what we need to start thinking of.
• 23:55
  It's not necessarily like, what are all these new risks that coming?
• 23:57
  Even hallucinations.
• 23:58
  mean, hallucination is not a new risk.
• 24:01
  Have you never had an intern?
• 24:04
  Have you never had someone new to a job?
• 24:06
  I mean, it's...
• 24:08
  It's not new, but now it's the systemization of it which potentially amplifies that underlying risk associated with
• 24:16
  yes, especially in that goes up another uh order of magnitude with agentic systems and more autonomy.
• 24:25
  So then how can organizations confront that systemization of risk?
• 24:29
  Well, as a very wise woman, my mother says, you can't bowl the ocean to make a cup of tea.
• 24:36
  So number one is recognizing that we are dealing with same risk.
• 24:41
  I'm literally not saying that this is the perfect way of doing it, but I always like to, because I'm a first principles kind of person, I like to go, OK, you have agents today.
• 24:52
  They just happen to be human.
• 24:54
  How do you deal with that risk today?
• 24:56
  Now, why do I do that?
• 24:57
  Because if the answer is,
• 24:59
  is anywhere around the region of we don't, then yeah, don't even look at AI.
• 25:06
  You need to have a baseline management of risk, number one.
• 25:11
  Then you go to the level, within this world of process, which are the risks that we're able to mitigate and manage in an automated fashion by saying, well, through degree of,
• 25:23
  let's say, a confidence interval that says, look, I'm giving you this result, but I'm not quite sure.
• 25:28
  we can control it with human over the loop or human in the loop in terms of a um maker and checker, where the maker is an agent and the checker is a human.
• 25:36
  So you see my point.
• 25:38
  You start dissecting it, and you take it incrementally.
• 25:41
  Now, I know, especially when you look at the Fintechs and you look at all the juicy stuff that's happening, it's like, no, but I want that.
• 25:48
  I want the F-16.
• 25:49
  I want whatever, the supersonic jet and all that.
• 25:52
  It's like, I hear you, but you haven't flown a Cessna yet.
• 25:57
  fly the Cessna, then maybe go to a jet, and take that incremental, because that is also a risk mitigation based approach.
• 26:05
  And you sometimes want to take a few extra steps because it makes it far more resilient and far more robust.
• 26:13
  You talked a minute ago about the underlying data governance challenge.
• 26:17
  And as you pointed out, this is not new, but organizations, one would think by now should have realized how big a problem this is, not just in terms of business deed, but with
• 26:27
  regard to regulation.
• 26:29
  GDPR has been around since 2018 requiring, know, for privacy reasons and data protection reasons, companies to better understand their data, but they still often don't.
• 26:40
  So...
• 26:42
  what's going to make that actually change in the AI era where I think there's a risk that the companies are going to say, well, this is great.
• 26:49
  I don't need to think about it.
• 26:50
  The AI will just do it for me or I'll farm it out to a scale AI or a company that's in that world to do it for
• 26:57
  Yeah, no, I can't see this with my ex regulator kind of goes.
• 27:02
  That's a risk.
• 27:03
  That's a very, very, very, you can't outsource accountability.
• 27:08
  know, talk about a risk you cannot outsource accountability.
• 27:11
  If anything, well, look, we're doing it.
• 27:15
  And I would like to hope that others will take that kind of approach whereby saying what is AI given us?
• 27:20
  It has given us the end application.
• 27:22
  It's given us that shiny tool that goes, I want that.
• 27:25
  So
• 27:26
  In other words, and look again, just being pragmatic, the problem previously with data governance is it's this hidden job.
• 27:35
  It's the plumbing, it's the piping, it's not the glamorous stuff.
• 27:38
  And only a few people, I raise my hand because I'm one of them who gets really excited about it and wants to it done.
• 27:43
  So it's seen as a cost rather than a business impact.
• 27:48
  Now suddenly you have AI that is seen as a business impact in terms of increasing revenue, reducing costs, mitigating risk.
• 27:56
  but it's linked back to data governance.
• 27:57
  So in a way, you suddenly have that motif by saying, well, I want that 30 % improvement on revenue.
• 28:03
  OK, let me spend that money because anywhere I can cost it in to help make sure I have those controls on data.
• 28:09
  if anything, I would hope it has given us more of a motivation to do it down with the right and proper investment and not just as a compliance requirement.
• 28:20
  If there's one thing I even used to say back in the good days of 2018 is,
• 28:25
  Governance and compliance is not a ticker box exercise.
• 28:30
  It's not a cost.
• 28:32
  It's actually a revenue center.
• 28:34
  Because if you do it right, if you do governance right, it not only improves, it has the opportunity of enhancing, products, and revenue opportunities.
• 28:46
  So like I said, AI, I hope, maybe I'm wrong, but it kind of gives that extra motivation to do so.
• 28:54
  completely agree with you on that, that this should be seen as an enabler.
• 28:59
  But how do you actually make that case in an organization?
• 29:02
  Is there data that you can show?
• 29:05
  Are there metrics, a way to make the positive case for government?
• 29:09
  No, there is.
• 29:10
  And so obviously, the best practice before you jump into a full blown production uh system is you'll do an MVP, minimal viable product.
• 29:19
  Or even before that, you do a proof of concept or a proof of value.
• 29:22
  Choose your acronym.
• 29:24
  Now, many times whereby, let's say, there isn't yet that uh buy-in on the importance of cleaning data is.
• 29:33
  also, sorry, just to jump in is.
• 29:35
  Many times, the people come from the technical background and be like, no, no, no, but we have to do this right.
• 29:39
  We have to fix the data.
• 29:41
  I actually like to take a slightly different approach.
• 29:42
  It's like, you know, it's OK.
• 29:44
  I'm fully cognizant that the data perhaps is not as spicy as it should be.
• 29:50
  Let's just go ahead and build those front end consumption layer on the application.
• 29:55
  Because anyway, it's a proof of concept.
• 29:57
  It's mitigated.
• 29:57
  It's air gapped.
• 30:00
  I remember cases whereby we would do it and then
• 30:04
  the business would go, ah, we now understand what you meant by the data is We didn't realize that a company can have 15 different ways of writing it.
• 30:14
  Yes, we need to clean the data.
• 30:17
  And by the way, when I say clean the data, actually, we need to clean the process, because it's the process that's resulting in the data.
• 30:24
  So I find that it actually shows it, because at end of the day, if we're collecting bad data, why are we collecting it?
• 30:31
  We're collecting data because it needs to serve a purpose.
• 30:33
  So it actually serves two reasons.
• 30:35
  One is we go, OK, this is the implications of how data has been collected and its usability.
• 30:42
  So either we now have a justification, a monetary justification, be it cost or revenue, to go back and rectify it, or we suddenly go like, well, actually, this doesn't make sense as
• 30:51
  a business.
• 30:51
  We should just stop doing it.
• 30:53
  Let's say we're onboarding a completely messy environment that doesn't have the proper data, et cetera and so forth.
• 31:00
  Maybe the cost of dealing with it
• 31:03
  far exceeds the revenue.
• 31:04
  it suddenly puts a numerical value on what was before, you know, very ethereal in its way.
• 31:14
  You're at a major financial services institution, which is highly regulated and has all companies like that have a long history of dealing with model risk and data governance and
• 31:26
  so forth.
• 31:27
  uh For organizations that don't have that starting point, where would you say they should begin on this journey?
• 31:37
  So again, fantastic questions, Kevin.
• 31:41
  The first one I would say is begin.
• 31:43
  And I know this sounds a bit like, but I do mean that because especially if you're regulated, you slightly have an unfair advantage because you're kind of given a shove in a
• 31:54
  direction.
• 31:54
  You kind of have to start in a very specific place.
• 31:57
  If you don't have that luxury, let me use that term, is because the ultimate intent of governance is actually just do no harm.
• 32:06
  That's the intent.
• 32:08
  It's to make sure that a business is sustainable, it can continue, and it's providing a transparent and beneficial service ultimately to whoever the customers, uh businesses B2B
• 32:21
  basis or B2C point of view.
• 32:23
  So really my recommendation is just start, whichever place in the supply chain.
• 32:28
  Now, the other good thing is because you have regulated industries from financial services, health care, energy,
• 32:36
  You can always look at their models.
• 32:38
  You can always look at their frameworks, which are very, very much available in the public domain, and go like, well, look, I'm going to adapt it to me.
• 32:47
  I'll take the good, and I'll drop the bad in terms of things that don't quite fit.
• 32:51
  Now, and the second one is, as again, perhaps this is a really silly example, but at many times, you don't need to have a regulator to do you the right thing.
• 33:01
  Just like when you cross the road.
• 33:03
  You don't need someone to tell you to look left and right before you cross the You cannot do it because you want to keep on being able to cross the road.
• 33:09
  Again, to me, organizations need to shift it in that it's not just a uh lip service.
• 33:14
  It's actually business sustainability.
• 33:17
  It's a trust mark.
• 33:19
  And we've seen this already over the last decade or so of how the public also responds.
• 33:24
  So if you're able to say, I am doing the best I can.
• 33:28
  I am doing the best I believe that I'm doing, don't get me wrong.
• 33:33
  I will learn, I will improve, but it's a very different response from you as a customer with like, anyhow, it's okay, I'm just gonna do whatever.
• 33:41
  It's very, very different.
• 33:42
  Just like, again, a silly analogy, friendships.
• 33:46
  Are you telling me that a friend is never gonna make a mistake?
• 33:48
  Of course they will.
• 33:49
  But the difference is a friend will come to saying, look, Kevin, I messed up, I'm sorry.
• 33:53
  I'm gonna do better, I'm gonna learn and improve.
• 33:56
  So that will be my recommendation to them is do the right thing, realize that it's about business sustainability,
• 34:02
  And it's about doing a right internal continuity with the customer, that fiduciary responsibility.
• 34:08
  Great.
• 34:09
  David, thank you so much for the conversation.
• 34:11
  It's been my pleasure.
• 34:12
  Thank you for having me.