Latest / The Road to Accountable AI / Heather Domin: From Principles to Practice
Transcript
- 0:00Heather, welcome.
- 0:01It's really a pleasure to have you on the podcast.
- 0:04Glad to be here.
- 0:06Tell me a little bit about your background.
- 0:08How did you get involved in the area of AI governance?
- 0:13Yeah, so for me, it's been a number of years now of interest.
- 0:18And in fact, going back before AI governance was a thing.
- 0:22um think, you know, even as I reflect back on ah my early years of education, I always kind of skewed my projects and the things that I studied towards um the ethical trust
- 0:38areas and how they intersected with technology.
- 0:42And so, you when the opportunity came to uh actually work in the space, it was very appealing to me.
- 0:49had the opportunity to, while working at IBM, uh help establish many of the foundational practices that, you know, we were setting up at the time around AI ethics and governance.
- 1:04and have worked then with a number of groups like the IAPP to help establish the profession.
- 1:11I was one of the original subject matter experts brought in to set up the AI governance professional certification.
- 1:18I now co-chair that certification.
- 1:21And I now lead the Office of Responsible AI and Governance at HCL Tech and get to continue working in this space.
- 1:29So it's a pleasure.
- 1:32Let's go back to the beginning.
- 1:33You said you always were interested in these ethical questions and you have a PhD, I believe, in data science.
- 1:41what appealed to you about these kinds of topics back then?
- 1:46Yeah, so I think it was the types of questions that were coming up in, you know, common conversations with my family.
- 1:58think it's one of the ways that, you know, I have a lot of academics in my family, a lot of uh people who like to think deeply about tough questions.
- 2:08And um at the same time, uh
- 2:11You know, my brother is in um computer science and we have lots of like technology focus.
- 2:17And so it's this intersection of, you know, this stuff is amazing, but, you know, why are people concerned in the news?
- 2:26Like what's happening and kind of dissecting that.
- 2:28So it's a very interesting, um you know, philosophical challenge, m social challenge, as well as a technical challenge in many cases.
- 2:40And so
- 2:41I was always curious then, okay, what made the system do that?
- 2:46Why did you get that outcome?
- 2:48And so that uh particular answer was something I've always been interested in trying to answer.
- 2:58Yeah, that question, yeah.
- 3:00Do you feel like data scientists and engineers and computer scientists more generally are more willing to accept now that there are ethical and other dimensions of what they do as
- 3:12opposed to saying, well, I just build the system to work effectively to its specifications.
- 3:17That's for someone else to
- 3:20Yeah, I've seen a major uh shift in that even um in the education space, like early on, you know, in my data science education journey, know, ethics was maybe one chapter in one
- 3:37course.
- 3:37It really wasn't covered much.
- 3:39I'm now seeing many more programs, you know, people that I work with and that I have the pleasure of interacting with.
- 3:49have the opportunity to go much deeper and learn much more about the ethical aspects of technology and there's full-fledged programs around it.
- 3:59I think it's also, you know, in the workplace, in the workforce, it's now we have a growing number of AI literacy and educational programs and efforts that help
- 4:17people actually in the development jobs understand the potential risks and how to mitigate them.
- 4:23is still though, I would say a challenge because there is, we're still pretty early, especially in the AI space, right?
- 4:34This particular technology of adoption and putting it into full fudge production offerings and deployments.
- 4:45And so,
- 4:47that because it's like, okay, we have to get this AI off the ground, this AI system, we have to make it effective.
- 4:54ah We have to make sure it's accurate, it's reliable, it does what it's supposed to do, which is all by the way, very important from a responsible AI governance standpoint.
- 5:04But there's additional factors as well that need to be tested.
- 5:08But understanding like, you know, the 70 plus bias metrics out there is still a specialty area.
- 5:14The good news is that we are seeing also the, I would say, wide expansion of inbuilt methods for testing and tools for testing within the platforms that developers and data
- 5:32scientists are actually using, which is, I think, enabling them in a way that they were not enabled in the past.
- 5:43So if you know how to turn on your content safety filters and you know what to look for and you use your governance platform for running the test and the APIs and things like
- 5:55that, that all is relatively new and I think um pushing us forward quite a bit.
- 6:04One of the challenges in this area is that uh even though they're, as you point out, dealing with the same concerns, the engineers and the technical people tend to speak a
- 6:14different language than the lawyers and the compliance people who are both involved in this area.
- 6:20So as someone who's really sat on both sides of that, how do we effectively get those conversations to happen where they can realize where they're addressing the same?
- 6:31Hmm.
- 6:33Yeah.
- 6:33So I think we do need cross functional groups and it's one of the early ah
- 6:42challenges that I think when people were looking at AI ethics, they understood, right?
- 6:46This is a socio-technical system.
- 6:49There are multiple aspects.
- 6:51We're going to need cross-functional teams to address them.
- 6:54um so part of the way we see that in practice is, of course, we want, um you know, within teams, a certain amount of cross-functional expertise and experience, but also
- 7:10in the management system that you have around it and how you actually govern at an organizational level.
- 7:16ah Like I chair our AI ethics committee at HCL Tech and we have, ah you know, in many other organizations, boards and committees that help bring together a number of different
- 7:30groups and weigh in and collaborate.
- 7:34Now, uh I think those sort of forums are incredibly important
- 7:39And then that's also at a policy level and an organizational level where you can uh influence and get people to work together and form as many of those leadership level
- 7:52connects that you need when it comes down to a given model or system, having the engineers and the legal people talk to each other.
- 8:03So you build those leadership connects, open the doors, um
- 8:09You can also enable, uh for example, even during an assessment process that you have specific points of contact from legal and from the data scientist team that are
- 8:22responsible for that given um product line or that given offering that you have.
- 8:29So it's combination of, I'd say, lower level connects that you need to be happening.
- 8:36within the organization, the front line, and then also the um leadership connects.
- 8:45As you said, you spent a number of years at IBM uh doing some of the early foundational work in this area.
- 8:51It's probably an unfair question, but what are some of the things that you took away from that experience that you brought into your current role?
- 9:00Yeah, it was a fantastic experience for me.
- 9:04I really enjoyed the energy and the collaboration um that we had during the time and the excitement around a new area.
- 9:16um so part of what I took away was just an excitement and a love of the uh topic and the challenges that come.
- 9:26And it's actually, it's something that I see and as I've
- 9:30hired my team and helped build my team, the people that get excited about the challenges and want to help find solutions, this is a great thing to bring into this type of role
- 9:46because so many of the challenges are new and also we continue to see more new ones all the time.
- 9:54And so I think
- 9:58how you address this is a um key takeaway for me.
- 10:02So a key part of being successful and effective in this type of field.
- 10:08um And then I think also, um there were so many things that uh I learned from the researchers that we worked with, so incredible IBM research folks and um the many diverse
- 10:26teams that we came across.
- 10:28So I loved, you know, working in this global organization.
- 10:31So obviously now working in another global organization and understanding how to connect these diverse groups and how they can work together.
- 10:40mean, every company is different.
- 10:42So that's an interesting thing.
- 10:43But there are some commonalities in terms of how you can bring uh team members together and what types of roles ah need to be at the table and connected.
- 10:55So it's m
- 10:57It's definitely a lot of lessons learned that I've been able to take forward.
- 11:01Great.
- 11:02I want to get onto HAL Tech, but I want to just follow up on one thing you said, where you talked about people being excited about doing this work.
- 11:10I think some people on the outside would think, responsible AI, it's about saying no, or it's about saying there's a risk this could go wrong.
- 11:17um So what is it that excites people and excites you?
- 11:21Yeah, so I think it's uh meaningful work and these are big issues, important issues that need to be solved.
- 11:32And so I think it gives you that sense of, you know, really tackling something that's important.
- 11:40And it's exciting to see also, I think what's exciting about it is that often, at least for me,
- 11:47The technology side of this also that keeps shifting and enabling better outcomes.
- 11:53mean, the rate at which the technology is evolving is amazing.
- 11:57uh And also the research and the solutions to help solve that are also rapidly um growing and changing all the time.
- 12:06And so I love, you know, um like when I was helping to roll out the first AI impact assessments at IBM and it was
- 12:17so much more manual and now we have all these amazing tools that can support that and enable the process in ways that it's like, wow, just a couple, you know, a few years ago,
- 12:27this was a much harder challenge to solve.
- 12:31uh so when you see that continued progress, that's also exciting.
- 12:37Yeah.
- 12:39Even though the technology is advancing super fast, you think the response mechanisms are advancing even faster.
- 12:46I do, I do.
- 12:47Yeah, because I think, you know, it's a...
- 12:55something actually probably, you know, obviously I haven't worked in a lot of other technology areas, but I understand that this is a unique aspect in that the widespread
- 13:06awareness and social pressure and awareness around the potential risks is driving more focus than in other previous, you know, development of technology.
- 13:19So it's pretty exciting.
- 13:22Yeah.
- 13:24Yeah, look, I'm excited too.
- 13:25I'm just playing devil's advocate and asking these questions.
- 13:27But I think it's a really critical question how fast things are moving.
- 13:32again, I would tend to agree with you.
- 13:34And certainly the point you're making is important in terms of how good the tooling has gotten.
- 13:38But I hear a lot this assumption that it's all going so fast that we can't possibly keep up.
- 13:45Yeah, yeah, that's a concern I hear often as well.
- 13:50And I think what fuels that in particular is that all the time people see news, like news stories, and then, you know, the tech company will respond with, well, we didn't know that
- 14:05that was there.
- 14:06But then you also see if you check like a few days later, sometimes like they fixed it already.
- 14:12It's incredible.
- 14:14You know, and so.
- 14:15um
- 14:18It is, you know, a challenge we have to, you know, that's certainly it's not that it's not a concern because, you know, we don't want ideally and it's also hard to know how many of
- 14:31those things actually got fixed, like how many things we not see in the news, right?
- 14:35Because I think and no, right, so much more is getting fixed before it even gets out.
- 14:42Now, I think but what does get out scares people.
- 14:44I think it's just the scale.
- 14:47at which these systems are being rolled out, um that we start to see more of these um situations hit the news.
- 14:55And it's also a headline, right?
- 14:59So it's getting a lot of attention um these days.
- 15:04Tell us a little about HCL Tech.
- 15:06It's a very big global company, but not everyone, especially outside of tech, knows what it does.
- 15:12uh And what are some of the particular issues that you have to contend with on doing responsible AI and governance there?
- 15:21Yeah, absolutely.
- 15:22So, HCL Tech is a global technology company with more than 220,000 employees operating in 60 plus countries.
- 15:32And we have clients all over the world and work on many different aspects of technology, um including, you know, managed services and how we help clients actually deploy.
- 15:44You know, we're an uh integrated service provider, we can help to
- 15:50um manage very difficult technology challenges that many other companies value that we can do.
- 16:00This is a very valuable service as well as we have AI capabilities m and platforms that we um put out and help develop.
- 16:11So we develop ourselves.
- 16:12We also help clients develop AI systems.
- 16:14yeah, um what's kind of unique from
- 16:19maybe other companies is that a lot of it is it's very client oriented work.
- 16:26So from an AI governance standpoint, right, it's ah much more about the client uh project, right.
- 16:35So we're dealing with a lot of individual client projects, ah which all have very unique aspects, right.
- 16:42It's a little different, I guess, if you were in an organization that ah developed one product or, you know, certain type of
- 16:49product set and you have to manage the AI governance risks around that.
- 16:54We're dealing with uh many, many clients all over the world in different projects and um that does present uh unique challenges.
- 17:04um Luckily, the company has very, very good enterprise risk management support already, right?
- 17:13So there's a lot of ingrained.
- 17:15Also quality control, because basically the history of the company is engineering, right?
- 17:21So very engineering uh heavy uh background.
- 17:26so especially on the technology aspects, that tends to be very easy for the uh teams that I'm working with to understand.
- 17:38that even more so than some of the other things is actually the technology solutions, which is very cool.
- 17:45What is the fact that you have all these different client engagements mean in practice for the work you're doing on AI governance?
- 17:54Yeah, so it means that we have to be sensitive to the fact that, for example, if a client um has a preference for a given environment, so not every client is going to want to adopt
- 18:07um governance controls that you've used in another um client that may be using a different cloud provider and a different base platform, they want to operate in their environment.
- 18:22They also have their own
- 18:24tend to have their own AI risk management policies and governance policies they want you to comply with.
- 18:31So we have our own for our company, our own standards and our own policy that we follow just across the board, but then also have to manage and consider what the client wants.
- 18:45And so it's a combination.
- 18:46You're often working with two sets of policies that you're working to follow.
- 18:55And how much variation is there?
- 18:57Because every company now has a set of AI principles, and everyone understands this is a risk.
- 19:03So how much does that really matter?
- 19:05So typically it's not that much of a difference in terms of the high level controls and expectations.
- 19:15I think that there can be differences, especially based on jurisdictional focus.
- 19:21So if it's a client in Europe, they may be very concerned about particular laws like the UAI Act.
- 19:28then in other cases, if we're in Canada or wherever, they have their own specific
- 19:36uh jurisdictional differences, I'd say, and what they put the most focus on, which might mean that you're going to apply more controls, more ah or even specific controls for that
- 19:48given jurisdiction.
- 19:49um And so that can be something that is certainly possible and does happen.
- 19:58What um did you feel was the most important starting point for putting together an AI governance program?
- 20:06So I think for me coming in new to the company, I really wanted to understand ah the need and the gap from where we were.
- 20:17What do we need to address?
- 20:18ah What things were already being handled very well and what things could we do better ah immediately?
- 20:29And also to make sure that, ah for me personally, to build the relationships that
- 20:37I knew would be important from the beginning, right?
- 20:41So a lot of this when you're operating in a large company, you have to form a lot of partners.
- 20:48It's all, you know, nothing happens in a silo.
- 20:51ah I think even in small companies, but you know, especially in larger uh organizations in my experience, it's just, um you know, understanding and having those relationships so
- 21:03that you can be effective.
- 21:04um
- 21:05And certainly we don't do this alone, this type of role and work alone.
- 21:13There's a lot to do.
- 21:15So for me, a lot of it was making sure that the AI governance program was appropriate and effective um in the context of the organization.
- 21:30so understanding the organizational needs and the people.
- 21:35And then from there, right, because it's a process then also of, you know, prioritization and some of it's also just what's possible, right?
- 21:47So you can do things sort of in any given order.
- 21:53Obviously, one of the first things we did was set up an AI ethics committee and, you know, really make sure that we started educating people a lot on
- 22:05the AI governance um policy that we have and how do we put in place those controls.
- 22:11So lot of it is um some of the things that you would expect anywhere, but just making sure also that it fits for the organization.
- 22:23So a lot of AI governance work on the ground is how do I fit it into an existing process?
- 22:30So there's an existing process, how do I insert um
- 22:34the AI governance requirements, you know, in our procurement process and our, you know, what we do with clients and the actual life cycle of that client interaction, right?
- 22:46So a lot of it is process-based understanding.
- 22:50And then also, I think from a technology standpoint, understanding how the development teams work and at what point do they need in their process, a control or a test run.
- 23:03And so it's a lot of the details around that stuff.
- 23:11How do you answer those questions?
- 23:14ah Well, it's not an easy question.
- 23:18Those questions are not easy.
- 23:19They're basically um context specific, which is often what we hear in the case of AI, right?
- 23:26So it's uh what is the use case?
- 23:28What is the context?
- 23:29And so I think for it's the same way like deciding on the governance controls.
- 23:35um We have um quite a bit of, um you know,
- 23:44if the um control itself needs to be um adapted or...
- 23:53So given the type of work we're doing with the client, for example, could be something that we need to think about.
- 24:01um And also where we have client teams that are working on particularly high risk industries, um making sure that we have...
- 24:11um
- 24:12clarity because there's often an intersection between existing laws and highly high risk, highly regulated areas and the AI governance laws.
- 24:20So what is that intersection point?
- 24:22Like we've done a lot of work like with our life sciences and healthcare groups.
- 24:27you know, that becomes a question of two.
- 24:30mean, this, this is a control you're inserting that is also in the context of many, many others.
- 24:39You mentioned earlier that the tools and automation capabilities for responsible AI have advanced a tremendous amount over the past decade or so.
- 24:51What are the things that you uh most want that you don't have in terms of capabilities or tools to do the work you do?
- 25:00So I think that we have a lot to do on agentic AI still.
- 25:08I think this is just because the technology is so new.
- 25:10think that I've seen a lot of really good research and a lot of good early um product capabilities around this.
- 25:19I think we still have quite a bit more that we need to do and we'll see in the coming years.
- 25:27And that is the technology too.
- 25:30again, is something that we are seeing picked up very rapidly.
- 25:36But I am seeing a lot of movement in the research and development of uh governance controls for agents.
- 25:45think also um
- 25:50some of it is still in the process.
- 25:52What's really interesting about AI governance itself as a function and as a profession and the area where people work, it can fit organizationally in many different parts of uh a
- 26:06company or organization.
- 26:11depending on where they sit, whether that's a uh privacy office or a legal group or a technology office or a security office.
- 26:20All of that um presents differences in the operationalization of the process and also, I think, the potential for automation.
- 26:33um And also, I think that it's still a challenge with the number of different...
- 26:42We talked about the importance of cross-functional teams, but um enabling...
- 26:49good quality data sharing and um integration, right, across those groups, still I think is a challenge.
- 26:59And part of that is honestly just the human aspect and um the risks of data sharing and merging and that sort of thing, right?
- 27:10So there's a lot of it is maybe not even the technology itself.
- 27:15It's just, if you can't get access to the data,
- 27:18from that group, you may not uh have it as readily available um for AI governance type of work.
- 27:30Where does your group sit within the organization?
- 27:32So we're part of the chief technology office.
- 27:35So this is a technology group.
- 27:38Yeah.
- 27:39So it's pretty common, I think, for organizations to um have a technology executive that is responsible for this.
- 27:53Or it can be a risk and compliance or privacy type of executive.
- 27:59And that's where it was for me at IBM was more in the legal and privacy area.
- 28:06And yeah, it's a very different um skill set that's brought to the team.
- 28:16And um there's pros and cons uh both ways for sure.
- 28:21absolutely.
- 28:21But I'm curious, in your experience, what does it mean to be doing this work within that technology organization as opposed to more on the privacy or legal side?
- 28:32Yeah, so I mean, you know, it's, it's, uh I think we all bring our lens, right, our lens of the world.
- 28:38And so technologists tend to say, how can I solve this with technology?
- 28:43How can I measure it?
- 28:46What measures?
- 28:47What metrics do you have?
- 28:49What methods?
- 28:49What tools can I use?
- 28:51Whereas, um you know, somebody in a area like law or compliance or privacy or risk,
- 29:01is asking questions about what are the risks?
- 29:05How do I measure?
- 29:06How do I comply with the law?
- 29:07What is the law?
- 29:10What is the specific clause?
- 29:12What is the definition?
- 29:14And so they're asking questions that often framed a little different way.
- 29:20think um what I've seen is that they're both critical.
- 29:27So when I was operating in like more of the
- 29:31privacy, legal risk type of area, it was always, where is the technology group so that we can get our technology questions answered?
- 29:39And same thing when I'm operating in the technology area, it's always like, okay, but we have to comply with this law lawyer, please help us with those definitions and the
- 29:51understanding of it, right?
- 29:51So um you need both.
- 29:55And um I don't think that it necessarily matters where you place
- 30:01the group as long as there can be effective collaboration and support between them.
- 30:08You mentioned a little bit ago agentic AI, and it's obviously something that a lot of people are talking about.
- 30:16What's really different from a governance perspective about agentic systems?
- 30:22Is there something that really makes it harder, or is it just asking the same questions for agents that you would be asking for other kinds of systems?
- 30:30Yeah, so it's, you know, it is an AI system, clearly.
- 30:34So we ask um many of the same foundational questions that we do about any AI system.
- 30:39So that's very clear, and that's true.
- 30:43uh However, there are some unique challenges, um but like AI systems, it is really risk-based.
- 30:51So depending on the situation which you're deploying,
- 30:56those AI agents, it's going to matter what kind of controls you have in place.
- 31:00But I think just the level of autonomy that the agent has is really driving that concern.
- 31:08So the ability to create compounding impact over time, operating independently, um without proper oversight can be um an issue.
- 31:20Now, the speed as well is also a concern.
- 31:23um
- 31:25When we used to think and talk about human oversight um of AI systems, that was much more feasible.
- 31:35In this case, with AI agents, we're starting to look to more automated controls and oversight mechanisms as well so that we can catch potential issues um at the speed at
- 31:49which the technology moves itself.
- 31:52And so having, you
- 31:54other agents that essentially govern agents underneath them is part of the picture.
- 32:01so uh that also, and I think also there's challenges around the um complexity of the environment and the number of connections um that they have.
- 32:17that root cause identification can sometimes be a challenge.
- 32:21So you really need good logging and tracking and understanding the source of potential issues.
- 32:29And so that is a key component.
- 32:31If you're operating in multiple environments and calling multiple APIs and taking many different actions, you'll need to have in your workflows for the agent, good controls and
- 32:47checkpoints as well as
- 32:49Like I said, maybe oversight agents and things to help control.
- 32:54And what else is on your roadmap or agenda in terms of issues that you're focused on for the next year or two?
- 33:03Yeah, so a lot of what I'm hearing and seeing from clients is a...
- 33:15And this also in my own world, in my own experience.
- 33:18I think just generally in the industry, there's a continued um interest in adopting AI.
- 33:27So it's how do we um get the most value and have the most benefit come from our adoption of AI?
- 33:37Everybody understands um the importance of that.
- 33:42And then um
- 33:45what does that mean in practice?
- 33:47But I think we're moving from a period that was, ah so we talked a lot about AI ethics and principles, the 2018 sort of timeframe.
- 33:57ah And then it was all about moving from principles to practice.
- 34:03So how do we put that into practice?
- 34:04And I still think large majority, and there's lots of studies to um highlight the fact that we're still in this
- 34:13phase of getting it into practice.
- 34:16There's no doubt.
- 34:17did actually a released a study earlier this year with MIT on the uh gap that uh we see.
- 34:26So like 87 % of executives feel that responsible AI and AI governance practices are important, but only 15 % of them really felt ready to implement the necessary controls and
- 34:40capable of managing the risks.
- 34:43huge gap in terms of awareness and recognition of the issue and then being ready to actually do it.
- 34:49I still, especially for practitioners like myself, we are still very much in this, you know, um moving from principles to practice and continuing to stay abreast of the changes
- 35:02that continue to happen in the technology and the new challenges all the time.
- 35:06So that is, I would say we're still there, but then
- 35:10There is a bit of a shift, I'd say, that's happening more around, you know, how do we actually move from um practice and sort of self-regulation, right?
- 35:23We didn't have many laws and frameworks.
- 35:27Now there's many more frameworks out there, you know, the NIST AI Risk Management Framework and the ISO 40-2001 standard, and all sorts of good frameworks and standards out
- 35:37there that we can look to.
- 35:39now.
- 35:39um And also we're starting to see more, obviously laws being passed all the time.
- 35:49And so it's starting, I'd say, looking at like the proof points.
- 35:54So okay, you have it in practice.
- 35:56Now, how do we prove it?
- 35:58What, you know, maybe there's audits happening, uh you know, governments are asking and lawsuits and all sorts of things, right?
- 36:08That it's
- 36:09um Less about like, so we sort of moved from ideas and principles to how do we put this into practice?
- 36:15Let's figure out some ways to now show me that you have it, right?
- 36:21Show me, show me.
- 36:24Great.
- 36:24Well, so that's a great place to end.
- 36:27And it's still a long way to go, but we've made a lot of progress.
- 36:32So Heather, thank you so much.
- 36:33been a pleasure speaking with you.
- 36:34Absolutely likewise.