Latest / The Road to Accountable AI / Shae Brown: AI Auditing Gets Real

Transcript

Shae Brown: AI Auditing Gets Real · The Road to Accountable AI

• 0:00
  Shea, thank you so much for joining me on the podcast.
• 0:03
  Thank you for having me here.
• 0:06
  How does an astrophysicist turn into an AI auditor?
• 0:11
  Yeah, that's a really strange story.
• 0:17
  my research in astrophysics was primarily in data analysis.
• 0:24
  So I worked on detecting black holes in distant galaxies, measuring magnetic fields, things like this.
• 0:29
  And the problem with astrophysics is that there's so much data that we're getting from the sky now that literally if every human on earth spent their entire lives looking at it,
• 0:39
  they would not
• 0:40
  be able to get through it all.
• 0:42
  And so it sort of necessitated me getting into machine learning and artificial intelligence as a tool to sift through this data.
• 0:51
  And I decided that I was really excited about AI and I wanted to get into it.
• 0:55
  And so I sort of started to do a little discovery of like, what, where could I have a unique impact?
• 1:02
  And I felt like AI auditing and was kind of a unique place where my brain just sort of fit.
• 1:09
  you know, the critical scientific approach to let's dig and uncover what the problems with, with this, these systems are.
• 1:17
  And it was around the time of like Cambridge Analytica and ProPublica's article about biased algorithms.
• 1:22
  And it just felt like the right time.
• 1:24
  So around 2018.
• 1:26
  And so I sort of made a switch to sort of spend a lot more time focusing on how do we audit systems?
• 1:33
  What are AI systems and what are the ways we can kind of systematically uncover?
• 1:38
  the risks that were beginning to become apparent.
• 1:42
  So what are the basic technical skills or capabilities that are needed in order to effectively audit an AI system?
• 1:52
  Yeah.
• 1:52
  So I think that a lot of the, there's not that many technical skills per se.
• 1:58
  So, so we spent a lot of time trying to train auditors and, and, upskill them into, into this field.
• 2:07
  And it's not like you have to learn to code in Python or be able to build a neural network or something like that.
• 2:12
  It's a much more about understanding the types of systems you're going to interact with that you might be auditing in terms of how they work roughly.
• 2:21
  What kind of data they use, what are the risks associated in particular with that kind of technology?
• 2:28
  And then a lot of sort of societal risk analysis.
• 2:33
  So we have a lot of philosophers actually are really great at thinking through sort of what issues are really germane to this problem, sifting through irrelevant information and
• 2:43
  getting down to the core of what's important.
• 2:47
  And that's really the...
• 2:49
  That's really the skill and of the technical skills, would say statistics or an understanding of how many factors can influence a data point that there's a big, we call
• 3:06
  it parameter space thinking.
• 3:08
  That's really the skill.
• 3:09
  It's much more about understanding the little bit of statistics and appreciating the complexity of data and how AI processes data.
• 3:20
  What does that exactly mean, parameter space thinking?
• 3:23
  So parameter space thinking, so a parameter space is just that there are lots of different factors that influence a particular result.
• 3:33
  Let's say it's a number, let's say it's a behavior that AI system has.
• 3:39
  most of the time when you're auditing these systems, some of those parameters are important, others are not.
• 3:44
  So that's like the first way of thinking, like understanding what the parameter space is.
• 3:50
  So an example might be
• 3:53
  I have some sort of activity detection in video recordings, right?
• 3:59
  So maybe I want to detect from a camera, a video feed, whether someone's getting robbed or when someone's stealing something.
• 4:07
  So in that scenario, there's a whole bunch of parameters.
• 4:10
  It's like, what kind of camera did it use?
• 4:13
  What kind of model am I using to predict this?
• 4:16
  What kind of training data?
• 4:17
  Where did that training data come from?
• 4:19
  Is it different than where I'm?
• 4:21
  using it now.
• 4:22
  Maybe I'm doing it in parking garages, but all my data is from like YouTube channels, really high quality video.
• 4:28
  Those are all parameters that are relevant for understanding the outputs of some testing that you might have done or the risk profile that you might have.
• 4:39
  And so being able to parse that out and actually, I don't know if quantifies the right word, ideally quantify would be great.
• 4:47
  But sometimes it just qualitatively parse out what are the things that are important of this massive parameter space and then getting down to here are the relevant things and
• 4:56
  this is how I can sort of partition what factors are important for risk.
• 5:02
  Okay, let's take a step back before we go on.
• 5:06
  What exactly is an AI audit and what basically are the kinds of services that your company Babel provides to organizations?
• 5:16
  Yeah.
• 5:17
  So in 2018, we started AI audit wasn't really a thing.
• 5:21
  And so it's, it's now becoming more of a thing.
• 5:24
  So what is it?
• 5:26
  it's very akin to, let's say a financial audit, like a typical audit that you would expect.
• 5:32
  So what is that?
• 5:33
  There's some standard or some normative guidance for like what a company or a person ought to do or ought to have in place.
• 5:42
  And an auditor's job is to come in and to
• 5:46
  look at what a company or a person has done and has in place against that standard and weigh in on with some judgment.
• 5:55
  there are different types of audits.
• 5:57
  It could be like binary where it's like you pass or fail.
• 6:00
  It might be more like an assurance engagement where it's like, I have reasonable assurance that this company adheres to the standard.
• 6:08
  So that's exactly what we do, except that it's over AI systems.
• 6:14
  And the sort of processes around those AI systems, how they're governed, how they're managed, how they're tested.
• 6:21
  And that's really it.
• 6:23
  The complication here is that you can't just, you wouldn't just get a financial auditor to do this, right?
• 6:28
  There's certain capabilities that you need to have to recognize when something is in place or not.
• 6:36
  You know, is that risk management framework that that company has the right one?
• 6:40
  Is it actually effective at managing risks?
• 6:42
  For instance, is that testing the right kind of testing?
• 6:45
  Is that information you get relevant?
• 6:49
  And so it's the same as that sort of auditing, except it just has added complexity because the complexity of the system is so much higher than just like QuickBooks or some financial
• 7:02
  records.
• 7:05
  So you mentioned when you got started, there were not a lot of people and organizations in the space.
• 7:11
  Now there's a range, everything from individuals to some of the very biggest professional services and consulting firms providing AI audit and assessment services.
• 7:21
  And there's also researchers doing audit studies from the outside without firms' permission.
• 7:26
  So how do you look at the space?
• 7:29
  don't know if industry is too strong a word, but the community that exists around AI auditing today.
• 7:36
  So there is a strong ecosystem around AI auditing that's growing and there are different sort of players and actors and places where people naturally fit.
• 7:47
  And in this space, I would say there are kind of the technical assessor space, right?
• 7:54
  So these are individual people or firms that are gonna really come in and do some sort of technical assessment.
• 7:59
  They're gonna test for bias.
• 8:01
  They're going to check robustness.
• 8:02
  There might be some cybersecurity elements or...
• 8:05
  red teaming of large language models would fit into this.
• 8:08
  And there are a lot of players in that space from individual consultants, academics that might work on the side to all of the sort of large assurance firms, the big four and
• 8:21
  consultancies will have some services around this.
• 8:25
  And then there's like the, those same people are also going to offer services around like risk management, things like this.
• 8:31
  These are the sort of consulting
• 8:34
  capability building players.
• 8:37
  Then there are the of the technology players where it's might be a technology platform that will automatically run tests or might be like a GRC platform that will organize how
• 8:50
  you might manage your risk.
• 8:52
  And they will kind of have the connective, that will be like the connective tissue, the tech assisted layer for getting this done.
• 9:02
  And then there's sort of the
• 9:04
  the external sort of third party audit assurance services.
• 9:08
  And that's where Babel sits primarily.
• 9:10
  We do very little consulting.
• 9:12
  We try to avoid it.
• 9:13
  We prefer to be like an independent third party auditor.
• 9:17
  And there are a number of smaller organizations like Babel.
• 9:20
  Eticus is another one.
• 9:22
  There are sort of mixed like holistic AI is a platform and they do audits.
• 9:29
  And then of course there are the big players that are already in the
• 9:33
  sort of regulatory assurance space of the big four plus, you know, the other ones, they're all sort of getting into this in various levels, but the maturity is still quite low
• 9:46
  because there are very few standards around it at the moment.
• 9:50
  Yeah, so how does a small firm like yours compete against those giant consultants?
• 9:55
  So, well, we start early, which we did.
• 10:00
  The way we compete is that we're hyper -focused.
• 10:03
  And so we're not doing, we don't do ESG assurance.
• 10:09
  We don't do financial auditing.
• 10:13
  We don't do cybersecurity auditing.
• 10:14
  We do one thing and we do it very well, which is the sort of AI assurance risk management also includes technical testing.
• 10:25
  we approach most of the sort of senior team, we were professors and other things we know about research.
• 10:31
  And so we started early on recognizing that we don't know what we're doing.
• 10:36
  And so we have to figure out what to do.
• 10:38
  so early on we weren't auditing, we were consulting and getting our hands dirty, trying to figure out how do you actually systematically detect risk in these systems?
• 10:49
  What is a good risk assessment?
• 10:50
  What kind of technical testing and how should they be informed by each other?
• 10:54
  and we published a lot, know, so we're publishing our research, we're really coming at it with ideally sort of intellectual humility that there are a lot of things to be figured
• 11:04
  out and it's that niche aspect and so now I mean we have people from the big four coming through our training program to learn from us how to do these things because we're just
• 11:16
  focusing on one thing and that's probably
• 11:19
  Any, all the business people listening will know that that that's a good strategy in general.
• 11:24
  If you're small and don't have resources to niche down and just make sure you're very good at a very specific thing that hopefully will have a big market at the end, which I think
• 11:35
  is becoming apparent.
• 11:38
  Can you describe what makes a good AI audit?
• 11:43
  So a good AI audit, so this will be my opinion, because some people will think different things.
• 11:50
  I think a good AI audit is going to have a clear objective, right?
• 11:55
  So you have to know what the audit is for.
• 11:57
  Like why are you doing this?
• 11:59
  Is it because there's a law in place?
• 12:01
  Is it for some sort of internal risk management that you want senior management to know how their company is performing, for instance?
• 12:09
  What's the goal?
• 12:10
  So it has to have a very clear goal and a very clear intended audience.
• 12:14
  And that's not always obvious.
• 12:16
  And so if you have that, then that's a good, good start.
• 12:19
  There has to be some kind of standards in place.
• 12:23
  Now it doesn't have to be standards.
• 12:24
  That's, that's like totally set or that aren't changing or they don't even, they could be standards that the auditors themselves had put in place, but they have to be there ahead
• 12:36
  of time.
• 12:37
  And they have to be clear and clearly articulated.
• 12:40
  And then there has to be independence.
• 12:43
  think this is a, it, can of course have internal audit, which is not fully independent.
• 12:48
  There's some independence because they report, say up to the board or something.
• 12:52
  But I think independence or impartiality is a pretty important component because what we've seen is that it's so easy to manipulate the results of these things like technical
• 13:03
  testing.
• 13:03
  For instance, I have a big data set.
• 13:06
  I'm measuring bias.
• 13:07
  I run it through, I don't like the results.
• 13:10
  say, what is it that's causing these results to be bad?
• 13:12
  Well, maybe this data point is not appropriate.
• 13:15
  So I'll just take that out and slowly the results start looking much, much better and the way I want them to look.
• 13:22
  That's not a great situation.
• 13:24
  so having that impartiality, having the clear goals ahead of time, knowing what the process is will avoid those sorts of problems.
• 13:34
  and so I think those are kind of the key components.
• 13:36
  And then the final thing I'll say is auditor competence because you have to understand.
• 13:43
  mean, so we, our audits are kind of assurance engagements.
• 13:47
  So we follow sort of assurance, international assurance standards.
• 13:52
  And one of the things you need to do is really assess the audit risk or where, where it's the risk of material misstatement that could happen.
• 14:01
  where they just gave us the wrong information, maybe on purpose, maybe by accident.
• 14:07
  If you don't understand the system and how it works, then it's going to be hard to detect where those risks are.
• 14:14
  so auditor competence is sort of the final thing that like seals the deal.
• 14:17
  That feels to me like a good package of things that would make a good audit.
• 14:22
  Great, so there's a lot in what you just said to unpack.
• 14:26
  Let me start at the beginning with the rationale.
• 14:29
  What do you find today are the main reasons that companies come to you for those audit services?
• 14:37
  So there were sort of three stages.
• 14:40
  The first stage was reputational risk.
• 14:43
  So early on, the people who came to us were under sort of severe kind of reputation scrutiny.
• 14:49
  Either the articles were written about them, accusing them of bad practices or AI that was bad, the Senate was looking at them or something like that.
• 15:00
  That was sort of the first phase.
• 15:02
  People were just panicked about.
• 15:03
  having a bad reputation because a lot was being written about it, let's say five years ago.
• 15:09
  The next is that laws actually got passed.
• 15:11
  so things like New York city has a local law one for four, which requires bias audits of automated employment decision tools.
• 15:19
  So the tools that would like sort through your CV or your resume, when you apply for a job, there's many of those, almost every job you apply to will have those.
• 15:28
  If you're operating in New York, they have to be audited.
• 15:30
  So there was like a compliance or regulatory pressure that
• 15:33
  brought a new wave of clients to us and to other auditors, because I had to get this done because of that.
• 15:39
  That's not going to stop because there's a lot of laws coming that are going to require that.
• 15:44
  But there's a new wave now, which is procurement pressure.
• 15:48
  So even before these other laws have come into effect, the majority of people who come to us now are trying to sell to, say a large enterprise.
• 15:57
  That large enterprise is, has already worried about compliance and reputational risk from before.
• 16:02
  is now pushing back on their vendors to get some sort of auditor assurance done.
• 16:07
  They need something that's gonna limit their downside risk.
• 16:11
  And so that's the pressure we're feeling right now.
• 16:13
  That's what's driving most of the activity in this space, from my experience.
• 16:19
  Yeah, no, no, no, it's really interesting.
• 16:21
  So the second thing you said before was standards.
• 16:24
  And sometimes, so if we're about local L -144, specifies an adverse impact report, what that test is.
• 16:31
  But if you don't have something like that, where do the standards come from that you use?
• 16:37
  So that's a really good question.
• 16:40
  So there are some emerging standards.
• 16:43
  So NIST has their AI risk management framework.
• 16:50
  That is a fairly kind of, I wouldn't say comprehensive.
• 16:53
  It has a lot of options for people to manage risk.
• 16:59
  And so if we are trying to audit somebody for their risk management practices,
• 17:05
  That's, it's not really a standard.
• 17:07
  It's not written necessarily like a standard, but it does have enough elements and enough specificity that we could use it as sort of criteria for auditing.
• 17:17
  There are now ISO has now released 42 ,001, which is a, an AI management system standard, which has gotten a lot of interest recently.
• 17:29
  And that is because it's an ISO standard is written like a standard that is
• 17:33
  meant to be auditable.
• 17:34
  even have guidelines.
• 17:35
  It's 42 ,006, which are in draft, but they're meant to specify how that should be audited against.
• 17:43
  So that's a great framework to work from.
• 17:46
  And then there are other laws that like EU AI Act, Colorado now has another law, Illinois passed some law, California has some new laws that are likely to be signed very soon.
• 17:59
  All of those will work, but there are always details
• 18:03
  that are complications for an auditor that we have to sort through that does cause, there's extra risk and there's a ton of development work.
• 18:13
  So we spend probably half our time working on audits.
• 18:16
  The other half of the time working on standard, our own internal processes and internal standards and risk management and procedures to manage the risk of those audits.
• 18:25
  it's R and D, half R and D at the moment.
• 18:31
  No, I would think that there is a danger in what you described in the things go the other way and there are too many different standards.
• 18:37
  There's all these different competing options out there with financial accounting.
• 18:41
  We've got GAP and international equivalents and financial accounting standards board and stuff and there's some clarity.
• 18:48
  Do we need more coordination about what the standards are for doing an AI audit?
• 18:54
  I think we do need that.
• 18:56
  And there are some organizations that are trying to do that.
• 18:59
  I'm a fellow at For Humanity.
• 19:01
  That organization is trying to do exactly this, have a central kind of repository of certification schemes that might be informed by laws or might be informed by standards,
• 19:13
  but are sort of developed in a unique sort of coherent way.
• 19:18
  But I don't think that we're going to get there.
• 19:21
  I think if you look at cybersecurity, for instance,
• 19:24
  There's just so many different certification schemes, so many different types of ways of auditing types of audits.
• 19:30
  You've got SOC 2, you've got ISO, there are other organizations.
• 19:35
  Some companies have just had their own certification that they develop.
• 19:38
  And I think we're going to see it evolve in that way.
• 19:41
  Now, one thing I'll say is that the EU AI Act is so comprehensive in its requirements, or at least so onerous, maybe is the word that some people would use.
• 19:54
  that it will probably be the most difficult quote unquote standard to adhere to.
• 20:01
  And so if you adhere to the most rigorous standard, it's probably gonna cover you for 95 % of all of the other regulations.
• 20:10
  And so I think we'll see people gravitating towards that as a benchmark.
• 20:15
  then it'll be just filling in the gaps for some individual local law or individual kind of...
• 20:23
  association that might want to put something together.
• 20:27
  Although it's interesting you mentioned the work that you have to do internally on R &D and assessment on standards with something like the AI Act, there's still tremendous gaps
• 20:37
  in terms of the interpretive guidance and what those standards mean and so forth.
• 20:41
  So do firms like yours really have to fulfill a role for making some of those decisions under conditions of uncertainty as these standards are evolving?
• 20:52
  Absolutely.
• 20:53
  we do have to interpret if there aren't standards and the EU will have, Sensenlack is going to come out with more detailed standards and we are sort of keeping track of that
• 21:08
  and providing input when we can.
• 21:12
  But a lot of times we are going to have to make some calls on our own.
• 21:17
  What do we think is good enough given the current language of the law?
• 21:22
  But I think that's okay because the level of maturity for most organizations frankly is not anywhere near even the laws it's written, much less some detailed standards.
• 21:33
  And so our sort of general strategy, and I think it's a good strategy for other organizations that they want to try to audit, is to fall back on transparency and say,
• 21:45
  listen, this is exactly what we are using as a...
• 21:48
  as a standard, these are the criteria that we use, these are the procedures we went through to check things and disclose that.
• 21:55
  And then people will know exactly what happened and what you did.
• 22:00
  And it may not be exactly compliant with the law as the new standards might indicate, but you can always go back and redo it.
• 22:10
  And it just, provides a lot more clarity on what exactly is going on.
• 22:16
  about certifications and accreditations for the auditors themselves?
• 22:20
  I know that's something you've been involved in, in the AI space.
• 22:23
  So that's a difficult thing because there isn't a central body for that.
• 22:28
  And so I mentioned for Humanity before, they have some sort of certifications based on their certification scheme.
• 22:36
  So they'll kind of accredit auditors for their certification schemes.
• 22:40
  And so we've, for instance, gotten some of those as our organization.
• 22:45
  There's a new organization that I'm one of the founding members of, which is the International
• 22:52
  Association of algorithmic auditors.
• 22:54
  I might've gotten one of those words mixed up, but it's I AAA, I AAA.
• 22:58
  And so the goal there is much more about identifying what are the capabilities.
• 23:05
  It's in a professional association.
• 23:07
  What are the capabilities we think auditors need to have and how could they acquire the sort of bona fides that they need in order to do this?
• 23:16
  It might be, we haven't got to the point where we have an examination yet or anything like that.
• 23:20
  It probably will get to that point, but I have a feeling it will be a mix of things from experience to education.
• 23:28
  We don't have any degrees in this at the moment.
• 23:30
  That's something that will come.
• 23:32
  I'm sure just like, just like financial auditing has accounting degrees that will lead to financial auditing that was going to happen eventually.
• 23:39
  But right now it's a little bit of the wild West.
• 23:42
  And I think we rely on our own training for our own auditors.
• 23:48
  And so we have our own program.
• 23:50
  where we've outlined the capabilities and we train internally our own auditors and we just make sure that we are transparent about that and everyone can see what we are expecting in
• 23:59
  terms of capabilities.
• 24:01
  But eventually, probably everybody's gonna have to get some sort of certification whenever one of these organizations kind of rises to the top in terms of credibility.
• 24:12
  And then going back to when you answer the question about what makes a good audit, think the third thing you said was independence.
• 24:19
  Isn't there though an inherent conflict of interest if a company is paying you to provide a service?
• 24:24
  How can you provide enough of an assurance of independence in what you respond to them?
• 24:31
  Yeah.
• 24:32
  So we basically approach this the same way that, that financial auditors approach this or assurance professionals approach this.
• 24:39
  So there's a, there's a standard kind of code of conduct.
• 24:43
  And we, in fact, the standard we rely on is the same one that the, auditors rely on.
• 24:50
  And so we look at, because this happens, of course, you know, a company pays Deloitte to come audit their financial, they have to pay them, right.
• 24:57
  Deloitte is not going to do it for free.
• 24:59
  So there, there are.
• 25:01
  different ways of mitigating the sort of fundamental issue of impartiality and independence.
• 25:11
  know, Sarbanes -Oxley came along and had some additional requirements there.
• 25:14
  We keep an eye on that and make sure that we're following that as well.
• 25:18
  But there, it's not easy and it's a difficult task.
• 25:22
  And what makes it more difficult is it's not like financial auditing where you can show up and expect that the company understands how
• 25:30
  bookkeeping works and understands how they need to track their financial transactions.
• 25:39
  That's not the case here.
• 25:40
  We are dealing with organizations that it's shifting so much that they don't know what they need to do.
• 25:47
  And so we have to play a balancing act of education, like what is it that you need to do?
• 25:54
  But then we also are gonna come in and ensure that you do that.
• 25:57
  And that's not easy.
• 25:59
  And I think that the level of independence is by necessity slightly less than it would be if there was a very strict standard that everybody understood and they go off and get it
• 26:10
  done and we are only coming in to check their homework.
• 26:13
  But I think that that's just a function of the time we're in right now.
• 26:18
  And as this becomes more mature as a industry, we're gonna see that independence is actually not gonna be that different than
• 26:28
  than financial auditing.
• 26:31
  So right now, how do you convince clients or prospective clients to accept your approach to it, to, you know, the value of what you're doing, the way that you put it together for
• 26:45
  sometimes it's difficult.
• 26:48
  what are the challenges?
• 26:49
  The challenges are the way we approach it is that we are not consulting them.
• 26:55
  we're, are simply, they have to do all the work, right?
• 27:00
  So they're the ones who do testing.
• 27:02
  They're the ones who have to manage the risk.
• 27:04
  We have governance requirements, like for New York, New York law doesn't require risk assessments or governance or any risk management at all.
• 27:11
  We have that in our audits.
• 27:13
  And so there's this super augatory nature of some of the things that they have to accept that they're going to be doing the work and we are going to be checking their homework and
• 27:23
  validating the everything they've done, everything they said they did, they've actually done.
• 27:28
  That's a tough call.
• 27:30
  The way we, we convince them is that every law besides New York, every law that's coming
• 27:38
  is going to require robust internal governance and risk management and technical testing.
• 27:42
  They all are.
• 27:43
  So if you were going to be a mature organization using AI in the near future, you have to do this anyway.
• 27:50
  So why not start now where the bar is much lower, get your feet wet, get used to having people hold your feet to the fire.
• 27:59
  And that's going to mature you as an organization and then you can grow from there.
• 28:03
  That's the, that's the selling point.
• 28:05
  Not everybody wants that of course.
• 28:08
  But at this point, we're only looking for the people who are willing to do that.
• 28:13
  And so there's a filter effect a little bit.
• 28:16
  And so there's probably a large swath of the market that is going to get serviced by other kinds of organizations or other kinds of companies that don't approach audit in the same
• 28:25
  way we do.
• 28:29
  How broad do you think the practice of AI auditing is going to get?
• 28:33
  Because obviously we're seeing now companies of every scale in every industry deploying AI systems and often many different AI systems.
• 28:42
  So do you envision a world where all those things are subject to auditing?
• 28:46
  sure that would be good for a firm like yours from a business standpoint, but obviously there's some overhead at some point.
• 28:53
  Yeah, so I don't think so.
• 28:57
  think it's going to evolve into much more of a, and again, I don't know, like I don't have a crystal ball, but my hunch is that a lot of the processes for all of these algorithms
• 29:11
  are gonna have to be automated and there will be centralized risk management and governance and testing of these systems that will be
• 29:22
  more specific and more based on standards and that the role of the auditor is to audit that system, that quality management system with the extra bits that are really relevant
• 29:37
  for AI systems.
• 29:39
  think that's going to be, because that's much more manageable.
• 29:42
  don't have to check that every, you know, for this particular algorithm that you're using internally to do something is compliant.
• 29:48
  What I'm checking is you have that program in place.
• 29:52
  and you have the processes in place, the controls that are going to manage that.
• 29:56
  Now, the caveat here is that some laws like the EU AI Act, there'll be high risk systems which have requirements for the AI system itself.
• 30:06
  Luckily, a lot of those requirements are also organizational based.
• 30:11
  do you have a risk, have you done risk management for that?
• 30:14
  Right.
• 30:14
  So one risk management system can cover multiple high risk algorithms.
• 30:19
  The technical testing is going to be unique to a particular algorithm, but that can be centralized and audited at a sort of organizational level.
• 30:27
  so anyway, that's what I see it's emerging as organizations get audited and the individual AI systems are being controlled internally in a robust way by those organizations.
• 30:41
  And going forward, what do you see as the greatest challenge for the auditing community in AI or specifically for you at Babel?
• 30:51
  So the biggest challenge is right now, as you alluded to, the explosion of standards and laws.
• 31:00
  there are just so many, so we spent a long time for New York City, for instance, developing how are we gonna test, and it's very simple, it's like one metric, disparate
• 31:09
  impact.
• 31:09
  How are we gonna test that?
• 31:10
  How are we gonna provide assurance that they have actually done the right thing?
• 31:13
  And it was a lot of development.
• 31:16
  And if you look at these laws, like the digital services act, which is already out and, and, and, and people are being audited for that.
• 31:23
  The EU AI act, Colorado, all the state laws, some of the federal guidance that is, that is coming out.
• 31:29
  There's just so many kind of normative frameworks for, for what you need to do.
• 31:35
  That it's going to be difficult to have that level of development work.
• 31:38
  And so the way we're approaching this is that we are focusing on.
• 31:43
  our internal process of like, how do we provide assurance?
• 31:47
  How do we audit these systems and these organizations in general based on that normative guidance?
• 31:54
  What is, and then it's like, what is the process?
• 31:56
  If someone comes to us with this brand new thing, like in Taiwan, we need to, this is the regulation and here are the standards.
• 32:02
  What's our process for determining is this auditable?
• 32:07
  What are the capabilities we need to audit that?
• 32:09
  What are the extra resources we might need to
• 32:12
  to execute that audit at what level of assurance.
• 32:15
  And that's sort of a more unified framework that we're working on.
• 32:20
  And that's the way it's probably going to have to proceed until there's like really niche down into like, I'm an auditor for just this one law and then just this one industry.
• 32:32
  have to be kind of, there has to be that flex.
• 32:33
  That's the challenge, that flexibility.
• 32:37
  Great, well this has been a really fascinating conversation.
• 32:40
  Really interesting to see how the whole space of all is going forward.
• 32:43
  Jay, thank you very much for your time.
• 32:45
  Thank you so much for having me.