Latest / The Road to Accountable AI / Walter Haydock, StackAware: In Search Of AI Governance Certification

Transcript

Walter Haydock, StackAware: In Search Of AI Governance Certification · The Road to Accountable AI

0:09
Werbach: Hi, I'm Kevin Warbeck, professor of Legal Studies and
0:11
Business Ethics at the Wharton School of the University of Pennsylvania.
0:15
For decades, I've studied emerging technologies from broadband to blockchain.
0:19
Today, AI is promising to transform our world, but AI needs accountability
0:26
mechanisms to ensure it's developed and deployed in responsible,
0:29
safe, and trustworthy ways.
0:32
On this podcast, I speak with the experts leading the charge.
0:34
For Accountable ai
0:38
Haydock: Today I'm joined by
0:39
Werbach: Walter Haydock, founder of Stack Aware, which helps companies
0:43
manage AI security, compliance, and privacy risks with a particular
0:47
focus on ISO 40 2001 certification.
0:50
We talk about his path from the military and cybersecurity to AI governance, the
0:54
difference between voluntary frameworks and certifiable standards for ai.
0:59
What ISO 42,000 readiness.
1:01
Actually entails benefits for firms that make the investment and what the
1:06
ideal combination of certification audits, insurance and legal safe
1:13
harbors for AI would look like.
1:16
Walter, thank you for joining me.
1:17
Welcome to the Road to Accountable ai.
1:20
Haydock: Kevin, thanks for having me on.
1:23
Werbach: First, how did you get into this field of AI governance?
1:27
Because you, you didn't necessarily have what I would
1:29
think is the traditional path.
1:33
Haydock: So I spent the early part of my career in the US military and government.
1:38
I was a Marine Corps intelligence and reconnaissance officer.
1:40
I worked on Capitol Hill as a congressional staffer and also
1:45
was a targeting analyst at the National Counter-Terrorism Center.
1:49
And in all of those experiences, I thought I understood chaos
1:54
and how to deal with it.
1:56
But when I decided to move into the private sector a little bit later in my
2:00
career, I encountered a whole new level of disorganization and chaos as well.
2:08
And I initially worked in the cybersecurity field at a bunch of
2:14
different software companies and developed an understanding of how
2:18
to apply some of these military risk management techniques to the problem
2:23
of data protection, of compliance of.
2:27
Combating attackers and decided to eventually launch my own firm Stack Aware.
2:33
And after some initial iteration and unfolding as, uh, one of my mentors calls
2:39
it, we decided to focus on the problem of AI risk management and governance.
2:45
And I've been working on that for almost three years at this point.
2:51
Werbach: So obviously in the military and in, you know,
2:54
cybersecurity counter-terrorism, you, you need to deal with risks.
2:57
Um, but different kinds of risks than private organizations
3:02
are, are dealing with largely.
3:03
So what, what do you take from that experience?
3:05
What does it actually mean to apply some of those military
3:08
principles to this kind of domain?
3:11
Haydock: Well, whether you're in the military or you're in the private
3:15
sector, there are really only for things you can do with the risk.
3:20
And those are, you can avoid the risk by not doing the activity that's causing it.
3:25
You can transfer the risk by buying insurance, by an indemnification,
3:31
by a contractual term.
3:32
You can mitigate the risk by applying some sort of control, whether it's
3:38
a, a safety control in the military, or a technical control in the
3:42
security or AI governance context.
3:44
And then fourth and finally, you can accept the risk, which means that you
3:47
understand something could go wrong along the way, but at the end of the
3:51
day, the juice is worth the squeeze, so you're gonna press ahead anyway.
3:56
Werbach: How do you decide which of those to choose in any situation?
4:00
Haydock: The only way to make an informed decision when it comes
4:04
to risk management is quantitative analysis, and historically,
4:10
organizations have done a lot of.
4:13
What is colloquially known as heat mapping when it comes to risks.
4:17
So saying we've got a low probability, but high impact risk.
4:24
And ergo, that is a, a medium overall risk.
4:29
That's what I describe as doing math with colors, which unfortunately doesn't really
4:34
make sense and I found myself wrapping.
4:38
Myself and others in axles trying to figure out exactly
4:41
how you do that math with color.
4:43
So my recommendation is to just avoid that entirely and focus
4:47
on quantitative assessment.
4:48
Mm-hmm.
4:49
And when you do quantitative assessment, you can understand
4:52
what is the dollar value of a given event occur, or the dollar value
4:59
of a given risk materializing.
5:01
And if you take.
5:02
Annual rate of occurrence times, single loss expectancy, and then
5:07
look at the exposure factor.
5:08
You can do that math to understand what the value of a given risk is and why
5:15
that's key is because it lets you compare that to the value that you're gonna obtain
5:21
from conducting whatever action it is.
5:23
And then also the cost of the controls, whether that's mitigating
5:28
the risk or transferring it through insurance or some other method.
5:33
Werbach: Great.
5:33
So I wanna get into it more specifically, but, but first,
5:36
just one more general question.
5:37
What, what is it that appealed to you about AI governance
5:40
coming out of cybersecurity?
5:41
What made you think this was the area to focus on?
5:46
Haydock: When I was first leaving the public sector and I was in business
5:50
school, I actually did a lot of, bit a lot of self-education in terms of ai.
5:55
I was considering pursuing machine learning engineering as a career
5:59
path and actually did a, a nano degree from a company called Udacity.
6:05
Taught myself how to code and really loved the subject matter and.
6:10
Decided that I eventually wanted to wrap that into, you
6:14
know, my work in the future.
6:16
I went into the cybersecurity field out of business school and then
6:20
saw the two fields merging together in terms of their significance.
6:25
And that led me to pursue the AI governance and risk management field
6:31
as, uh, as the focus of my company.
6:34
Werbach: And in general, what do you think is the biggest gap in that area?
6:38
What is it that most firms are missing when it comes to AI governance?
6:45
Haydock: The biggest gap for most firms is understanding their exposure
6:50
versus their actual risk appetite.
6:52
Werbach: Mm-hmm.
6:52
Haydock: So on the one hand, you will have.
6:55
Companies that don't really have a good idea of what AI
6:58
tools and systems are in use.
7:00
And on the other hand, they'll have very restrictive and what I would consider
7:04
to be boilerplate policies mm-hmm.
7:06
That are very black and white.
7:08
Say things like, don't create intellectual property risk with
7:11
ai, or use AI responsibly, which.
7:15
From a practical perspective, it's not really helpful guidance, and that puts
7:20
employees in a very tough spot where they need to navigate the pressure of getting
7:24
their job done with these sometimes draconian and unrealistic requirements.
7:29
So having a realistic and actionable approach to AI risk
7:33
management is absolutely key.
7:36
Werbach: And you've been, uh, something of an advocate for the
7:39
ISO 40 2001 certification framework.
7:43
Um, first, for those who aren't familiar, just talk about what that is.
7:50
Haydock: ISO 40 2001 is the global standard for building an AI management
7:56
system, and that is a set of policies, procedures, and technical controls
8:02
to harness AI effectively and manage the risk associated with it.
8:07
At the same time, it's similar to the ISO 27,001.
8:12
Information security management system standard.
8:14
But ISO 40 2001 is even broader in its applicability because it requires
8:20
you to look outside the organization and look at things like societal and
8:24
environmental impacts from the use of ai.
8:27
So it is a comprehensive way to guide your organization's
8:32
use of artificial intelligence.
8:35
Werbach: And how is it different from other frameworks or regulations
8:38
that, that people may be familiar with, like the the NIST framework
8:41
or some of the European or American laws that deal with AI governance?
8:48
Haydock: I bucket.
8:49
Frameworks into three different categories.
8:52
So the first category would be a piece of legislation like the European
8:57
Union Artificial Intelligence Act, or Colorado's SB 2 0 5, the Colorado AI Act.
9:04
For those, it's really a binary.
9:07
Are you in compliance?
9:08
Are you not in compliance?
9:09
And the only way you find out you're not is through an enforcement action.
9:13
Of course, there are best practices, there are more specific guidelines
9:17
you need to follow for those.
9:19
Requirements.
9:20
Mm-hmm.
9:20
But that is one category of framework when it comes to ai or more broadly.
9:25
Werbach: Mm-hmm.
9:26
Haydock: The second category are things that are self at
9:30
testable or voluntary standards.
9:33
You mentioned the nist, artificial Intelligence Risk Management framework.
9:37
That's one.
9:38
The open web application security projects.
9:41
Top 10 for generative AI is another example of a voluntary framework.
9:47
And then the third category of framework are those certifiable standards where
9:53
you can have a third party come in and confirm that you are meeting
9:58
the requirements of the standard.
10:00
ISO 40 2001 is one of those, but additional examples include
10:05
the high trusts AI security certification, and then the AI uc one
10:10
standard, which is relatively new.
10:13
Werbach: What's the difference in a standard that's certifiable?
10:18
Haydock: Can you drill down into that a little bit in terms of
10:21
difference between the, those standards I mentioned, or between
10:25
standards that are certifiable and not
10:27
Werbach: Yeah, E exactly What, what is it that, what is it that would look
10:31
different in terms of what a firm would've to do, or what the requirements would
10:34
be of something that can be externally certified versus something that is
10:39
purely voluntary and self-certified?
10:43
Haydock: The biggest difference between a self-certified standard and an externally
10:47
certifiable standard is the credibility that you would bring to customers.
10:53
So you can claim that you're adhering to ISO 40 2001, that you're adhering to
10:59
the EU AI Act, and you very well may be.
11:02
With that said, customers are gonna have far more confidence in that claim.
11:08
If you have a a third party who is independent, come in and confirm
11:14
that you are meeting the requirements of that standard according to.
11:19
Their guidelines for conducting audits.
11:21
So there's no way you can achieve a certification around the NIST
11:26
AI risk management framework.
11:28
There are attestations and there are ways that you can have an auditor come
11:32
in and say, yeah, you're, you're probably following those guidelines, but there
11:35
is no true certification for that.
11:38
ISO 40 2001 is different because it was designed from the beginning to allow.
11:43
An independent auditor to come in and confirm or deny that you're meeting
11:48
the requirements of the standard.
11:50
Werbach: Presumably that means there has to be a standard for the auditor.
11:54
Haydock: Absolutely.
11:55
There is a standard for the auditor.
11:57
The all the certification bodies are.
12:01
Required to meet specific guidelines when it comes to auditing artificial
12:07
intelligence management systems.
12:08
In the case of ai, it's ISO 40 2006 is the auditing standard, which guides how these
12:15
certification bodies conduct their work.
12:18
And they are overseen by accreditation bodies, which
12:22
will review what they're doing.
12:24
And actually, for last year, stack Aware during its own ISO
12:28
40 2001 surveillance audit.
12:31
Our audit was witnessed by the ANSI National Accreditation Board, so we had
12:38
someone looking over the shoulder of our auditor while we were being audited.
12:44
Werbach: Is there an ecosystem of auditors that's developing for ISO 40 2001?
12:51
Haydock: There are a set of.
12:54
Auditors that are currently accredited to conduct ISO 40 2001 audits,
13:00
and we work with several of them.
13:03
We are not necessarily beholden to them.
13:05
We don't necessarily have to work with them.
13:08
We will work with any auditor that our customer wants to use.
13:12
Um, but we are separate from them in that we are a consulting firm, so we help.
13:17
Organizations get ready for the audit and we necessarily cannot be involved in the
13:21
certification side of things because Sure.
13:24
That firm needs to maintain independence from the process
13:28
of preparing for the audit.
13:29
So there are, I'd say in the US there are probably a dozen, maybe more
13:34
firms that are currently accredited.
13:36
Mm-hmm.
13:36
To grant ISO 40 2001 certification, and that number is growing.
13:40
Werbach: Okay.
13:41
And you mentioned that that Stack Aware went through the process yourself.
13:44
Um, so you know you can speak with some authority and what it
13:47
means to actually get certified.
13:50
What, what should an organization understand is required if they
13:52
want to go down this path?
13:56
Haydock: ISO 40 2001 certification is a heavy lift for an organization.
14:02
That's because it requires things like executive buy-in.
14:06
It requires a full understanding of the scope of your management system,
14:11
and it's gonna require ongoing resources for maintenance, for doing
14:16
internal audits, things of that nature.
14:18
So being fully committed to the process is really important.
14:22
Upfront.
14:23
Now, with that said, if you put in the right level of investment, you can
14:28
use ISO 40 2001 as a way to improve the functioning of your AI systems
14:35
as a way to accelerate your business objectives through both effective
14:39
risk management, but also monitoring and measuring of your AI performance,
14:44
training of your employees, and.
14:47
Improving trust with customers who have improved confidence that
14:51
you're using artificial intelligence safely, securely, and responsibly.
14:56
Werbach: Can it also potentially give you some legal protection
14:59
under these laws we talked about?
15:02
Haydock: O 40 2001 is very interesting in that it gives you two different
15:08
levels of protection when it comes to regulatory compliance.
15:13
So the first level is that it requires incorporating what the
15:16
standard calls external issues into your AI management system.
15:20
So things like laws are certainly external requirements.
15:24
They can also include things like contractual requirements.
15:27
The business landscape, things like that.
15:29
So ISO 40 2001 gives you a system for incorporating these
15:34
various demands on your business into your AI management system.
15:39
So that's the first benefit.
15:42
The second benefit is that in specific cases, for example, Colorado's SB
15:47
2 0 5, that law calls out ISO 40 2001 compliance as providing safe
15:53
harbor under certain circumstances.
15:56
Under that law.
15:57
So it's unique in that it's called out by a specific law as giving you protection
16:04
if you're meeting other requirements.
16:06
Mm-hmm.
16:07
Werbach: And you mentioned a little bit the work that Stack Aware does
16:11
with companies in terms of, uh, becoming ISO 40 2001 compliant.
16:15
What, what are the major areas that, that companies need help
16:19
on to go through this process?
16:23
Haydock: Stack Aware generally works with companies in three phases.
16:27
So in the first phase, we'll come in, we will help them do an asset inventory, make
16:33
sure we understand everything that's in scope, evaluate the risk of those systems.
16:38
That includes, in some cases, doing ai red teaming to evaluate the security and.
16:44
Effectiveness of the controls for these AI systems.
16:48
In the second phase, we will help the company apply administrative
16:52
controls, including building their AI management system documentation,
16:57
building the policies and procedures, ensuring management reviews are
17:00
being conducted on a regular cadence.
17:02
And then in the third phase, we will help the companies apply technical
17:06
controls in accordance with Annex A of the ISO 40 2001 standard.
17:10
And then we can actually perform an internal audit, which is essentially
17:14
a way of checking prior to the external audit that these controls
17:19
are functioning effectively.
17:22
Werbach: As you mentioned, it's a heavy lift.
17:23
What, what are the, uh, ideal characteristics of an organization
17:28
that should go down this path?
17:32
Haydock: There are three broad types of organizations that would benefit
17:35
most from ISO 40 2001 certification.
17:39
So the first are AI powered B2B startups because these organizations generally
17:46
only have the capacity to pursue one standard ISO 40 2001 checks a lot of
17:52
boxes at the same time, it addresses security, it addresses privacy.
17:57
It addresses societal impact, and I can speak from personal experience that
18:02
we've used our certification to build confidence with our customers when we're
18:06
going through a procurement process.
18:10
A second type of company that would benefit from ISO 40 2001 certification
18:16
is one that's training on customer data.
18:19
And there are many examples out there of companies that have gotten
18:24
bad press because of the way they've disclosed or not disclosed what
18:29
they're doing with customer data.
18:30
Examples include zoom, DocuSign, slack.
18:36
I'm not saying whether or not these were valid responses to what these
18:39
companies were doing, but nonetheless, there was a public outcry based on some
18:44
disclosures about what they were doing.
18:47
If you have an ISO 40 2001 Certified AI Management System, you can say
18:54
we are following these principles and we have external verification
18:58
that we are taking these measures.
19:02
Finally, I would recommend that heavily regulated companies,
19:05
especially in healthcare and finance, would also benefit from ISO 40
19:10
2001 readiness and Certification.
19:13
That's because of things like the Colorado AI Act providing safe harbor under certain
19:18
circumstances, but more broadly, it gives you a comprehensive way to evaluate
19:23
all of the requirements levied upon the organization and filter them through
19:28
the lens of artificial intelligence to ensure that you're checking all your
19:33
boxes, that you have all your ducks in a row, and at the same time, you're
19:37
actually managing the risk of using ai.
19:42
Werbach: You painted a, a picture of, uh, firms that are willing to invest
19:47
more seriously in AI governance, being rewarded and, and market forces actually
19:53
reinforcing that kind of behavior.
19:54
That's, that's a, a vision that I also really share.
19:57
But are we really seeing that in the market?
19:59
Do we have evidence to suggest that the firms that are most serious, whether,
20:03
whether it's ISO 40 2001 or not, are actually getting that kind of benefit?
20:11
Haydock: I think there's a timely example where there's certainly
20:14
been a bump to affirm that.
20:18
At least appears to be applying a more stringent set of controls when it comes to
20:23
AI governance, and that's Anthropic, which recently was designated by the Department
20:28
of War as a supply chain risk, which has a specific definition under US code.
20:35
I won't necessarily weigh in on the merits of that designation or not, or whether
20:40
Anthropic was acting in a more upright manner than their competitor open ai.
20:47
But what matters is that people are reacting to the perception that
20:52
Anthropic is behaving in a more responsible and ethical manner.
20:56
And as a result, I saw today looks like installations of Anthropic were
21:02
up something like 300% or their clawed AI tool was up 300% as a result.
21:08
You know, whether that's causation, correlation, maybe Anthropics,
21:12
just really good AI tool.
21:13
They've certainly been getting a lot of.
21:15
Press for just being good.
21:17
You know, it's unclear, but there's certainly some benefit to the perception
21:24
that you're using artificial intelligence responsibly from a commercial perspective.
21:28
Werbach: Mm-hmm.
21:29
I mean, it's certainly.
21:30
True of the Frontier Labs and they, they've taken different approaches, uh,
21:35
in terms of governance and and so forth.
21:37
With regard to enterprises, though, at least my perception of what happened
21:43
in cyber is even though there's, you know, there, there's a really clear
21:47
imperative given the, the losses that can happen and, and, and the threats.
21:52
You know, that, that broadly speaking, even though there are all these
21:55
notification requirements and so forth, the market has a hard time perceiving.
22:00
If there's, you have a big, um, uh, incident, then you may take some loss.
22:04
But, but we don't really see, at least in my perception, that the companies that
22:09
are, that are doing the work overall or are getting that kind of halo effect, um.
22:14
You know, and, and you, you've spent more time in that field than I have,
22:17
so, so tell me if I'm wrong there, but, but are, are we going to see that kind
22:21
of dynamic, uh, in the AI world, or, or will it be something like what you
22:24
described with anthropic more broadly?
22:26
For Deployers?
22:29
Haydock: There's certainly something to be said about the market not
22:33
actually caring about cybersecurity.
22:35
And there is good evidence that stock prices are only
22:39
temporarily impacted mm-hmm.
22:40
As a result of data breaches.
22:43
And related incidents.
22:46
With that said, I think we're still in the early days when it comes to
22:50
cybersecurity and AI governance, and I think organizations are only beginning
22:57
to understand the impacts of mishandling customer data, of using AI systems.
23:04
Unethically or in a, a careless manner because the costs are going to
23:10
be born over large periods of time.
23:13
If you look at, for example, data breaches, the consequences will only
23:16
be felt down the road and I think with artificial intelligence in some
23:23
circum, in some areas or some manners.
23:27
The impacts are gonna be felt more rapidly than with a data breach,
23:31
because if you have an autonomous system that goes outta control, it deletes
23:35
a bunch of data or knocks the system offline, you're gonna see impacts that
23:40
are much more readily apparent and they're gonna happen much more quickly.
23:44
So I think you're going to see more market concern with
23:49
respect to cybersecurity, but.
23:52
Even more so with AI governance because the potential for impacts is, is greater.
24:01
Werbach: So many firms now are in this environment where they're pushing
24:04
to go fast with ai and that's often intention with risk and legal and,
24:10
and the groups that are, you know, overseeing those control functions.
24:14
And again, I make this argument myself that it's similar to the
24:18
one that, that you made earlier.
24:20
Doing the investment in governance we're downs to all sorts of
24:24
other benefits for the firm.
24:26
But I find that, that that argument doesn't always go over well with, you
24:31
know, management that just says, I, I know it all sounds good, but you know,
24:35
we've gotta, you know, keep ahead of our competitors or catch up to our competitors
24:39
and just deploy as fast as possible.
24:40
Then we'll figure it out.
24:41
So what have you found actually works?
24:45
In, uh, getting traction with organizations that it's worth
24:49
making this investment, including in, in something like ISO 40
24:53
2001, which is not trivial to do.
24:57
Haydock: ISO 40 2001 is definitely a risk management framework, but it
25:02
is much more than that, and I think there are lots of companies that
25:07
are going out there and have no idea what they're doing from a business
25:11
perspective with artificial intelligence.
25:13
They're seeing their competitors do things and deciding that they
25:17
need to go out and use AI as well.
25:19
They don't even know what they're doing though.
25:22
They're not tracking metrics, they're not understanding effectiveness.
25:25
And in organizations that are kind of rushing out there to deploy ai,
25:30
they may be buying duplicative tools.
25:32
They're wasting money on these resources.
25:34
They're bringing in consultants, even though the organization doesn't
25:38
even know what they're trying to do.
25:40
Werbach: Mm-hmm.
25:40
Haydock: So you definitely need a. Effective business strategy before
25:45
you start worrying about governance.
25:46
But the two go hand in hand because if you don't understand what you're doing
25:51
from a business perspective, there's no real point in talking about AI governance.
25:55
But AI governance can help you clarify your objectives when it
25:59
comes to how you're deploying and purchasing these systems.
26:03
Werbach: Does, does ISO four 2001 provide that kind of quantitative assessment of
26:07
risks that you were talking about before?
26:09
Or is it more general framework for management and
26:13
they're still more specific?
26:13
That has to be done.
26:17
Haydock: ISO 40 2001 is incredibly high level.
26:20
That's with respect to risk assessment and treatment.
26:22
It's with respect to measurement and monitoring.
26:26
With that said, it gives you a framework for how to conduct these types of
26:31
assessments, and I can tell you from personal experience that Stack Aware
26:35
has made it through certification using a quantitative approach to AI risk
26:39
management, so it doesn't dictate that you need to do your risk assessment.
26:44
Assessments in a certain way only that they are repeatable and that you achieve
26:48
the same results given the same inputs.
26:51
So it gives you a, a backbone for building a risk management
26:55
and an AI evaluation program.
26:59
Werbach: The, uh, standard is, I think two and a half years
27:02
old now, which is not that long.
27:03
But a AI moves so fast.
27:06
How can any standard keep up with the way the technology's advancing?
27:15
Haydock: Having a standard that is flexible and high level is a benefit
27:21
when technology is advancing rapidly because it doesn't necessarily need
27:26
to change that quickly with the times.
27:29
So.
27:30
I think ISO 40 2001 can use an overhaul already at this point, mainly because of
27:35
the way that it's structured, and there are some elements that, in my opinion,
27:40
are duplicative and overlapping, so cleaning those up would certainly help.
27:44
However, that's less of an issue when it comes to the pace of technology
27:48
and more of one when it comes to.
27:51
Design and how you're architecting the standard.
27:55
So I think a key benefit of ISO 40 2001 is that it is high level.
28:00
The alternative approach would be something like the high Trusts AI
28:05
security certification or AI UC one, which affirmatively attempts to keep
28:11
up with the pace of change and releases quarterly adjustments that incorporate.
28:18
Threat environment and technological developments.
28:22
Werbach: Mm-hmm.
28:23
And can you talk about how um, certification ties in with
28:27
insurance for AI liability?
28:34
Haydock: There are already programs in place when it comes to
28:39
certification frameworks and insurance
28:45
discounts.
28:47
Additional coverages, things like that.
28:49
Stack wear recently entered into a partnership with ARM ai,
28:53
which is a firm specifically focused on, um, on AI insurance.
28:59
And they also partner with aline, which is, which is a, a firm that
29:04
we work with on the auditing side.
29:05
To verify the effectiveness of ISO 40 2001 Controls and Arm Miller has
29:13
said that they will incorporate the fact of ISO 40 2001 certification
29:17
into their underwriting process.
29:19
So I think as we move forward, the future is going to be.
29:24
A firm will have an auditor verify how it's operating.
29:29
Its AI systems in a very machine readable way.
29:33
There will be data pipelines that the auditors will be able to connect to,
29:37
and then the auditors will confirm that everything's in order, that there are no,
29:41
you know, funny business so to speak when it comes to the presentation of the data.
29:45
Then an insurance firm or an underwriter can come in and look at that data and
29:50
make very educated decisions about what sort of risk they're assuming, and
29:55
if the company's doing a good job at managing the risk, they can get discounts
30:00
because of exactly those types of controls that they've implemented under
30:04
ice, O 40 2001 or a similar standard,
30:07
Werbach: what do you think are the biggest factors that will influence how quickly
30:11
and how successfully that model develops?
30:16
Haydock: Even in 2026, I think we're unfortunately a long ways off from
30:22
a truly machine readable way to evaluate the total risk provi posed
30:28
by a company or its use of AI systems.
30:31
And unfortunately.
30:34
Audit practices are still a little bit old school in that
30:37
they rely on visual observation.
30:41
They rely on interview, which of course has its purposes.
30:44
You can understand if there are gaps in knowledge when
30:48
you're speaking with people.
30:52
I would love to see over the next five to 10 years, a much greater focus
30:56
on machine data on reproducibility when it comes to auditing, so that.
31:03
90% of an audit is just pushing a button to fire a bunch of APIs
31:09
that test whether certain systems are functioning as intended.
31:13
And then the other 10% is the human element, focusing on scoping, making
31:17
sure that there's no evasion on the, on the part of the audited company,
31:22
and then, you know, interviews with, with key leaders at the organization
31:26
to evaluate their level of competence.
31:28
So I think we're unfortunately.
31:31
On the other side of that spectrum right now where it's 10% automated,
31:35
90% manual, but would love to see that flip over the next decade or so.
31:40
Werbach: Great.
31:40
Well, we have to wrap up, but uh, Walter, thank you so much
31:43
for sharing all this with us.
31:45
Haydock: Kevin, thank you so much for having me on.
31:50
Werbach: This has been the Road to Accountable ai.
31:52
If you like what you're hearing, please give us a good review and check out
31:55
my substack for more insights on AI
31:57
Haydock: accountability.
31:58
Thank you for listening.
32:03
Werbach: If you want to go deeper on AI governance, trust
32:05
and responsibility with me.
32:07
Another distinguished faculty of the world's top business school.
32:11
Sign up for the next cohort of Wharton's Strategies for Accountable
32:14
AI Online Executive education program, featuring live interaction
32:18
with faculty expert interviews and custom designed asynchronous content.
32:23
Join fellow business leaders to learn valuable skills you can
32:26
put to work in your organiz.
32:28
Visit exec ed.warden.upen.edu/acai for full details.
32:35
I hope to see you there.