Latest / The Road to Accountable AI / Oliver Patel: Sharing Frameworks for AI Governance

Transcript

Oliver Patel: Sharing Frameworks for AI Governance · The Road to Accountable AI

0:01
Oliver, great to have you on the road to Accountable AI.
0:05
Thanks so much for having me on the podcast today.
0:07
I'm looking forward to our discussion.
0:10
You've worked in a number of different places for the UK government, academia, uh AI governance companies, and now at a major global enterprise.
0:24
What do you take from those other experiences in your current work?
0:29
Well, I'm really grateful for the career journey that I've had.
0:32
always trace.
0:33
my story back to when I was in grad school studying philosophy and public policy.
0:39
my course was in particular focused on ethics and moral philosophy as it applies to issues such as AI and the impact of AI on society.
0:48
I trace my kind of career journey back to my academic foundations in philosophy and in ethics.
0:55
And that's really what got me inspired in the topic of AI in the first place.
1:00
And then since then, really, my journey, as you've alluded to, consists of
1:03
three distinct phases.
1:05
from theory.
1:07
to policy, to practice.
1:09
obviously each one of those steps of the journey has really been vital in shaping the career that I've had today.
1:15
The theory piece, so after my studies, I spent several years working in academia, doing research and really taking the time to understand these issues around data and AI as much
1:28
as I possibly could, publishing work and sharing knowledge.
1:31
And then I moved to government, as you said, where I was more around applying that work and that knowledge to support the
1:37
UK government and its policy ambitions, in particular on the topic of international data transfers and data policy.
1:43
And then in recent years, as AI governance has become a distinct professional field in its own right, I've then applied my kind of earlier interest in AI and AI ethics in a
1:53
corporate context.
1:54
So I feel like my journey has started with strong academic foundations and has progressively become
1:59
more and more practical and now it's led to what I do today on enterprise AI governance which is my core focus but I don't think I would be able to do this work in the way that
2:09
I'm doing it and share my content and materials in the way that I am without those academic foundations which is why I'm really grateful for them.
2:19
What do those of us who are still in the academic world or people elsewhere not understand as well as they should about the realities of enterprise AI governance?
2:28
Well, I wouldn't want to say anything negative or imply anyone doesn't understand anything.
2:34
I think that would be inappropriate because in many ways, one of the things that we miss in the corporate world and in the enterprise world is we miss the time that you have in
2:43
academia to actually engage with foundational research and foundational scholarly work that is vital for understanding an issue.
2:49
So think it's more around different personas have different perspectives, but I guess
2:55
a lot of the research and academia on this space leans more, you could maybe say it leans more towards the idealistic or what would we do if we didn't have certain obstacles in
3:07
place?
3:08
And I think the enterprise reality, if we think about kind of translating from AI ethics to AI governance is that AI is being...
3:18
adopted at speed and at scale.
3:20
And no AI governance professional is going to be able to truly challenge that or stop that.
3:26
Nor should they.
3:27
don't think, you know, it's not our role within our organizations to try and put the brakes on AI.
3:33
It's our role to enable and empower the organizations we work for to adopt AI safely and responsibly.
3:39
So I think that the business reality of the work we have to do in enterprise AI governance is such that we have to be
3:48
We have to be proportionate.
3:49
have to pick our battles.
3:50
And maybe that concept of being super pragmatic and picking your battles is not something that's as pertinent in academia where it's more around, you know, developing your own
3:59
ideas and frameworks and putting them out into the world.
4:02
And then that is up to other organizations how they take that on board.
4:08
Beyond that, what does it take to be effective doing AI governance in a major global organization like the AstraZeneca?
4:18
So.
4:19
Obviously it depends.
4:20
I think that it depends on when you're doing this work.
4:23
So my journey is that I actually joined AstraZeneca at the very early stages of AI governance.
4:29
And my role has been to develop, design, and now implement and scale our enterprise AI governance framework.
4:36
So the advice that I would give to someone just starting out on the journey in the way that I was a few years ago is very different to the advice that I would give to somebody
4:45
that is joining an organization which already has an AI governance.
4:48
and so it'll potentially even a mature AI governance framework already in place.
4:52
But some general principles I would put out there on my...
4:58
six Ps for AI governance success.
5:00
So my kind of six Ps framework is all around the how of AI governance.
5:05
So how to be an effective and successful AI governance professional.
5:09
And just to briefly summarize, the six Ps are principled.
5:12
So sticking to your core values and your core principles, no matter how difficult or complicated things become.
5:20
Pragmatic.
5:22
proportionate, people first.
5:25
that's acknowledging that AI governance is all about change management and being perceptive and learning to speak the language of AI and data science.
5:33
And finally, being persistent because it is difficult work.
5:36
It's rewarding, but it's also difficult and requires a lot of patience, a lot of persistence and a lot of resilience.
5:43
So you mentioned, you you started early on when the organization was developing AI governance.
5:50
What are some lessons from your own experience that you would give to someone who's coming into another organization and still has that scope to build up a program?
6:00
Well, I think that...
6:02
A big difference between when I was getting started with this work versus today is that there's a lot more rigor and lot more clarity from the external regulatory world now than
6:14
there was back then.
6:15
So I remember in the first few months of my work, there were a lot of debates around things like what is AI?
6:21
How should we define AI?
6:22
This kind of thing where it's a very interesting philosophical debate.
6:25
And of course, I, with my background in philosophy, I'm always up for debating the meaning of AI.
6:30
I'm not sure that today that's
6:32
a useful way to spend your time in the enterprise because ultimately organizations and groups like the EU, NIST,
6:40
ISO, OECD, we can just keep reading them off, have done a lot of hard work to standardize and clarify what some of these key concepts mean and what sort of frameworks we should be
6:51
putting in place.
6:51
So I think today AI governance is more about taking the best practice that is crystallized and that is out there from these types of bodies and other groups.
7:01
are also sector-specific bodies and institutes that have developed AI governance-related definitions and frameworks.
7:08
that apply to specific sectors.
7:10
And it's more around taking those and then building something tailored internally that works for your organization based on the core definitions and principles and frameworks
7:21
that are already out there.
7:22
Whereas maybe a few years ago, it was really about inventing the wheel.
7:27
Whereas today it's about not reinventing the wheel, but tailoring what's already out there for your own organization.
7:34
You've built a big presence on social media, Substack, LinkedIn, in this area.
7:40
You've already given an example of one of the frameworks that you put out with the six Ps.
7:46
What has been your experience in terms of taking this work and translating it for that kind of audience?
7:53
Well, my experience doing this kind of content creation and sharing knowledge and thought leadership in this way has honestly been overwhelmingly positive.
8:02
And it's something that I really think in this era especially is obviously becoming more and more the norm.
8:08
Maybe a few years ago, it would have looked a bit odd to see someone with a job sharing all of this content and material online.
8:14
But I think that, first of all, it's increasingly just the way the world is now.
8:18
We're all living online.
8:19
with sharing content and ideas and resources with each other on social media.
8:24
But I think it's been overwhelmingly positive and I'll give three main reasons why that is.
8:28
So first of all, I actually learned so much from the comments and the feedback and the responses I get from the content I share.
8:37
So obviously the content I share, I'm not sort of having a peer review of every time I do a LinkedIn post or a Substack article, but I almost get a peer review of the whole AI
8:46
governance community every time I put out a cheat sheet and infographic.
8:49
an article.
8:50
So actually it's helping me refine and improve the quality of my own thoughts and my own work so much and almost like I'm getting all this free feedback and support back, which is
9:03
amazing.
9:04
that's the first thing, just how much I get back from the community by them kind of commenting on and building on the work that I put out there.
9:11
The second is obviously just you end up
9:14
developing connections with people and organizations that you never would have otherwise.
9:19
So for example, being able to speak with you today, I'm very obviously honored and happy to be on this podcast.
9:25
I don't think that would have happened had I not been openly sharing comment and
9:30
commentary and content and ideas online.
9:32
So obviously it's a way in which it can connect you with opportunities and people all over the world.
9:38
And one of the main takeaways from that is that AI governance actually is impacting all industries and all segments of the economy.
9:47
And I am always surprised by the types of organizations that reach out to me requesting advice, requesting input, or just wanting to chat because it's truly sector agnostic,
9:58
which I think is part of
10:00
reason.
10:00
why this is so fascinating.
10:03
And the third one, actually, it's a bit more personal to me.
10:05
The third reason why this has been a fulfilling journey is because with my sort of work and more enterprise leadership, you don't actually write that much compared to some of the
10:14
previous roles I did.
10:15
So obviously when I worked in policy and government and then academia, writing was a core part of my role.
10:20
Whereas the more you kind of climb the corporate ladder, the more you're spending your time in meetings and maybe your writing consists of sending emails and developing
10:28
PowerPoints.
10:29
But actually I love writing.
10:30
It's one of
10:30
are my favorite hobbies and I think a core skill of mine.
10:35
So one of the reasons I started my Substack is to actually force myself to write substantive long form content on a regular basis so that I didn't lose that writing skill
10:44
that I obviously spent years honing.
10:46
And through doing that, I've obviously been inspired to write my first book, which is coming out next year.
10:51
So overall, very positive and I would highly recommend it to anyone thinking about putting their ideas and content out into the world.
10:59
I want to get to the book in a moment, but there's some really interesting things you said that I wanted to follow up on first.
11:04
uh What's an example of something that you've learned or where your views have changed based on feedback that you got from things you posted?
11:14
Well, there are so many, but I'll mention something that's relevant for what I said earlier.
11:19
So I spoke about my six Ps for AI governance success framework and went through each of the six Ps.
11:26
It initially started as five Ps.
11:29
so
11:30
when I put that out there for the first time, quite a lot of people commented with kind of suggestions and ideas for other Ps that should be included.
11:38
Some of them were more, I took more seriously than others.
11:41
Some of them were humorous.
11:42
Some of them I didn't quite agree with, but there was one.
11:44
And almost like I feel embarrassed to admit this, because it makes so much sense, but the principle is now the six P.
11:51
It wasn't initially there in the first place.
11:53
So I was maybe too focused on the tactical reality of being pragmatic, being proportionate, being perceptive.
12:00
And I almost neglected the most important thing, which is to be principled and to not deviate from your core values.
12:08
So actually that was a recommendation from someone I'm connected with on LinkedIn.
12:14
In a comment, they said, put the 6P, which is principled, at the heart of it.
12:17
And so that's significantly strengthened that framework that's now a core part of my overall AI governance framework that I advocate for.
12:28
And the second thing you said, which I find as well is that people often don't realize how broad a field this is.
12:36
There's so much focus on the frontier AI labs and the big tech companies who of course are doing a tremendous amount around AI safety and AI governance and are obviously key
12:47
providers.
12:48
But I always say to people, every company is going to deploy AI pretty much around the world.
12:54
And therefore every company needs to think about AI governance.
12:56
um
12:58
What do you think people should do if they are coming to this though and feel like they're in a company, they don't really have the technical expertise around AI, they want
13:11
something that is consistent with their corporate culture and unique attributes.
13:18
Do you have any advice in terms of how they should go about this journey beyond just what you said before in terms of setting up a program?
13:26
Absolutely.
13:27
So, you know, I would agree with you that the frontier AI companies that obviously dominate the headlines merely represent the tip of the iceberg for AI governance.
13:35
I would even go one step further and say that the big kind of multinational like mega enterprises like the one I work for is still not that much more than the tip of the
13:45
iceberg.
13:45
mean, obviously AI's general purpose democratized widely accessible technology, which the whole world is now using and potentially billiard, you know, over a billion
13:56
in people using AI in some way.
13:59
really every single organization that uses the internet in some way is impacted by the risks of AI and the opportunities of AI.
14:09
I think that, as I said, lots of organizations approach me that are smaller in scale.
14:14
could be a small medical clinic or a primary school or all sorts of stuff.
14:21
An airport, there's all sorts of organizations out there that are not at
14:26
the bleeding edge of AI adoption and AI governance.
14:30
companies in many cases.
14:31
Yes, exactly.
14:32
And even individuals, so individual creators, individual artists, it's having a huge impact on so many freelancers and so many creative professionals and all sorts.
14:43
I think that organizations won't have the resources to develop a mature enterprise AI governance framework like the sort of stuff that I've been working on because that
14:54
requires teams of people and lots of cash to basically pay for all sorts of stuff like technology platforms and
15:01
lots of basically resources and support.
15:04
But I think that AI governance doesn't mean the same thing to everyone.
15:08
So whatever you are, however big or small your organization is, the most important thing is to figure out, what are the most significant and potentially impactful risks?
15:19
with respect to how AI can impact your organization and then start from there because you can't do everything.
15:26
You have to be risk-based in your approach.
15:29
if you're a primary school, for example, and it may be that you cannot have the full AI governance framework, but you may still need an AI policy that...
15:40
that has some guidance or requirements on how your teachers can use AI for marketing, for example, and you just start there because it's the most significant and immediate concern.
15:51
It's just an example.
15:53
Don't hold me to it, but I would just say you have to start somewhere and you should start with a kind risk-based analysis of how the use of AIs has the potential to impact your
16:02
organization and potentially what has the most negative impact or could have the most negative impact.
16:09
I want to come back to the sub stack and uh things that you posted.
16:13
You just recently put out a framework for uh data risks.
16:18
And so I'm curious if you could talk about that.
16:20
It's a good segue because I think the data risks of AI are actually a risk theme that impacts all organizations.
16:28
I would go as far as saying that if your workforce or your employees have access to the internet, you are exposed to this AI risk.
16:39
so I put out this new framework, which is called the Protect framework.
16:43
And it's all about how you can manage data risks in the AI era.
16:47
So protect.
16:49
There's seven themes there for each of the letters in the word protect.
16:53
So first is P public AI tool usage.
16:56
So that's about risk relating to your workforce or your employees using publicly available AI tools, which haven't been vetted and approved for use.
17:05
R is.
17:06
standing for rogue internal AI projects.
17:08
So that's all around AI projects progressing and going to production potentially without any kind of proper compliance and data related compliance checks having been done.
17:19
O stands for opportunistic vendors.
17:21
So there's a whole risk area here around working with AI vendors that may use your data in inappropriate way, such as to train their AI models in a manner that can potentially
17:31
expose your data to other customers and partners they may work with in the future.
17:36
T is all around technical attacks and vulnerabilities.
17:40
So this includes things like prompt injection attacks that can lead to data exfiltration or data leakage.
17:48
So these are AI specific attack vectors and AI specific vulnerabilities that maybe traditional cybersecurity hasn't fully accounted for.
17:58
E stands for embedded assistance and agents.
18:00
So increasingly the workplace software that we all use is embedded with AI agents and AI assistants that can help us by summarizing our emails or telling us what's on our top
18:10
priorities for our to-do list in our calendar today.
18:13
But there's a whole set of risks with these assistance and agents that they can actually inappropriately surface information to us or to others that work to people that weren't
18:22
supposed to see it.
18:23
We're getting there now.
18:24
C stands for compliance, copyright and contractual breaches.
18:28
So again, there are so many areas of law and regulation that are relevant for data, whether it's privacy, copyright, AI specific laws like the EU AI Act.
18:37
And then finally T, which is almost a subset of C is transfer violations.
18:41
So there are of course really stringent rules relating to international data transfers in the EU.
18:47
with the adequacy regime in the US and specifically between US and countries of concern, according to the Department of Justice like China.
18:55
So that's my protect framework.
18:57
It basically helps any organization or practitioner to understand, map out and manage the data related risks of AI, which I say apply to all organizations that use or can use AI.
19:11
As you've already illustrated, you've got a lot of frameworks and a lot of acronyms.
19:15
um Why do you tend to structure things in this way?
19:19
And what's the value to someone of having that list that they can operate from?
19:25
That's a very good question and not something I've ever spoken about before.
19:29
think that it's interesting.
19:31
So when I worked in academia and when I worked at University College London and when I studied philosophy before then, I didn't do this and I didn't really consume much content
19:39
that did.
19:40
But I think ultimately it feels like people are much busier now than they've ever been before.
19:47
It feels like with the way we all use technology, we all use social media, the pressures that everyone is under at work.
19:53
we seem to have a lot less free time than we used to.
19:57
I think there's plenty of evidence to show that our attention spans have got shorter and shorter.
20:04
But on the flip side, the actual problems that we're dealing with, the impact of technology in society are getting increasingly complex.
20:11
So we have this kind of...
20:12
dual situation of harder and harder, more and more complex problems to solve.
20:18
And it feels that we will have less and less time and shorter and shorter retention span to figure out how to solve all of these problems.
20:26
So I think that...
20:27
One of the reasons I think these sorts of frameworks resonate is that you're packaging up a complex area in a manner that makes it easy for someone to kind of consume and
20:37
understand in a really short space of time.
20:39
So those seven themes are all kind of data risk themes that I've been aware of and others will have been aware of for a long time.
20:46
But actually the work that I did, you know, it took me several hours after several years of working in this field, several hours of thinking through, okay, what are the main
20:55
categories of data risk and how can I put it all together?
20:58
It's almost like I'm giving someone the shortcut to understand what's almost taken me years to get to in like a few minutes.
21:04
And I think I get a lot of feedback from people saying that it really helps them a lot.
21:08
I think, especially if you're sort of an AI governance leader and you need to go and do a presentation to your board or to your C-suite, they may have only got passing knowledge of
21:18
these things and you can put it to them in such a way that they just get it like that.
21:22
I think that's the sort of feedback I get as to why it's valuable.
21:26
And you mentioned that you're working on a book.
21:29
Can you give us a sneak peek about what's that going to focus on, what it's going to add to the content you've already put out there?
21:35
Absolutely.
21:36
So the book is called Fundamentals of AI Governance, and it's essentially the definitive visual book for implementing enterprise AI governance.
21:44
So the book is highly practical and practitioner focused, and it really lays out that step-by-step guide to implementing and scaling an AI governance framework for kind of your
21:56
organization.
21:57
So it could be both a private sector or business organization, or it could be a third sector or academic organization or a public
22:05
sector organization, but really the book's focus is on how organizations and in particular enterprises can implement and scale AI governance.
22:14
So it first covers the main AI risks that enterprises are most exposed to, such as the data risks that I've outlined, as well as associated areas like security, privacy,
22:25
copyright.
22:27
It then does a
22:28
overview of the global AI laws and policies and standards around the world with a particular focus on the US and China and a particular focus on the international standards
22:39
and international frameworks that have been published by organizations like the OECD and the UN and it then
22:46
has a deep dive on the EU AI Act.
22:48
So the EU AI Act is, think, the most, obviously it's the most comprehensive AI law in the world.
22:53
It's the most stringent AI law in the world in many ways.
22:56
And really it's one of its kind.
22:58
most AI governance professionals that I work with are grappling with the EU AI Act, which is why it gets its dedicated chapter.
23:05
And then the fifth and probably most important and most original chapter is the implementing enterprise AI governance.
23:12
So that's where I really lay out in detail my framework and my
23:16
proposed approach covering the why, the what, and the how of AI governance.
23:21
And it's original.
23:24
The whole book is basically consisting of over 150 original visuals, infographics, cheat sheets, but also things like templates, checklists, flow charts.
23:34
it's not your kind traditional book.
23:39
It's more of an interactive visual resource, I would say.
23:44
No, sounds fantastic.
23:46
I will look forward to seeing it when it comes out.
23:48
Let me follow up on one of the things that you talked about there, which is the legal regimes like the EU AI Act.
23:54
There's been a good deal of criticism on my side of the Atlantic and even some within Europe that it's too regulatory, too detailed.
24:04
It gets in the way of people going forward.
24:07
What has been your experience and how do you view that law and the AI laws that are out there in general?
24:14
What I think is super interesting is that in recent months, there has been quite a lot of pressure put on the EU from a range of different actors to kind of basically change course
24:25
on the AI Act.
24:26
And although there's a lot of talk about EU digital regulation simplification, and we know to expect this kind of omnibus package on EU digital regulation simplification, I think
24:39
later in November, so I'm not exactly sure, it will probably go live with this before that has been published.
24:44
published, I don't sense a major change of course coming from the EU.
24:48
I think the EU is quite committed here to the EU AI Act as it is.
24:53
know, they might tinker and tweak in some areas such as maybe broadening out
24:59
some of the exemptions or liberalizations for SMEs and scale ups.
25:05
There may be some tweaks on sort of timings in some area, but I think as a whole, the EU is standing firm on its approach to AI regulation.
25:13
in a way, it doesn't really...
25:15
matter that much what I think or what anyone thinks because I think the EU has basically made it clear that the EU AI Act is here to stay.
25:23
What is super interesting is that I don't think we're seeing this kind of Brussels effect of other countries sort of replicating and taking inspiration from the EU AI Act for their
25:33
own AI regulation framework.
25:34
And that's really different to the GDPR, where you saw many countries around the world adopt kind of GDPR lights or GDPR style privacy regulations and data protection
25:44
regulations.
25:45
I can't name a
25:45
single country that has or is in the process of adopting a comprehensive
25:53
horizontal stringent AI law like the EU AI Act.
25:55
You have some laws in like Japan and South Korea, but they're more focused on promoting the AI innovation in the economy.
26:02
And then of course, you have US state laws, which are often very narrowly focused on a specific issue.
26:06
So I think the most important points to know are the EU AI Act is here to stay.
26:10
And it's quite unique.
26:12
And I'm not seeing any other countries or governments adopting a similar approach.
26:16
Although even without those other laws, given that it applies broadly to organizations that do business in Europe, pretty much any multinational is going to have to take into
26:26
account, right?
26:28
Yeah, absolutely.
26:29
So the key thing to point out about the Brussels effect is that
26:33
Although we may not be having this domino effect of other countries and jurisdictions adopting EU AI Act style laws, I know Canada had one on the table a few years back, but
26:43
that's now completely off the table.
26:45
It is having a Brussels effect in terms of impacting the internal corporate governance and compliance practices of companies around the world as it pertains to AI.
26:56
So of course, this will be most relevant for companies that operate in the EU, which I guess is most multinational companies.
27:03
operate in or sell to the EU market.
27:06
But actually there's also many vendors and smaller companies around the world that may be a bit separate from the EU market, but may want to sell their services to multinationals
27:15
in the EU and then are going to have to go through due diligence and governance processes that are heavily connected with the EU AI Act.
27:22
So I think in a nutshell, no Brussels effects in terms of other countries adopting similar laws, but there is a Brussels effect in terms of companies aligning their frameworks,
27:32
internal governance.
27:33
very much with the core elements of the EU AI Act.
27:38
Can you talk about your experience of what that process has been like?
27:41
The high risk provisions of the act are not yet effective, but all major companies, I'm sure like yours, are going through that compliance process.
27:50
Has it been feasible to align with all of these detailed requirements?
27:55
Of course, you have to take a step-by-step approach.
27:58
So it's a hugely complex law with many different requirements.
28:02
I think that, know, a lot of companies, I mean, naturally so companies are focused more on the provisions that have become applicable.
28:09
So I think across the board and across industry, we see a huge focus on AI literacy.
28:14
So I think it's safe to say that.
28:16
one of the biggest impacts of the EU AI Act on the kind of world of industry and the corporate world has been to kind of mandate AI literacy.
28:24
And this is obviously something that many organizations now take really seriously with various kind of training and upskilling programs.
28:32
I don't have any evidence to prove this, but I think that
28:35
the EU AI Act has undoubtedly had a big impact and really highlight sort of reinforced how important AI literacy and AI training is.
28:45
And I'm not sure we would have seen so much of it were it not for the EU AI Act.
28:48
And then again, every organization that has any kind of AI governance framework has a process of classifying the risks of specific AI systems and AI use cases, and then doing
29:00
proportionate governance and compliance reviews and impact assessments that are tailored
29:05
based on the risk level of the AI solution.
29:09
these kind of core pillars of AI governance and AI literacy and upskilling and training, as well as your kind AI risk classification and AI governance assessment process, I think
29:20
one of the reasons why these are core elements of AI governance is in part driven by the fact that it's basically impossible to comply with the EU AI Act without doing these
29:28
things.
29:29
And then another kind of core element of AI governance that you see across the board in all companies that take this seriously is having an AI
29:35
inventory or an AI catalog where you can actually track your AI systems and use cases and then, and also track with respect to what's high risk, what's low risk, what's live in the
29:46
EU or not in the EU.
29:48
So again, these are the kind of core pillars of what I, one of my other frameworks, the 10 key pillars of enterprise AI governance.
29:54
I would say that all of those pillars would be good to do without the EU AI act, they're essentially mission critical with the EU AI act as a, as a, you know,
30:05
law that companies have to comply with.
30:08
Beyond what you've already covered, what do you see on the horizon in the next several years as issues that should be top of mind for people who are working in this area?
30:20
That's a big question.
30:22
The top challenges that I see today and that I think are only going to get more and more pertinent.
30:29
think there's a kind of bucket of three separate, but related challenges.
30:34
So first of all, we have what I'm calling the democratization dilemma.
30:38
So how do you govern AI when it's fully democratized and everyone in the workforce has the ability not only to use AI, but to even build AI with low code and no code tools.
30:49
So that's the first challenge.
30:51
The second challenge is.
30:52
kind of volume and velocity of AI initiatives is quite frankly overwhelming for the average enterprise AI governance function to keep up with and respond to.
31:03
And then third is
31:05
what should the risk-based approach to AI governance and in particular, how you classify AI risk B in this world in which AI is at the fingertips of everyone.
31:13
Everyone can build AI agents or AI bots and assistants.
31:17
And that means that we're having this huge increase in volume of AI initiatives coming through our processes and this kind of rapid velocity in terms of how the technology is
31:28
changing and how the risks are changing.
31:30
So.
31:32
The solution or one of part of the solution here is what I call the three G's for.
31:39
governing AI democratization.
31:41
And this is really to kind of help people not get too overwhelmed by basically all of this AI that they're expected to govern as AI governance leaders.
31:49
So the first G is guidance.
31:51
Ultimately, your workforce needs to have the appropriate guidance on how to use AI safely, how to build AI safely, how to procure or deploy AI safely, you're not going to be able to
32:02
just govern everything proactively, you need to have the whole workforce understanding the practical do's and don'ts and the
32:09
the most important compliance and sort of guidance.
32:13
That's the first G.
32:14
The second G is green light.
32:16
So just because AI is democratized and everyone can have access to it doesn't mean it should be a free for all in terms of what AI platforms and systems and tools they can use.
32:26
The best way to kind of keep up with this insatiable demand to use AI is to...
32:32
provide access to enterprise grade internal versions of the best AI tools on the market to your workforce internally.
32:40
So that's green light.
32:41
And then third is guardrails.
32:43
How do you build in the guardrails to those internally approved AI platforms so that you don't need to have manual governance reviews and checks of everything.
32:52
You actually build in that governance by design and you have automated things like.
32:58
prompt sanitization or output filters or automated incident detection and monitoring so that you can actually get ahead of risks in a more engineered way rather than just through
33:11
the manual kind of paper-based reviews.
33:14
So guidance.
33:16
m
33:17
green light guard rails is your three G's for dealing with this AI democratization, which I think is probably the biggest challenge facing AI governance practitioners today.
33:27
And it will only ramp up over the next few years.
33:31
Wonderful.
33:32
Well, my G is that was a great conversation.
33:35
Thank you so much for sharing all your insights with our listeners.
33:39
Thanks so much, Kevin.
33:40
It was really great to talk to you today.