Confident AI: Driving Value While Controlling Exposure

And so truly the job of strategists like Paul and I for leaders like all of you in your organization is to help you build that roadway. What is the roadway? And more importantly, how do you set those guardrails up? Because you always will have a left and right guardrail, you'll have some line markers, and you have to be able to lead the colleagues in your organization in a safe manner, protect the company, protect your IP, and really get the most value out of it. So I would say in general, that's our approach today and what we are going to try to do is to empower you with some of that information and knowledge to the best of our ability. In terms of agenda, Paul and I really thought about this a lot and we decided not to do the typical background and what is AI, where does it come from?

We figured that since you're spending this time with us, we're going to go straight into what we are seeing as the big bang for the buck. What are our predictions? What are we really feeling and seeing today? And our plan is to go straight into those items and really give you some tangible insights, how to think about things, where to implement, and how can you act with confidence in your organization, what you're doing and operating with the most care that you can. So in terms of our outcomes, as I said, we really want to make sure you're focused on how do you do it safely with the right governance, the right controls in place, and move forward in a responsible manner for all your shareholders and stakeholders that you have in the organization. So with that, let's get ourselves started. And Paul, I'll pass the baton over to you, my friend.

Paul Douglas:Thank you so much. And I appreciate the new middle name. I'll text my parents after this call and let them know how I would like to be referred to moving forward.

Rahul Mahna:That's great.

Paul Douglas:So a couple slides just to frame the conversation that we're going to have together. We're really excited for this. I mean, this is the type of conversation we really welcome right now and that we're having with a lot of organizations. So you have seen the triangle historically. This is something that we're all trying to keep in balance at our businesses, the cost, quality, speed triangle. And the reason we bring this into the conversation for framing purposes is AI is giving us new opportunities to push the boundaries of the triangle. Historically, we could only have two of the three. We could never be outstanding at all three.

And think about this in a real example. If you want to deliver a high quality product to your customers, regardless of industry that you're in, and we know we have a lot of industries represented on this phone call, if we're to deliver that high quality product at great speed, typically we're going to transfer a higher cost to our customer. When we think about AI and the ability to expand the boundaries, what does a winning organization, a winning business, a winning financial services institution, a winning university, a winning healthcare provider, all industries that are represented on this call here, what does that look like moving forward? We believe quality becomes that differentiator. Absolutely, AI is an opportunity to reduce that per unit cost, maybe have a faster speed delivery, but I think a topic that Rahul and I will come back to throughout this webinar is the differentiator is going to be how we push our quality, and that's where the human judgment comes in.

A way to think about this topic as we go through our predictions is how rapidly the capabilities are increasing, but how difficult it is for us, our organizations, our institutions to absorb those capabilities and to use them in a meaningful way. Again, thinking forward about who are those winning businesses, I mean, this is such a transformative time that we're going through. And when we are interacting with the boards that we participate on, the executive stakeholders that we work so closely with and those who are tasked with implementing, this is top of mind. We're at a point, call it an inflection point where we are going to see winners and losers start emerging from all the transformation that's occurring. And to be on the winning side, we know we need to be able to meaningfully adopt the capabilities while also having those guardrails that Raul mentioned.

I love the highway analogy because we all know that most highways are behind schedule over budget. We don't want that to happen. A lot of our role as strategists is helping that highway be on time, be on budget and have the right guardrails in place. The study you see here in front of you, it might be a nice read. It's called The Growing Gap. A couple of faculty members from the Harvard Business School wrote this thesis back in 2020. It has only become more applicable as we have moved forward, as we see the acceleration of capability with the technology and the AI advancements, but how slow we are to be able to absorb those capabilities. So we're going to talk a lot about what it takes to do this and to be that winning organization as we move forward.

Rahul Mahna:Paul, just thinking about this, we have had many clients want to adopt AI and many of them have run to do it, but it was interesting in one recent client I'm thinking of that even though they deployed it when we ran some data statistics, people were not using it. And it's interesting when I see this adoption gap, although executives have spent money, and I know we have a lot of CFOs on this call, they're allocating larger and larger dollar amounts towards technology, AI in particular, but if people are not truly using it and getting the value, how do you do it? And one solution I would love to get your thoughts on as well is we implemented at this client a very thoughtfully designed training program and we said we are going to go train everyone in the organization. We did an initial assessment. We saw their skill level.

We further went to a training program. The training and program was onsite if they came onsite, it was virtual if they were virtual. Then we did an ending training assessment to see how much their skills advanced. And when we did this thoughtful process, we saw adoption take off and it was almost like they needed the nudge and the tools to do that. So maybe that helps some of you out there. But Paul, have you seen that with any clients or maybe other ways this adoption gap can shrink?

Paul Douglas:Absolutely. And I think that's probably something we don't see enough of. We need to empower our users to be successful. We need to make our AI strategies human-centric. Training is a great way to help make those AI strategies as human-centric as we can. It's also going to help us embed the right risk mitigation. So in the same way that we are training and empowering our users to use the tools and the capability, we're also educating them on how to manage the risk. And this is the balance we're trying to strike. I tend to lean on the IT governance side of things as it relates to this topic. And what we're always trying to achieve is can we have our governance keep pace with our strategy and for those to be in harmony? We don't want governance to be overly burdensome. We don't want it to be overly restrictive, but we do want it to manage the risk that we care the most about.

Rahul Mahna:Yep, absolutely. We don't want to slow anything down, but we want to do it in a thoughtful manner. That's right. One point that we didn't make earlier, if you have any questions for Paul and I, please put them in the chat. We're monitoring those. If we don't get to them at the end, we'll be sure to follow up as well. So please continue to think about things and go from there. Look at that question.

Paul Douglas:Poll number two.

Rahul Mahna:It's interesting, Paul, this again is back to that word being thoughtful about how do you implement AI and what's your structure? And I think even for those that are in this call just thinking about it, it just doesn't make sense for many risks that we are going to talk about just to let everybody use anything they want and just let it become the wild west. It just doesn't work for long-term strategies that we'll talk about. But I see a lot of that. I don't know, Paul, if you see that as well.

Paul Douglas:I do. And I think it gets back to the triangle that we led off with. If our AI strategy is purely a cost reduction play, think about it this way. These tools are democratized. Our competitors have the same access to the same tools that we do, and that's a little bit different to technologies in the past. Some technologies, there may have been a greater barrier to entry. These, a simple license can get you started. So the barrier to entry isn't necessarily there. And that's why if we purely focus on cost reduction, we won't have that differentiator that our competitors will have. So if you're to think about if our competitors not only reduce their per unit cost via the usage of AI, but they also increase their quality, as a consumer, who do you go to? Consumers typically don't pick organizations that have the best margins.

They pick organizations that have the best quality. And so that's why it's so important to think about this from a quality standpoint. And look, inevitably there may be a per unit cost reduction benefit. Inevitably, there may be some speed and efficiency benefits, but when we push the quality, we think that's ultimately what will differentiate organizations moving forward.

Rahul Mahna:Yep. I agree with that. Looks like we have an overwhelming majority of people that think about things the way we do here, Paul, so that's good to see.

Paul Douglas:Okay. Into the predictions, what's your number one here?

Rahul Mahna:Well, in no particular order, but again, back to the fact of no fluff, Paul and I just wanted to get straight into it. And by the way, you're going to get six predictions, not like the slide said, three for me and three for Paul. So double the excitement here. I think as I talk to our organizations and clients, everybody's thinking about this. Everybody wants to do it. I will share two years ago, everybody started with Copilot and said, "We need to check the box." Many of the executives on this call had to have a compliance with their board of directors to say we are engaging in AI. So they bought a license to Copilot. Done. Last year, everyone said ChatGPT, we need to switch to ChatGPT. That's the greatest thing ever done. This year, about February, tidal wave went to Claude. Everybody wants anthropic. Okay, let's do that.

That's done. Now, the problem that I keep seeing is, and people have very strong opinions of this. I'm not sure what you're seeing, Paul, people think one way of Copilot at ChatGPT. Everybody has their personal opinion, probably on this call, which one is best, which one is better? But I always lean to what is the problem you're trying to solve? It really starts from there because as with any tool in your toolbox, you pick the right tool for the right problem. And I am sure as these tools evolve, they will become either verticalized or specialized or have better proficiency in different areas. And so the winners, I believe, in business and the successful leaders will first start with the problem statement. What is the business problem they're trying to optimize? And when you start there, a thoughtful process can follow right after that. And so it's very logical how you think about it.

Once you start with the problem, then if you try to find the right tool to fix the problem, then you set up some guardrails and some governance and you have either what I'm seeing now is governance committees being formed in some organizations where they want to have a process as to what tool will they allow, what problem is it solving for what department, deploy it in a controlled environment and move forward. I think that is a thoughtful structure that will lead to thoughtful results moving forward. So any thoughts, Paul, on that?

Paul Douglas:I couldn't agree more. And you can apply it to example historically to technology enablement, starting with the problem, aligning the right solution to that problem, that's what really guides us. And I think that's what makes this sustainable and puts you in that position to be a winner with this inflection point that we're experiencing as a society. I think it also puts us in a position to align what we do with our mission and ensuring that the usage of AI reflects our risk tolerances, our ethical goals as an organization. These are topics that will become more and more top of mind as we have to tackle more difficult ethical questions around the usage. So starting with the problem, aligning with the values of the organization, it's so important because what that will also enable you to do is when times are difficult, you are grounded in that because you will experience adversity rolling out any new technology.

Who's ever had an easy ERP implementation? They're all difficult. So AI, while the capability may feel a little bit easier to release into our environment, there will be challenges, but when we ground ourselves in the problem and the mission and the values of our organization, it moves us through those challenges in an effective way.

Rahul Mahna:I agree. So in summary, Paul and I both agree that have a framework before you deploy these tools and think about it, get some folks to help you think about it, but the more structured framework you have, the higher your success rate will absolutely be on the backside. Number two, the thing that I am most often seeing when I talk to our customers and newer customers is that they have the marketing department using one tool, they have the finance department using one tool, in one recent case, the legal department and the HR department using their own tools. And all of a sudden you have a wild west of AI running an organization that the CTO or the CIO, and I know we have some of those on this call, had no idea. And so that's what we call shadow AI, where there's multiple tools being used in the organization, some that are approved, some that are not approved.

And organizations have to know how to find this, otherwise you're going to have a massive reset happen in my mind in the very short term. And the reason for that reset is first and foremost, data leakage. I have a case example of where one person in an HR department was putting very personal information into AI to write termination letters. And so data is being leaked out on free tools that was not governed or set up with any type of compliance structure. As with the dotcom, and I'm sure there's many on this call that live the. Com, there was a new company started every day and every day there was yet a new, I think back in the search engine days, there was at least 10 to 15 search engines that were out there. You couldn't keep up with it. The same thing is happening with AI.

Every day there's a new AI company that your organization probably wants to look at and talk to, but do they have any security in place? Is it just five people that have vibe coded a new platform that are starting to try to sell it? And so organizations should be thoughtful about what's their vendor management process? How are they onboarding? What is their risk management? Does that company have a SOC two? Have they ever had any type of risk controls put in? And so thinking about vendor management is becoming even more and more critical. The spend, the one thing about AI that I see a lot is it costs money. It's not free. I think there's free versions. I've got my 80-year-old mom, bless her, on ChatGPT right now. She uses it every day and it's free. And so people have this kind of correlation that AI is kind of free and many organizations are paying for these licenses people don't realize, but there's some thoughtful CIOs, and I know one on this call that I've talked to who spent $157 building a PowerPoint.

And when he went back and saw that it cost him 150 some odd dollars to build a PowerPoint, he said, "Hold on a second, this is going to cost our organization a lot of money and we need to be very thoughtful about what licenses are we buying, how are we buying, who gets it deployed to?" And I think this cost is going to hit a lot of companies very, very quickly and again, force it some type of reset into how are they deploying tools, what's the cost structure? I think there's a lot of CFOs on this call that are going to get very much upset when they see some bills start coming in over the next 12 months. And how do you think about this before those types of things happen?

Let's move on here in the sake of time because I probably could do about 10 predictions. I know we were just forced down to three. And so my third prediction, Paul, before I turn it over to you is the board level. So as I said, a lot of our C-suite executives are signing off on AI. Use AI, use the AI costs. It's okay. We will figure it out later. And so there is a day of reckoning, and many times a day of reckoning is when you talk to your board of directors or if you have an owner in a family held business and that senior executive says, "What was my outcome? What did I get for spending 5,000, 50,000, five million, whatever that number is, what did we get for the return of this investment?" And it's a very fair question. And I don't think a lot of executives that run into AI without a methodology as we talked about so far can quantify what is that return.

And I think the smarter folks on this call hopefully can do this as a takeaway. Make sure you start with your problem, make sure you have a methodology to quantify what is the return and how you are measuring that return. And that could be a variety of things. It could be operational efficiency. It could be a new product that you're launching or a new expansion of your business as a return of doing some operations. And so I think this is an area that will continue to grow, which is executives, board levels asking, how do I get some value out of all of this money we're spending? And I believe that's going to come harder and faster as costs skyrocket very soon. Paul, I see you shaking your head. I have a feeling.

Paul Douglas:I couldn't agree more on the cost side because if you think about it, and you probably saw yesterday, Anthropic made the announcement of the IPO valuation that they were hoping to achieve. These AI companies, the leading AI models and organizations, they're trying to absorb as much of the demand as they can and they're finding new and innovative ways to recoup costs or to make this as profitable of an endeavor as they can. And it feels similar to what we saw with the shift when we were moving our infrastructure and our systems into the cloud. Initially when we were running these on-premise data centers and we were moving that infrastructure into the cloud, there was this idea that it would be more cost effective. And what we found over time is the cloud service providers, they found a way to absorb the demand and to start shifting their pricing models to what you see is it's almost somewhat similar.

Now moving our infrastructure and other pieces, if you did, into the cloud, it did free us up to redeploy resources to focus on other initiatives at our organizations, but it wasn't necessarily more cost effective. And we may see a similar dynamic happen where initially rolling out AI may be more cost effective for the use cases that we're applying it to. That assumes we even have a clear definition of what use cases. To your point, Rahul, around business outcomes and measurable returns, I think we will absolutely see the usage cost increase as we roll out and rely upon AI more and more. No doubt the cost will increase. In the end, will that make it more cost effective? Maybe. But again, if we just focus on this being a pure cost cutting initiative, that may be shortsighted and it may not work out that way. So I think you make a really great point around the ability to actually measure the return.

Rahul Mahna:Have to figure that out. Yeah. And I was going to mention, Paul, for the finance folks on this call, there are tools available that you can ask of your IT teams and tools that will show what's the shadow AI going on in the organization because that shadow AI is costing money in terms of licensing somehow or another, whether those folks are putting it in as personal expenses on their expense reports, however they're doing it, there's expenses coming through. There's data loss prevention tools. So if you're worried that your IP is leaving the organization, there's tools to manage that and there's tools to monitor your costs that we haven't even talked about, but everybody's talking Claude and OpenAI and you're spending 10, 20, 30, $40 a month per person, and then there might be usage charges. But there's a whole other sector of executives I'm talking to that are looking at open weight token technology.

And so some of them are coming from different lab frontier labs that are dramatically dropping the cost basis of some of this. So a lot of tools can be used to watch this cost basis. And so I would encourage everybody to be thoughtful and think through and ask those questions. So let's go to the next polling question.

Paul Douglas:All right. Well, while you're submitting your answers, another thought on cost is imagine what this is going to do to the insurance industry. In terms of how they valuate AI policies of the future that will be purchased to help manage risk. From a cyber liability coverage standpoint, that's a very mature market. We're able to run analyses to understand the right way to structure the policy, to structure the premiums. There's a lot of options available. But early on, if you recall, some insurance carriers were dropping that product because they couldn't get the balance right between what the policy limit should be, what the premiums they should charge. Imagine writing policies for AI right now and what those premiums should look like and the ability to provide the right coverage. I think this is going to be very interesting to watch. I mean, Rahul, what takes do you have in that regard?

Rahul Mahna:I mean, I absolutely think at a macro level, I saw cyber insurance when it started, I would say eight, nine years ago, it was a one-page piece of paper the State Farm rep was begging people to sign and to give coverage on. Then it turned into a five to 10, 15 page document just to get cyber coverage. And I've seen them get excluding different items. I know you and I talked about, Paul, what they will cover, what they won't cover moving forward. And I think this AI deep faking is going to cause a lot of concern in how they handle coverage and I think it will change. I don't know exactly, but I see it coming for sure. I think we're going to need to have a whole separate set of internal controls, governance, risk management around AI to get an AI insurance policy is my thought.

Paul Douglas:Agree. Agree. It'll be very interesting to see. Okay. Moving into our next few predictions. Okay, so a little bit about myself. I'm a lifelong IT governance, IT compliance practitioner. And so I do think about compliance a lot. And something that I have seen working in the space over the years is here in the US, we tend to have a fragmented compliance approach, usually very sectoral driven by industry needs. I think of healthcare and the HIPAA laws, GLBA for financial institutions. We have these variety of standards that we look to govern different types of data. And at one point in time, I think we were looking to see a more overarching cybersecurity law that regardless of industry that you were within that you can look to as, hey, this is the standard. And some countries do this. If you look over to the EU, they set forth the GDPR to have a standard across all EU member states.

These are the privacy expectations we have if you're within scope. You may have also saw that the EU put out an overarching EU AI Act, very focused on reducing potential harm to individuals. In the US, my prediction here, which may not be that profound based upon what I just said, is we are going to have fragmented AI laws. We may not have that overarching US based.

We didn't see it happen from a data privacy or cybersecurities laws ended up in. I think we may see something similar happen with AI and that's already starting to take place. California recently expanded the CCPA law, if you're familiar with the California Consumer Protection Act to add what they call ADMT, automated decision making technologies, as well as AI usage beginning next year. There's certain regulations and requirements you have if you do business in the state of California that you'll have to comply with. You see certain industries like the healthcare industry and joint commission just put out its AI standards for AI and the use of as it supports patient care. I think we'll see this continue. And so what that really speaks to is we need to have sophisticated governance practices to harmonize all these requirements to be able to efficiently deploy them across our operations to manage the risk from a business context perspective.

I personally have found so much professional fulfillment doing this. The industries that I tend to serve are highly regulated, highly complex environments, and we are always having to navigate that business context to make sure that our governance practices, now we're talking about AI governance practices, that they are properly adhering to the various laws we'll have to comply with moving forward, but if nothing else, managing the unique risks that we're faced with. So I think the call to action here is we need to start putting those AI governance programs together now. And we are working with a number of organizations on helping them design and stand up those AI governance functions. If the goal is to wait and see what that overarching federal standard may be, I'm not sure that it's going to come. And perhaps it will, and it may look similar to what the EU did, more focused on preventing harm to individuals, which I think we could all get behind.

I don't think any of us want to see these really scary scenarios unfolding in society, but when we're talking about navigating our specific risks, we need to have our own tailored governance programs. What do you think, Rahul?

Rahul Mahna:I believe that our clients are struggling a bit on this. Previously, we had very simple frameworks. Everybody followed NIST. It became like the Xerox. If you want to think about your IT organization and you want to have some kind of measurement and framework, you ran a NIST review. If you wanted to step down and focus on cyber, you ran a SIS program and the framework around it. And in terms of some of your web activity, you went to OS perhaps. And then of course you could fragment and go to HIPAA for healthcare and so forth. But the AI stuff is a little tricky. I saw that NIST included a little bit of AI governance. Did you see that at all or have you seen what it includes?

Paul Douglas:I did, yeah. NIST is the National Institute of Standards and Technology funded from our federal tax dollars. It's a great authoritative source for best practice, but where NIST comes short is it's not tailored to that business context. It's often written for federal agencies and federal systems that may look a little bit different than what we have within the private sector, but it's still best practices we can turn to. So the NIST AI RMF risk management framework is a good one. It's a really solid best practice framework that you can pull in. I think what we're all wanting to see next is risk management frameworks for agentic use cases and controlling the risk associated with AI agents. A point to make there, the risk associated with AI are only going to increase. That's why we need these governance programs in place today, because while the risk may feel scary right now, it's nothing compared to what the risk will be in five years.

Now is the time to put the governance in place. If I were to say nothing else on this call, it's that because the risk will only increase and they're going to increase rapidly. So we need the governance structure now to be able to keep pace.

Rahul Mahna:Out of all the clients that we manage in our practice of outsourced IT and co-sourcing or fully outsourcing, I can only think of possibly, let's say we have three to 500 clients. I would say only on one hand can I count the number of clients that have a governance structure or governance committee. And so there's a massive gap to your point and the magnifying effect is really going to happen quite quickly.

Paul Douglas:If I were to say the top three reasons we receive a phone call right now for us as cyber risk and IT practitioners on the line here, it's to help build AI governance programs. One of the top three reasons we receive phone calls. And it's something we feel very passionately about because we know now is the time. Now is the time to put those guardrails in place. To go back to the highway analogy, we need the guardrails now. Unless this is the Audubon and we're going to go a little free. I don't know if this is the right highway to let the agents loose on though. So we need the governance, but to the point around frameworks, we are still grappling with what is the best way to control agents in our environments, but there are absolutely ways we can do this. There are ways we can do it today and we need to start now.

Perhaps we needed to start yesterday actually, if you think about it enough.

Gosh, great conversation on this one. I think it's really important that we do have the governance conversation right now while there's still time, not to make this sound dire. Maybe we pause for a second here, Rahul, and talk about an interesting situation that folks may or may not be aware of. It's the hugging face attack that occurred. If you're not familiar with the OpenAI hug and face attack, one, there's a great Netflix Insta doc documentary that you can go watch. My daughter and I, my daughter's 14, we watched it together. My daughter is one of those individuals who really doesn't like AI because she wants there to be a genuine world for her to live in, in the next 10 years. She wants to go to college, get a job and there be a future that she can look forward to. So she's not a huge fan of AI for a few reasons.

So we watched this documentary together and it's one where I would say we should have more concern.

And the short of it is a group of agents in a test environment, they started collaborating together and they started exhibiting concerning behavior. And this speaks to the risk that can occur when we have a lot of AI agents in our environment. Simply to define it, an agent is a form of artificial intelligence that we assign a task to and it can perform that task autonomous of our intervention, but we put guardrails around the task. What we are learning from this hugging face attack, which I'm not going to do a full 10 minute podcast on this right now, but I will just say look it up because it's a real concern. What we learned from this is the relentless desire of an AI agent to complete its task by any means necessary. And if we were to apply that to a more scary scenario, you may have an AI agent that's been asked to perform a certain task, but because it has this relentless desire to complete the task by any means necessary, it may result to illegal behavior to complete the task.

And that is what we learned from this hugging face situation. Raul, what would you add to it?

Rahul Mahna:Well, I just happened to watch that last night based on our conversation the other day, and I found it really awesome. Someone asked the documentary name, I think it's called AI Gone Wild and it's 27 minutes. It's a mini documentary. So what do I think about it? I think we toss around these terms, superintelligence, agentic AI, singularity. I think we're getting there so much faster than anybody really knows except these frontier labs. I think they know what's going on. The way to your point that these 1,000 agents thought separately and realized they were better to be a team and then collaborated, and then they posted their findings and then they found a way to achieve their goal. And then they found a way to cover their tracks after they achieved their goal because they did not want to be destroyed. Just those four topic areas there make me realize that we are further along in this journey than we know.

And I think all business owners as a takeaway or business participants worried about your shareholders and stakeholders should really be thoughtful about this. This is not a, "Hey, just set it and forget it." This is not, "Hey, let the marketing people do whatever they want." We really have to have a governance structure if you're worried about your business because once the agents start, to your point, Paul, they will just continue on their own if it's not regulated, if you don't have IT tools to watch shadow AI, watch usage, watch technologies. Everything we've talked about so far, I think encapsulates that wonderful example and how thoughtful you need to be. And that was a great documentary.

Paul Douglas:It's a great watch. And my daughter and I were terrified after. I too though we had more time. Turns out we don't. But to translate that risk into what we are facing as organizations, I'll try to make this more tangible. So Rahul had mentioned a very tangible thing you can do earlier in this webinar, which is training your employees. What kind of data are we going to allow the AI models to have access to? What kind of use cases or what kind of problems, as we put it earlier, are we going to have AI solve? That's how you try to manage this risk. And you realize that these agents have the capabilities all around the relentless desire to complete the task. I mean, imagine if the task was, "Hey, we want to reduce CO2 emissions as a society." And let's say the agents got together and like, "You know what?

Let's just start dropping planes from the sky." I worry about the robotics of the future. What if you have a robot in your home or a Tesla humanoid of the near future, its task is to clean your dishes. Well, who creates the dishes? What if one day the task then becomes take out the person who creates the dirty dishes? These are the type of ways we need to think so we can then put guardrails in place so things can't go that far out of bounds and they're never operating in a way that is outside of our values. But training our employees, having AI governance programs to decide where we're going to have agents in our environment, how we're going to control what data they have access to, there are things we can do. It's not as though this is completely out of our hands. There are absolutely things we can do.

Technical safeguards as well. I say the most common reasons we're getting phone calls, data governance as a mean to manage AI risk is one of those common phone calls, implementing technical solutions to limit what data AI models have access to or what data the agents will have access to. These are technical configurations that you can have in place to manage the risk. And it's work we're doing today. It's one of the top phone calls we're receiving right now.

This is that moment where I'm realizing we could talk for hours, Raul. I knew that moment was going to happen. Okay, last prediction here. Again, perhaps no surprise, but durable governance is going to outperform the regulations we see. We can't wait for that perfect regulation to then start managing the risk. We need to implement the governance structure for our organizations. And then as regulation rolls out, we'll adopt, we'll make sure that our governance is in alignment with the compliance requirements. But we have known historically compliance doesn't necessarily equate to security. Compliance is a threshold. We have to be compliant. It's not negotiable, but compliance doesn't necessarily equate to security. And so now is the time for those governance programs. There are tangible things you can put forth today to help you manage the risk as you start to absorb more of the capabilities. Any other thoughts you would add on this last prediction, Raul?

Rahul Mahna:Yeah, I see a question in here as well that makes me think about this, which is who is setting these guardrails? And so Paul, organizations are calling you and your team to say, "Hey, help us think about this to put some guardrails for the organization." And that makes sense. How does it continue though, right? Because to your last point here, number five, technology will change. As I did my history so far in the short couple years, it went from Copilot to ChatGPT to Anthropic. I am sure a year from now, somebody will love Nvidia's new, or Grok will be the next one, or Llama or Gemini, and people will keep using them. And as I mentioned, I believe there will be a verticalization. I believe some of these tools will become better at certain things and they will say, "Hey, all the finance people love Claude, but OpenAI is really the leader in mathematics or in healthcare." And so how do you keep touching these governance documents to keep them updated, a committee updated, the thought leadership?

How does an organization keep going?

Paul Douglas:I've served on governance committees over the years and governance can be a squishy topic. It can be abstract. It's not always grounded in really tangible outcomes or tangible activities. And so your governance committees are at risk of just being another meeting on the calendar and you don't want that to happen. You want it to be a productive discussion that has actionable items. I had a CIO tell me one time, and I had never thought about it in this context, but he said, "Participation on this governance committee is optional. If we were really to encourage people to do this the right way, should we not incorporate this into their performance metrics? You measure what you care about as an organization. Should we measure the effectiveness of our governance and should we reward our employees for being governance rock stars?" And I though that was an interesting framing because we have so many competing priorities that we're trying to balance and often we default to what our organizations reward us for.

Something to think about.

Rahul Mahna:Yeah, absolutely. And I think organizations as a takeaway from here should think about this as a governance committee. How do you reward? How do you maintain? How do you keep incentivizing colleagues to protect the organization? It's a real challenge. And I saw a couple other questions here about fully going in. You take a platform, Paul, you have a client that says, "Hey, I want to fully go in on OpenAI." And they do every MCP connector, every API connector, they move the entire organization into OpenAI and then they go, "Well, is this safe? Did I do this the right way? OpenAI now has access to everything, my calendar, my emails, my databases, my IP of my business." And how hard is it to unwind, I guess is my thought to you, to set up a governance structure after someone has moved their chips all in?

Paul Douglas:I think we're going to see this litigated greatly over the years. I think we need some good case law around this. I mean, it revolves around the thought of can you destroy it once it's out there? Can you pull it back? And in some cases, for some systems, perhaps you can depending on how it's structured, but absolutely what it has access to opens up new risk because depending on how we have that configured, if other employees can then extract that information that our models are being trained on, well, now we have a data leakage, potentially a breach scenario that we're having to deal with. So I think I saw some comments around structuring what the AI models have access to. So it's both a combination of the data that we're loading into the model as well as what we're getting it access to. And then on the agentic side of things, it's very much what the agent has access to.

Rahul Mahna:Yeah. And what I also find interesting is when clients go all in on one platform, but then they might want to move a year from now. Who says that if you connect fully to Claude today, that's where you want to be three years from now? And how hard will it be to move and pick up and leave? And so there are ways though, if you were thoughtful in the beginning, to your point earlier, if you set your guardrails today and you're very thoughtful about how you frame things and how you apply your prompts, you can transport that. But you have to do it early because if you wait three years to transport it, I don't know how you do it at that point, but really being thoughtful is helpful today.

Paul Douglas:Absolutely. And there is an urgency with this. I think there's an urgency even at more of a higher regulatory level, what is our position going to be? But us as organizations, the urgency is ensuring that we are maximizing the benefit while having our governance and risk management keep pace with that. That's the urgency we have today because there will be winners and losers. We think about this as a firm as well. We too have the same challenge and I'm so grateful to work with an organization that's taking that challenge seriously. I greatly appreciate what EisnerAmper has put forth for us internally. And so we're in the same position.

Rahul Mahna:Absolutely. I think everybody is, so that's perhaps a great comfort for everyone on this call.

Paul Douglas:All right. Well, I think that takes us to our last polling question. I'll tell a funny meme I saw the other day, or sorry, a short reel. I promise I'm not a doom scroller on social media, but I did see a great reel the other day. It was breaking down the Terminator movies and the lessons learned for if we have to fight T1000s of the future and genuinely, genuinely breaking down scenes from the movie to say, "Hey, remember this flaw that the T1000 had. This may come in handy later." And I thought it was both humorous as well as kind of scary that the lessons learned of how we won... Anyways, it's interesting times right now. I perhaps shouldn't make light of it.

Rahul Mahna:That's right. That's right. Okay. All right. That was a pretty easy question and we got a smart audience here, so no need to belabor on that one. And let's bring it all together in the last... Gosh, Paul, you were right. We got three, four minutes left here, so we could probably go another hour. So what do you do moving forward? Paul and I hopefully gave you a lot of stories, a lot of ideas of what to do here. Just in the short order, we wanted to bring it all together and summarize it for you. So where do you start? I think it was great to have a lot of people try AI tools in your organization. I think you should immediately understand what tools are being used, what data is being released out of the organization, find your problem statements, find out what you are trying to solve, build a map around what is going to be your approved tools, what problems are they going to solve?

How are you going to structure it so that you have an ability to allow new tools in the future, not just for today and tomorrow? And so I think doing a bit of discovery is really step one in how do you apply this problem statement? Step two, Paul, I'm going to give to you in terms of the guardrails.

Paul Douglas:I'll position it this way. A lot of shadow AI that you see in historical shadow IT usages, so that meaning folks who are using AI without approval or purchasing software solutions without approval, it's usually done with good intentions. And I say that because users are typically going out, procuring their own solutions to achieve positive outcomes. They're not using this because they want to cause a breach or they want to introduce new risk. And that's why I think it's so important to have these honest conversations with our employees around what are the highest value use cases so we can then bring that into the light. That's what prioritization is all about, bringing this into the light, empowering our users and using what limited resources we have. We can't do everything at once, but this is where your AI governance committee can be helpful. AI governance brokers these conversations around what are we going to prioritize?

That's what it's all about. It's bringing these desires into the light because they exist. There are desires that we need to bring into the light and we need to govern appropriately.

Rahul Mahna:I can't agree more. And then as the final stage, I don't think you need to deploy all at once. I'm a firm believer of dipping your toe in the water. So once you've thought through and you have a structure, deploy it to one or two folks, try it, test it, see what happens, see what your cost structure is going to be. Another thing is AI is not a set it and forget it. It is not just a light switch. You have to nurture it just like any IT solution. So be prepared for a maintenance program, an update, a support program. Ongoing nurturing of this is needed, training as we mentioned earlier. And so monitor it all before you deploy it and then of course reassess again to see where you are in the deployment structure. So I think that pretty much brings us to the end, Paul.

We ran out of time for questions. We'll be happy to follow up with some of those that are there that we can help with. And from my side, I'd like to thank everybody for joining and listening to Paul and I talk about this. We're both available at any time to talk through any other questions. And Paul?

Paul Douglas:Yeah, please connect with us. Rahul, thank you so much for the opportunity to co-present with you. I'll say in closing, I hope this inspires you to build confident AI and we are here to help you on that journey however we can fit into that process.

^{Transcribed by Rev.com AI}