WEBVTT
00:00:02.240 --> 00:00:08.880
If you're forced to have an opinion on stoplights, I think most people would fall in one of two camps.
00:00:09.119 --> 00:00:14.640
Either one, these stoplights are annoying, I'm trying to get somewhere, and they're slowing me down.
00:00:14.800 --> 00:00:16.800
Or two, hey, stoplights, great.
00:00:16.960 --> 00:00:18.719
They keep people safe.
00:00:19.120 --> 00:00:25.039
And I think you can have the same two train of thoughts when it comes to AI governance.
00:00:25.199 --> 00:00:30.079
You could say, hey, this is slowing me or my company down and it's annoying.
00:00:30.320 --> 00:00:35.280
Or, hey, this is probably keeping us safe, this AI governance thing.
00:00:35.600 --> 00:00:42.799
But I don't think most people care or even know too much about AI governance.
00:00:43.119 --> 00:00:53.759
For a variety of reasons, but probably the main one being AI's capabilities are changing so fast that it becomes almost impossible to govern them.
00:00:53.920 --> 00:00:58.320
I mean, when you even think about cars, cars have been the same for like 110 years.
00:00:58.399 --> 00:01:01.759
So the stoplights are relatively effective, right?
00:01:02.159 --> 00:01:06.959
But AI isn't even the same this week as it was last week.
00:01:07.120 --> 00:01:12.319
So how can we keep up with governance and understand it and make it work for us?
00:01:12.480 --> 00:01:16.159
Well, that's what we're going to be diving into on today's show.
00:01:16.319 --> 00:01:19.280
So let's get to the big picture here.
00:01:19.599 --> 00:01:34.879
And that's right now, according to a state of AI report from Deloitte, 74% of companies expect to use agentic AI within the next two years, but only about 21% report having a mature model for governance.
00:01:35.200 --> 00:01:43.840
So just about every single company wants to use autonomous AI that will act without someone watching over it.
00:01:44.000 --> 00:01:47.680
Yet most people admit to not even having a plan.
00:01:48.239 --> 00:02:01.760
And compared to the prior year uh state of AI report from Deloitte, the number of companies reporting that they have a mature model of governance has actually gone down.
00:02:02.000 --> 00:02:08.159
It's because companies can't keep up and is getting scary, both in a good and bad way.
00:02:09.360 --> 00:02:12.159
So that's what we're going to be tackling on today's show.
00:02:12.240 --> 00:02:14.159
And if you do stick around, here's what you're going to learn.
00:02:14.240 --> 00:02:19.599
You're going to learn why the governance rules that you built for chatbots are already broken.
00:02:19.759 --> 00:02:24.879
Uh, what real lawsuits against big companies reveal about ungoverned AI.
00:02:25.039 --> 00:02:31.039
And I'm going to leave you with five operational rules that turn AI governance into a scaling advantage.
00:02:31.199 --> 00:02:36.240
Yeah, I'm going to tell you the five AI rules that literally every company needs to know and follow.
00:02:36.400 --> 00:02:39.199
Because then you don't have to worry about this.
00:02:39.439 --> 00:02:41.439
Hey, what the heck is AI governance?
00:02:41.520 --> 00:02:43.759
I'm going to tell you and how you can keep up with it.
00:02:44.000 --> 00:02:45.520
All right, let's get into it.
00:02:45.680 --> 00:02:48.879
Welcome to Everyday AI, and this is our Start Here series.
00:02:49.039 --> 00:02:53.840
It is the essential podcast series to both learn the AI basics and to double down on your AI knowledge.
00:02:54.000 --> 00:03:00.319
So, yeah, make sure you go start with volume one, all right, and then listen to them in order if you're brand new here.
00:03:00.400 --> 00:03:04.159
And also if you're brand new here, make sure to go to starthireseries.com.
00:03:04.319 --> 00:03:11.759
That will give you exclusive access to our private and free AI community called the Inner Circle.
00:03:11.840 --> 00:03:12.080
All right.
00:03:12.159 --> 00:03:17.120
And then there you can listen to every single uh episode from the Start Here Series.
00:03:17.199 --> 00:03:21.520
We even have an ongoing playlist and keep everything updated in one easy-to-find space.
00:03:21.680 --> 00:03:21.919
All right.
00:03:22.000 --> 00:03:25.599
And if you did miss our last episode, like I said, uh they all go in order.
00:03:25.680 --> 00:03:30.719
We talked about the AI labor shift, when it'll happen, and what it means for jobs.
00:03:30.960 --> 00:03:31.280
All right.
00:03:31.439 --> 00:03:38.879
But today we're talking about AI governance in plain English in the five AI rules that every company needs to follow.
00:03:39.120 --> 00:03:41.039
Let's start with definitions.
00:03:41.280 --> 00:03:41.840
All right.
00:03:42.240 --> 00:03:46.319
AI governance, people think it's it's ethics, it's it's rules.
00:03:46.479 --> 00:03:55.439
And that's sure, kind of true, but more than anything, it is quite literally how your company operates when it comes to AI.
00:03:55.599 --> 00:04:02.240
It's the roles, the rules, and the controls that manage how AI works in your company.
00:04:02.479 --> 00:04:11.759
So it's not just who can use AI, but it's what data goes into the AI systems and ultimately what happens after.
00:04:12.000 --> 00:04:14.400
So that is uh governance, right?
00:04:14.560 --> 00:04:16.160
AI governance in a nutshell.
00:04:16.319 --> 00:04:24.160
It's the before, during, and after and the who, the what, the why, and the how of AI.
00:04:24.399 --> 00:04:28.560
And it's not a debate on should we be doing this.
00:04:28.720 --> 00:04:30.240
It is an operational layer.
00:04:30.319 --> 00:04:31.439
It is foundational.
00:04:31.600 --> 00:04:43.519
And this is, you know, it's obviously going to look a little different if you're a small business of 10 employees versus if you're a uh company with a trillion dollar, multiple trillion dollar market cap.
00:04:43.600 --> 00:04:53.279
And I know we have uh listeners who represent both sides of that pendulum, but um, regardless, AI governance is extremely important, right?
00:04:53.439 --> 00:05:11.439
So think of it, and and this is obviously an extremely oversimplified um kind of uh analogy here, but I'm sure at some point you've, you know, when working for your company, you had to sign, you know, some sort of you know computer report, some kind of uh technology policy or something like that, right?
00:05:11.519 --> 00:05:13.920
That says here's how we use our computers, right?
00:05:14.720 --> 00:05:22.720
It's like that, but it's ever evolving because the technology is ever evolving, which is why I think some people are kind of ignoring it.
00:05:22.959 --> 00:05:29.839
And because without proper AI governance, it is just kind of chaos in the streets.
00:05:30.639 --> 00:05:37.120
And here's the reason why it's well, it's problematic now more than ever.
00:05:37.519 --> 00:05:52.560
Because in, you know, in 2023 or in 2024, right, when AI governance was this big hot topic, because I think it took a year after Chat GPT's launch for companies to realize, like, oh, this is actually going to be a thing that companies use, uh, right.
00:05:52.720 --> 00:05:56.480
I think as as these chatbots started to mature, uh, right.
00:05:56.639 --> 00:06:11.680
But at the time, AI governance was, well, it's what happens if something is wrong when we use a chatbot to summarize a PDF, or if it re-words an email and it's not the right way, right?
00:06:11.920 --> 00:06:24.879
The the repercussions were technically rather small, but but fast forward to today, and obviously AI agents can modify files, send emails, make purchases, and execute workflows.
00:06:25.199 --> 00:06:32.720
It's obviously so different because when AI just talks, governance is about accuracy.
00:06:33.040 --> 00:06:42.560
But when AI acts, governance is about accountability and it is about your fundament, your your foundational operation as a company.
00:06:42.959 --> 00:06:48.240
Because, you know, companies built governance, I think originally for chatbots, right?
00:06:48.319 --> 00:06:54.959
And they probably kicked the can in 2023, finally got it going in 2024, maybe got it approved in 2025.
00:06:55.120 --> 00:07:00.959
And by the time anyone's has read it in 2026, it makes no sense anymore.
00:07:01.120 --> 00:07:13.680
And that's why companies, according to Deloitte's study, which is a really good one, that's why companies feel less prepared this year uh in infrastructure, uh, data risk and talent than they did the previous year.
00:07:13.839 --> 00:07:22.879
And I think the main thing is, well, now we are seeing this, you know, this true jump in agentic uh capabilities from these models.
00:07:25.279 --> 00:07:36.560
And I think to truly understand governance, you unfortunately have to look at uh some of the cases of AI that have gone awry.
00:07:36.720 --> 00:07:41.680
All right, and there's dozens of them, but probably some names that you've heard, uh, right.
00:07:41.839 --> 00:07:55.360
So United Healthcare is facing a class action uh suit as their AI tool, uh, uh allegedly uh denied elderly care at a 90% error rate, right?
00:07:55.839 --> 00:07:56.720
Not a good thing.
00:07:56.879 --> 00:07:58.079
And this is okay.
00:07:58.319 --> 00:08:08.639
By the time the company realized it, it was too late because the AI was uh allegedly making decisions and denying people uh care that should have been given care.
00:08:08.959 --> 00:08:16.560
Uh Workday faced a nationwide age discrimination suit over its AI hiring screening tool, right?
00:08:16.720 --> 00:08:38.240
There's literally cases I could talk about these for uh days because there's hundreds of them, but this is the importance of government, because those instances they didn't require or there was no malicious intent involved, right?
00:08:38.399 --> 00:08:56.320
Because I think most people assume when it comes to AI governance, well, hey, if our company and department and our people are just, you know, act acting ethically, you know, and being, you know, good, thoughtful humans, then we don't have anything to worry about when it comes to governance, right?
00:08:56.399 --> 00:09:00.799
We're not doing anything illegal, and that's the exact opposite, right?
00:09:01.360 --> 00:09:11.759
When we talk specifically, the difference between you know AI being able to talk versus AI being able to act and agentic AI and you know autonomous loops of AI.
00:09:12.000 --> 00:09:20.399
You know, now we have you know this open claw uh you know surge that's really been uh you know popularized and legitimized, right?
00:09:20.480 --> 00:09:28.480
Uh with you know, NVIDIA, the largest company in the world, came out with you know their more secure version of it, uh, you know, called the Nemo Claw.
00:09:28.720 --> 00:09:40.879
Um it is going to become very common for your company, whether you know it now or not, to have autonomous agents acting on your behalf.
00:09:41.120 --> 00:09:46.399
And I think maybe that heightens the need for taking AI governance seriously.
00:09:46.639 --> 00:09:56.159
Because yeah, two years ago, you know, it's just like, oh, let's just, you know, put put something on our website, or, you know, we'll put one little checkbox here and then we're done and we don't have to worry about anything.
00:09:56.399 --> 00:10:01.360
But now what happens when an agent didn't have a proper guardrail in place?
00:10:01.600 --> 00:10:09.200
What happens when you don't have an expert-driven loop and you have a human in the loop, which is terrible, by the way, uh, right?
00:10:09.360 --> 00:10:16.960
That's when governance gets real and when the uh the egg lands on your company's face.
00:10:18.559 --> 00:10:27.360
And one of the reasons why I think companies haven't yet done anything is well, there's everyone's looking around for real rules, right?
00:10:27.519 --> 00:10:30.720
They're like, all right, well, just give us the law, we'll follow it, right?
00:10:30.799 --> 00:10:37.679
I think sometimes, you know, it's it's it turns into this top-down legislation, right?
00:10:37.759 --> 00:10:43.039
And they're like, okay, well, if we're not breaking any rules, that means we're doing the right thing and there are no rules, so we can do anything.
00:10:43.120 --> 00:10:44.240
And that's not the right thing.
00:10:44.320 --> 00:10:45.840
That's the wrong thing, right?
00:10:46.000 --> 00:10:51.759
So right now in the US, there's no comprehensive federal law on AI.
00:10:51.919 --> 00:10:57.840
And I don't think there will be, at least not in this administration, and you can argue whether that's a good thing or a bad thing.
00:10:57.919 --> 00:10:59.519
That's not what I'm here trying to do.
00:10:59.759 --> 00:11:07.039
And President Trump signed an executive order outlaw outlawing states' abilities to legislate AI, right?
00:11:07.120 --> 00:11:08.639
That didn't stop the states.
00:11:08.799 --> 00:11:12.000
The states are still uh, you know, approving things.
00:11:12.080 --> 00:11:28.000
And uh ultimately what's gonna happen is there's gonna be a showdown because there's states like Colorado and California that have uh, you know, not saying if they defied Trump's executive order, but they just went through with their um, you know, states laws on AI.
00:11:28.159 --> 00:11:36.879
And ultimately, you know, nothing's gonna happen until a federal judge, you know, strikes, strikes these state laws down.
00:11:37.039 --> 00:11:40.000
So until then, we're kind of left with this cloud of uncertainty.
00:11:40.080 --> 00:11:44.879
But at the same time, right, we have things like the E uh the EU AI Act, right?
00:11:44.960 --> 00:11:48.879
Things that are actually going into effect uh this August as an example.
00:11:49.039 --> 00:11:58.000
So I think a lot of companies are just kind of sitting on the sidelines and they're in this wait-and-see scenario, uh, you know, decision makers, which I think is extremely dangerous.
00:11:58.480 --> 00:12:07.279
Because a lawsuit is not going to care, you know, that you are waiting to see what the loss are.
00:12:07.600 --> 00:12:08.000
Right.
00:12:08.159 --> 00:12:17.840
Just because there is no true governance over AI doesn't mean that your company shouldn't take it upon itself to create that.
00:12:17.919 --> 00:12:20.799
Don't worry, I'm gonna give it to you uh with our five rules.
00:12:20.960 --> 00:12:25.679
But before we go over those five rules, I got to take a break.
00:12:25.840 --> 00:12:27.200
I gotta take a sip of water.
00:12:27.440 --> 00:12:29.759
Quick word from our partners.
00:12:30.000 --> 00:12:31.360
Here's a harsh truth.
00:12:31.519 --> 00:12:38.720
Your company is probably spending thousands or millions of dollars on AI tools that are being massively underutilized.
00:12:38.879 --> 00:12:44.240
Half of companies have AI tools, but only 12% use them for business value.
00:12:44.399 --> 00:12:47.759
Most employees are still just using AI to summarize meeting notes.
00:12:48.000 --> 00:12:52.399
If you're the one responsible for AI adoption at your company, you need section.
00:12:52.559 --> 00:12:57.759
Section is a platform that helps you manage AI transformation across your entire organization.
00:12:57.919 --> 00:13:08.399
It coaches employees on real use cases, tracks who's using AI for business impact, and shows you exactly where AI is and isn't creating value.
00:13:08.559 --> 00:13:09.200
The result?
00:13:09.600 --> 00:13:13.919
You go from rolling out tools to driving measurable AI value.
00:13:14.080 --> 00:13:20.559
Your employees move from meeting summaries to solving actual business problems, and you can prove the ROI.
00:13:20.720 --> 00:13:23.120
Stop guessing if your AI investment is working.
00:13:23.360 --> 00:13:26.879
Check out section at sectionai.com.
00:13:27.039 --> 00:13:31.279
That's S-E-C-T-I-O-N-AI.com.
00:13:32.879 --> 00:13:33.519
All right.
00:13:33.840 --> 00:13:36.639
Gosh you're paying attention to governance now, right?
00:13:36.720 --> 00:13:42.159
Uh so here are the five rules that every company needs to follow.
00:13:42.720 --> 00:13:43.200
Period.
00:13:43.360 --> 00:13:45.919
I don't think there's really any exception to these rules.
00:13:46.080 --> 00:13:57.360
There's more rules that you can follow, but I think if you follow these five rules to the T, I think that you are in a better place than 99% of the companies in the US.
00:13:57.519 --> 00:13:58.000
All right.
00:13:58.240 --> 00:14:02.399
Rule number one: know what AI you actually have.
00:14:02.799 --> 00:14:14.960
My gosh, I don't know if any company has a hold on this, partially because of shadow AI or what I predicted in 2023 would be called second computer AI.
00:14:15.039 --> 00:14:16.799
Apparently that's not as good as shadow AI.
00:14:16.960 --> 00:14:21.120
Shadow AI is uh, you know, it's scarier, stickier, right?
00:14:21.360 --> 00:14:28.879
But over half of organizations right now completely lack a systematic in inventory of their AI tools.
00:14:29.039 --> 00:14:31.279
And that's because, well, shadow AI.
00:14:31.360 --> 00:14:38.159
Uh so a recent IBM report said that shadow AI was involved in 20% of all data breaches, right?
00:14:38.480 --> 00:14:41.200
Uh, that were tracked in their report, at least.
00:14:41.440 --> 00:14:52.559
And those shadow AI breaches cost companies$670,000 more per incident on average than the non-AI or non-shadow AI involved breaches.
00:14:52.720 --> 00:14:53.039
All right.
00:14:53.200 --> 00:15:03.200
So obviously, there is a huge danger in you not knowing what AI is used across your company.
00:15:03.360 --> 00:15:10.240
We've had a couple uh really good episodes um on everyday AI about shadow AI.
00:15:10.320 --> 00:15:14.720
Uh, we had one with the CEO of uh ARIA, which was a really good episode.
00:15:14.799 --> 00:15:19.360
Uh, but you can't just ban certain AI tools.
00:15:19.519 --> 00:15:25.679
That doesn't get rid of your shadow AI or your AI sprawl because blocking that doesn't mean anything.
00:15:25.840 --> 00:15:30.960
That just means employees are gonna just do the same thing, switch over their Wi-Fi network, right?
00:15:31.279 --> 00:15:36.639
Tattle off the VPN somehow and still access their files that they said to themselves in an email.
00:15:36.799 --> 00:15:41.279
Uh people are always still going to use AI tools.
00:15:41.360 --> 00:15:53.440
So you might as well do the right thing, do a complete inventory, fast track green lighting the correct ones that make sense for your organization, and then train the people on them, right?
00:15:53.600 --> 00:16:02.240
One of the reasons why people are using other AI tools, they'll they probably have the capabilities and the access, they just don't know how to use it.
00:16:02.320 --> 00:16:11.919
So they're like, oh, well, I can do task C with uh Chat GPT and task B with Copilot, but we only have Gemini.
00:16:12.159 --> 00:16:16.080
Well, you if you learned about Gemini, you probably realized that you could do all those tasks, right?
00:16:16.240 --> 00:16:27.919
Uh about now, you know, at least when it turns like when it comes to the the harnessing and the tool use, most most of the the big four, you know, you have about 80% feature overlap, right?
00:16:28.080 --> 00:16:32.320
So it's not like, oh, you know, I'm I'm gonna use this because it can read PDFs.
00:16:32.480 --> 00:16:33.679
No, they can all do that now.
00:16:33.759 --> 00:16:35.200
It's not 2023.
00:16:35.679 --> 00:16:40.799
So, and also people think that banning AI eliminates the risk.
00:16:41.039 --> 00:16:43.679
Wrong, makes it way worse.
00:16:43.919 --> 00:16:44.559
All right.
00:16:45.200 --> 00:16:47.039
There's there's no way around it.
00:16:47.200 --> 00:16:58.720
You have to start implementing AI and an AI operating system across your entire organization, and you need to start moving all of your day-to-day knowledge work tasks in there, all of them, right?
00:16:59.039 --> 00:17:01.120
AI is becoming collaborative.
00:17:01.200 --> 00:17:04.400
Um, it is becoming uh dynamic, being able to work.
00:17:04.640 --> 00:17:06.240
Now it you can read and write.
00:17:06.319 --> 00:17:09.759
I mean, depending on when you're listening to this uh this episode, right?
00:17:09.839 --> 00:17:12.400
If you're listening in March 2026, this will make sense.
00:17:12.480 --> 00:17:16.319
If you're listening in January 2027, you're like, this is old now, right?
00:17:16.480 --> 00:17:18.960
But in the past couple of days alone, right?
00:17:19.119 --> 00:17:24.000
What you can do with your phone has completely changed, right?
00:17:24.079 --> 00:17:26.720
Now you can run Claude Cowork on your phone.
00:17:26.880 --> 00:17:30.400
You have agentic browsers on iPhones, right?
00:17:30.640 --> 00:17:32.720
Everyone is going to be using these tools.
00:17:32.960 --> 00:17:35.440
You banning them or your company banning them, right?
00:17:35.519 --> 00:17:39.519
So if you're listening to this and you're one of those companies that have have banned AI, right?
00:17:39.599 --> 00:17:44.400
Unless you're um, you know, a Fortune 10 company that maybe there's things I don't understand.
00:17:44.559 --> 00:17:51.920
Otherwise, go ahead, tell your CEO to talk to me, and I will tell said CEO that they're making an absolutely terrible mistake.
00:17:52.079 --> 00:18:02.240
Because even if you work in a highly regulated industry working with highly sensitive data, you see you can't avoid generative AI in large language models.
00:18:02.319 --> 00:18:03.759
You absolutely can't, right?
00:18:03.839 --> 00:18:11.359
Even if you've somehow, if you're in the 0.001% that, you know, doesn't have any internet, no cloud, right?
00:18:11.440 --> 00:18:13.440
Everything's on-prem locked down, right?
00:18:13.599 --> 00:18:18.000
I mean, even the the military, the government, everyone is using generative AI.
00:18:18.079 --> 00:18:19.200
You can't not use it anymore.
00:18:19.279 --> 00:18:25.119
So you have to map what problems our people are actually solving with the unauthorized tools.
00:18:25.279 --> 00:18:32.640
And then you need to teach them or provide them how to do that in an authorized and approved way, right?
00:18:32.880 --> 00:18:33.680
That's it.
00:18:35.759 --> 00:18:40.720
Okay, rule number two is you need to classify everything by risk level.
00:18:40.880 --> 00:18:46.720
So first you have to understand what you have, what's being used, what's not being used, what's authorized, what's not.
00:18:46.880 --> 00:18:48.720
Then you need to fix that part first.
00:18:48.880 --> 00:18:51.440
Then you need to classify everything by risk level.
00:18:51.519 --> 00:18:53.759
And actually, this has already been done for us, right?
00:18:53.920 --> 00:18:55.279
Just borrow the EU.
00:18:55.599 --> 00:18:57.920
Uh, their AI act has four tiers.
00:18:58.000 --> 00:19:01.759
It's unacceptable, high, limited, and minimal risk, right?
00:19:02.079 --> 00:19:15.119
So you need to assign everything by risk level because you don't have to apply the same level of guardrails to something that is minimal risk versus something that is unacceptable, right?
00:19:15.599 --> 00:19:18.720
You don't have to have the same approval process, the same guardrails.
00:19:18.880 --> 00:19:24.319
So a tool drafting a generic welcome email, you know, you know, that doesn't matter.
00:19:24.480 --> 00:19:26.960
It's, you know, it's a broom closet.
00:19:27.039 --> 00:19:32.480
It's not your highly classified room with all your company secrets, right?
00:19:32.640 --> 00:19:41.200
So you don't need to put, you know, 10 security guards uh and in laser beam lights and triple padlocks on the broom closet, right?
00:19:41.599 --> 00:19:45.920
A tool deciding who gets a mortgage, that's yeah, that's a little heavier, right?
00:19:46.000 --> 00:19:47.200
You need heavier controls.
00:19:47.359 --> 00:19:53.839
So for high-risk decisions like hiring credit and healthcare, human review is always required.
00:19:54.000 --> 00:20:04.799
So it's gonna look different for companies of different sizes, different sectors, uh it look right, like um if you're have different sanctions, it's gonna look different, right?
00:20:04.880 --> 00:20:05.680
Those four tiers.
00:20:05.759 --> 00:20:12.799
But for the most part, most people shouldn't be able to put most of their day-to-day processes under those four tiers, right?
00:20:12.880 --> 00:20:14.799
So you don't govern everything the same thing.
00:20:14.880 --> 00:20:19.359
You don't put the, you know, the caution tape and the sirens on every single thing.
00:20:19.440 --> 00:20:22.880
That's probably only on your, you know, on your unacceptable list.
00:20:23.680 --> 00:20:24.240
All right.
00:20:24.480 --> 00:20:27.119
Rule number three, assign clear ownership.
00:20:27.279 --> 00:20:29.279
Don't just kick something to IT.
00:20:29.599 --> 00:20:33.200
So there's a quick test you can take, right?
00:20:33.359 --> 00:20:41.599
So let's just say, as an example, an AI agent goes off the rails and it's going to, right, go back and listen to my 2026 AI prediction and romance series.
00:20:41.759 --> 00:20:45.519
Yeah, a lot of it's already come true, and there is going to be an agent crash coming.
00:20:45.759 --> 00:20:46.079
All right.
00:20:46.240 --> 00:20:59.680
So if an agent crash happens at your company, and that's essentially when uh you have a well-meaning agent, right, that you think is properly set up and it goes and does something catastrophically bad.
00:21:00.000 --> 00:21:07.680
Okay, if that happens, can you with a hundred percent certainty name the person who is accountable in 10 seconds?
00:21:09.599 --> 00:21:15.839
Most people would say, oh, it's probably, you know, Bill and IT or you know, Jane and Finance, right?
00:21:16.000 --> 00:21:18.799
Like most people could maybe say, oh, it's one of three.
00:21:18.960 --> 00:21:27.599
Unless you can definitively say instantly, the one person and you know 100% they're responsible, you don't even have the baseline of governance.
00:21:27.839 --> 00:21:29.839
You need clear ownership.
00:21:30.000 --> 00:21:39.200
Not only do you need clear ownership, but that person needs the authority to act without hardly any notice, right?
00:21:39.359 --> 00:21:43.359
That person needs almost full autonomy, right?
00:21:43.519 --> 00:21:48.160
Maybe aside from you know the CEO or you know how big how big the organization is.
00:21:48.319 --> 00:21:59.759
But whoever that person is, if they are the person that has uh direct and end ownership, they need the autonomy to make things happen quickly, to change the rules, to hit pause, to hit play.
00:22:00.079 --> 00:22:02.480
Play to hit rewind, they need it all.
00:22:02.640 --> 00:22:03.119
All right.
00:22:03.279 --> 00:22:08.640
And you also do need, as much as I hate buzzwords, you do need a cross-functional committee.
00:22:08.880 --> 00:22:10.720
You need an executive sponsor.
00:22:10.880 --> 00:22:12.160
You need someone in legal.
00:22:12.240 --> 00:22:16.799
Uh, you need someone in IT, you need a domain expert, and then you need a daily AI user.
00:22:16.880 --> 00:22:25.279
I think those are the five different people minimum that you need, or the five different departments that you need because agents are going to be making decisions.
00:22:25.440 --> 00:22:32.240
Remember, it's not a human expert talking to uh a chat bot and then the human expert making the decision.
00:22:32.400 --> 00:22:39.119
In many cases, this is someone who is unrelated to that domain who is creating agents.
00:22:39.279 --> 00:22:52.799
And then that agent is going and making decisions, sometimes without the actual expert, the actual domain uh expert, um, subject domain expert even knowing what's happening.
00:22:52.880 --> 00:22:58.880
Or they're like, okay, well, hey, whatever, whoever gave this agent directions on finance is completely wrong.
00:22:58.960 --> 00:23:00.960
We should have ran this by finance, right?
00:23:01.119 --> 00:23:02.079
So that's who you need.
00:23:02.160 --> 00:23:08.559
You need the executive sponsor, you need legal, you need IT, you need the domain expert, and then you need the daily AI user.
00:23:08.720 --> 00:23:10.880
And why do you need the daily AI user in your company?
00:23:10.960 --> 00:23:12.960
Well, that's your frontline person, right?
00:23:13.200 --> 00:23:22.079
That's your person that's actually probably using these tools way more than maybe the head of legal or your, you know, your IT director.
00:23:22.160 --> 00:23:22.880
Uh, right.
00:23:23.039 --> 00:23:28.799
That's the person that's gonna say, like, hey, wait, that's not how we're using this agentic platform.
00:23:28.960 --> 00:23:32.240
We're taking a completely different route, all right.
00:23:33.039 --> 00:23:39.359
So, rule four, don't write policies.
00:23:40.079 --> 00:23:47.759
All right, I can guarantee you the best written policy from 2025 is antiquated.
00:23:48.319 --> 00:23:50.640
It is holier than Swiss cheese right now.
00:23:51.119 --> 00:23:53.200
Swiss cheese on a Sunday, right?
00:23:54.480 --> 00:23:58.079
Because a policy just says do not do this, right?
00:23:58.240 --> 00:24:00.160
Do not input sensitive data.
00:24:00.880 --> 00:24:05.119
A playbook tells you exactly who reviews what and when, right?
00:24:05.519 --> 00:24:12.640
If you just have a list of of things to not do, right, which is usually what policies are, it's not helpful.
00:24:13.039 --> 00:24:15.680
Every AI use case needs five answers.
00:24:16.000 --> 00:24:22.240
It needs a task access, accuracy measure, reviewer, and an escalation path.
00:24:23.039 --> 00:24:23.519
All right.
00:24:23.680 --> 00:24:28.240
Every single AI use case that you deploy within your organization needs those things.
00:24:29.119 --> 00:24:38.240
And then outsourcing something to an AI agent does not outsource the responsibility.
00:24:38.400 --> 00:24:50.079
Actually, the FTC, right, the Federal Trade Commission here in the US, they're they they kind of shifted their focus away from you know Bitcoin and it's going full full all in on AI.
00:24:50.319 --> 00:24:55.519
You are all your company is ultimately responsible for any decisions that an AI makes, right?
00:24:55.599 --> 00:25:00.400
So if you're using a fully autonomous, you know, agentic loop, right?
00:25:00.480 --> 00:25:07.680
If you if if you're using right open claw, any of these things and something goes wrong, you don't get to point the finger at open claw.
00:25:07.759 --> 00:25:12.640
You don't get to point the finger at, you know, open AI, Google, Microsoft, Anthropic, et cetera.
00:25:12.720 --> 00:25:14.640
No, it is on you, right?
00:25:14.880 --> 00:25:24.160
So that's why you have to have those use cases have to be thoroughly vetted, and you need playbooks on what to do, not just what not to do.
00:25:24.319 --> 00:25:32.400
And then rule five, you need to treat governance as the scaling engine and not the break.
00:25:32.640 --> 00:25:34.480
So here's what here's what I mean by that.
00:25:34.640 --> 00:25:43.200
Right now, studies show that 75% of companies are stuck in pilot purgatory because they're just running small AI experiments endlessly.
00:25:43.359 --> 00:25:44.960
They can't get out of there.
00:25:45.119 --> 00:25:45.519
Right.
00:25:45.680 --> 00:25:50.640
Number one, it's because corporate policy moves too slow, agentic AI moves too fast.
00:25:50.720 --> 00:25:59.920
But companies with mature governance who deploy new AI capabilities, they do it faster, uh, 40% faster than their peers that don't.
00:26:00.079 --> 00:26:00.400
Right.
00:26:00.480 --> 00:26:05.599
So if you do have mature governance, you can get out of pilot purgatory.
00:26:06.160 --> 00:26:18.240
Because if you took care of steps one through four, it is actually no longer a stoplight that is stuck on green.
00:26:18.720 --> 00:26:25.119
It is a working stoplight that's just or sorry, it's it's it's no longer a a uh traffic light stuck on red.
00:26:25.200 --> 00:26:31.920
It is a traffic light that is properly pulling the cars through and keeping them going at a high speed, right?
00:26:32.400 --> 00:26:46.880
People think business leaders think people on you know Twitter, LinkedIn, whatever, people who are AI experts, they assume that governance slows companies down.
00:26:47.359 --> 00:26:54.559
And it is the exact opposite, because without governance, you cannot compete, you cannot keep up.
00:26:54.799 --> 00:27:03.200
There's going to be too many small roadblocks along the way, too many giant Chicago-sized potholes.
00:27:03.440 --> 00:27:06.160
Your car's not going to make it out of the lot, y'all.
00:27:06.880 --> 00:27:11.839
Governance is the scaling engine, not the brakes.
00:27:12.079 --> 00:27:12.480
All right.
00:27:12.640 --> 00:27:26.160
So uh both studies from Align AI and IBM said that report organizations with strong AI governance actually saved$1.9 million per data breach on average, right?
00:27:27.039 --> 00:27:35.599
A lot of this data just uh goes back to data breaches because ultimately, like that's that's where a lot of this is headed, right?
00:27:35.839 --> 00:27:40.799
When agentic AI goes off the rails, everyone knows about it.
00:27:40.880 --> 00:27:44.319
And then you have to start diagnosing, and it takes a lot of time and a lot of money.
00:27:44.400 --> 00:27:52.880
And that's that's where we are unfortunately learning the good lessons about what we should do in governance when we learn where things go wrong.
00:27:53.119 --> 00:27:57.359
And the biggest thing where things go wrong, it's going back.
00:27:57.440 --> 00:28:00.400
I'm gonna I'm gonna just read these rules here one more time.
00:28:00.960 --> 00:28:01.440
All right.
00:28:01.599 --> 00:28:06.559
I think it starts with not knowing what you actually have and not knowing what the capabilities are.
00:28:06.720 --> 00:28:06.960
All right.
00:28:07.039 --> 00:28:09.359
So, rule one, you have to know what you actually have.
00:28:09.599 --> 00:28:12.960
Rule number two, you have to classify everything at risk by risk level.
00:28:13.119 --> 00:28:16.960
Rule three, you need to assign clear ownership, not just kick it to IT.
00:28:17.200 --> 00:28:19.759
Rule four, write playbooks, not policies.
00:28:19.920 --> 00:28:24.079
And rule five, treat governance as the scaling engine, not the break.
00:28:24.319 --> 00:28:24.880
All right.
00:28:25.200 --> 00:28:27.680
So that's not all.
00:28:27.839 --> 00:28:29.920
You and you might not like this part.
00:28:30.160 --> 00:28:33.119
You have to set monthly review cycles.
00:28:33.279 --> 00:28:38.400
Yes, not yearly, not quarterly, monthly.
00:28:38.799 --> 00:28:39.440
All right.
00:28:40.559 --> 00:28:56.480
Because a government policy that if if if if you think you can set it once and forget it, that's literally like you know, thinking you can repurpose a 20 2006 social media policy, uh, change a couple words and use it for AI in 2026.
00:28:56.640 --> 00:29:02.079
Like monthly review is the absolute minimum cadence to keep governance matched to reality.
00:29:02.240 --> 00:29:07.279
Y'all, I've literally been doing this thing for more than three years, every single day.
00:29:07.440 --> 00:29:18.559
And I'm not exaggerating when I say the last three months in terms of capabilities, what an AI can output and do, have far outpaced the previous three years.
00:29:18.799 --> 00:29:22.000
Like I said, it is scary in a good and bad way.
00:29:22.319 --> 00:29:27.119
So you cannot just set something and revisit it once a year.
00:29:27.359 --> 00:29:28.799
That is a recipe for failure.
00:29:29.039 --> 00:29:34.240
But a recipe for success is to stick with us through the rest of the Start Here series.
00:29:34.400 --> 00:29:41.519
All right, because we're gonna be guiding you along the way, whether you are brand new to AI or you're trying to keep up and double down.
00:29:41.759 --> 00:29:49.279
Thank you for going with us on this one as we went over AI governance in plain English, five AI rules every company needs to follow.
00:29:49.440 --> 00:29:50.319
I hope this was helpful.
00:29:50.480 --> 00:29:51.920
If so, do me a favor.
00:29:52.000 --> 00:29:58.720
And I'm not gonna keep this open forever, FYI, uh, right, just free, open, unlimited access to our community.
00:29:58.960 --> 00:30:01.519
So go to starthireseries.com.
00:30:01.599 --> 00:30:05.920
If this was at all helpful, all right, that's gonna give you free access to our community.
00:30:06.000 --> 00:30:19.200
And you can go check out every single episode in the Start Here series, all in one easy to find space and also connect with uh thousands of other people in our community right now who are doing the same thing you're doing.
00:30:19.359 --> 00:30:20.960
So uh thank you for tuning in.
00:30:21.119 --> 00:30:23.920
Hope to see you back tomorrow in everyday for more everyday AI.
00:30:24.000 --> 00:30:25.039
Thanks, y'all.
00:00:02.240 --> 00:00:08.880
If you're forced to have an opinion on stoplights, I think most people would fall in one of two camps.
00:00:09.119 --> 00:00:14.640
Either one, these stoplights are annoying, I'm trying to get somewhere, and they're slowing me down.
00:00:14.800 --> 00:00:16.800
Or two, hey, stoplights, great.
00:00:16.960 --> 00:00:18.719
They keep people safe.
00:00:19.120 --> 00:00:25.039
And I think you can have the same two train of thoughts when it comes to AI governance.
00:00:25.199 --> 00:00:30.079
You could say, hey, this is slowing me or my company down and it's annoying.
00:00:30.320 --> 00:00:35.280
Or, hey, this is probably keeping us safe, this AI governance thing.
00:00:35.600 --> 00:00:42.799
But I don't think most people care or even know too much about AI governance.
00:00:43.119 --> 00:00:53.759
For a variety of reasons, but probably the main one being AI's capabilities are changing so fast that it becomes almost impossible to govern them.
00:00:53.920 --> 00:00:58.320
I mean, when you even think about cars, cars have been the same for like 110 years.
00:00:58.399 --> 00:01:01.759
So the stoplights are relatively effective, right?
00:01:02.159 --> 00:01:06.959
But AI isn't even the same this week as it was last week.
00:01:07.120 --> 00:01:12.319
So how can we keep up with governance and understand it and make it work for us?
00:01:12.480 --> 00:01:16.159
Well, that's what we're going to be diving into on today's show.
00:01:16.319 --> 00:01:19.280
So let's get to the big picture here.
00:01:19.599 --> 00:01:34.879
And that's right now, according to a state of AI report from Deloitte, 74% of companies expect to use agentic AI within the next two years, but only about 21% report having a mature model for governance.
00:01:35.200 --> 00:01:43.840
So just about every single company wants to use autonomous AI that will act without someone watching over it.
00:01:44.000 --> 00:01:47.680
Yet most people admit to not even having a plan.
00:01:48.239 --> 00:02:01.760
And compared to the prior year uh state of AI report from Deloitte, the number of companies reporting that they have a mature model of governance has actually gone down.
00:02:02.000 --> 00:02:08.159
It's because companies can't keep up and is getting scary, both in a good and bad way.
00:02:09.360 --> 00:02:12.159
So that's what we're going to be tackling on today's show.
00:02:12.240 --> 00:02:14.159
And if you do stick around, here's what you're going to learn.
00:02:14.240 --> 00:02:19.599
You're going to learn why the governance rules that you built for chatbots are already broken.
00:02:19.759 --> 00:02:24.879
Uh, what real lawsuits against big companies reveal about ungoverned AI.
00:02:25.039 --> 00:02:31.039
And I'm going to leave you with five operational rules that turn AI governance into a scaling advantage.
00:02:31.199 --> 00:02:36.240
Yeah, I'm going to tell you the five AI rules that literally every company needs to know and follow.
00:02:36.400 --> 00:02:39.199
Because then you don't have to worry about this.
00:02:39.439 --> 00:02:41.439
Hey, what the heck is AI governance?
00:02:41.520 --> 00:02:43.759
I'm going to tell you and how you can keep up with it.
00:02:44.000 --> 00:02:45.520
All right, let's get into it.
00:02:45.680 --> 00:02:48.879
Welcome to Everyday AI, and this is our Start Here series.
00:02:49.039 --> 00:02:53.840
It is the essential podcast series to both learn the AI basics and to double down on your AI knowledge.
00:02:54.000 --> 00:03:00.319
So, yeah, make sure you go start with volume one, all right, and then listen to them in order if you're brand new here.
00:03:00.400 --> 00:03:04.159
And also if you're brand new here, make sure to go to starthireseries.com.
00:03:04.319 --> 00:03:11.759
That will give you exclusive access to our private and free AI community called the Inner Circle.
00:03:11.840 --> 00:03:12.080
All right.
00:03:12.159 --> 00:03:17.120
And then there you can listen to every single uh episode from the Start Here Series.
00:03:17.199 --> 00:03:21.520
We even have an ongoing playlist and keep everything updated in one easy-to-find space.
00:03:21.680 --> 00:03:21.919
All right.
00:03:22.000 --> 00:03:25.599
And if you did miss our last episode, like I said, uh they all go in order.
00:03:25.680 --> 00:03:30.719
We talked about the AI labor shift, when it'll happen, and what it means for jobs.
00:03:30.960 --> 00:03:31.280
All right.
00:03:31.439 --> 00:03:38.879
But today we're talking about AI governance in plain English in the five AI rules that every company needs to follow.
00:03:39.120 --> 00:03:41.039
Let's start with definitions.
00:03:41.280 --> 00:03:41.840
All right.
00:03:42.240 --> 00:03:46.319
AI governance, people think it's it's ethics, it's it's rules.
00:03:46.479 --> 00:03:55.439
And that's sure, kind of true, but more than anything, it is quite literally how your company operates when it comes to AI.
00:03:55.599 --> 00:04:02.240
It's the roles, the rules, and the controls that manage how AI works in your company.
00:04:02.479 --> 00:04:11.759
So it's not just who can use AI, but it's what data goes into the AI systems and ultimately what happens after.
00:04:12.000 --> 00:04:14.400
So that is uh governance, right?
00:04:14.560 --> 00:04:16.160
AI governance in a nutshell.
00:04:16.319 --> 00:04:24.160
It's the before, during, and after and the who, the what, the why, and the how of AI.
00:04:24.399 --> 00:04:28.560
And it's not a debate on should we be doing this.
00:04:28.720 --> 00:04:30.240
It is an operational layer.
00:04:30.319 --> 00:04:31.439
It is foundational.
00:04:31.600 --> 00:04:43.519
And this is, you know, it's obviously going to look a little different if you're a small business of 10 employees versus if you're a uh company with a trillion dollar, multiple trillion dollar market cap.
00:04:43.600 --> 00:04:53.279
And I know we have uh listeners who represent both sides of that pendulum, but um, regardless, AI governance is extremely important, right?
00:04:53.439 --> 00:05:11.439
So think of it, and and this is obviously an extremely oversimplified um kind of uh analogy here, but I'm sure at some point you've, you know, when working for your company, you had to sign, you know, some sort of you know computer report, some kind of uh technology policy or something like that, right?
00:05:11.519 --> 00:05:13.920
That says here's how we use our computers, right?
00:05:14.720 --> 00:05:22.720
It's like that, but it's ever evolving because the technology is ever evolving, which is why I think some people are kind of ignoring it.
00:05:22.959 --> 00:05:29.839
And because without proper AI governance, it is just kind of chaos in the streets.
00:05:30.639 --> 00:05:37.120
And here's the reason why it's well, it's problematic now more than ever.
00:05:37.519 --> 00:05:52.560
Because in, you know, in 2023 or in 2024, right, when AI governance was this big hot topic, because I think it took a year after Chat GPT's launch for companies to realize, like, oh, this is actually going to be a thing that companies use, uh, right.
00:05:52.720 --> 00:05:56.480
I think as as these chatbots started to mature, uh, right.
00:05:56.639 --> 00:06:11.680
But at the time, AI governance was, well, it's what happens if something is wrong when we use a chatbot to summarize a PDF, or if it re-words an email and it's not the right way, right?
00:06:11.920 --> 00:06:24.879
The the repercussions were technically rather small, but but fast forward to today, and obviously AI agents can modify files, send emails, make purchases, and execute workflows.
00:06:25.199 --> 00:06:32.720
It's obviously so different because when AI just talks, governance is about accuracy.
00:06:33.040 --> 00:06:42.560
But when AI acts, governance is about accountability and it is about your fundament, your your foundational operation as a company.
00:06:42.959 --> 00:06:48.240
Because, you know, companies built governance, I think originally for chatbots, right?
00:06:48.319 --> 00:06:54.959
And they probably kicked the can in 2023, finally got it going in 2024, maybe got it approved in 2025.
00:06:55.120 --> 00:07:00.959
And by the time anyone's has read it in 2026, it makes no sense anymore.
00:07:01.120 --> 00:07:13.680
And that's why companies, according to Deloitte's study, which is a really good one, that's why companies feel less prepared this year uh in infrastructure, uh, data risk and talent than they did the previous year.
00:07:13.839 --> 00:07:22.879
And I think the main thing is, well, now we are seeing this, you know, this true jump in agentic uh capabilities from these models.
00:07:25.279 --> 00:07:36.560
And I think to truly understand governance, you unfortunately have to look at uh some of the cases of AI that have gone awry.
00:07:36.720 --> 00:07:41.680
All right, and there's dozens of them, but probably some names that you've heard, uh, right.
00:07:41.839 --> 00:07:55.360
So United Healthcare is facing a class action uh suit as their AI tool, uh, uh allegedly uh denied elderly care at a 90% error rate, right?
00:07:55.839 --> 00:07:56.720
Not a good thing.
00:07:56.879 --> 00:07:58.079
And this is okay.
00:07:58.319 --> 00:08:08.639
By the time the company realized it, it was too late because the AI was uh allegedly making decisions and denying people uh care that should have been given care.
00:08:08.959 --> 00:08:16.560
Uh Workday faced a nationwide age discrimination suit over its AI hiring screening tool, right?
00:08:16.720 --> 00:08:38.240
There's literally cases I could talk about these for uh days because there's hundreds of them, but this is the importance of government, because those instances they didn't require or there was no malicious intent involved, right?
00:08:38.399 --> 00:08:56.320
Because I think most people assume when it comes to AI governance, well, hey, if our company and department and our people are just, you know, act acting ethically, you know, and being, you know, good, thoughtful humans, then we don't have anything to worry about when it comes to governance, right?
00:08:56.399 --> 00:09:00.799
We're not doing anything illegal, and that's the exact opposite, right?
00:09:01.360 --> 00:09:11.759
When we talk specifically, the difference between you know AI being able to talk versus AI being able to act and agentic AI and you know autonomous loops of AI.
00:09:12.000 --> 00:09:20.399
You know, now we have you know this open claw uh you know surge that's really been uh you know popularized and legitimized, right?
00:09:20.480 --> 00:09:28.480
Uh with you know, NVIDIA, the largest company in the world, came out with you know their more secure version of it, uh, you know, called the Nemo Claw.
00:09:28.720 --> 00:09:40.879
Um it is going to become very common for your company, whether you know it now or not, to have autonomous agents acting on your behalf.
00:09:41.120 --> 00:09:46.399
And I think maybe that heightens the need for taking AI governance seriously.
00:09:46.639 --> 00:09:56.159
Because yeah, two years ago, you know, it's just like, oh, let's just, you know, put put something on our website, or, you know, we'll put one little checkbox here and then we're done and we don't have to worry about anything.
00:09:56.399 --> 00:10:01.360
But now what happens when an agent didn't have a proper guardrail in place?
00:10:01.600 --> 00:10:09.200
What happens when you don't have an expert-driven loop and you have a human in the loop, which is terrible, by the way, uh, right?
00:10:09.360 --> 00:10:16.960
That's when governance gets real and when the uh the egg lands on your company's face.
00:10:18.559 --> 00:10:27.360
And one of the reasons why I think companies haven't yet done anything is well, there's everyone's looking around for real rules, right?
00:10:27.519 --> 00:10:30.720
They're like, all right, well, just give us the law, we'll follow it, right?
00:10:30.799 --> 00:10:37.679
I think sometimes, you know, it's it's it turns into this top-down legislation, right?
00:10:37.759 --> 00:10:43.039
And they're like, okay, well, if we're not breaking any rules, that means we're doing the right thing and there are no rules, so we can do anything.
00:10:43.120 --> 00:10:44.240
And that's not the right thing.
00:10:44.320 --> 00:10:45.840
That's the wrong thing, right?
00:10:46.000 --> 00:10:51.759
So right now in the US, there's no comprehensive federal law on AI.
00:10:51.919 --> 00:10:57.840
And I don't think there will be, at least not in this administration, and you can argue whether that's a good thing or a bad thing.
00:10:57.919 --> 00:10:59.519
That's not what I'm here trying to do.
00:10:59.759 --> 00:11:07.039
And President Trump signed an executive order outlaw outlawing states' abilities to legislate AI, right?
00:11:07.120 --> 00:11:08.639
That didn't stop the states.
00:11:08.799 --> 00:11:12.000
The states are still uh, you know, approving things.
00:11:12.080 --> 00:11:28.000
And uh ultimately what's gonna happen is there's gonna be a showdown because there's states like Colorado and California that have uh, you know, not saying if they defied Trump's executive order, but they just went through with their um, you know, states laws on AI.
00:11:28.159 --> 00:11:36.879
And ultimately, you know, nothing's gonna happen until a federal judge, you know, strikes, strikes these state laws down.
00:11:37.039 --> 00:11:40.000
So until then, we're kind of left with this cloud of uncertainty.
00:11:40.080 --> 00:11:44.879
But at the same time, right, we have things like the E uh the EU AI Act, right?
00:11:44.960 --> 00:11:48.879
Things that are actually going into effect uh this August as an example.
00:11:49.039 --> 00:11:58.000
So I think a lot of companies are just kind of sitting on the sidelines and they're in this wait-and-see scenario, uh, you know, decision makers, which I think is extremely dangerous.
00:11:58.480 --> 00:12:07.279
Because a lawsuit is not going to care, you know, that you are waiting to see what the loss are.
00:12:07.600 --> 00:12:08.000
Right.
00:12:08.159 --> 00:12:17.840
Just because there is no true governance over AI doesn't mean that your company shouldn't take it upon itself to create that.
00:12:17.919 --> 00:12:20.799
Don't worry, I'm gonna give it to you uh with our five rules.
00:12:20.960 --> 00:12:25.679
But before we go over those five rules, I got to take a break.
00:12:25.840 --> 00:12:27.200
I gotta take a sip of water.
00:12:27.440 --> 00:12:29.759
Quick word from our partners.
00:12:30.000 --> 00:12:31.360
Here's a harsh truth.
00:12:31.519 --> 00:12:38.720
Your company is probably spending thousands or millions of dollars on AI tools that are being massively underutilized.
00:12:38.879 --> 00:12:44.240
Half of companies have AI tools, but only 12% use them for business value.
00:12:44.399 --> 00:12:47.759
Most employees are still just using AI to summarize meeting notes.
00:12:48.000 --> 00:12:52.399
If you're the one responsible for AI adoption at your company, you need section.
00:12:52.559 --> 00:12:57.759
Section is a platform that helps you manage AI transformation across your entire organization.
00:12:57.919 --> 00:13:08.399
It coaches employees on real use cases, tracks who's using AI for business impact, and shows you exactly where AI is and isn't creating value.
00:13:08.559 --> 00:13:09.200
The result?
00:13:09.600 --> 00:13:13.919
You go from rolling out tools to driving measurable AI value.
00:13:14.080 --> 00:13:20.559
Your employees move from meeting summaries to solving actual business problems, and you can prove the ROI.
00:13:20.720 --> 00:13:23.120
Stop guessing if your AI investment is working.
00:13:23.360 --> 00:13:26.879
Check out section at sectionai.com.
00:13:27.039 --> 00:13:31.279
That's S-E-C-T-I-O-N-AI.com.
00:13:32.879 --> 00:13:33.519
All right.
00:13:33.840 --> 00:13:36.639
Gosh you're paying attention to governance now, right?
00:13:36.720 --> 00:13:42.159
Uh so here are the five rules that every company needs to follow.
00:13:42.720 --> 00:13:43.200
Period.
00:13:43.360 --> 00:13:45.919
I don't think there's really any exception to these rules.
00:13:46.080 --> 00:13:57.360
There's more rules that you can follow, but I think if you follow these five rules to the T, I think that you are in a better place than 99% of the companies in the US.
00:13:57.519 --> 00:13:58.000
All right.
00:13:58.240 --> 00:14:02.399
Rule number one: know what AI you actually have.
00:14:02.799 --> 00:14:14.960
My gosh, I don't know if any company has a hold on this, partially because of shadow AI or what I predicted in 2023 would be called second computer AI.
00:14:15.039 --> 00:14:16.799
Apparently that's not as good as shadow AI.
00:14:16.960 --> 00:14:21.120
Shadow AI is uh, you know, it's scarier, stickier, right?
00:14:21.360 --> 00:14:28.879
But over half of organizations right now completely lack a systematic in inventory of their AI tools.
00:14:29.039 --> 00:14:31.279
And that's because, well, shadow AI.
00:14:31.360 --> 00:14:38.159
Uh so a recent IBM report said that shadow AI was involved in 20% of all data breaches, right?
00:14:38.480 --> 00:14:41.200
Uh, that were tracked in their report, at least.
00:14:41.440 --> 00:14:52.559
And those shadow AI breaches cost companies$670,000 more per incident on average than the non-AI or non-shadow AI involved breaches.
00:14:52.720 --> 00:14:53.039
All right.
00:14:53.200 --> 00:15:03.200
So obviously, there is a huge danger in you not knowing what AI is used across your company.
00:15:03.360 --> 00:15:10.240
We've had a couple uh really good episodes um on everyday AI about shadow AI.
00:15:10.320 --> 00:15:14.720
Uh, we had one with the CEO of uh ARIA, which was a really good episode.
00:15:14.799 --> 00:15:19.360
Uh, but you can't just ban certain AI tools.
00:15:19.519 --> 00:15:25.679
That doesn't get rid of your shadow AI or your AI sprawl because blocking that doesn't mean anything.
00:15:25.840 --> 00:15:30.960
That just means employees are gonna just do the same thing, switch over their Wi-Fi network, right?
00:15:31.279 --> 00:15:36.639
Tattle off the VPN somehow and still access their files that they said to themselves in an email.
00:15:36.799 --> 00:15:41.279
Uh people are always still going to use AI tools.
00:15:41.360 --> 00:15:53.440
So you might as well do the right thing, do a complete inventory, fast track green lighting the correct ones that make sense for your organization, and then train the people on them, right?
00:15:53.600 --> 00:16:02.240
One of the reasons why people are using other AI tools, they'll they probably have the capabilities and the access, they just don't know how to use it.
00:16:02.320 --> 00:16:11.919
So they're like, oh, well, I can do task C with uh Chat GPT and task B with Copilot, but we only have Gemini.
00:16:12.159 --> 00:16:16.080
Well, you if you learned about Gemini, you probably realized that you could do all those tasks, right?
00:16:16.240 --> 00:16:27.919
Uh about now, you know, at least when it turns like when it comes to the the harnessing and the tool use, most most of the the big four, you know, you have about 80% feature overlap, right?
00:16:28.080 --> 00:16:32.320
So it's not like, oh, you know, I'm I'm gonna use this because it can read PDFs.
00:16:32.480 --> 00:16:33.679
No, they can all do that now.
00:16:33.759 --> 00:16:35.200
It's not 2023.
00:16:35.679 --> 00:16:40.799
So, and also people think that banning AI eliminates the risk.
00:16:41.039 --> 00:16:43.679
Wrong, makes it way worse.
00:16:43.919 --> 00:16:44.559
All right.
00:16:45.200 --> 00:16:47.039
There's there's no way around it.
00:16:47.200 --> 00:16:58.720
You have to start implementing AI and an AI operating system across your entire organization, and you need to start moving all of your day-to-day knowledge work tasks in there, all of them, right?
00:16:59.039 --> 00:17:01.120
AI is becoming collaborative.
00:17:01.200 --> 00:17:04.400
Um, it is becoming uh dynamic, being able to work.
00:17:04.640 --> 00:17:06.240
Now it you can read and write.
00:17:06.319 --> 00:17:09.759
I mean, depending on when you're listening to this uh this episode, right?
00:17:09.839 --> 00:17:12.400
If you're listening in March 2026, this will make sense.
00:17:12.480 --> 00:17:16.319
If you're listening in January 2027, you're like, this is old now, right?
00:17:16.480 --> 00:17:18.960
But in the past couple of days alone, right?
00:17:19.119 --> 00:17:24.000
What you can do with your phone has completely changed, right?
00:17:24.079 --> 00:17:26.720
Now you can run Claude Cowork on your phone.
00:17:26.880 --> 00:17:30.400
You have agentic browsers on iPhones, right?
00:17:30.640 --> 00:17:32.720
Everyone is going to be using these tools.
00:17:32.960 --> 00:17:35.440
You banning them or your company banning them, right?
00:17:35.519 --> 00:17:39.519
So if you're listening to this and you're one of those companies that have have banned AI, right?
00:17:39.599 --> 00:17:44.400
Unless you're um, you know, a Fortune 10 company that maybe there's things I don't understand.
00:17:44.559 --> 00:17:51.920
Otherwise, go ahead, tell your CEO to talk to me, and I will tell said CEO that they're making an absolutely terrible mistake.
00:17:52.079 --> 00:18:02.240
Because even if you work in a highly regulated industry working with highly sensitive data, you see you can't avoid generative AI in large language models.
00:18:02.319 --> 00:18:03.759
You absolutely can't, right?
00:18:03.839 --> 00:18:11.359
Even if you've somehow, if you're in the 0.001% that, you know, doesn't have any internet, no cloud, right?
00:18:11.440 --> 00:18:13.440
Everything's on-prem locked down, right?
00:18:13.599 --> 00:18:18.000
I mean, even the the military, the government, everyone is using generative AI.
00:18:18.079 --> 00:18:19.200
You can't not use it anymore.
00:18:19.279 --> 00:18:25.119
So you have to map what problems our people are actually solving with the unauthorized tools.
00:18:25.279 --> 00:18:32.640
And then you need to teach them or provide them how to do that in an authorized and approved way, right?
00:18:32.880 --> 00:18:33.680
That's it.
00:18:35.759 --> 00:18:40.720
Okay, rule number two is you need to classify everything by risk level.
00:18:40.880 --> 00:18:46.720
So first you have to understand what you have, what's being used, what's not being used, what's authorized, what's not.
00:18:46.880 --> 00:18:48.720
Then you need to fix that part first.
00:18:48.880 --> 00:18:51.440
Then you need to classify everything by risk level.
00:18:51.519 --> 00:18:53.759
And actually, this has already been done for us, right?
00:18:53.920 --> 00:18:55.279
Just borrow the EU.
00:18:55.599 --> 00:18:57.920
Uh, their AI act has four tiers.
00:18:58.000 --> 00:19:01.759
It's unacceptable, high, limited, and minimal risk, right?
00:19:02.079 --> 00:19:15.119
So you need to assign everything by risk level because you don't have to apply the same level of guardrails to something that is minimal risk versus something that is unacceptable, right?
00:19:15.599 --> 00:19:18.720
You don't have to have the same approval process, the same guardrails.
00:19:18.880 --> 00:19:24.319
So a tool drafting a generic welcome email, you know, you know, that doesn't matter.
00:19:24.480 --> 00:19:26.960
It's, you know, it's a broom closet.
00:19:27.039 --> 00:19:32.480
It's not your highly classified room with all your company secrets, right?
00:19:32.640 --> 00:19:41.200
So you don't need to put, you know, 10 security guards uh and in laser beam lights and triple padlocks on the broom closet, right?
00:19:41.599 --> 00:19:45.920
A tool deciding who gets a mortgage, that's yeah, that's a little heavier, right?
00:19:46.000 --> 00:19:47.200
You need heavier controls.
00:19:47.359 --> 00:19:53.839
So for high-risk decisions like hiring credit and healthcare, human review is always required.
00:19:54.000 --> 00:20:04.799
So it's gonna look different for companies of different sizes, different sectors, uh it look right, like um if you're have different sanctions, it's gonna look different, right?
00:20:04.880 --> 00:20:05.680
Those four tiers.
00:20:05.759 --> 00:20:12.799
But for the most part, most people shouldn't be able to put most of their day-to-day processes under those four tiers, right?
00:20:12.880 --> 00:20:14.799
So you don't govern everything the same thing.
00:20:14.880 --> 00:20:19.359
You don't put the, you know, the caution tape and the sirens on every single thing.
00:20:19.440 --> 00:20:22.880
That's probably only on your, you know, on your unacceptable list.
00:20:23.680 --> 00:20:24.240
All right.
00:20:24.480 --> 00:20:27.119
Rule number three, assign clear ownership.
00:20:27.279 --> 00:20:29.279
Don't just kick something to IT.
00:20:29.599 --> 00:20:33.200
So there's a quick test you can take, right?
00:20:33.359 --> 00:20:41.599
So let's just say, as an example, an AI agent goes off the rails and it's going to, right, go back and listen to my 2026 AI prediction and romance series.
00:20:41.759 --> 00:20:45.519
Yeah, a lot of it's already come true, and there is going to be an agent crash coming.
00:20:45.759 --> 00:20:46.079
All right.
00:20:46.240 --> 00:20:59.680
So if an agent crash happens at your company, and that's essentially when uh you have a well-meaning agent, right, that you think is properly set up and it goes and does something catastrophically bad.
00:21:00.000 --> 00:21:07.680
Okay, if that happens, can you with a hundred percent certainty name the person who is accountable in 10 seconds?
00:21:09.599 --> 00:21:15.839
Most people would say, oh, it's probably, you know, Bill and IT or you know, Jane and Finance, right?
00:21:16.000 --> 00:21:18.799
Like most people could maybe say, oh, it's one of three.
00:21:18.960 --> 00:21:27.599
Unless you can definitively say instantly, the one person and you know 100% they're responsible, you don't even have the baseline of governance.
00:21:27.839 --> 00:21:29.839
You need clear ownership.
00:21:30.000 --> 00:21:39.200
Not only do you need clear ownership, but that person needs the authority to act without hardly any notice, right?
00:21:39.359 --> 00:21:43.359
That person needs almost full autonomy, right?
00:21:43.519 --> 00:21:48.160
Maybe aside from you know the CEO or you know how big how big the organization is.
00:21:48.319 --> 00:21:59.759
But whoever that person is, if they are the person that has uh direct and end ownership, they need the autonomy to make things happen quickly, to change the rules, to hit pause, to hit play.
00:22:00.079 --> 00:22:02.480
Play to hit rewind, they need it all.
00:22:02.640 --> 00:22:03.119
All right.
00:22:03.279 --> 00:22:08.640
And you also do need, as much as I hate buzzwords, you do need a cross-functional committee.
00:22:08.880 --> 00:22:10.720
You need an executive sponsor.
00:22:10.880 --> 00:22:12.160
You need someone in legal.
00:22:12.240 --> 00:22:16.799
Uh, you need someone in IT, you need a domain expert, and then you need a daily AI user.
00:22:16.880 --> 00:22:25.279
I think those are the five different people minimum that you need, or the five different departments that you need because agents are going to be making decisions.
00:22:25.440 --> 00:22:32.240
Remember, it's not a human expert talking to uh a chat bot and then the human expert making the decision.
00:22:32.400 --> 00:22:39.119
In many cases, this is someone who is unrelated to that domain who is creating agents.
00:22:39.279 --> 00:22:52.799
And then that agent is going and making decisions, sometimes without the actual expert, the actual domain uh expert, um, subject domain expert even knowing what's happening.
00:22:52.880 --> 00:22:58.880
Or they're like, okay, well, hey, whatever, whoever gave this agent directions on finance is completely wrong.
00:22:58.960 --> 00:23:00.960
We should have ran this by finance, right?
00:23:01.119 --> 00:23:02.079
So that's who you need.
00:23:02.160 --> 00:23:08.559
You need the executive sponsor, you need legal, you need IT, you need the domain expert, and then you need the daily AI user.
00:23:08.720 --> 00:23:10.880
And why do you need the daily AI user in your company?
00:23:10.960 --> 00:23:12.960
Well, that's your frontline person, right?
00:23:13.200 --> 00:23:22.079
That's your person that's actually probably using these tools way more than maybe the head of legal or your, you know, your IT director.
00:23:22.160 --> 00:23:22.880
Uh, right.
00:23:23.039 --> 00:23:28.799
That's the person that's gonna say, like, hey, wait, that's not how we're using this agentic platform.
00:23:28.960 --> 00:23:32.240
We're taking a completely different route, all right.
00:23:33.039 --> 00:23:39.359
So, rule four, don't write policies.
00:23:40.079 --> 00:23:47.759
All right, I can guarantee you the best written policy from 2025 is antiquated.
00:23:48.319 --> 00:23:50.640
It is holier than Swiss cheese right now.
00:23:51.119 --> 00:23:53.200
Swiss cheese on a Sunday, right?
00:23:54.480 --> 00:23:58.079
Because a policy just says do not do this, right?
00:23:58.240 --> 00:24:00.160
Do not input sensitive data.
00:24:00.880 --> 00:24:05.119
A playbook tells you exactly who reviews what and when, right?
00:24:05.519 --> 00:24:12.640
If you just have a list of of things to not do, right, which is usually what policies are, it's not helpful.
00:24:13.039 --> 00:24:15.680
Every AI use case needs five answers.
00:24:16.000 --> 00:24:22.240
It needs a task access, accuracy measure, reviewer, and an escalation path.
00:24:23.039 --> 00:24:23.519
All right.
00:24:23.680 --> 00:24:28.240
Every single AI use case that you deploy within your organization needs those things.
00:24:29.119 --> 00:24:38.240
And then outsourcing something to an AI agent does not outsource the responsibility.
00:24:38.400 --> 00:24:50.079
Actually, the FTC, right, the Federal Trade Commission here in the US, they're they they kind of shifted their focus away from you know Bitcoin and it's going full full all in on AI.
00:24:50.319 --> 00:24:55.519
You are all your company is ultimately responsible for any decisions that an AI makes, right?
00:24:55.599 --> 00:25:00.400
So if you're using a fully autonomous, you know, agentic loop, right?
00:25:00.480 --> 00:25:07.680
If you if if you're using right open claw, any of these things and something goes wrong, you don't get to point the finger at open claw.
00:25:07.759 --> 00:25:12.640
You don't get to point the finger at, you know, open AI, Google, Microsoft, Anthropic, et cetera.
00:25:12.720 --> 00:25:14.640
No, it is on you, right?
00:25:14.880 --> 00:25:24.160
So that's why you have to have those use cases have to be thoroughly vetted, and you need playbooks on what to do, not just what not to do.
00:25:24.319 --> 00:25:32.400
And then rule five, you need to treat governance as the scaling engine and not the break.
00:25:32.640 --> 00:25:34.480
So here's what here's what I mean by that.
00:25:34.640 --> 00:25:43.200
Right now, studies show that 75% of companies are stuck in pilot purgatory because they're just running small AI experiments endlessly.
00:25:43.359 --> 00:25:44.960
They can't get out of there.
00:25:45.119 --> 00:25:45.519
Right.
00:25:45.680 --> 00:25:50.640
Number one, it's because corporate policy moves too slow, agentic AI moves too fast.
00:25:50.720 --> 00:25:59.920
But companies with mature governance who deploy new AI capabilities, they do it faster, uh, 40% faster than their peers that don't.
00:26:00.079 --> 00:26:00.400
Right.
00:26:00.480 --> 00:26:05.599
So if you do have mature governance, you can get out of pilot purgatory.
00:26:06.160 --> 00:26:18.240
Because if you took care of steps one through four, it is actually no longer a stoplight that is stuck on green.
00:26:18.720 --> 00:26:25.119
It is a working stoplight that's just or sorry, it's it's it's no longer a a uh traffic light stuck on red.
00:26:25.200 --> 00:26:31.920
It is a traffic light that is properly pulling the cars through and keeping them going at a high speed, right?
00:26:32.400 --> 00:26:46.880
People think business leaders think people on you know Twitter, LinkedIn, whatever, people who are AI experts, they assume that governance slows companies down.
00:26:47.359 --> 00:26:54.559
And it is the exact opposite, because without governance, you cannot compete, you cannot keep up.
00:26:54.799 --> 00:27:03.200
There's going to be too many small roadblocks along the way, too many giant Chicago-sized potholes.
00:27:03.440 --> 00:27:06.160
Your car's not going to make it out of the lot, y'all.
00:27:06.880 --> 00:27:11.839
Governance is the scaling engine, not the brakes.
00:27:12.079 --> 00:27:12.480
All right.
00:27:12.640 --> 00:27:26.160
So uh both studies from Align AI and IBM said that report organizations with strong AI governance actually saved$1.9 million per data breach on average, right?
00:27:27.039 --> 00:27:35.599
A lot of this data just uh goes back to data breaches because ultimately, like that's that's where a lot of this is headed, right?
00:27:35.839 --> 00:27:40.799
When agentic AI goes off the rails, everyone knows about it.
00:27:40.880 --> 00:27:44.319
And then you have to start diagnosing, and it takes a lot of time and a lot of money.
00:27:44.400 --> 00:27:52.880
And that's that's where we are unfortunately learning the good lessons about what we should do in governance when we learn where things go wrong.
00:27:53.119 --> 00:27:57.359
And the biggest thing where things go wrong, it's going back.
00:27:57.440 --> 00:28:00.400
I'm gonna I'm gonna just read these rules here one more time.
00:28:00.960 --> 00:28:01.440
All right.
00:28:01.599 --> 00:28:06.559
I think it starts with not knowing what you actually have and not knowing what the capabilities are.
00:28:06.720 --> 00:28:06.960
All right.
00:28:07.039 --> 00:28:09.359
So, rule one, you have to know what you actually have.
00:28:09.599 --> 00:28:12.960
Rule number two, you have to classify everything at risk by risk level.
00:28:13.119 --> 00:28:16.960
Rule three, you need to assign clear ownership, not just kick it to IT.
00:28:17.200 --> 00:28:19.759
Rule four, write playbooks, not policies.
00:28:19.920 --> 00:28:24.079
And rule five, treat governance as the scaling engine, not the break.
00:28:24.319 --> 00:28:24.880
All right.
00:28:25.200 --> 00:28:27.680
So that's not all.
00:28:27.839 --> 00:28:29.920
You and you might not like this part.
00:28:30.160 --> 00:28:33.119
You have to set monthly review cycles.
00:28:33.279 --> 00:28:38.400
Yes, not yearly, not quarterly, monthly.
00:28:38.799 --> 00:28:39.440
All right.
00:28:40.559 --> 00:28:56.480
Because a government policy that if if if if you think you can set it once and forget it, that's literally like you know, thinking you can repurpose a 20 2006 social media policy, uh, change a couple words and use it for AI in 2026.
00:28:56.640 --> 00:29:02.079
Like monthly review is the absolute minimum cadence to keep governance matched to reality.
00:29:02.240 --> 00:29:07.279
Y'all, I've literally been doing this thing for more than three years, every single day.
00:29:07.440 --> 00:29:18.559
And I'm not exaggerating when I say the last three months in terms of capabilities, what an AI can output and do, have far outpaced the previous three years.
00:29:18.799 --> 00:29:22.000
Like I said, it is scary in a good and bad way.
00:29:22.319 --> 00:29:27.119
So you cannot just set something and revisit it once a year.
00:29:27.359 --> 00:29:28.799
That is a recipe for failure.
00:29:29.039 --> 00:29:34.240
But a recipe for success is to stick with us through the rest of the Start Here series.
00:29:34.400 --> 00:29:41.519
All right, because we're gonna be guiding you along the way, whether you are brand new to AI or you're trying to keep up and double down.
00:29:41.759 --> 00:29:49.279
Thank you for going with us on this one as we went over AI governance in plain English, five AI rules every company needs to follow.
00:29:49.440 --> 00:29:50.319
I hope this was helpful.
00:29:50.480 --> 00:29:51.920
If so, do me a favor.
00:29:52.000 --> 00:29:58.720
And I'm not gonna keep this open forever, FYI, uh, right, just free, open, unlimited access to our community.
00:29:58.960 --> 00:30:01.519
So go to starthireseries.com.
00:30:01.599 --> 00:30:05.920
If this was at all helpful, all right, that's gonna give you free access to our community.
00:30:06.000 --> 00:30:19.200
And you can go check out every single episode in the Start Here series, all in one easy to find space and also connect with uh thousands of other people in our community right now who are doing the same thing you're doing.
00:30:19.359 --> 00:30:20.960
So uh thank you for tuning in.
00:30:21.119 --> 00:30:23.920
Hope to see you back tomorrow in everyday for more everyday AI.
00:30:24.000 --> 00:30:25.039
Thanks, y'all.
