WEBVTT
00:00:07.280 --> 00:00:12.640
This is the Caffeinated Risk summer show with your hosts Tim McCree and Doug Lee.
00:00:14.880 --> 00:00:26.160
Technically, it's not fall until the 21st of September, so we just snuck under the wire for our annual summer show.
00:00:27.600 --> 00:00:29.920
It feels like fall out here right now.
00:00:31.519 --> 00:00:39.679
Labor Day weekend, and it's usually the last last summer weekend of people buttoning up the cottage and all the rest kind of thing.
00:00:40.079 --> 00:00:44.079
And some of our previous episodes just accidentally worked out this way.
00:00:44.240 --> 00:00:49.119
There seemed to be a bunch of uh catastrophic failures in Canada.
00:00:49.280 --> 00:00:49.600
Yeah.
00:00:49.759 --> 00:01:04.079
So we had uh Suncor had one and then uh Iraq had another one, and there wasn't any major critical infrastructure disruption here in Canada this summer.
00:01:04.480 --> 00:01:17.280
But instead, there was a law that came into effect that said you're not allowed to have major critical infrastructure disruptions, or we can lift all the stuff off your rack and you're not allowed to tell anybody.
00:01:17.599 --> 00:01:21.599
That was Bill C8 actually hit Royal Ascent.
00:01:22.480 --> 00:01:24.719
So it means it's a real law.
00:01:25.359 --> 00:01:36.799
But what I found interesting is the Canadian one is written in a very casual tone that anybody can actually just pick up and read.
00:01:37.040 --> 00:01:39.599
And it's pretty straightforward.
00:01:40.560 --> 00:01:48.959
I'm doubting most people will voluntarily read it, but you've been part of some of these laws and stuff in the past.
00:01:49.120 --> 00:02:06.719
Like I know it takes forever to get something done, but how do you then go back to a business or an organization and say, hey, the rubber stamp officially happened, so these are the new rules now.
00:02:06.959 --> 00:02:08.240
Like, where do you lean in?
00:02:08.319 --> 00:02:15.759
Like, this is what happens if you don't follow it, or here's all the stuff I think we should do, or how would how would you do that?
00:02:16.639 --> 00:02:17.919
No, it's a it's a good question.
00:02:18.000 --> 00:02:26.479
And I mean, in past lives, we always tried to stay current with legislative requirements, especially for something as big as Bill C8.
00:02:26.960 --> 00:02:30.639
And and what we're looking at in Europe for some of the other laws that are coming through.
00:02:30.879 --> 00:02:38.879
And and part of it is understanding, you know, if I go back to my ESRM model, is do I understand the business that I'm there to protect?
00:02:38.960 --> 00:02:43.360
And what are the legislative and regulatory requirements that impact my program?
00:02:43.759 --> 00:02:47.680
So Bill C eight, yes, it's going to absolutely impact my program.
00:02:47.919 --> 00:02:59.759
So the goal then is can I work within the security team, within my, you know, updating my administration and my executive team, but also from an operational perspective.
00:02:59.919 --> 00:03:04.639
Can we start taking a look at what does that mandatory threat protection really look like?
00:03:04.800 --> 00:03:07.599
How do I address supply chain risks?
00:03:07.840 --> 00:03:14.319
And then how am I gonna document and create the instant reporting structure that Bill C8 now requires?
00:03:14.560 --> 00:03:15.520
So, how can I do that?
00:03:15.599 --> 00:03:24.719
Because it isn't going to be the security team doing all of this work, but it's gonna be on the security team to make sure that a majority of this work actually is actioned.
00:03:24.879 --> 00:03:30.960
So now it's how can I work with the team that's going to be uh I don't know, focusing on supply chain risks.
00:03:31.120 --> 00:03:32.080
We can pick on that.
00:03:32.400 --> 00:03:36.319
So now I'm gonna sit down with procurement and accounts payable and accounts receivable.
00:03:36.479 --> 00:03:39.599
We're gonna start walking through some of the things that we need to focus now on.
00:03:39.759 --> 00:03:46.400
And how am I gonna get rid of some of the risks that you know I'm looking at either from a third-party software or AI systems in particular?
00:03:46.719 --> 00:03:47.439
What does that mean?
00:03:47.680 --> 00:03:50.400
How can I collaborate with groups across the company to build it out?
00:03:50.560 --> 00:03:56.960
Because you're right, it isn't like it doesn't work if you just walk into somebody's office going now, you have to have this done.
00:03:57.360 --> 00:04:02.479
Or you get to face a you know, a big like a$15 million a day penalty.
00:04:02.560 --> 00:04:03.599
Yeah, that goes over well.
00:04:03.680 --> 00:04:05.120
Yeah, people want to hear that shit right away.
00:04:05.360 --> 00:04:10.560
Can't come in with a hammer and say, you know, hey kids, we got to change our approach because now the government's gonna find us every day.
00:04:10.800 --> 00:04:16.639
No, it's how do I manage building out a program now that the legislative requirements have changed?
00:04:17.519 --> 00:04:28.000
You know, we we were joking about it before we we uh turned record on is that how long did it take for the automotive industry and for the government to catch up with the idea that you should probably wear a seatbelt?
00:04:28.160 --> 00:04:28.399
Yeah.
00:04:28.560 --> 00:04:29.920
And here's the fine if you don't.
00:04:30.079 --> 00:04:35.040
More importantly, here's what happens if you don't wear a seatbelt, and then what we need you to start doing and how to train people.
00:04:35.279 --> 00:04:38.879
Like, how often now do you jump into a vehicle and not put a seatbelt on?
00:04:39.199 --> 00:04:40.000
Almost never.
00:04:40.160 --> 00:04:40.560
Yeah.
00:04:40.879 --> 00:04:41.839
Yeah, almost never.
00:04:41.920 --> 00:04:47.600
I mean, in it where, you know, as kids growing up, Jesus, we stood in that back seat because it was vinyl like all over the place.
00:04:47.839 --> 00:04:48.240
Oh, yeah.
00:04:48.480 --> 00:04:50.480
So we we didn't have seatbelts back then.
00:04:50.639 --> 00:04:51.519
But picture it now.
00:04:51.600 --> 00:05:02.879
So, as an example, before Bill C8, we didn't have a set of mandatory requirements, we didn't have strict instant reporting, we didn't have you know some of the guide rails we needed to put into place to focus on supply chain.
00:05:03.040 --> 00:05:03.759
Well, now we do.
00:05:04.240 --> 00:05:04.959
Oh, okay, great.
00:05:05.040 --> 00:05:06.079
So, how do we adapt?
00:05:06.560 --> 00:05:08.160
I look at it, it's no different now.
00:05:08.399 --> 00:05:10.720
Just okay, now we got to start putting a seatbelt on.
00:05:11.040 --> 00:05:11.920
Yeah, okay.
00:05:12.160 --> 00:05:17.439
Let's explain that to the company and focus on what it means to, you know, take the theory of putting that seatbelt on.
00:05:17.519 --> 00:05:20.639
What does it mean now with supply chain or instant reporting?
00:05:20.959 --> 00:05:24.879
Yeah, well, they they use the word program, which is good.
00:05:25.120 --> 00:05:31.839
I think when you look at the original TSA stuff that came out for the pipeline, it was very prescriptive.
00:05:32.319 --> 00:05:37.839
And a lot of people thought, oh, if I just hook these things up, I'm good, right?
00:05:38.319 --> 00:05:44.000
And then even TSA came back and said, actually, here's what we meant.
00:05:44.319 --> 00:05:52.240
And then the CER came in and said, now that we understand this, you need to figure out what fits for you.
00:05:52.480 --> 00:05:58.480
So I took the liberty of copying something else just because it would be too long to remember.
00:05:58.720 --> 00:06:22.160
But ensuring that, among other things, right out of the text, any cybersecurity risks in respect of cyber critical or critical cyber systems are identified and managed, including risks associated with supply chains and the use of third-party products and services, semicolon, 8,000 more lines of stuff.
00:06:22.319 --> 00:06:37.279
Yeah, but it's like anything could fit in here, and you have to now explain how it works in your world, which is kind of nice from the lack of prescription.
00:06:37.360 --> 00:06:41.439
It means nobody can kind of say, we're done.
00:06:42.240 --> 00:06:48.720
It's going to force you to put down on paper, this is how we think our world goes together.
00:06:48.879 --> 00:06:55.279
That's kind of part one of ESRM is understanding your business and knowing what needs protecting.
00:06:55.519 --> 00:07:01.040
So it does feel like they're going to be complementary.
00:07:01.199 --> 00:07:01.839
Yeah.
00:07:02.480 --> 00:07:19.759
North America and Europe have they're at different places in this, and there's two acts out of Europe that are are very, you know, big and important, but one of them doesn't even technically come into monitoring until next week.
00:07:19.920 --> 00:07:25.519
So on the 11th of September, the Cyber Resilience Act, you have to start reporting.
00:07:26.240 --> 00:07:31.680
But in 2027, September, you actually have to start following the rules.
00:07:32.000 --> 00:07:38.319
But it's different because they're talking about anything with digital elements.
00:07:38.399 --> 00:07:38.639
Yeah.
00:07:38.879 --> 00:07:44.480
So I think that is pacemakers and televisions and watches and phones and all the rest.
00:07:44.639 --> 00:07:49.040
And basically, you can't sell it if it's not safe.
00:07:49.600 --> 00:07:51.279
And and this is what's the interesting part.
00:07:51.360 --> 00:07:57.759
Like, I wanted to ask, how did it feel when you saw the word program in there or this idea, the concept of program?
00:07:58.240 --> 00:08:11.199
I thought it was great because from a professional in the business, I already know that this is a three to five year moving the battleship most of the time.
00:08:12.000 --> 00:08:17.519
Hooking up a couple firewalls is a two-week professional services engagement at best.
00:08:18.240 --> 00:08:21.759
And nothing changes, but you get your rubber stamp.
00:08:22.079 --> 00:08:38.480
It is kind of interesting that Bill C8 goes after it better protect your business, whereas the Cyber Resilience Act says you better not put anything in your business that isn't safe.
00:08:38.799 --> 00:08:42.879
But you can hook it up wrong and do a crap job, but you're still good.
00:08:43.039 --> 00:08:43.360
Yeah.
00:08:43.840 --> 00:08:47.039
So there's a there's a balance there, right?
00:08:47.440 --> 00:08:57.600
What I liked about the approach that they've taken is they are complimentary, but what I liked about it is by creating this concept of a program, it takes away that compliance approach.
00:08:57.759 --> 00:08:59.440
And you and I have seen this on Tarquare.
00:08:59.679 --> 00:09:07.039
It's a new piece of regulation because there's a legislation, and all it someone turns into a checklist, you just got to work through, and now you're compliant.
00:09:07.279 --> 00:09:08.960
Great, we're compliant to the legislation.
00:09:09.120 --> 00:09:16.000
No, this actually forces you to really look at what's the risk that's facing your infrastructure, particularly for critical infrastructure.
00:09:16.159 --> 00:09:23.120
And it forces you to design a program, not a compliance check mark exercise, but an actual program to address it.
00:09:23.200 --> 00:09:27.519
And then eventually start reporting on it and then coming back with all the other things that are part of the act.
00:09:27.679 --> 00:09:33.440
So I think maybe legislation is starting to look at the value that it can bring to an organization.
00:09:33.600 --> 00:09:43.600
So instead of, you know, that punch list that we've seen with every other legislation that comes out, now they're forcing you to build a program and to follow a framework to put it into place.
00:09:44.320 --> 00:09:44.960
Yeah.
00:09:45.360 --> 00:09:54.960
And you write the one that works for you, but it this better not have been something you just cooked up with Chat GPT 20 minutes before I got here.
00:09:55.120 --> 00:09:55.360
Yeah.
00:09:55.519 --> 00:09:56.159
Yeah.
00:09:56.559 --> 00:09:57.919
Interesting segue.
00:09:58.080 --> 00:10:02.879
I was next thing on the list was the EU Artificial Intelligence Act.
00:10:03.279 --> 00:10:08.720
And this is weird because they're very separate acts over in Europe.
00:10:09.360 --> 00:10:26.240
And as far as I can tell, there isn't anything in Canada or North America that is specific to artificial intelligence, whereas the EU has something that is, it's actually right in the name.
00:10:27.279 --> 00:10:35.600
Apparently, the original version of Bill C8, which was Bill C27, did have an AI element to it.
00:10:35.840 --> 00:10:41.840
27 was supposed to be, then we had the election and it died.
00:10:42.000 --> 00:10:49.200
They reopened it, but only the critical infrastructure stuff seemed to make it in, and the AI sort of fell down.
00:10:50.159 --> 00:10:53.840
So maybe there'll be another one, maybe there won't.
00:10:54.159 --> 00:10:59.679
But the European ruling is very different.
00:11:00.720 --> 00:11:10.320
Certain countries are looking at it as a threat to human civilization, and others are looking at it as a commercial advantage.
00:11:10.559 --> 00:11:14.320
So which one's gonna say go, baby, go, right?
00:11:14.559 --> 00:11:17.519
And uh it's like we don't need any rules yet.
00:11:17.679 --> 00:11:20.559
It's like, okay, we'll see.
00:11:21.039 --> 00:11:21.840
We'll see.
00:11:22.080 --> 00:11:33.840
I think what they did is I kind of like, and and this is just you know, me, the, you know, coffee and risk guy, is they created that those four categories of risk, right?
00:11:34.000 --> 00:11:41.840
Like whether it's unacceptable risk or high risk or limited risk or minimal, but what they've given at least is a benchmark to start.
00:11:42.080 --> 00:11:50.720
And I think I think we really need we kind of need it to see that because it it sets the tone and the structure for what an organization has to focus on.
00:11:50.879 --> 00:12:03.840
So if you're bringing in an inordinately number high number of unacceptable risks and systems into your organization, you probably have some explaining to do or some understanding, or or perhaps you should look at different things to bring into your organization.
00:12:04.080 --> 00:12:18.240
But do you know what it did, at least for me, is it kind of brought this idea that I'm not gonna bring in a tool that's gonna expose my company to unacceptable risk, particularly if I'm in things like education or healthcare or pharma or banking.
00:12:18.480 --> 00:12:22.720
Those are systems, you know, we have 10 critical infrastructure systems here in Canada.
00:12:22.879 --> 00:12:30.240
Those types of systems reflected in Europe, you know, that's you know, that is one of the largest trading blocks on earth.
00:12:30.399 --> 00:12:43.919
And to finally now put in some level of risk identification that's codified as a law and forcing organizations that fall within that structure to at least look at these requirements and go, ah, crap, we've got a lot of unacceptable risk.
00:12:44.000 --> 00:12:45.360
We have to start dealing with that.
00:12:45.600 --> 00:12:50.000
And it's no longer something that a board or you know, executives or others can walk away from.
00:12:50.159 --> 00:12:52.240
You actually have to start doing shit to fix this.
00:12:52.480 --> 00:12:55.279
Well, they they went as far, you know.
00:12:55.440 --> 00:13:01.279
The minute I see the risk, the word risk, it's like, do you even know what the word means?
00:13:01.360 --> 00:13:03.039
So I I dug a little deeper.
00:13:03.120 --> 00:13:17.919
Yeah, yeah, but the European Artificial Intelligence Act actually prohibits the use of AI for work that's going to conflict with things that are laid out in their charter of rights.
00:13:18.399 --> 00:13:26.159
So you can't use it for separating people using biometrics, for example.
00:13:26.320 --> 00:13:39.120
You know, like uh you're not probably gonna be able, as much as it would, you know, an insurance company would love to know do you have the right genetics to make you not insurable?
00:13:39.679 --> 00:13:41.360
You're not allowed to do that.
00:13:41.519 --> 00:13:43.039
Yeah, to say, okay.
00:13:43.200 --> 00:13:43.919
Yeah, yeah.
00:13:44.159 --> 00:13:52.720
Now, how we'll know, how we'll even know that a company's doing that is gonna be problematic.
00:13:53.039 --> 00:14:13.039
But I think I think just drawing the line of saying certain things we're just gonna say no to, bottom line, yeah, yeah, and then high risk is where it gets interesting because, like you say, the medical stuff they they call out as high risk.
00:14:13.840 --> 00:14:22.159
But when I read uh the actual text, it said health sector diagnostics are supporting human decisions, not replacing them.
00:14:22.240 --> 00:14:23.600
Well, I thought, okay, good.
00:14:23.840 --> 00:14:24.720
Yeah, yeah, okay.
00:14:25.039 --> 00:14:26.240
But you know, all right, we'll see.
00:14:26.799 --> 00:14:29.039
How many lousy doctors are there out there?
00:14:29.120 --> 00:14:41.519
So maybe maybe I am okay with Chat GPT as a you know, as a practitioner, but it does say they need to be reliable and accurate.
00:14:41.679 --> 00:15:02.559
And when you look at the way other medical solutions are tested and evaluated with control groups and repeatable input and everything else, it sometimes takes years for a good idea to actually turn into a routine procedure.
00:15:02.960 --> 00:15:06.960
So that does feel directionally correct.
00:15:07.120 --> 00:15:12.960
Um, it yeah, it says should be reliable and accurate, not must.
00:15:13.120 --> 00:15:16.480
I'm not a lawyer, but that kind of sounds like a loophole.
00:15:16.639 --> 00:15:20.080
But yeah, it does sound like they get it.
00:15:20.240 --> 00:15:34.240
That and there were several, several different stanzas in that act that were going through at different different versions of what they meant by high risk for finance, for education, for everything else.
00:15:34.480 --> 00:15:40.159
And um, they even called out critical infrastructure in there as high risk.
00:15:40.240 --> 00:15:46.240
Yeah, but they were focused on the safety systems, not the cybersecurity components.
00:15:46.480 --> 00:15:53.600
So your firewall isn't necessarily high risk, but your fire suppression system is okay.
00:15:54.799 --> 00:15:59.279
It was anything that would disrupt the physical integrity of the control system.
00:15:59.679 --> 00:16:04.799
So I do think they got it right because they're looking at the outcome.
00:16:06.159 --> 00:16:18.559
You know, somebody breaks in through a bad account and shuts down your operation is not the same as they blew something up and people died.
00:16:20.000 --> 00:16:34.080
Well, and that's the difference, Doug, and I think you nailed it, is that I think part of that legislative focal point was on the human element because inside that same legislation they're making sure that there still needs to be a guarantee of human oversight.
00:16:34.559 --> 00:16:34.799
Right?
00:16:35.039 --> 00:16:43.120
What what whatever that happens to be, I don't know what they're gonna work on for that, plus this idea of a conformity assessment that has to be there as well.
00:16:43.360 --> 00:16:45.200
So I think I think you kind of nailed it.
00:16:45.279 --> 00:16:49.840
They're they're really looking at the far-end result of an impact to a human.
00:16:49.919 --> 00:17:02.399
And I think that's where I really like this, the idea of the safety element in advance of the security element, is the life safety of somebody, you know, in a foundry working by a furnace.
00:17:02.879 --> 00:17:09.440
We're concerned about that person being impacted by a potential explosion, and and that's identified.
00:17:09.599 --> 00:17:14.480
Versus do you have the right firewall in front of the furnace to make sure it doesn't get compromised?
00:17:14.720 --> 00:17:23.200
It's it's the the end result of a cascade of errors or cascade of events that could lead to that impact to the human.
00:17:23.359 --> 00:17:25.440
And I kind of like what they've done with it.
00:17:25.680 --> 00:17:29.759
But I mean, it's gonna be like I hate to say this, but it's gonna be kind of like GDPR.
00:17:29.920 --> 00:17:31.839
The first test is gonna be in the court.
00:17:32.079 --> 00:17:54.400
And then I think that's where we're gonna see some of the validity of this framework that the EU has put together, is that very first court case that's gonna challenge somebody because the the penalties for some of you know the inability to meet the requirements, like some of those prohibited violations, are just like 35 million pounds or uh euros or seven percent of your worldwide annual turnover.
00:17:54.720 --> 00:17:56.799
Holy that's bigger than the GDPR.
00:17:57.279 --> 00:18:00.400
Big enough to get your attention, even if you're a board member.
00:18:00.640 --> 00:18:08.160
Yeah, um, you're all working for free for the next two and a half years, tends to yeah.
00:18:08.400 --> 00:18:10.160
Bonus is what bonus, right?
00:18:10.240 --> 00:18:12.880
So, and I mean non just just general non-compliance.
00:18:13.039 --> 00:18:16.079
It's like a 15 million euro and a three percent of your worldwide.
00:18:16.240 --> 00:18:22.400
And it's like, Jesus, that's that's got some teeth, because that that enforcement mechanism, we've seen it, right?
00:18:22.480 --> 00:18:26.400
We actually saw it play out for GDPR complaints and how the enforcement worked.
00:18:26.640 --> 00:18:34.799
Here, this is this is going to be interesting, like a year from now, two years from now, this is where we're gonna see some of the fun come through with this piece of decision.
00:18:35.279 --> 00:18:48.640
The fact that they're they use the word output all over that play, all over that, and that's usually then that's usually where the trouble starts with generative AI is what's coming out of it, not what's going into it.
00:18:49.119 --> 00:18:50.640
Or people believing it.
00:18:50.720 --> 00:18:53.119
That's that's probably the bigger issue.
00:18:53.519 --> 00:18:54.480
Yeah, yeah.
00:18:55.359 --> 00:19:01.440
But it definitely looks like they tried to tier it so that the impacts are there.
00:19:02.319 --> 00:19:12.960
And they even went around or went in to say it doesn't meet a high risk threshold if it doesn't materially influence a decision.
00:19:13.359 --> 00:19:17.920
What I read a little further, uh, and these are dry documents.
00:19:18.079 --> 00:19:25.200
I I don't expect anybody to voluntarily pick up legislation and go, let me read what it says.
00:19:25.359 --> 00:19:30.640
You know, I I definitely skim and summarize, but all of this is public.
00:19:30.799 --> 00:19:36.400
You can go get it, and if you're responsible for this, you probably do need to do it.
00:19:36.640 --> 00:19:42.160
And you do need to read it, and that's why they call it a job, I guess, right?
00:19:42.640 --> 00:19:55.759
But it does say things like if you're dedupling data or trying to give it a very narrow scope, that that is a reasonable low-risk use of the technology.
00:19:56.319 --> 00:20:07.440
And it also goes on to say that if it's editing or reinterpreting work that a human already started, that it's considerably lower.
00:20:07.680 --> 00:20:22.240
So one of the things I've heard on a lot of podcasts around this is you treat AI like an intern and you keep a reasonable and ideally a qualified human in the middle.
00:20:23.200 --> 00:20:23.519
Yeah.
00:20:23.759 --> 00:20:27.359
Um, yeah, and you're gonna get below that high risk.
00:20:27.599 --> 00:20:34.799
And so I think just the fact that they're calling out, like you said, this has got to be tested in the courts.
00:20:35.039 --> 00:20:41.680
Was it a high risk or was it a low risk thing that you did with your AI as part of your business?
00:20:42.000 --> 00:20:45.119
Well, what's that benchmark?
00:20:45.279 --> 00:20:47.519
You know, was a human in there?
00:20:47.839 --> 00:20:53.519
Was it a pretty narrow scope, or did you say, we don't have any salespeople anymore?
00:20:53.680 --> 00:20:58.640
People just talk to chat bots, and whatever deal they can work out, that's the one we go with.
00:20:59.119 --> 00:21:09.839
Well, maybe tokens are cheaper than commissions, I don't know, but you know, we've heard stories of cars being offered for a dollar.
00:21:10.079 --> 00:21:15.519
The people responsible in the accounting department are gonna go, yeah, we're not we're not letting that pass.
00:21:15.599 --> 00:21:15.920
Yeah.
00:21:16.319 --> 00:21:23.839
So I think the I think it's gonna take a while for the legal side to catch up to this.
00:21:23.920 --> 00:21:29.119
And I think my concern is that that doesn't stop people from inventing.
00:21:29.200 --> 00:21:29.359
Yeah.
00:21:29.599 --> 00:21:33.599
There were three brand new model versions that released this week.
00:21:33.839 --> 00:21:34.799
Oh wow.
00:21:35.119 --> 00:21:37.759
Well, four, I guess, technically, because Meta had one too.
00:21:37.839 --> 00:21:46.160
I don't follow those guys as close, but yeah, Anthropic, OpenAI, and Google all released a a new updated thing.
00:21:46.559 --> 00:21:54.240
Do you know what bugs me too is that because in the past, being able to work through all of this with AI worked so well for us.
00:21:54.559 --> 00:21:55.039
Right.
00:21:55.519 --> 00:21:59.759
Jeez, because every company I know did a fantastic job of staying on top of it.
00:22:00.160 --> 00:22:05.759
It's you know, its ASM framework or its vulnerability management protocol and platform.
00:22:05.839 --> 00:22:08.000
Yeah, because we always patch whenever it came out.
00:22:08.319 --> 00:22:09.039
Seriously?
00:22:09.279 --> 00:22:13.599
Now I'm I'm actually asking you to do something even more complex.
00:22:14.319 --> 00:22:15.599
I mean, you just brought it up, Doug.
00:22:15.680 --> 00:22:17.200
It's you know, what an awesome point.
00:22:17.359 --> 00:22:20.240
I now have to validate the output from the brand new version.
00:22:20.880 --> 00:22:21.680
Holy shit.
00:22:21.759 --> 00:22:23.119
Like, did we think of that through?
00:22:23.200 --> 00:22:28.000
Because how often did we validate an update from a brand new app that we just launched?
00:22:28.160 --> 00:22:32.240
We were just worried about getting into the change cycle and making sure that it was updated and didn't break anything.
00:22:32.319 --> 00:22:33.920
Now we gotta go test output.
00:22:34.160 --> 00:22:34.720
Wow.
00:22:34.960 --> 00:22:35.279
Okay.
00:22:35.759 --> 00:22:40.240
Well, I maybe test beyond I can log in, which was usually oh good.
00:22:40.319 --> 00:22:41.039
Yeah, there we go.
00:22:41.279 --> 00:22:41.839
Yeah, yeah.
00:22:42.000 --> 00:22:44.480
Like yeah, I I can print and it works fine.
00:22:44.640 --> 00:22:45.200
Go, right?
00:22:45.279 --> 00:22:52.079
So now we actually figure out I'm gonna run another query, I'm gonna run another prompt, and it needs to come up with the same, if not better, response than we did last time.
00:22:52.319 --> 00:22:53.279
Jesus, really?
00:22:53.599 --> 00:22:54.319
Oh, okay.
00:22:54.799 --> 00:23:01.759
So every flow, every agent, every piece of you know, whatever you have on behind the scenes, we have to make sure we test.
00:23:01.920 --> 00:23:06.880
So that that concept, that iterative approach, that design thinking approach that we talk about a lot.
00:23:07.279 --> 00:23:08.640
Now we have to actually apply it.
00:23:08.880 --> 00:23:10.240
We actually have to do it now.
00:23:10.880 --> 00:23:20.799
I think it's gonna be a rude awakening for some companies that that thought they were gonna save money and this was gonna save their operation.
00:23:21.440 --> 00:23:22.640
Time will tell, right?
00:23:22.720 --> 00:23:25.039
Like the marketplace isn't sentimental.
00:23:25.200 --> 00:23:31.200
It'll some will win and some will lose, and we'll see, we'll see how it shakes out.
00:23:35.359 --> 00:23:38.880
I I think it's uh gonna be a real challenge in critical thinking.
00:23:38.960 --> 00:23:41.440
And you had mentioned Wynn's books as well.
00:23:41.680 --> 00:23:54.799
So I think we should include a link to that one again because that was the again, how to think through some of this stuff that we had never really got through before.
00:23:55.039 --> 00:24:23.599
So it's gonna be an interesting final quarter of the year because everybody wants to make money, but I'm thinking 2027 is gonna be even stranger because uh the wheels are starting to come off of some of these things financially, as well as you know, some of the technology is now showing that it's not exactly trustworthy.
00:24:24.000 --> 00:24:29.200
So I'm I'm very, very interested to see what'll happen.
00:24:29.440 --> 00:24:33.279
But now it's against the law not to think about that.
00:24:33.680 --> 00:24:38.240
So that should change how businesses approach this.
00:24:38.319 --> 00:24:41.119
So I mean the the YOLO days are over, I think.
00:24:41.359 --> 00:24:42.160
Yeah, I agreed.
00:24:42.319 --> 00:24:54.000
And this is I think this is one of the first times we've seen this approach where we're actually enforcing at a business level first what you need to have in place from a technical level second.
00:24:54.160 --> 00:24:59.519
And I'm yeah, this is going to be uh interesting to watch for the next 12, 18 months.
00:24:59.680 --> 00:25:00.160
Yeah.
00:25:00.400 --> 00:25:00.960
Yeah.
00:25:01.279 --> 00:25:04.160
Well, we'll be around to talk about it, God willing.
00:25:04.400 --> 00:25:04.960
There you go.
00:25:05.279 --> 00:25:07.920
Hey, next next season's coming around the corner, right?
00:25:08.000 --> 00:25:09.839
So yeah, awesome.
00:25:10.000 --> 00:25:10.319
Awesome.
00:25:10.480 --> 00:25:11.839
Well, we'll talk to you again soon, eh?
00:25:12.079 --> 00:25:12.880
You betcha.
00:25:20.880 --> 00:25:24.319
Thanks for listening to the latest podcast from Caffeinated Risk.
00:25:24.480 --> 00:25:29.519
Make sure you visit our website, CaffeinatedRisk.com, to stay up to date on what we've been working on.
00:25:29.759 --> 00:25:38.640
Our website has bios of our podcast guests, posts about topics we're passionate about, and even the library reference material we find valuable in the work we do every day.
00:25:38.880 --> 00:25:43.039
And don't forget to subscribe to Caffeinated Risk on your favorite podcast service.
00:25:43.200 --> 00:25:49.440
This way you'll be notified when we release our next podcast, and you can listen to our previous guests just in case you missed them.
00:25:49.599 --> 00:25:52.160
Thanks so much for listening to Caffeinated Risk.
00:00:07.280 --> 00:00:12.640
This is the Caffeinated Risk summer show with your hosts Tim McCree and Doug Lee.
00:00:14.880 --> 00:00:26.160
Technically, it's not fall until the 21st of September, so we just snuck under the wire for our annual summer show.
00:00:27.600 --> 00:00:29.920
It feels like fall out here right now.
00:00:31.519 --> 00:00:39.679
Labor Day weekend, and it's usually the last last summer weekend of people buttoning up the cottage and all the rest kind of thing.
00:00:40.079 --> 00:00:44.079
And some of our previous episodes just accidentally worked out this way.
00:00:44.240 --> 00:00:49.119
There seemed to be a bunch of uh catastrophic failures in Canada.
00:00:49.280 --> 00:00:49.600
Yeah.
00:00:49.759 --> 00:01:04.079
So we had uh Suncor had one and then uh Iraq had another one, and there wasn't any major critical infrastructure disruption here in Canada this summer.
00:01:04.480 --> 00:01:17.280
But instead, there was a law that came into effect that said you're not allowed to have major critical infrastructure disruptions, or we can lift all the stuff off your rack and you're not allowed to tell anybody.
00:01:17.599 --> 00:01:21.599
That was Bill C8 actually hit Royal Ascent.
00:01:22.480 --> 00:01:24.719
So it means it's a real law.
00:01:25.359 --> 00:01:36.799
But what I found interesting is the Canadian one is written in a very casual tone that anybody can actually just pick up and read.
00:01:37.040 --> 00:01:39.599
And it's pretty straightforward.
00:01:40.560 --> 00:01:48.959
I'm doubting most people will voluntarily read it, but you've been part of some of these laws and stuff in the past.
00:01:49.120 --> 00:02:06.719
Like I know it takes forever to get something done, but how do you then go back to a business or an organization and say, hey, the rubber stamp officially happened, so these are the new rules now.
00:02:06.959 --> 00:02:08.240
Like, where do you lean in?
00:02:08.319 --> 00:02:15.759
Like, this is what happens if you don't follow it, or here's all the stuff I think we should do, or how would how would you do that?
00:02:16.639 --> 00:02:17.919
No, it's a it's a good question.
00:02:18.000 --> 00:02:26.479
And I mean, in past lives, we always tried to stay current with legislative requirements, especially for something as big as Bill C8.
00:02:26.960 --> 00:02:30.639
And and what we're looking at in Europe for some of the other laws that are coming through.
00:02:30.879 --> 00:02:38.879
And and part of it is understanding, you know, if I go back to my ESRM model, is do I understand the business that I'm there to protect?
00:02:38.960 --> 00:02:43.360
And what are the legislative and regulatory requirements that impact my program?
00:02:43.759 --> 00:02:47.680
So Bill C eight, yes, it's going to absolutely impact my program.
00:02:47.919 --> 00:02:59.759
So the goal then is can I work within the security team, within my, you know, updating my administration and my executive team, but also from an operational perspective.
00:02:59.919 --> 00:03:04.639
Can we start taking a look at what does that mandatory threat protection really look like?
00:03:04.800 --> 00:03:07.599
How do I address supply chain risks?
00:03:07.840 --> 00:03:14.319
And then how am I gonna document and create the instant reporting structure that Bill C8 now requires?
00:03:14.560 --> 00:03:15.520
So, how can I do that?
00:03:15.599 --> 00:03:24.719
Because it isn't going to be the security team doing all of this work, but it's gonna be on the security team to make sure that a majority of this work actually is actioned.
00:03:24.879 --> 00:03:30.960
So now it's how can I work with the team that's going to be uh I don't know, focusing on supply chain risks.
00:03:31.120 --> 00:03:32.080
We can pick on that.
00:03:32.400 --> 00:03:36.319
So now I'm gonna sit down with procurement and accounts payable and accounts receivable.
00:03:36.479 --> 00:03:39.599
We're gonna start walking through some of the things that we need to focus now on.
00:03:39.759 --> 00:03:46.400
And how am I gonna get rid of some of the risks that you know I'm looking at either from a third-party software or AI systems in particular?
00:03:46.719 --> 00:03:47.439
What does that mean?
00:03:47.680 --> 00:03:50.400
How can I collaborate with groups across the company to build it out?
00:03:50.560 --> 00:03:56.960
Because you're right, it isn't like it doesn't work if you just walk into somebody's office going now, you have to have this done.
00:03:57.360 --> 00:04:02.479
Or you get to face a you know, a big like a$15 million a day penalty.
00:04:02.560 --> 00:04:03.599
Yeah, that goes over well.
00:04:03.680 --> 00:04:05.120
Yeah, people want to hear that shit right away.
00:04:05.360 --> 00:04:10.560
Can't come in with a hammer and say, you know, hey kids, we got to change our approach because now the government's gonna find us every day.
00:04:10.800 --> 00:04:16.639
No, it's how do I manage building out a program now that the legislative requirements have changed?
00:04:17.519 --> 00:04:28.000
You know, we we were joking about it before we we uh turned record on is that how long did it take for the automotive industry and for the government to catch up with the idea that you should probably wear a seatbelt?
00:04:28.160 --> 00:04:28.399
Yeah.
00:04:28.560 --> 00:04:29.920
And here's the fine if you don't.
00:04:30.079 --> 00:04:35.040
More importantly, here's what happens if you don't wear a seatbelt, and then what we need you to start doing and how to train people.
00:04:35.279 --> 00:04:38.879
Like, how often now do you jump into a vehicle and not put a seatbelt on?
00:04:39.199 --> 00:04:40.000
Almost never.
00:04:40.160 --> 00:04:40.560
Yeah.
00:04:40.879 --> 00:04:41.839
Yeah, almost never.
00:04:41.920 --> 00:04:47.600
I mean, in it where, you know, as kids growing up, Jesus, we stood in that back seat because it was vinyl like all over the place.
00:04:47.839 --> 00:04:48.240
Oh, yeah.
00:04:48.480 --> 00:04:50.480
So we we didn't have seatbelts back then.
00:04:50.639 --> 00:04:51.519
But picture it now.
00:04:51.600 --> 00:05:02.879
So, as an example, before Bill C8, we didn't have a set of mandatory requirements, we didn't have strict instant reporting, we didn't have you know some of the guide rails we needed to put into place to focus on supply chain.
00:05:03.040 --> 00:05:03.759
Well, now we do.
00:05:04.240 --> 00:05:04.959
Oh, okay, great.
00:05:05.040 --> 00:05:06.079
So, how do we adapt?
00:05:06.560 --> 00:05:08.160
I look at it, it's no different now.
00:05:08.399 --> 00:05:10.720
Just okay, now we got to start putting a seatbelt on.
00:05:11.040 --> 00:05:11.920
Yeah, okay.
00:05:12.160 --> 00:05:17.439
Let's explain that to the company and focus on what it means to, you know, take the theory of putting that seatbelt on.
00:05:17.519 --> 00:05:20.639
What does it mean now with supply chain or instant reporting?
00:05:20.959 --> 00:05:24.879
Yeah, well, they they use the word program, which is good.
00:05:25.120 --> 00:05:31.839
I think when you look at the original TSA stuff that came out for the pipeline, it was very prescriptive.
00:05:32.319 --> 00:05:37.839
And a lot of people thought, oh, if I just hook these things up, I'm good, right?
00:05:38.319 --> 00:05:44.000
And then even TSA came back and said, actually, here's what we meant.
00:05:44.319 --> 00:05:52.240
And then the CER came in and said, now that we understand this, you need to figure out what fits for you.
00:05:52.480 --> 00:05:58.480
So I took the liberty of copying something else just because it would be too long to remember.
00:05:58.720 --> 00:06:22.160
But ensuring that, among other things, right out of the text, any cybersecurity risks in respect of cyber critical or critical cyber systems are identified and managed, including risks associated with supply chains and the use of third-party products and services, semicolon, 8,000 more lines of stuff.
00:06:22.319 --> 00:06:37.279
Yeah, but it's like anything could fit in here, and you have to now explain how it works in your world, which is kind of nice from the lack of prescription.
00:06:37.360 --> 00:06:41.439
It means nobody can kind of say, we're done.
00:06:42.240 --> 00:06:48.720
It's going to force you to put down on paper, this is how we think our world goes together.
00:06:48.879 --> 00:06:55.279
That's kind of part one of ESRM is understanding your business and knowing what needs protecting.
00:06:55.519 --> 00:07:01.040
So it does feel like they're going to be complementary.
00:07:01.199 --> 00:07:01.839
Yeah.
00:07:02.480 --> 00:07:19.759
North America and Europe have they're at different places in this, and there's two acts out of Europe that are are very, you know, big and important, but one of them doesn't even technically come into monitoring until next week.
00:07:19.920 --> 00:07:25.519
So on the 11th of September, the Cyber Resilience Act, you have to start reporting.
00:07:26.240 --> 00:07:31.680
But in 2027, September, you actually have to start following the rules.
00:07:32.000 --> 00:07:38.319
But it's different because they're talking about anything with digital elements.
00:07:38.399 --> 00:07:38.639
Yeah.
00:07:38.879 --> 00:07:44.480
So I think that is pacemakers and televisions and watches and phones and all the rest.
00:07:44.639 --> 00:07:49.040
And basically, you can't sell it if it's not safe.
00:07:49.600 --> 00:07:51.279
And and this is what's the interesting part.
00:07:51.360 --> 00:07:57.759
Like, I wanted to ask, how did it feel when you saw the word program in there or this idea, the concept of program?
00:07:58.240 --> 00:08:11.199
I thought it was great because from a professional in the business, I already know that this is a three to five year moving the battleship most of the time.
00:08:12.000 --> 00:08:17.519
Hooking up a couple firewalls is a two-week professional services engagement at best.
00:08:18.240 --> 00:08:21.759
And nothing changes, but you get your rubber stamp.
00:08:22.079 --> 00:08:38.480
It is kind of interesting that Bill C8 goes after it better protect your business, whereas the Cyber Resilience Act says you better not put anything in your business that isn't safe.
00:08:38.799 --> 00:08:42.879
But you can hook it up wrong and do a crap job, but you're still good.
00:08:43.039 --> 00:08:43.360
Yeah.
00:08:43.840 --> 00:08:47.039
So there's a there's a balance there, right?
00:08:47.440 --> 00:08:57.600
What I liked about the approach that they've taken is they are complimentary, but what I liked about it is by creating this concept of a program, it takes away that compliance approach.
00:08:57.759 --> 00:08:59.440
And you and I have seen this on Tarquare.
00:08:59.679 --> 00:09:07.039
It's a new piece of regulation because there's a legislation, and all it someone turns into a checklist, you just got to work through, and now you're compliant.
00:09:07.279 --> 00:09:08.960
Great, we're compliant to the legislation.
00:09:09.120 --> 00:09:16.000
No, this actually forces you to really look at what's the risk that's facing your infrastructure, particularly for critical infrastructure.
00:09:16.159 --> 00:09:23.120
And it forces you to design a program, not a compliance check mark exercise, but an actual program to address it.
00:09:23.200 --> 00:09:27.519
And then eventually start reporting on it and then coming back with all the other things that are part of the act.
00:09:27.679 --> 00:09:33.440
So I think maybe legislation is starting to look at the value that it can bring to an organization.
00:09:33.600 --> 00:09:43.600
So instead of, you know, that punch list that we've seen with every other legislation that comes out, now they're forcing you to build a program and to follow a framework to put it into place.
00:09:44.320 --> 00:09:44.960
Yeah.
00:09:45.360 --> 00:09:54.960
And you write the one that works for you, but it this better not have been something you just cooked up with Chat GPT 20 minutes before I got here.
00:09:55.120 --> 00:09:55.360
Yeah.
00:09:55.519 --> 00:09:56.159
Yeah.
00:09:56.559 --> 00:09:57.919
Interesting segue.
00:09:58.080 --> 00:10:02.879
I was next thing on the list was the EU Artificial Intelligence Act.
00:10:03.279 --> 00:10:08.720
And this is weird because they're very separate acts over in Europe.
00:10:09.360 --> 00:10:26.240
And as far as I can tell, there isn't anything in Canada or North America that is specific to artificial intelligence, whereas the EU has something that is, it's actually right in the name.
00:10:27.279 --> 00:10:35.600
Apparently, the original version of Bill C8, which was Bill C27, did have an AI element to it.
00:10:35.840 --> 00:10:41.840
27 was supposed to be, then we had the election and it died.
00:10:42.000 --> 00:10:49.200
They reopened it, but only the critical infrastructure stuff seemed to make it in, and the AI sort of fell down.
00:10:50.159 --> 00:10:53.840
So maybe there'll be another one, maybe there won't.
00:10:54.159 --> 00:10:59.679
But the European ruling is very different.
00:11:00.720 --> 00:11:10.320
Certain countries are looking at it as a threat to human civilization, and others are looking at it as a commercial advantage.
00:11:10.559 --> 00:11:14.320
So which one's gonna say go, baby, go, right?
00:11:14.559 --> 00:11:17.519
And uh it's like we don't need any rules yet.
00:11:17.679 --> 00:11:20.559
It's like, okay, we'll see.
00:11:21.039 --> 00:11:21.840
We'll see.
00:11:22.080 --> 00:11:33.840
I think what they did is I kind of like, and and this is just you know, me, the, you know, coffee and risk guy, is they created that those four categories of risk, right?
00:11:34.000 --> 00:11:41.840
Like whether it's unacceptable risk or high risk or limited risk or minimal, but what they've given at least is a benchmark to start.
00:11:42.080 --> 00:11:50.720
And I think I think we really need we kind of need it to see that because it it sets the tone and the structure for what an organization has to focus on.
00:11:50.879 --> 00:12:03.840
So if you're bringing in an inordinately number high number of unacceptable risks and systems into your organization, you probably have some explaining to do or some understanding, or or perhaps you should look at different things to bring into your organization.
00:12:04.080 --> 00:12:18.240
But do you know what it did, at least for me, is it kind of brought this idea that I'm not gonna bring in a tool that's gonna expose my company to unacceptable risk, particularly if I'm in things like education or healthcare or pharma or banking.
00:12:18.480 --> 00:12:22.720
Those are systems, you know, we have 10 critical infrastructure systems here in Canada.
00:12:22.879 --> 00:12:30.240
Those types of systems reflected in Europe, you know, that's you know, that is one of the largest trading blocks on earth.
00:12:30.399 --> 00:12:43.919
And to finally now put in some level of risk identification that's codified as a law and forcing organizations that fall within that structure to at least look at these requirements and go, ah, crap, we've got a lot of unacceptable risk.
00:12:44.000 --> 00:12:45.360
We have to start dealing with that.
00:12:45.600 --> 00:12:50.000
And it's no longer something that a board or you know, executives or others can walk away from.
00:12:50.159 --> 00:12:52.240
You actually have to start doing shit to fix this.
00:12:52.480 --> 00:12:55.279
Well, they they went as far, you know.
00:12:55.440 --> 00:13:01.279
The minute I see the risk, the word risk, it's like, do you even know what the word means?
00:13:01.360 --> 00:13:03.039
So I I dug a little deeper.
00:13:03.120 --> 00:13:17.919
Yeah, yeah, but the European Artificial Intelligence Act actually prohibits the use of AI for work that's going to conflict with things that are laid out in their charter of rights.
00:13:18.399 --> 00:13:26.159
So you can't use it for separating people using biometrics, for example.
00:13:26.320 --> 00:13:39.120
You know, like uh you're not probably gonna be able, as much as it would, you know, an insurance company would love to know do you have the right genetics to make you not insurable?
00:13:39.679 --> 00:13:41.360
You're not allowed to do that.
00:13:41.519 --> 00:13:43.039
Yeah, to say, okay.
00:13:43.200 --> 00:13:43.919
Yeah, yeah.
00:13:44.159 --> 00:13:52.720
Now, how we'll know, how we'll even know that a company's doing that is gonna be problematic.
00:13:53.039 --> 00:14:13.039
But I think I think just drawing the line of saying certain things we're just gonna say no to, bottom line, yeah, yeah, and then high risk is where it gets interesting because, like you say, the medical stuff they they call out as high risk.
00:14:13.840 --> 00:14:22.159
But when I read uh the actual text, it said health sector diagnostics are supporting human decisions, not replacing them.
00:14:22.240 --> 00:14:23.600
Well, I thought, okay, good.
00:14:23.840 --> 00:14:24.720
Yeah, yeah, okay.
00:14:25.039 --> 00:14:26.240
But you know, all right, we'll see.
00:14:26.799 --> 00:14:29.039
How many lousy doctors are there out there?
00:14:29.120 --> 00:14:41.519
So maybe maybe I am okay with Chat GPT as a you know, as a practitioner, but it does say they need to be reliable and accurate.
00:14:41.679 --> 00:15:02.559
And when you look at the way other medical solutions are tested and evaluated with control groups and repeatable input and everything else, it sometimes takes years for a good idea to actually turn into a routine procedure.
00:15:02.960 --> 00:15:06.960
So that does feel directionally correct.
00:15:07.120 --> 00:15:12.960
Um, it yeah, it says should be reliable and accurate, not must.
00:15:13.120 --> 00:15:16.480
I'm not a lawyer, but that kind of sounds like a loophole.
00:15:16.639 --> 00:15:20.080
But yeah, it does sound like they get it.
00:15:20.240 --> 00:15:34.240
That and there were several, several different stanzas in that act that were going through at different different versions of what they meant by high risk for finance, for education, for everything else.
00:15:34.480 --> 00:15:40.159
And um, they even called out critical infrastructure in there as high risk.
00:15:40.240 --> 00:15:46.240
Yeah, but they were focused on the safety systems, not the cybersecurity components.
00:15:46.480 --> 00:15:53.600
So your firewall isn't necessarily high risk, but your fire suppression system is okay.
00:15:54.799 --> 00:15:59.279
It was anything that would disrupt the physical integrity of the control system.
00:15:59.679 --> 00:16:04.799
So I do think they got it right because they're looking at the outcome.
00:16:06.159 --> 00:16:18.559
You know, somebody breaks in through a bad account and shuts down your operation is not the same as they blew something up and people died.
00:16:20.000 --> 00:16:34.080
Well, and that's the difference, Doug, and I think you nailed it, is that I think part of that legislative focal point was on the human element because inside that same legislation they're making sure that there still needs to be a guarantee of human oversight.
00:16:34.559 --> 00:16:34.799
Right?
00:16:35.039 --> 00:16:43.120
What what whatever that happens to be, I don't know what they're gonna work on for that, plus this idea of a conformity assessment that has to be there as well.
00:16:43.360 --> 00:16:45.200
So I think I think you kind of nailed it.
00:16:45.279 --> 00:16:49.840
They're they're really looking at the far-end result of an impact to a human.
00:16:49.919 --> 00:17:02.399
And I think that's where I really like this, the idea of the safety element in advance of the security element, is the life safety of somebody, you know, in a foundry working by a furnace.
00:17:02.879 --> 00:17:09.440
We're concerned about that person being impacted by a potential explosion, and and that's identified.
00:17:09.599 --> 00:17:14.480
Versus do you have the right firewall in front of the furnace to make sure it doesn't get compromised?
00:17:14.720 --> 00:17:23.200
It's it's the the end result of a cascade of errors or cascade of events that could lead to that impact to the human.
00:17:23.359 --> 00:17:25.440
And I kind of like what they've done with it.
00:17:25.680 --> 00:17:29.759
But I mean, it's gonna be like I hate to say this, but it's gonna be kind of like GDPR.
00:17:29.920 --> 00:17:31.839
The first test is gonna be in the court.
00:17:32.079 --> 00:17:54.400
And then I think that's where we're gonna see some of the validity of this framework that the EU has put together, is that very first court case that's gonna challenge somebody because the the penalties for some of you know the inability to meet the requirements, like some of those prohibited violations, are just like 35 million pounds or uh euros or seven percent of your worldwide annual turnover.
00:17:54.720 --> 00:17:56.799
Holy that's bigger than the GDPR.
00:17:57.279 --> 00:18:00.400
Big enough to get your attention, even if you're a board member.
00:18:00.640 --> 00:18:08.160
Yeah, um, you're all working for free for the next two and a half years, tends to yeah.
00:18:08.400 --> 00:18:10.160
Bonus is what bonus, right?
00:18:10.240 --> 00:18:12.880
So, and I mean non just just general non-compliance.
00:18:13.039 --> 00:18:16.079
It's like a 15 million euro and a three percent of your worldwide.
00:18:16.240 --> 00:18:22.400
And it's like, Jesus, that's that's got some teeth, because that that enforcement mechanism, we've seen it, right?
00:18:22.480 --> 00:18:26.400
We actually saw it play out for GDPR complaints and how the enforcement worked.
00:18:26.640 --> 00:18:34.799
Here, this is this is going to be interesting, like a year from now, two years from now, this is where we're gonna see some of the fun come through with this piece of decision.
00:18:35.279 --> 00:18:48.640
The fact that they're they use the word output all over that play, all over that, and that's usually then that's usually where the trouble starts with generative AI is what's coming out of it, not what's going into it.
00:18:49.119 --> 00:18:50.640
Or people believing it.
00:18:50.720 --> 00:18:53.119
That's that's probably the bigger issue.
00:18:53.519 --> 00:18:54.480
Yeah, yeah.
00:18:55.359 --> 00:19:01.440
But it definitely looks like they tried to tier it so that the impacts are there.
00:19:02.319 --> 00:19:12.960
And they even went around or went in to say it doesn't meet a high risk threshold if it doesn't materially influence a decision.
00:19:13.359 --> 00:19:17.920
What I read a little further, uh, and these are dry documents.
00:19:18.079 --> 00:19:25.200
I I don't expect anybody to voluntarily pick up legislation and go, let me read what it says.
00:19:25.359 --> 00:19:30.640
You know, I I definitely skim and summarize, but all of this is public.
00:19:30.799 --> 00:19:36.400
You can go get it, and if you're responsible for this, you probably do need to do it.
00:19:36.640 --> 00:19:42.160
And you do need to read it, and that's why they call it a job, I guess, right?
00:19:42.640 --> 00:19:55.759
But it does say things like if you're dedupling data or trying to give it a very narrow scope, that that is a reasonable low-risk use of the technology.
00:19:56.319 --> 00:20:07.440
And it also goes on to say that if it's editing or reinterpreting work that a human already started, that it's considerably lower.
00:20:07.680 --> 00:20:22.240
So one of the things I've heard on a lot of podcasts around this is you treat AI like an intern and you keep a reasonable and ideally a qualified human in the middle.
00:20:23.200 --> 00:20:23.519
Yeah.
00:20:23.759 --> 00:20:27.359
Um, yeah, and you're gonna get below that high risk.
00:20:27.599 --> 00:20:34.799
And so I think just the fact that they're calling out, like you said, this has got to be tested in the courts.
00:20:35.039 --> 00:20:41.680
Was it a high risk or was it a low risk thing that you did with your AI as part of your business?
00:20:42.000 --> 00:20:45.119
Well, what's that benchmark?
00:20:45.279 --> 00:20:47.519
You know, was a human in there?
00:20:47.839 --> 00:20:53.519
Was it a pretty narrow scope, or did you say, we don't have any salespeople anymore?
00:20:53.680 --> 00:20:58.640
People just talk to chat bots, and whatever deal they can work out, that's the one we go with.
00:20:59.119 --> 00:21:09.839
Well, maybe tokens are cheaper than commissions, I don't know, but you know, we've heard stories of cars being offered for a dollar.
00:21:10.079 --> 00:21:15.519
The people responsible in the accounting department are gonna go, yeah, we're not we're not letting that pass.
00:21:15.599 --> 00:21:15.920
Yeah.
00:21:16.319 --> 00:21:23.839
So I think the I think it's gonna take a while for the legal side to catch up to this.
00:21:23.920 --> 00:21:29.119
And I think my concern is that that doesn't stop people from inventing.
00:21:29.200 --> 00:21:29.359
Yeah.
00:21:29.599 --> 00:21:33.599
There were three brand new model versions that released this week.
00:21:33.839 --> 00:21:34.799
Oh wow.
00:21:35.119 --> 00:21:37.759
Well, four, I guess, technically, because Meta had one too.
00:21:37.839 --> 00:21:46.160
I don't follow those guys as close, but yeah, Anthropic, OpenAI, and Google all released a a new updated thing.
00:21:46.559 --> 00:21:54.240
Do you know what bugs me too is that because in the past, being able to work through all of this with AI worked so well for us.
00:21:54.559 --> 00:21:55.039
Right.
00:21:55.519 --> 00:21:59.759
Jeez, because every company I know did a fantastic job of staying on top of it.
00:22:00.160 --> 00:22:05.759
It's you know, its ASM framework or its vulnerability management protocol and platform.
00:22:05.839 --> 00:22:08.000
Yeah, because we always patch whenever it came out.
00:22:08.319 --> 00:22:09.039
Seriously?
00:22:09.279 --> 00:22:13.599
Now I'm I'm actually asking you to do something even more complex.
00:22:14.319 --> 00:22:15.599
I mean, you just brought it up, Doug.
00:22:15.680 --> 00:22:17.200
It's you know, what an awesome point.
00:22:17.359 --> 00:22:20.240
I now have to validate the output from the brand new version.
00:22:20.880 --> 00:22:21.680
Holy shit.
00:22:21.759 --> 00:22:23.119
Like, did we think of that through?
00:22:23.200 --> 00:22:28.000
Because how often did we validate an update from a brand new app that we just launched?
00:22:28.160 --> 00:22:32.240
We were just worried about getting into the change cycle and making sure that it was updated and didn't break anything.
00:22:32.319 --> 00:22:33.920
Now we gotta go test output.
00:22:34.160 --> 00:22:34.720
Wow.
00:22:34.960 --> 00:22:35.279
Okay.
00:22:35.759 --> 00:22:40.240
Well, I maybe test beyond I can log in, which was usually oh good.
00:22:40.319 --> 00:22:41.039
Yeah, there we go.
00:22:41.279 --> 00:22:41.839
Yeah, yeah.
00:22:42.000 --> 00:22:44.480
Like yeah, I I can print and it works fine.
00:22:44.640 --> 00:22:45.200
Go, right?
00:22:45.279 --> 00:22:52.079
So now we actually figure out I'm gonna run another query, I'm gonna run another prompt, and it needs to come up with the same, if not better, response than we did last time.
00:22:52.319 --> 00:22:53.279
Jesus, really?
00:22:53.599 --> 00:22:54.319
Oh, okay.
00:22:54.799 --> 00:23:01.759
So every flow, every agent, every piece of you know, whatever you have on behind the scenes, we have to make sure we test.
00:23:01.920 --> 00:23:06.880
So that that concept, that iterative approach, that design thinking approach that we talk about a lot.
00:23:07.279 --> 00:23:08.640
Now we have to actually apply it.
00:23:08.880 --> 00:23:10.240
We actually have to do it now.
00:23:10.880 --> 00:23:20.799
I think it's gonna be a rude awakening for some companies that that thought they were gonna save money and this was gonna save their operation.
00:23:21.440 --> 00:23:22.640
Time will tell, right?
00:23:22.720 --> 00:23:25.039
Like the marketplace isn't sentimental.
00:23:25.200 --> 00:23:31.200
It'll some will win and some will lose, and we'll see, we'll see how it shakes out.
00:23:35.359 --> 00:23:38.880
I I think it's uh gonna be a real challenge in critical thinking.
00:23:38.960 --> 00:23:41.440
And you had mentioned Wynn's books as well.
00:23:41.680 --> 00:23:54.799
So I think we should include a link to that one again because that was the again, how to think through some of this stuff that we had never really got through before.
00:23:55.039 --> 00:24:23.599
So it's gonna be an interesting final quarter of the year because everybody wants to make money, but I'm thinking 2027 is gonna be even stranger because uh the wheels are starting to come off of some of these things financially, as well as you know, some of the technology is now showing that it's not exactly trustworthy.
00:24:24.000 --> 00:24:29.200
So I'm I'm very, very interested to see what'll happen.
00:24:29.440 --> 00:24:33.279
But now it's against the law not to think about that.
00:24:33.680 --> 00:24:38.240
So that should change how businesses approach this.
00:24:38.319 --> 00:24:41.119
So I mean the the YOLO days are over, I think.
00:24:41.359 --> 00:24:42.160
Yeah, I agreed.
00:24:42.319 --> 00:24:54.000
And this is I think this is one of the first times we've seen this approach where we're actually enforcing at a business level first what you need to have in place from a technical level second.
00:24:54.160 --> 00:24:59.519
And I'm yeah, this is going to be uh interesting to watch for the next 12, 18 months.
00:24:59.680 --> 00:25:00.160
Yeah.
00:25:00.400 --> 00:25:00.960
Yeah.
00:25:01.279 --> 00:25:04.160
Well, we'll be around to talk about it, God willing.
00:25:04.400 --> 00:25:04.960
There you go.
00:25:05.279 --> 00:25:07.920
Hey, next next season's coming around the corner, right?
00:25:08.000 --> 00:25:09.839
So yeah, awesome.
00:25:10.000 --> 00:25:10.319
Awesome.
00:25:10.480 --> 00:25:11.839
Well, we'll talk to you again soon, eh?
00:25:12.079 --> 00:25:12.880
You betcha.
00:25:20.880 --> 00:25:24.319
Thanks for listening to the latest podcast from Caffeinated Risk.
00:25:24.480 --> 00:25:29.519
Make sure you visit our website, CaffeinatedRisk.com, to stay up to date on what we've been working on.
00:25:29.759 --> 00:25:38.640
Our website has bios of our podcast guests, posts about topics we're passionate about, and even the library reference material we find valuable in the work we do every day.
00:25:38.880 --> 00:25:43.039
And don't forget to subscribe to Caffeinated Risk on your favorite podcast service.
00:25:43.200 --> 00:25:49.440
This way you'll be notified when we release our next podcast, and you can listen to our previous guests just in case you missed them.
00:25:49.599 --> 00:25:52.160
Thanks so much for listening to Caffeinated Risk.
