Trascrizione completa di Auditing AI

00:05:10.079 And one what can go wrong still is that they might not have the critical thinking about what kind of risks are involved when we use this kind of data in that model. 00:05:10.079 --> 00:05:14.639 When we did that, we looked at what data did they put in. 00:05:14.639 --> 00:05:22.639 And knowing that we work with a lot of personal data, we have uh immense amounts of data from our claims, for example. 00:05:22.639 --> 00:05:26.319 So we're all looking what kind of data did you put in there? 00:05:26.319 --> 00:05:28.879 Did you analyze the data first? 00:05:28.879 --> 00:05:35.360 Did you look for anything that was a deviation from the normal set that you didn't want to train it on? 00:05:35.360 --> 00:05:37.199 Did you clean the data? 00:05:37.199 --> 00:05:42.959 All these columns that you put in here, are they relevant for what the model is going to do? 00:05:42.959 --> 00:05:52.079 And does any of it contribute to any bias that we don't want or any discrimination that we don't want? 00:05:52.079 --> 00:05:54.639 Are we allowed to use this data for this? 00:05:54.639 --> 00:05:57.839 So these are the things that we are discussing. 00:05:57.839 --> 00:06:04.319 And that that was one of the key issues that we brought into these topics. 00:06:04.319 --> 00:06:12.160 And we have some government agencies who are working especially around discrimination or sustainability. 00:06:12.160 --> 00:06:18.800 They made a guide for what should you look for when you're looking for bias and discrimination. 00:06:18.800 --> 00:06:22.480 And that model from the government was really good. 00:06:22.480 --> 00:06:26.480 So we use that also as a guide to have these discussions. 00:06:26.480 --> 00:06:44.240 And what is really complex about when you build vectors on data is to understand, even though let's say that we can't discriminate on gender, even though if you don't put gender in it, we would still, with our data, have a possibility to separate gender from it. 00:06:44.240 --> 00:07:01.120 So it's basically finding these hidden patterns that the model will understand and will start to produce output, not because the model wants to discriminate, it doesn't have its own opinion, but from the data, it can actually turn out to discriminate on gender. 00:07:01.120 --> 00:07:15.360 So we are in insurance in Norway not allowed to discriminate on gender for car insurance, for example, which is a huge benefit for us men because we are really bad drivers compared to women, although we like to think differently. 00:07:15.360 --> 00:07:24.319 But the data shows that we have much more expensive claims than uh women, if we take the big numbers, and not me, of course. 00:07:24.319 --> 00:07:25.360 Makes sense. 00:07:25.360 --> 00:07:40.480 But then if you look at them, uh we have to take away the color of the cars, we have to take away some dimensions from the cars uh that to basically reduce the chance of uh this kind of discrimination. 00:07:40.480 --> 00:07:43.680 So this audit taught us a lot. 00:07:43.680 --> 00:07:53.920 So by delving deep into some complexity like this, made us much more able to go to the next audit where probably other audit functions would start. 00:07:53.920 --> 00:08:01.839 Other audit functions would probably start at the more easy thing, which would go for how do we live by the AI Act? 00:08:01.839 --> 00:08:08.000 How do we create policies and governing documents and roles and responsibilities around this? 00:08:08.000 --> 00:08:10.319 Which is also important. 00:08:10.319 --> 00:08:21.199 But when we audited this model, we built a company that was quite unique to be more relevant in the next audit that we did, which was the AI governance audit. 00:08:21.199 --> 00:08:29.680 Where we were looking more at the downside risks, where we were seeing: do we have the right security regulations in place? 00:08:29.680 --> 00:08:31.759 Do we have the right policies in place? 00:08:31.759 --> 00:08:44.159 The risk matrix, how we will govern it, the inventory system, uh, the roles and responsibilities, the awareness training that should be in place, all these kind of communication parts of it. 00:08:44.159 --> 00:08:49.120 So we could have more relevant discussions because we have this experience from before. 00:08:49.120 --> 00:08:52.080 Of course, we have been using Chat GPT, etc. 00:08:52.080 --> 00:08:55.679 So we are we're familiar with this. 00:08:56.080 --> 00:09:02.399 Your context here is insurance and probably making making prices and doing insurance things. 00:09:02.399 --> 00:09:11.039 You were probably one of the few companies in Norway that's actually made your own models, and you've been doing that's the core of your business, I guess. 00:09:11.039 --> 00:09:11.519 Yes. 00:09:11.519 --> 00:09:13.600 So this is nothing new for you in that sense. 00:09:13.600 --> 00:09:14.960 Is that is that correctly understood? 00:09:15.200 --> 00:09:15.759 That's correct. 00:09:15.759 --> 00:09:32.559 And where we came from earlier is that the way we build something called tariffs is a mathematical model where we are trying to calculate the risks based on our data that we have from earlier claims and other extra official data. 00:09:32.559 --> 00:09:40.639 And then we build a risk model called a tariff that will basically put data in and say this will then be the insurance premium. 00:09:40.639 --> 00:09:42.240 It's just statistics. 00:09:42.240 --> 00:09:49.759 It doesn't have the same problems that we have from the model machine learning models that we're using because they're so complex. 00:09:49.759 --> 00:09:54.879 These other models that we were using before, we could totally explain. 00:09:55.440 --> 00:10:02.480 So deterministic, non-deterministic is what you're talking about now, the models that you've been building and auditing. 00:10:02.480 --> 00:10:04.000 Do those hallucinate? 00:10:04.000 --> 00:10:08.159 Or am I because that's different from like one of these

frontier models, correct? 00:10:08.399 --> 00:10:17.759 Yeah, so basically what we are did with the machine learning model is that the chance of hallucinating is less because we know what data it was trained on. 00:10:17.759 --> 00:10:20.159 It doesn't contain any other data. 00:10:20.159 --> 00:10:26.559 So basically what it does is basically producing only numerical output for pricing. 00:10:26.559 --> 00:10:36.639 And this is also a thing that a lot of people are missing when they are choosing different AI solutions for different tasks is how do we make them explainable? 00:10:36.639 --> 00:10:41.679 How do you manage to build a model that you can explain? 00:10:41.679 --> 00:10:54.240 So our key concept of the audit of machine learning is that we contributed to making it more explainable and coming closer to what we call the glass box model. 00:10:54.240 --> 00:10:56.480 Can you explain that? 00:10:56.480 --> 00:10:57.360 How do you did that? 00:10:57.360 --> 00:11:20.960 Yeah, so the first phase of it that they did have in place was that they made the model to output to the customer service department or those who were uh going to talk to the customer, giving the I won't say the number of factors, but it's a uh set number of factors that contributed most to the decision. 00:11:20.960 --> 00:11:40.879 So the dangerous thing about implementing AI is that if you are implementing it in anything that affects the customer, and the customer calls back uh or something happened with a decision that they can't explain, you can't have someone sitting there, oh, it's just AI, I don't know what that machine is doing. 00:11:40.879 --> 00:11:43.919 That's gonna be ruining your company. 00:11:43.919 --> 00:11:45.440 So it's gonna be on Vega. 00:11:45.440 --> 00:11:46.159 Yeah, yeah. 00:11:46.159 --> 00:11:49.519 It's uh it's not where you want to end up. 00:11:49.519 --> 00:11:56.480 So we built this uh structure where it basically said that these are the factors that contributed most to that decision. 00:11:56.480 --> 00:12:01.759 Because there could be 1,000 factors, but the most prominent one. 00:12:01.759 --> 00:12:06.000 Once it's uh multiple, uh quite a few actually. 00:12:06.000 --> 00:12:12.480 And I think that's important to enable the customers to get an explanation that is understandable. 00:12:12.480 --> 00:12:14.639 That's one of the factors. 00:12:14.639 --> 00:12:29.840 Now, with the glass box model, we have a more open machine learning model uh that has been developed over time, and we're gonna go back and audit that one and then understand how that is so much more explainable now than it was before. 00:12:29.840 --> 00:12:33.840 So it's been multiple versions going through uh to improve it. 00:12:33.840 --> 00:12:42.320 But I think we were key in contributing to get those discussions in place and start that ball rolling. 00:12:42.320 --> 00:12:53.039 So I think we were recognized by the financial subvisory authorities as the one only one in

insurance so far at that time who had audited anything AI, which we were quite proud of. 00:12:53.360 --> 00:12:55.360 Awesome, all the work that you've done. 00:12:55.360 --> 00:12:59.200 Have you tried to audit one of the foundation models? 00:12:59.519 --> 00:13:01.039 I would say yes and no. 00:13:01.039 --> 00:13:12.000 So what you you can't is that uh let's say you take a Lama model or any other model that you find, GPT for all or chat uh RTX or whatever. 00:13:12.000 --> 00:13:19.679 You can't basically know what it's been trained on because it's a model that's been trained on a lot of data. 00:13:19.679 --> 00:13:25.200 And they can maybe tell you what it's been trained on, but it's still gonna be a guess. 00:13:25.200 --> 00:13:41.039 What you can do, of course, is that you can build a model when you train it on your own data and uh you basically start to use the model for your own data, you can build another model or build another system who's gonna uh test and ask questions for from it. 00:13:41.039 --> 00:13:46.320 You can also limit what kind of prompts that you can send to it. 00:13:46.320 --> 00:13:53.679 So you won't get that kind of uh can I make a bomb or what is uh this and this person's salary or something like that. 00:13:53.679 --> 00:14:02.480 So you can do templates for prompts, input, and then you can also do output prompts saying that these are what that model is supposed to do. 00:14:02.480 --> 00:14:04.559 So let's take an example. 00:14:04.559 --> 00:14:17.679 If we have a llama model and I'm training it for the cantina on how to make uh Indian food, then I can basically say that what you're gonna output is only things that have food ingredients in them. 00:14:17.679 --> 00:14:19.200 Nothing else. 00:14:19.200 --> 00:14:22.639 You will only answer it within this and this framework. 00:14:22.639 --> 00:14:28.000 Then you can start to limit hallucination or anything that a bad model can do. 00:14:28.000 --> 00:14:39.440 But you can also start to train it on a very diverse set of questions that you can do structured without AI asking it, to basically test it. 00:14:39.440 --> 00:14:46.159 And then you will uh see if you have a good enough training set, you will be able to try to find something. 00:14:46.159 --> 00:15:01.919 So, for example, if you want to test discrimination, you can test with a set of data that is fit for purpose, where you want to test for does it become a racist or does it do any decisions on gender or things that we don't want. 00:15:01.919 --> 00:15:07.519 And it's easy to create that data and just send it and see do we get different answers? 00:15:07.519 --> 00:15:09.440 Trying diverse sets. 00:15:09.440 --> 00:15:21.919 And the more advanced model is that you start to make an AI challenger model that will challenge the model and start to work with it and then see if it will deviate uh or give a bad output. 00:15:22.480 --> 00:15:25.120 You're at the very mature end of the scale. 00:15:25.120 --> 00:15:34.639 All the other companies that uh I feel like the the vast majority just started, they get started with this, and they're wondering where they should start on their governance journey. 00:15:34.639 --> 00:15:36.320 What would you tell them? 00:15:36.879 --> 00:15:40.720 There are two things that you really need to evaluate. 00:15:40.720 --> 00:15:45.200 One is the employee side of it, shadow AI. 00:15:45.200 --> 00:15:50.399 You don't want to have your data sent out to a public model. 00:15:50.399 --> 00:16:01.120 It's probably not going to happen anything, but it will still be a breach, compliance breach, uh sending data where you're not supposed to send data, especially from a privacy perspective. 00:16:01.120 --> 00:16:12.000 You should as fast as possible try to evaluate uh some models that are generative, give them to your uh employees and make rules. 00:16:12.000 --> 00:16:17.679 Then you mean need to create those boundaries, making awareness, uh, what can we use the different models for? 00:16:17.679 --> 00:16:20.559 Is it okay to use an external model or not, etc.? 00:16:20.559 --> 00:16:23.120 And then you need to monitor it for it. 00:16:23.120 --> 00:16:32.559 So what we did, we did a shadow AI audit, and to make it simple what we did, uh, because we're mostly talking to security people, right? 00:16:32.960 --> 00:16:35.679 I'd be very surprised if anybody else was listening to this. 00:16:35.679 --> 00:16:36.480 But they're welcome. 00:16:36.480 --> 00:16:38.240 I'm listening to your podcast. 00:16:38.559 --> 00:16:43.120 So um what we did was basically ask for the proxy server logs. 00:16:43.120 --> 00:16:52.559 And we got a lot of data out from there, and then we were looking for traces of are they using NODNL and external models that are the most common ones. 00:16:52.559 --> 00:16:55.200 We didn't look for everything, it was like the big ones. 00:16:55.200 --> 00:16:59.440 This this is uh two years ago now, I think. 00:16:59.440 --> 00:17:00.559 Uh I don't remember. 00:17:00.559 --> 00:17:02.639 It's uh a long time ago in my world. 00:17:02.639 --> 00:17:04.400 It's time flies when you're having fun. 00:17:04.400 --> 00:17:14.880 We found out that uh how much data is coming in, which is not that interesting, but we could see usage coming in, then but we were also looking at how much data is going out. 00:17:14.880 --> 00:17:20.720 And if you look at how much data going out, one prompt on text is very little data. 00:17:20.720 --> 00:17:23.680 Sending documents, you will see the difference. 00:17:23.680 --> 00:17:25.759 And then we use it for awareness. 00:17:25.759 --> 00:17:30.799 We see which kind of uh employees and which departments are using it. 00:17:30.799 --> 00:17:36.799 And we in internal audit are allowed to do these things because internal audit can combine data sources that no one else can. 00:17:36.799 --> 00:17:41.440 And we also have strict confidentiality uh requirements to our department. 00:17:41.440

--> 00:17:46.640 So we were using it to create awareness for management and saying that we know it's gonna be being used. 00:17:46.640 --> 00:17:51.200 We know in those departments, you need to talk about awareness. 00:17:51.200 --> 00:17:53.279 What can we use for what purpose? 00:17:53.279 --> 00:17:57.279 So we didn't go after persons in this audit. 00:17:57.279 --> 00:17:59.279 So that is one aspect. 00:17:59.279 --> 00:18:03.519 I think enable your employees, otherwise, they will use something else. 00:18:03.519 --> 00:18:10.400 And then from a company perspective, is do the evaluation about can we use AI? 00:18:10.400 --> 00:18:12.720 Uh would it be useful for us? 00:18:12.720 --> 00:18:18.880 And then in order to ask us questions, you need to understand what AI is and what AI isn't. 00:18:18.880 --> 00:18:32.480 All these people who are used to saying no, legal, compliance, risk, also internal, some internal audit functions, who are afraid because they don't understand it, build competence there as well. 00:18:32.480 --> 00:18:39.839 And one thing I think is also important when you're building this competence is that you also need to build cloud confidence. 00:18:39.839 --> 00:18:58.079 Because if you don't know what an enterprise boundary is and these normal cloud structures, what is in within a subscription, what is in a personal boundary, and how these cloud structures work, then you're also gonna fail about what is dangerous and not. 00:18:58.079 --> 00:19:02.799 If you build that confidence, then you can start to work with the right choices. 00:19:02.799 --> 00:19:06.640 Where will we have the most effect from AI? 00:19:06.640 --> 00:19:18.160 Because if you just start random, like uh working with AI here and there, it's gonna be a limited set of people who can actually make those AI solutions. 00:19:18.160 --> 00:19:22.400 So, how do you use those to create the most effect for the company? 00:19:22.400 --> 00:19:25.279 That's a strategic decision. 00:19:25.279 --> 00:19:43.680 So, what we built in our company, we built a unit who will attract the best competence and do that strategic enabler work on what which processes are gonna get priority with these resources first, where it's gonna have effect. 00:19:43.680 --> 00:19:44.799 Cool. 00:19:44.799 --> 00:20:00.720 But you also need to enable these small tasks when you're mature enough, then when you are gonna build co-pilot agents with uh co-pilot studio, for example, which is a system you can just buy if you have Azure, for example. 00:20:00.720 --> 00:20:02.559 There are different other solutions. 00:20:02.559 --> 00:20:10.400 Those agents can solve small business problems or big business problems. 00:20:10.400 --> 00:20:20.400 So basically enabling that to also get people to work on this, given that they have competence to ask themselves the right questions. 00:20:20.400 --> 00:20:24.000 Can I use this data for that task? 00:20:24.000 --> 00:20:26.000 Is it kind of fit for purpose? 00:20:26.000 --> 00:20:27.200 Is it legal? 00:20:27.200 --> 00:20:29.599 Which is one important question. 00:20:29.599 --> 00:20:32.160 Uh, can we trust it to make that decision? 00:20:32.160 --> 00:20:52.480 So the way we uh made that is that we made an AI governance system that is built in ServiceNow, where basically when you start to ask yourself these questions, you are getting a guide to what is the typical questions you want to ask yourselves when you are handling personal data. 00:20:52.480 --> 00:21:00.400 What is the simple questions you should ask when you are working on customer closed processes, which are things that you need to build. 00:21:00.400 --> 00:21:19.839 So make governance relevant for your company, for your data, for what is the most dangerous things you could do with AI, which are you say this is not legal, you can't put AI in there unless you talk to these people and we really make uh a group management decision on it, for example. 00:21:19.839 --> 00:21:24.640 So you have to get all this concept in place to make the right decisions. 00:21:25.359 --> 00:21:31.519 If you don't mind me asking, if you're allowed to share, which teams won those early resources in the beginning. 00:21:32.000 --> 00:21:35.920 What we've seen is that they're using it in HR. 00:21:35.920 --> 00:21:39.200 And now you're thinking, oh, that's the dangerous part. 00:21:39.200 --> 00:21:40.960 We're not using it in recruiting. 00:21:40.960 --> 00:21:46.559 Because that's the big no no that if you're using that to automatically hire people, then you're gonna fail. 00:21:46.559 --> 00:21:48.319 That's prohibited. 00:21:48.319 --> 00:21:51.279 But we use it for the personal handbook. 00:21:51.279 --> 00:21:54.240 And it's it's it's really efficient. 00:21:54.240 --> 00:21:59.759 Um we use it for the customer advisors, you're getting a tool to say. 00:21:59.759 --> 00:22:05.279 Say this customer is asking this what are the rules for selling these kind of products? 00:22:05.279 --> 00:22:08.960 So we have a lot of rules for all the insurance products that we're gonna sell. 00:22:08.960 --> 00:22:11.519 You should ask these and these questions. 00:22:11.519 --> 00:22:17.440 So it's much more efficient for the case handlers to just ask in the model. 00:22:17.440 --> 00:22:24.640 And now we are putting it closer to the core processes. 00:22:24.640 --> 00:22:34.720 So I think we were forward-leaning in some cases, and I'm kind of the impatient auditor, so I would uh I want it to go faster. 00:22:34.720 --> 00:22:46.640 So we are not we're starting just now to put it directly into our core processing uh of insurance, especially claims, where it will have an effect. 00:22:46.640 --> 00:22:55.440 Because if you put it right into your production systems where you have the most people working, you can improve the quality. 00:22:55.440 --> 00:23:02.160 So we see that the quality is improving compared to manual handling, and the speed is improving.

00:23:02.160 --> 00:23:07.839 And then you can use your competence and the best people to handle the most complex cases. 00:23:07.839 --> 00:23:11.359 So this is where we are getting traction now. 00:23:11.359 --> 00:23:21.680 And it's uh I go to this insurer tech conference every year, and in the Nordics, we are we have a high degree of automation compared to the rest of Europe. 00:23:21.680 --> 00:23:26.319 So when I went to this uh in earlier years, I was thinking, oh, we are so far ahead. 00:23:26.319 --> 00:23:32.799 They're still doing manual pricing and they still have like branches all over and have manual handling for a lot of things. 00:23:32.799 --> 00:23:40.880 And then I came back a few years ago and then I saw like the big European players are putting AI straight into the core processes. 00:23:40.880 --> 00:23:46.400 And these are big major players who are getting real effects from it. 00:23:46.400 --> 00:23:52.960 And not just production cost saving effects or efficiency effects, but quality effects. 00:23:52.960 --> 00:23:54.880 They can handle so much more data. 00:23:54.880 --> 00:23:57.839 So they put it into data-heavy solutions. 00:23:57.839 --> 00:24:01.359 So in some claims, you have to deliver a lot of documentation. 00:24:01.359 --> 00:24:09.119 Just the evaluation or classification of those things, a machine can do much faster and with much higher quality. 00:24:10.640 --> 00:24:14.480 So far, the use cases have been using generative AI. 00:24:14.480 --> 00:24:16.640 Have you moved to the more agentic? 00:24:16.640 --> 00:24:20.799 You know, they talk about this agency AI where things are actually going and doing things by themselves. 00:24:20.799 --> 00:24:23.119 Have you gotten there yet? 00:24:23.119 --> 00:24:25.680 And if you haven't, why not? 00:24:26.000 --> 00:24:44.000 I think we think we have enough use cases now with machine learning and with the AI solution that are going in advisory to enabling our employees, which are in directly into the profession, and with the automation area of it. 00:24:44.000 --> 00:25:01.039 Agentic, uh, I think uh we are building agents, but we will look at it this year to see what they're doing because I don't know everything the company is doing, because we have a lot of analytics people, because insurance is all about analytics. 00:25:01.039 --> 00:25:05.359 And these people are also the ones who are adept at building solutions. 00:25:05.359 --> 00:25:19.680 So we can probably see maybe there are some agents that talk to each other that we are doing workflow and task handling between agents, but we haven't seen that in the seed yet because we are have this on this year's audit lab to look through this. 00:25:19.680 --> 00:25:22.880 But I see that there are coming Azure tools that can help us. 00:25:22.880 --> 00:25:25.119 So we can look for MCP traffic. 00:25:25.119 --> 00:25:29.440 Uh MCP is the communication protocol between AI agents. 00:25:29.440 --> 00:25:35.680 They have a

security agent that can automatically detect MCP traffic in your subscription. 00:25:35.680 --> 00:25:44.079 So these things that we will look for to automate more to find where these things come into our environment. 00:25:44.559 --> 00:25:48.240 Do you think that whole agentec AI thing is just overhyped then? 00:25:48.559 --> 00:25:48.880 No. 00:25:48.880 --> 00:25:50.559 Not at all. 00:25:50.559 --> 00:26:07.039 One of the things that we can do is to build narrow AI solutions who can handle specific tasks and are just good at that, which will also reduce the risk compared to big generic models. 00:26:07.039 --> 00:26:27.920 So I think it's a possibility for us to have more control if you compare it to microservices kind of uh architectures, that we can build more structured, narrow solutions that have more explainability, more narrow solutions that function as agents that are going to talk to each other based on tasks that they're gonna do. 00:26:27.920 --> 00:26:36.480 So I think it's gonna be more of the future in how we should design things from an architectural perspective and risk perspective. 00:26:36.880 --> 00:26:40.480 So a mature AI governance program. 00:26:40.480 --> 00:26:50.000 Do you have any tips for like where to start and how do you like operationalize it in practice just based on your two years of doing it? 00:26:50.400 --> 00:26:53.599 So don't build an AI governance just on the side. 00:26:53.599 --> 00:26:55.839 Integrate it with what you've always been doing. 00:26:55.839 --> 00:27:10.079 So most of us have an STLC process, we have a procurement process, we have a risk management process, we have a governing structure for how we handle privacy, integrated into those structures. 00:27:11.279 --> 00:27:11.920 Hmm. 00:27:11.920 --> 00:27:22.799 I was thinking it makes sense that you own this process in your organization because the audit function is holy, like the board hired you and the CEO, which is that's crazy. 00:27:22.799 --> 00:27:23.680 It makes sense though. 00:27:23.680 --> 00:27:28.000 What about for companies that don't have a really strong compliance or audit function? 00:27:28.000 --> 00:27:34.640 Because you're an insurance, like you they'll take away your license or whatever if you don't adhere to these things, but most companies don't have that. 00:27:35.039 --> 00:27:38.559 No, so basically uh they don't need that either. 00:27:38.559 --> 00:27:42.720 It's it's gonna be helpful on the journey if you have the right people in those functions. 00:27:42.720 --> 00:27:48.400 Uh so we hired a person to be the AI risk officer. 00:27:48.400 --> 00:27:55.680 He's in first line, he's not in second line or third line, he's helping guide those decisions. 00:27:55.680 --> 00:28:04.240 So if you build that competence in one per one or more persons, who's gonna help ask the right questions when people are starting to work with this? 00:28:04.240 --> 00:28:08.000 I think that is one of the key enablers that you need to have in place. 00:28:08.000 --> 00:28:14.240 He's organized in one of our most sensitive areas where we're using most data. 00:28:14.240 --> 00:28:22.079 But he's also going across division or department, so he can go anywhere because he has a company role. 00:28:22.079 --> 00:28:36.240 So if you don't have a compliance function or anything, hire one who's gonna be lead on AI risk things, security things, or competence in what AI is and what it isn't. 00:28:36.240 --> 00:28:45.200 And that person can help you build the training program, the awareness program, help building how we ask the right questions in our governing documents. 00:28:45.200 --> 00:28:56.960 Because what I hate about governing documents, if you don't make them pragmatic about context sense relevant for your business, it's just generic theoretical stuff, then it's not gonna work. 00:28:56.960 --> 00:29:02.880 You have to make how do we ask the right AI questions for the business that we are in. 00:29:02.880 --> 00:29:10.640 So get someone to work with it because this is gonna take time if you're gonna really enable AI in your company. 00:29:11.279 --> 00:29:13.039 Last question could be a fun one. 00:29:13.039 --> 00:29:15.119 You still do cyber insurance, correct? 00:29:15.119 --> 00:29:17.200 We do cyber insurance, yeah. 00:29:17.200 --> 00:29:22.480 I've read that certain providers are excluding AI systems from their coverage. 00:29:22.480 --> 00:29:24.319 What's your take on that? 00:29:25.200 --> 00:29:27.440 I think that's gonna mature over time. 00:29:27.440 --> 00:29:38.640 What they are really afraid of now is that companies are putting big language models into customer-facing services without knowing what they do. 00:29:38.640 --> 00:29:51.039 So I think in order for this to mature, then they need to also, from an insurer's perspective, they need to set more strict requirements about what kind of governance can you need to have in place. 00:29:51.039 --> 00:29:52.000 So I don't know. 00:29:52.000 --> 00:29:57.440 I like to say that cyber insurance makes the world better if you try to buy it. 00:29:57.440 --> 00:30:06.720 Because if you try to buy it, then you will look, uh then you will understand more about what uh you're expected to do as a company. 00:30:06.720 --> 00:30:09.359 Because there's a lot of requirements in it. 00:30:09.359 --> 00:30:15.359 So if you start to think about this, this will automatically start to improve if you actually do something about it. 00:30:15.359 --> 00:30:20.079 Because you will have to do a lot before you buy uh cyber insurance. 00:30:20.079 --> 00:30:24.319 The same will apply to AI insurance when it's matures. 00:30:24.319 --> 00:30:39.039 The best way you can prepare the things we talked about earlier about getting the right governance in place, asking the right questions, uh starting maturingness, working structured with it, will help you when you want to buy insurance. 00:30:39.759 --> 00:30:41.039 It's kind of crazy, right?

00:30:41.039 --> 00:30:47.759 That there hasn't been any big newsworthy attacks coming from AI systems lately. 00:30:47.759 --> 00:30:49.279 I thought there'd be more by now. 00:30:49.519 --> 00:30:53.440 Yeah, it's the recent attack that was before the weekend, where they get all the prompts. 00:30:53.440 --> 00:31:02.400 It's a small narrow uh AI solution built for uh anime manga things where you want to create comics or uh figures. 00:31:02.400 --> 00:31:05.039 And who knows what they've used that for. 00:31:05.039 --> 00:31:06.799 Oh no. 00:31:06.799 --> 00:31:14.720 It's uh so basically if you combine the prompts with the person, you can basically do extortion. 00:31:14.720 --> 00:31:16.319 Yeah, that's horrible. 00:31:16.319 --> 00:31:18.559 No, but you have horrible incidents. 00:31:18.559 --> 00:31:20.079 So you have the Dutch case. 00:31:20.079 --> 00:31:36.400 Whenever I talk about it, I get tears in my eyes, where they put AI solutions direct on uh some of the most vulnerable people in society on welfare and support, basically for people who need welfare tickets or payments. 00:31:36.400 --> 00:31:43.119 And they automated decisions where they were looking for fraud and they stopped welfare payments. 00:31:43.119 --> 00:31:49.839 People lost uh right to be with their children, people lost their house. 00:31:49.839 --> 00:31:55.359 The people who worked in the welfare department could not answer why the payments were stopped. 00:31:55.359 --> 00:31:57.039 So what everything went wrong? 00:31:57.039 --> 00:31:58.559 It's a terrible case. 00:31:58.559 --> 00:32:01.519 And this is about terrible wrong competence. 00:32:01.519 --> 00:32:04.720 And if you think about security, what it really means. 00:32:04.720 --> 00:32:13.119 Security is not only about attacks, it's about how you create systems that have integrity availability as well. 00:32:13.119 --> 00:32:21.200 And I think these things, integrity, is key to AI, that you can actually do the right thing with the right data. 00:32:21.200 --> 00:32:27.440 This is where this is kind of an employee error where someone put AI on the wrong solution. 00:32:27.440 --> 00:32:32.160 So a lot of things are happening where you put AI on the wrong tasks. 00:32:32.160 --> 00:32:42.240 And that's so you had the Trump administration doing it on veterans, uh, also trying to find fraud, and that model was not built for finding that. 00:32:42.240 --> 00:32:44.160 It's it's just horrible. 00:32:44.160 --> 00:32:51.839 Imagine uh how many companies are rolling out things because they're stressed about if we're not in the AI game, we're not relevant. 00:32:51.839 --> 00:32:54.319 And I'll leave one end note. 00:32:54.319 --> 00:32:55.680 I'm talking a lot now. 00:32:55.680 --> 00:33:03.039 But if you look at all the SaaS solutions that you're buying, all the solutions that you have, the cloud solutions, AI is coming from the side. 00:33:03.039 --> 00:33:12.240 So you need to know that suddenly AI is doing something to your data because in the last update that just happened, suddenly an AI solution was in there. 00:33:12.240 --> 00:33:18.319 Because now, if you work in tech and Linux software, you're not relevant if you don't have something AI. 00:33:18.319 --> 00:33:20.319 So that's a it's a huge pressure. 00:33:20.319 --> 00:33:23.119 So there's gonna be a lot of mistakes. 00:33:23.759 --> 00:33:29.519 Well, Gaute, thank you so much for your time today and for showing your expertise and for making audit sexy again. 00:33:29.519 --> 00:33:31.279 I never knew that you had so much fun at work. 00:33:31.279 --> 00:33:33.200 No, it's it's a lot of fun. 00:33:34.079 --> 00:33:37.279 So, thank you for so much for uh inviting me. 00:33:37.279 --> 00:33:41.359 It's a learning experience to just uh communicate this to others. 00:33:41.359 --> 00:33:43.359 The honor and pleasure is all mine. 00:33:43.440 --> 00:33:44.319 Thank you so much, Gaute. 00:33:44.319 --> 00:33:44.559 Take care. 00:33:44.559 --> 00:33:45.039 See you. 00:33:45.039 --> 00:33:45.839 Take care. 00:33:45.839 --> 00:33:48.720 Well, that's all for today, folks. 00:33:48.720 --> 00:33:51.519 Thank you for tuning in to the mnemonic security oodcast. 00:33:51.519 --> 00:34:00.960 If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcast at mnemonic.no. 00:34:00.960 --> 00:34:04.400 Thank you for listening, and we'll see you next time.