speaker-0: I think that anyone can argue seriously against the following observation. There has been a lot of content being now published and comments and posts, which I fully agenated. just copy-basing whatever comes out of ChessGBT or whatever, without ever thinking of like how that looks like. So it's a good signal to delete. even not just to block them, but if somebody is commenting under your post and you see that it's clearly AI generated without any edit value, my preference would be to delete content as well for other people to not receive this in their feed. If I can control this, at least a little bit for my viewers, for my subscribers. I want to do as much as possible as I can do. This is just all noise.
speaker-1: Alexander, find it very bold when you say you not only block people, but even remove the comments from your posts. Alexander, welcome to the Core Impact Podcast. I'm excited to have you here. Today, as we said, we're going to talk about AI governance, adoption, ethics, responsible AI regulations, and we're going to talk about how AI is shaping our future of work. Before we dive deep into these topics, I just want to know in general before we talk about the regulations, when does Governance become too much because there are many companies that are already overwhelmed with so many other regulations and now it's coming with AI, have new regulations. Why do we have the need? Can we start from here? Can explain what is the purpose of it?
speaker-0: mean, it all depends on what normally, at least in democratic societies, what the people want and what they prefer. And through their representatives, they usually express their wishes towards a more, let's say, permissive regime, economically speaking, politically speaking, legally speaking, where they let more freedom to the companies to expand and prioritize really economic development. Some companies do that or some countries prefer that approach like United States, for example. And you can have other countries or even country blocks like the European Union where we prioritize prosperity and human rights. We do not necessarily value. per se, economic expansion and things like that. So we have pretty much settled on the common understanding that what our priorities are in Europe, plus or minus, right? So more or less. And it's obviously very different from what the American people have settled on. And there are no incorrect choices here. It's very nice that... On this earth, we have such a variety of choices which people are making towards like whether prioritizing, for example, welfare and fairness and justice, which requires legislation and imposing requirements on economic operators more than if you were to follow strictly the focus on economic prosperity and expansion, in which case you would necessarily downplaying the importance of human rights, you will give less protections to people, but you will at the same time help your private sector grow and compete on the global stage. So there are no wrong choices. There are just preferences here and Europe tends to prefer to maintain the already achieved high level of protections.
speaker-1: So the purpose, if we say it in one sentence, is the protection of people and their data privacy. This is the main purpose.
speaker-0: ⁓ This is just a very narrow example. We can speak about consumer safety more broadly, human rights more broadly. And this would present itself in the way of how we have product safety laws. For example, the newest kind we've got recently on AI, with the act as part of European broader product safety law. It's just one example. which has become recently more like, ⁓ received more spotlight recently, but, ⁓ it's just a good old product safety legislation adapting to the new realities and new hazards, new risk factors. So nothing new under the sun, just adaptation of, ⁓ the already existing concepts and data privacy just, ⁓ you know, one of, ⁓ the. aspects of fundamental rights protections that we care about in Europe. So this is just one narrow example, I would say.
speaker-1: Alexander, since we started already now with the EU AI Act, this is one of the things that you are teaching, you are making courses here, who are the people who should come to you and learn from you?
speaker-0: There are different kinds of people who are visiting, attending my courses. They tend to be more on the side of like governance risk and compliance professionals. The majority of the public. Occasionally there are some business leaders as well, up to the vice president level. I used to have like even on my retail course. So. The way I do the courses, for example, on the Act is I usually have this one prepared structure and content, but I can also customize it to... address the needs of corporate clients. So sometimes they ask me to deliver a specialized, a tailored version where they will have a different mix perhaps of audiences, right? So depending on that, can adapt. But the people who attend my retail courses, said they are mostly... Governance, risk and compliance people, senior, at the senior level, senior contributor level, would say, managers. Although, as I said, usually there is a mix and, you know, but from the things, the things which I've been doing through years, all those things, required, you know, a good translation skill, meaning ⁓ inter-domain translation. from, you know, complex legal topics to... ⁓ how this translates into business impact, business requirements, business policies, procedures, right? So, and also technical because for the last 10 years, I think I've been mostly focused on digital policy and technology projects. So without ⁓ the... ability to translate in between the legal domain, the technology domain and the business domain, I would not be successful in the roles that I was involved in.
speaker-1: If you are excited to dive deeper into AI governance, EU AI Act and responsible AI adoption, Alexander is offering courses that you can check out. You can use the code coreimpact to get 10 % off when booking. The details are in the description. Now let's come back to the conversation and let's talk here about the challenges since you mentioned it. What are the biggest challenges when connecting between tech, legal and business domains?
speaker-0: ⁓ I mean, there is plenty ⁓ besides this translation aspect, right? Because I think this is what fascinates me the most is that I have this tendency, especially for those who are more focused on visualizing the content they want to intake and... I think I'm very good at doing quite simple but impactful visuals. And one of those was, by the way, in the wake of the chat GPT popularity, like when it came out in 2022, November, right? The public version made available. And somewhere at the beginning of 2023, when the initial like... experimentation has already started with many people, myself included. We tried to understand like what was the utility of those tools and what are the limitations and the appropriate ways of ⁓ using them. And so I made this very succinct graphic and it suddenly received a lot of attention and a lot of understanding and uptake and across different channels actually. My usual delivery channel for my content is LinkedIn, right? So I do a lot of posting there, newsletters and things like that. And when I just came up with this graphic and I explained basically in that graphic, so the criteria you need to meet to use a tool such as ChatGPT, right? Without being sorry about that in the long term and, ⁓ you know, I have made certain, you know, a decision flow or, know, decision tree, can call it. And the killer elements were being competent to, for example, to tell if, ⁓ what you are preparing with your tool is truthful or not. Right. So apart from the situation, whether you don't care, like you are doing some science fiction or whatever, right. So where you don't really care what the tool delivers and. might not be factual. So we set this ⁓ specific domain of artistic assistance aside. If we are talking about domains where factuality is critical, then actually to be able to properly use the outputs of those kinds of tools like ChargeGPD, you must be yourself as domain expert. You are just a lay person who is using the tools and relies on it. but has no way of telling whether the result is correct or not, then you are setting yourself for failure down the road because you are not an expert. You will not be able to tell if the result is ⁓ useful and good. It may appear because the systems like that were trained to produce plausibly sounding text, right? So this is their goal, but factuality has nothing to do with it. So without being a subject meta expert first, and then without your ability and desire to take on full responsibility for the output, you should not be using those tools at all. Because if you are not a subject meta expert and you're not ready,
speaker-1: right?
speaker-0: to sign, you know, the dotted line that you, you know, accept any kind of ethical, legal and other, you know, outcome which may come out of you using that in the wider world, that output, and you should not be using it in the first place. So this leaves us with a huge gap between what people actually use those tools for and what they can safely, you know, limit they use to, right? So, because usually this is not how people understand the way they can use the tools, right? So, because also they have this tendency to over rely on the new systems because they appear to them like something magical, something not comparable to older, like actually more reliable systems which does not operate on in the public. in a probabilistic manner, right? So if they always would be reaching the same results. So people who started using computers in the seventies or something on the eighties, they may have a false equivalence in their head, right? In terms of trustworthiness and accuracy, right? So they got used to that fact that computer is never wrong. And in a strict technical sense, like, you know, those tools which we did use, were just arriving at the result depending on what input data we feed and what the algorithm was. And there was not such a thing as a classical, there was not such a thing which then relied on some probability, right? And what we now have, like the majority of ASS, which we now have, they all rely on probability. So even in the definitions, if you look into the ISO standard on key concepts around AI, machine learning, ISO 22989 standard. it even in one of the nodes for sub-symbolic AI, which is ⁓ narrow, you know, scientific term for what the systems are currently, which we are using sub-symbolic AI. In the node, the definition is just like that. The whole thing with those systems that they produce to result with a specified degree of error. There is always a degree of error. So this is just by definition how they work. They cannot operate with a hundred percent error free probability. This is inherently not possible. And depending on the domain where you use them, level of accuracy, if it's 95 or... 99.999, even that result sometimes will not be sufficient, especially if we are using them in kind of a loop ⁓ or in the kind of a... As it's now beginning more, like becoming more and more popular to use those kinds of systems in an agentic manner. where they execute the workflow, right? So, and if you get a certain specific level of error at each step, And then the errors will accumulate at the end. Right? So the majority of people don't even understand this. Right? So I'm a huge fan of technology. There's specific technology as well. But I tend to be always ⁓ on the critical thinking side, skeptical side in assessing like any claims which are made by the providers, by the developers. Right? So. I tried to check for myself, I tried to see what the scientists say about the aspects, how these tools are useful, how they are not useful and so on. This is my idea. This is what I wanted to deliver also with this graphic, which was so successful. I'm still receiving from time to time, even if it was in 2023. So after three years, I'm still receiving ⁓ occasional requests for permission to reproduce. though I published this graphic about this ChudGPT, you know, use under the creative commons license, like only reference was required. People still at least like at least those old school people who know what is like academic integrity and things like that. They still ask for permission, you know.
speaker-1: See, Alexander, I didn't want to interrupt you, but you touched on four questions that I wanted to ask you. So I'm going to come back to one by one. So let's start by talking about the EU AI Act and say, if you want to summarize it in a simple way, what is it? And also tell me what are the things that companies usually mostly either don't understand or struggle with understanding.
speaker-0: Speaking of the act, the most important thing which most readers do not understand is the fact which I am raising again and again. It's a product safety law, right? So people see it as some kind of a new regulation which was not based on anything in existence before. something out of the ordinary. Very few people actually do understand that grounding, that the EU Act is a part of the broader EU product safety legislation. We have this kind of a horizontal framework for specific technology, which does not prescribe how you must build your systems, right? So there is no prescriptive way of like... specifying what you must do exactly. There are only objectives. there are policy objectives. So we call them essential requirements for products. So what requirements must be met if your product were to enter the European market. And they are not for all AI systems. They are only for certain categories like... High-risk AI systems, they have ⁓ specific requirements as regards to their quality, different aspects of it. This is the main thing. Like we have in the Act, we have the essential requirements for high-risk AI systems. So before they are placed on the market or put into service in Europe, they must comply with certain requirements, expectations, let's say. Right? So, but the law does not say like how you arrive at the meeting those expectations. And one of those, like for example, to have a risk management system in place for the organization to assess specific hazards which may be relevant for the system you are building. So for each system, it may be a different set of hazards which are relevant. So for example, if you're building a facial recognition system, right? So it's a high risk system if you're used in, for example, remote biometrics settings. where it's permissible, but you must have ⁓ certain requirements met. And I must meet certain requirements. And in which case you are, for example, assessing what are the potential hazards for people who are being subjected, affected persons who are being subjected to the use of systems, right? So, and you try to identify what those hazards are for their, for example, fundamental rights. And then you try to identify as far as your risk management process, how you can evaluate what is the probability, what is the severity of the risk, right? To fundamental rights, for example. To what rights exactly, right? So is it, for example, right to... I don't know, a liberty or something like that. So it depends on the use case, right? So, and then you need to assess if the degree of the level of risk is, the probability are such as that overall the assessment is that it's acceptable as regards to like the level of protections has been achieved in Europe. So we do not benchmark against totalitarian regimes or something. We benchmark against our own very high level of protections. if we ⁓ think that this technology is foreseen to be used, like is going to influence material like the level of protections, we need to mitigate, provide mitigations. ⁓ And as a result, the idea is to reduce this risk overall to an acceptable level before they place the product on the market. And there are different other requirements, for example, to data quality for those systems, technical documentation, human oversight, cybersecurity, overall accuracy and resilience, robustness. things like that for high risk and these are expected to be assessed by the provider and sometimes by an independent body. So, conformity assessment body needs to be involved. Oftentimes, if we are talking about a product which has been already regulated, like a medical device which now includes an AI component, they, for example, will already be subject to third-party conformity assessment. but ⁓ the AI component will also have to be included in that assessment. For example, if you have this remote biometric system, they will also usually be subject to this independent assessment, flat-party assessment. But many other systems are just... The regime for them is quite permissive, the provider itself must assess... You know, based on the criteria, right? Which law provide, are they, the systems that are being placed on the market, are they meeting the requirements or not? Right? So it will be an internal assessment, which needs to be, of course, documented. And if there will be any investigation, for example, by a market surveillance authority, then yes, the provider may need to provide those documents for review. ⁓ For the majority, even high-risk systems, is no market barrier. So you just have to comply with the requirements. But there is no so-called licensing or however, like some US techno bros call it, that we in Europe impose like a so-called licensing regime on like on AI. This is absolute nonsense. There is no licensing of that. Some systems even have even the... LSA set of requirements is, for example, the ones we use for generating manipulated content, right? They are only subject to a small set of transparency requirements. And some systems will be subject to an overlap between those transparency requirements and high risk requirements, like emotional recognition systems. are both, you know... be subject to those high risk requirements and transparency requirements. But again, it's not like 100 % of the market, just a certain portion. I know what is the exact percentage of AI market, but it's just a certain portion of the market which is subject to those requirements. Many other users of AI are just not considered to pose ⁓ significant threat so they are just admitted on the market without any problems.
speaker-1: Do you think the development will lead to something similar to how we have financial audits?
speaker-0: They already exist. auditing industry is developing and growing. are requirements to involve ⁓ third party confirmative assessment body for products which are already regulated like medical devices, toys and things like that. Right? So if you use an AI system as a safety component for such a product, right? So, or... Perhaps you have the whole AI as a product, right? Look, it's just software as a product, like medical device software, for example, right? So things like that where you actually already have to involve a third-party conformity assessment body to come and check you independently. And what this means for remote biometrics in the Act case, which has not been previously regulated. What you are required in that case, you have to invite the, you know, auditors from the conformity assessment body who will review your system, your documentation and provide the assessment of whether you are conformant or not to the essential requirements. So in the United States also there is demand on certain topics. they have, they don't have a comp. comprehensive AI safety regulation like we have in the Act in the EU. But they do have some topical protections. For example, they have in the New York City, they have local law, which requires companies to assess AI decision tools, which are used in hiring, like for hiring decisions, things like that. There are high risk in Europe and in the United States at least like... As you see in this example, there is a certain requirement to do those audits on those tools specifically. And they have to, of course, follow the framework which exists in the United States in assessing whether, for example, there is any unwanted, undesirable, and unlawful bias introduced into the systems. By the way, how you made the choices to which training data to use to train the system, any other design choices which may have introduced that undesirable bias and things like that. which would be, let's say, contributing to violating procedural fairness. So it's not something abstract, it's something objective which can be measured. and auditors are coming in and evaluating a system according to certain audit criteria based on the regulatory requirements. So even in countries which lack comprehensive protection, there are some aspects which are audited in AI systems. And in case of Europe, again, there is a subset of AI products which ⁓ require independent auditing and... not only on the organizational aspect, but ⁓ also in terms of the product itself. Is the product safe? Meaning, is it compliant with essential requirements, which the European Union imposes?
speaker-1: It's part of the financial order that usually happens. It's something separate.
speaker-0: It's a completely different specialization. You need to have different skill set for doing AI audits. You may need actually a team of specialists competent in different aspects. Some may be competent in machine learning, some may be competent in some other aspects in regulatory. It's often that you will require a ⁓ competent team of professionals with different specializations to properly analyze and assess such a social, technical system. AI systems are called social-technical. It's exactly because of their complexity and... they interact, right? So, and how they are used to in the context of organizations in broader societal context. Usually the best practice today is to have like a team of, you know, ⁓ as experts from the, coming from different fields. Yeah. And acting as auditors and what you can borrow and what... people tend to borrow from the financial sector is, independency rules. So the general aspects of what is good, what is bad practice in terms of relationships between, for example, organizations which can do pre-audit work, audits themselves, the clients, things like that. So, which are quite universal, I would say for all, more or less. professions which have certain deontology, right? So some code of practice, ethics and so on. So this is quite applicable, both in financial audits and AI audits. But the subject matter is different, so you need to have a different skill set to go.
speaker-1: Alexander, I'm going to ask you a general question now. What concerns you most and what excites you most about AI?
speaker-0: Well, I'm excited about the possibility to, you know, use this tool to improve my work results, for example, right? So even just manage some aspects which have sometimes difficulty managing, for example, right? So if we are talking specifically chatbots, you know, we, I think all have this tendency to be sometimes overwhelmed, right? So emotionally. And you may be like not ⁓ very, let's say pleasant when you, you know, express yourself in that state. You may not be like using the best language and things like that. So the way you can use, right. So for example, a tool like Claude or ChatGPT, could even moderate your language, right? So before you, you know, respond to a person like with an angry email. For me, it helps a lot to give it a try and reward something more like in a more neutral and polite and professional manner when I don't have the internal energy to formulate that from the start. So I have my intentions, I have my like ideas, but you know, in order to maintain a social connection, you of course can take your time and do it yourself. but sometimes you need to act like. respond in some way and sometimes may even help you, right? So to avoid the unnecessary conflict. This is just one example and some quite mundane tasks which you can do with it, right? But again, for example, what I would not do is trying to write a first draft of any serious work or post on my social media. So I would not delegate because, because
speaker-1: Hmm.
speaker-0: There's a very good expression by someone I can't remember right now. I think they were themselves ⁓ quoting Orwell, ⁓ if I'm not mistaken, about writing as thinking. So the idea is that you can do your writing and do your thinking for yourself. Or you can let your thinking down for you if you delegate the writing, right? So not the precise quote, but here's the idea. So the worst thing you could do is try to delegate your thinking to an AI or whoever. So this is the pathway to like destruction of intellectual capacity. Polishing what you've done already. This I understand. double checking, fact checking your own outputs, right? So you may have thought that you have created a very solid piece of work, but you run it through cloud and it would very often signal like what potential like rooms for improvement is there, right? And this is very helpful in this case. This is very helpful. Also stylistic, I know improvements. Although again, It's depend on how you are choosing to use this tool because nowadays the most unpleasant thing which I'm observing, which is why I would like on balance would prefer even those tools not to exist, right? On balance, on balance. Because even for example, let's take LinkedIn, the professional network, right? So I don't think that anyone can argue seriously against the following observation. There has been a lot of content being now published and comments and posts, which are fully generated without the posters at any point are gaining consciousness. Right? So they're ⁓ copy-pasting whatever comes out of ChessGBT or whatever, without ever thinking of like how that looks like. And that looks like, like that looks terrible because they are all Like all lookalikes, right? So because the language, like a language models, like they tend to average out like the style and the typical, you know, language which has been used. And after some time you get, ⁓ like, ⁓ get to see a few of those posts and dozens of them, ⁓ every week you get to understand like, ⁓ okay. Again, another. person who is not using their brain. So it's a good signal to delete, even not, not just to block them, but if you, for example, somebody is commenting under your post and you see that it's clearly AI generated without any edit value. My preference would be to delete the content as well for other people to net. not receive this in their feed, right? If I can control this, at least a little bit for my viewers, for my subscribers, I want to do as much as possible as I can do to not... distract from the signal, right? So because what these boards of people are generating, this is just all noise. There is no signal there. And I don't want in a professional network like that, I don't want there to be noise. Only as much signal as possible. I can filter that based on my own preferences. I want to subscribe to some people. Some others people are not interesting to me, but to others they are. What I think everybody would benefit from is from... Again, in this hypothetical scenario where the society at large would not have access to those tools, I would prefer actually that they would not have access. People who have something to say, they already can say it. They don't need AI for that. Right? So this would be like my takeaway. So of course, I just need to qualify that with observation because, we tend to like use this AI tag broadly for all kinds of technology and becomes meaningless because AI is just a field of direction of scientific research actually. So you have all kinds of systems there and you can, for example, computer vision. which is also sometimes packed into one, you know, rubric under like AI, right? So we have computer vision, have machine learning, have, you know, generative transformers, large models, selection of different technologies, different applications, and all of that, it just holds a call the way. And it detracts from the nuances, right? So, right. So we have certain uses for those tools. said we have certain benefits and. risks, but they are different. They are not set for all those kinds of different technologies and use cases which are broadly coming under the AI rubric. This would be just incorrect. I understand we use it as a shorthand now and kind of myself have been a sinner already today. by saying AI this, AI that, although what I meant specifically was generative AI, right? So one specific type of technology. We have, of course, some predictive AI systems, predictive AI technology has existed for decades. You can imagine, for example, very useful ⁓ sub technologies there, which help ⁓ enterprises of plug trans... transportation do predictive maintenance of their rolling stock or buses or anything. So it has nothing to do with generative AI. And still somehow we all equate it under AI. I acknowledge this is not the best way to... We happened to use this in this way, but this was not the best formulation, of course.
speaker-1: ⁓ Alexander, I find it very bold when you say you not only block people who clearly use AI in their communication, but even like remove the comments from your posts. But it's, yeah, but I think it's kind of the way you see the responsibility as I understood from you.
speaker-0: Yeah, it's not that they're using AI, right? I'm using AI too as well. Again, I'm not using it to draft my posts or anything. This I'm doing like manually, but in principle I'm using AI. I'm not just, I'm trying at least not to be stupid when using AI because in the end, yeah, if you are using the technology mindfully, again, you can check for grammar, right? Or you can double check your assumptions as I said, right? So. This is one thing and you are feel free to use a, but it will not influence your, you know, style, your personal voice, right? And when people are just copy pasting, whatever comes out of GPT nowadays, it's very often visible. So there is no added value in them just regurgitating whatever I have said and presenting that as some points, even if the sentiment is positive, right? So. ⁓ Right? So they may be praising my posts and some words and these kinds of attracts additional engagement. But I want, I don't want that kind of engagement because it's harmful for the general interest, like for the general public. So if people will be receiving LinkedIn, like notifications because somebody left, ⁓ a comment under my post because They like, for example, my post, okay, and then they're receiving 10 notifications and all those 10 notifications are about some bot regurgitating whatever they said. What is the value? There is zero value. There's only damage. So of course I will delete all that stuff to avoid the people being harmed, actually.
speaker-1: Imagine if you had to enable thousands of employees globally to use AI tools. They use Microsoft Copilot and you're leading this project. What would you put as the first three priorities?
speaker-0: Number one is not to consider like this is like a goal to implement a co-pilot or whatever other, you know, technology is out there for the purpose of just implementing the technology and raising my figure. if I were to have this KPI centered around like how many new workplaces have I managed to force use co-pilot, GPD or cloud. I wouldn't be working even in such a position. would resign because it's stupid and it's harmful. What you must start with is assessing whether, for example, it's in a certain process or in a certain population, like organization, right? So you have certain ⁓ aspects which you can optimize. Right? So for example, you have business process. need to think from first principles, whether this process makes sense at all. Right? Before you try to automate this or improve it, right? Maybe the process itself is meaningless and useless and only adds overhead without any value to the organization or to the people. This is what I would start with. So number one is just to... check the process or whatever activity I'm reviewing, right? So for common sense, like common sense check, does it make sense or not? If it doesn't make sense, ⁓ crap it, delete it, obviate the process, retire. So, because it will save much more money for a good reason, you know, like by not having this stupid process in the first place, right? If the process makes sense or some like metric, whatever it makes sense, Then yes, then you can assess what kinds of technological help can be of use there, if any, and what are the pros and cons, right? So what are the benefits and the outcomes, which will be negative. And it's important to understand that oftentimes, especially in the classical commercial context, what people tend to do is they tend to only assess the benefits for themselves, for their organizations. and they tend to externalize all the negative outcomes. Right? So let's, if anyone else is caring or taking the negative outcomes, like the general public or some, you know, even other department, not my department, I'm very happy because my KPS are great. If my colleagues in the other part of the organization are starving, I don't care because I'm such like amazing, like manager of the year. This is, find, very disturbing when people do that. But even if they are not ⁓ as, let's say... as self-centered as like even not to care about other parts of the organization. Let's suppose they care about the whole organization, holistically, okay, this is already better. But what about again, externalizing the harm elsewhere, right? So to other stakeholders, to active persons, this is what corporates are not often thinking about. And this is what regulations forces them to do. things like the act, right? So this forces them to think about others outside the organization, about the harm which can occur to others outside the organizations. Because for example, the enterprise risk management is caring mostly about enterprise risk. It risks like negative outcomes, the risk to the organization. But enterprise risk management does not care about downside risk to, let's say, the... the economy or society or any specific subset of affected persons, which may be vulnerable to the technology or whatever. And this is what regulation requires. And this is where the utility of regulation ⁓ comes. Forcing organizations to think about others, not themselves only. So this is what I think is very important.
speaker-1: So the most important thing is to have a clear intention and purpose of using whatever tool is used and also to think holistically. Like in summary, this is the most important thing that you would focus on.
speaker-0: Yeah, holistically thinking about the organization, the benefits to the organization, but also to other stakeholders, including society at large.
speaker-1: If you had to design also an AI governance framework for a mid-sized company, what would be your core building blocks?
speaker-0: Well, for the organization which wants to succeed with AI, ⁓ like development or deployment, so just using some third-party AI. What I'm usually actually recommending to my clients at least is start with the AI management system, which is... following the requirements of actually the international standards. So in which case I'm talking about ISO 402001, AI management systems. Management system standards. So many organizations already have similar management systems in place like quality management 9001 or information security management. So 27001. And for them it's even easier to implement on top of their pre-existing management system, an additional set of requirements, right? Because they all harmonize in the way structured and things like that. But even if they don't have a management system in place, just having some documented management system in place is already a huge step towards both meeting the expectations of Internal stakeholders within the organization, right? But also the the board and then investors and then hopefully potentially Laying the groundwork for legal compliance. So the standards will not allow you to automatically achieve like legal compliance But it sets the important groundwork for doing that. Because if you don't have a proper documented management system in the organization, you are nowhere near to any regulatory compliance whatsoever. Be it the Act or some US state requirements or whatever. And this is quite universal. Many, many organizations are now taking this up as part of their... like organizational expectations, what they need to achieve. Some companies even require this as a kind of a procurement requirements, right? So for our vendors to be either certified, otherwise having confirmed that they implemented these standards. And I think it's very good standard. Again, for a T-PILK organization to implement, it may take some months to implement, but it's... ⁓ I think worth it and at least from my experience this is what I recommend to clients. To provide full disclosure, I'm a certified implementer in that standard. It's no surprise that I'm recommending it, but it's all based on my experience. throughout those years, what the challenges are in organizations and what is the utility of the standard. I've become of the opinion that it's quite a useful framework.
speaker-1: Alexander now would like to ask you some questions about what do you expect in the future? So the first one is You can tell me any kind of roles that will emerge, maybe does not even exist yet that has relation with AI and AI governance in the next five years probably.
speaker-0: I'm not sure how truthful my prognosis will be, but let me put it this way. So we have, for example, in terms of professional certifications, right? So we have, let's say in privacy, because I'm also a privacy professional, right? So in privacy, we have different types of certifications for people who are specializing, for example, regulatory aspects. Right? So then in managing the systems, which help us achieve like some privacy related outcomes, right? And operating a management program, right? Privacy management program in the organization. So kind of a project management skills and things like that. So we have already seen this specialization showing up in privacy, right? So I'm of the opinion that we will have the same, even if not more. ⁓ In AI, people just nowadays speak of AI governance, but actually if you dive deeper into it, you will see different facets of AI governance. Of course, the corporate governance is it properly is, right? So interacting with, for example, stakeholders on the board level, helping them govern the organization. to the extent it concerns the use of specific technology and things like that. On the other hand, you will see some project management skills useful on a certain level. For example, for those who will be running an AI management system, the one under ISO 4001 or something else, they need to have a project manager profile. ⁓ On the other hand, will be some really, really... like professional technologists, right, who know how to operate the stack, how to deal with, you know, continual improvement, right, which is also, by the way, an aspect of the standard, so it's 42 and one, because you need to continually improve with all what is going on in the field. And then... course, there will be an I security, right? So cyber security as applied to AI because there are specific vulnerabilities such as for example, prompt injections and etc. Which are not, not characteristic to any other technology, but for the AI specifically based on generative pre-trained transformers, this is something like inevitably present in all generative AI like prompt injections. And this means that. you have a certain subset of security professionals, which will take on like some new knowledge, but we'll have a solid security background that will specialize in AI security. and AI security is one thing, right? So this is how potentially the system itself is exposed to some potential harms and you have AI safety, right? So product safety, the way systems... can harm other people and organizations and so on. So external, right? So security is like inwards looking perspective, safety is outwards looking perspective, how the system itself may potentially bring out harms in the external environment. So all those people will have different aspects of their knowledge they need to be experts in and of course to be... ideally on the frontier, so continually develop their expertise and things like that. So, this pretty much like different specializations in what nowadays is sometimes being subsumed under this broad AI governance topic. But actually there are tons of specializations.
speaker-1: And I like how you connected also the human aspect again, we talked about project management and connecting with stakeholders, et cetera. Lots of skills that are related to the human side, which makes you successful also and something that many people perceive that it's more about logic and data only.
speaker-0: Yeah, it's a very complex, you know, ⁓ interrelationship between technology, different people, societies, organizations.
speaker-1: If a professional wants to move into roles that are related to AR transformation, what are your three pieces of advice that you will give them?
speaker-0: Try to play your strongest sides, right? So whatever you already have in your professional portfolio and build from that because AI again is just a field or direction where we are trying to use some advanced automation. You can be as simple as that. And the way you can leverage that is something. to your, towards your goals, your organization's goals, right? So be it your company where you work in or your client, right? So you can find out like what ⁓ the exactly the relevant pertinent questions there in your field, right? So again, you can transform how you do project management. You can transform how you do security work. You can transform how you. approach client work, right? So, and AI could be one of those tools which can be available in your toolkit. But again, I would be advising against focusing on AI as a technology per se. I would just be trying to focus on how I can be my better self, right? In what I do best with account of ⁓ what is going on with technology.
speaker-1: Hmm. So this is the top advice and you see this is the most important thing to focus on. You don't have to give them another two.
speaker-0: Yeah, I mean, for me, that's just foundation.
speaker-1: Alexander, my previous guest, Ralph Thuram, he asked me to ask the future guest, what is holding you back from helping create an economic system that allows life on this planet to prosper? So I didn't edit the question, I kept it as it is.
speaker-0: Yeah, I think it's difficult to take on full responsibility, accountability for this kind of task. Not in my position, but I think realistically we can all think about what we are not yet doing, what we could do theoretically in our lives, what depends on our discernment or what is within our personal control, what we can do. to make life better for everyone, less miserable at least. And this is just one example. Maybe it's very trivial again. The thing which I'm doing with... trying not to expose people to the harm they would otherwise be exposed by, for example, warning them about not only the benefits, but about the risks of using the technology or abusing it, misusing it. I think I'm doing my own part as best as I can. And with all those publications, graphics and everything I'm releasing to the public domain. I'm doing whatever I can.
speaker-1: And Alexander, what would you like to ask future guests? What questions do you think business leaders should be asking?
speaker-0: This is difficult.
speaker-1: Maybe something you are already interested and you are reflecting on.
speaker-0: Yeah, I mean... So, more generally, I'm not sure, I will not be succinct here, but the idea is when you try to... achieve some business results. should really think about what is the evidence, this new technology or approach which is proposed to me actually works. What is the scientific evidence for, right? because oftentimes I think this is completely skipped from any, you know, business equations. People tend to make assumptions which are completely not based on science. based on junk science or nonsense, hype, whatever, right? So they just go with it because it's hype or whatever, right? So because it seems familiar, right? Because everybody done that before me, my predecessors and things. what I find useful is like to pause and ask yourself like what I'm doing or about to do. What evidence? Do I have what scientific evidence do I have that this works and that the. Risk benefit wise, this is good not only for my organization, but also for others, including the society at large.
speaker-1: Hmm. Hmm. Then the last question I would like to ask you, Alexander, how do you celebrate success and life in general?
speaker-0: of the celebrate success. I don't know, I'm usually just enjoying whatever I anyway. Like I love jazz, for example, listening to jazz live on concerts, ⁓ spending time with my close, people who are close to me. So nothing, nothing really special, maybe going to some interesting place. Nothing really. Out of the ordinary.
speaker-1: Thank very much, Alexander. I really enjoyed the conversation with you. It bored my perspective and there were some bold statements that you said that also makes me also rethink about many things also, for example, when you said about how to be responsible in different examples when I talk about AI. So thank you very much. I wish you all the best and yeah, let's stay in touch.
speaker-0: Thank you for enlightening me.
speaker-1: Congratulations for listening until the end. are in the top 25 % of listeners. Studies show that we forget up to 70 % of what we hear within 24 hours. But when we repeat an insight by sharing it with someone, commenting or journaling it, it moves into long-term memory. So now tell me, what are your 1, 2, 3 takeaways you're keeping from this conversation? Enjoy every moment. Until next time.
speaker-1: Alexander, find it very bold when you say you not only block people, but even remove the comments from your posts. Alexander, welcome to the Core Impact Podcast. I'm excited to have you here. Today, as we said, we're going to talk about AI governance, adoption, ethics, responsible AI regulations, and we're going to talk about how AI is shaping our future of work. Before we dive deep into these topics, I just want to know in general before we talk about the regulations, when does Governance become too much because there are many companies that are already overwhelmed with so many other regulations and now it's coming with AI, have new regulations. Why do we have the need? Can we start from here? Can explain what is the purpose of it?
speaker-0: mean, it all depends on what normally, at least in democratic societies, what the people want and what they prefer. And through their representatives, they usually express their wishes towards a more, let's say, permissive regime, economically speaking, politically speaking, legally speaking, where they let more freedom to the companies to expand and prioritize really economic development. Some companies do that or some countries prefer that approach like United States, for example. And you can have other countries or even country blocks like the European Union where we prioritize prosperity and human rights. We do not necessarily value. per se, economic expansion and things like that. So we have pretty much settled on the common understanding that what our priorities are in Europe, plus or minus, right? So more or less. And it's obviously very different from what the American people have settled on. And there are no incorrect choices here. It's very nice that... On this earth, we have such a variety of choices which people are making towards like whether prioritizing, for example, welfare and fairness and justice, which requires legislation and imposing requirements on economic operators more than if you were to follow strictly the focus on economic prosperity and expansion, in which case you would necessarily downplaying the importance of human rights, you will give less protections to people, but you will at the same time help your private sector grow and compete on the global stage. So there are no wrong choices. There are just preferences here and Europe tends to prefer to maintain the already achieved high level of protections.
speaker-1: So the purpose, if we say it in one sentence, is the protection of people and their data privacy. This is the main purpose.
speaker-0: ⁓ This is just a very narrow example. We can speak about consumer safety more broadly, human rights more broadly. And this would present itself in the way of how we have product safety laws. For example, the newest kind we've got recently on AI, with the act as part of European broader product safety law. It's just one example. which has become recently more like, ⁓ received more spotlight recently, but, ⁓ it's just a good old product safety legislation adapting to the new realities and new hazards, new risk factors. So nothing new under the sun, just adaptation of, ⁓ the already existing concepts and data privacy just, ⁓ you know, one of, ⁓ the. aspects of fundamental rights protections that we care about in Europe. So this is just one narrow example, I would say.
speaker-1: Alexander, since we started already now with the EU AI Act, this is one of the things that you are teaching, you are making courses here, who are the people who should come to you and learn from you?
speaker-0: There are different kinds of people who are visiting, attending my courses. They tend to be more on the side of like governance risk and compliance professionals. The majority of the public. Occasionally there are some business leaders as well, up to the vice president level. I used to have like even on my retail course. So. The way I do the courses, for example, on the Act is I usually have this one prepared structure and content, but I can also customize it to... address the needs of corporate clients. So sometimes they ask me to deliver a specialized, a tailored version where they will have a different mix perhaps of audiences, right? So depending on that, can adapt. But the people who attend my retail courses, said they are mostly... Governance, risk and compliance people, senior, at the senior level, senior contributor level, would say, managers. Although, as I said, usually there is a mix and, you know, but from the things, the things which I've been doing through years, all those things, required, you know, a good translation skill, meaning ⁓ inter-domain translation. from, you know, complex legal topics to... ⁓ how this translates into business impact, business requirements, business policies, procedures, right? So, and also technical because for the last 10 years, I think I've been mostly focused on digital policy and technology projects. So without ⁓ the... ability to translate in between the legal domain, the technology domain and the business domain, I would not be successful in the roles that I was involved in.
speaker-1: If you are excited to dive deeper into AI governance, EU AI Act and responsible AI adoption, Alexander is offering courses that you can check out. You can use the code coreimpact to get 10 % off when booking. The details are in the description. Now let's come back to the conversation and let's talk here about the challenges since you mentioned it. What are the biggest challenges when connecting between tech, legal and business domains?
speaker-0: ⁓ I mean, there is plenty ⁓ besides this translation aspect, right? Because I think this is what fascinates me the most is that I have this tendency, especially for those who are more focused on visualizing the content they want to intake and... I think I'm very good at doing quite simple but impactful visuals. And one of those was, by the way, in the wake of the chat GPT popularity, like when it came out in 2022, November, right? The public version made available. And somewhere at the beginning of 2023, when the initial like... experimentation has already started with many people, myself included. We tried to understand like what was the utility of those tools and what are the limitations and the appropriate ways of ⁓ using them. And so I made this very succinct graphic and it suddenly received a lot of attention and a lot of understanding and uptake and across different channels actually. My usual delivery channel for my content is LinkedIn, right? So I do a lot of posting there, newsletters and things like that. And when I just came up with this graphic and I explained basically in that graphic, so the criteria you need to meet to use a tool such as ChatGPT, right? Without being sorry about that in the long term and, ⁓ you know, I have made certain, you know, a decision flow or, know, decision tree, can call it. And the killer elements were being competent to, for example, to tell if, ⁓ what you are preparing with your tool is truthful or not. Right. So apart from the situation, whether you don't care, like you are doing some science fiction or whatever, right. So where you don't really care what the tool delivers and. might not be factual. So we set this ⁓ specific domain of artistic assistance aside. If we are talking about domains where factuality is critical, then actually to be able to properly use the outputs of those kinds of tools like ChargeGPD, you must be yourself as domain expert. You are just a lay person who is using the tools and relies on it. but has no way of telling whether the result is correct or not, then you are setting yourself for failure down the road because you are not an expert. You will not be able to tell if the result is ⁓ useful and good. It may appear because the systems like that were trained to produce plausibly sounding text, right? So this is their goal, but factuality has nothing to do with it. So without being a subject meta expert first, and then without your ability and desire to take on full responsibility for the output, you should not be using those tools at all. Because if you are not a subject meta expert and you're not ready,
speaker-1: right?
speaker-0: to sign, you know, the dotted line that you, you know, accept any kind of ethical, legal and other, you know, outcome which may come out of you using that in the wider world, that output, and you should not be using it in the first place. So this leaves us with a huge gap between what people actually use those tools for and what they can safely, you know, limit they use to, right? So, because usually this is not how people understand the way they can use the tools, right? So, because also they have this tendency to over rely on the new systems because they appear to them like something magical, something not comparable to older, like actually more reliable systems which does not operate on in the public. in a probabilistic manner, right? So if they always would be reaching the same results. So people who started using computers in the seventies or something on the eighties, they may have a false equivalence in their head, right? In terms of trustworthiness and accuracy, right? So they got used to that fact that computer is never wrong. And in a strict technical sense, like, you know, those tools which we did use, were just arriving at the result depending on what input data we feed and what the algorithm was. And there was not such a thing as a classical, there was not such a thing which then relied on some probability, right? And what we now have, like the majority of ASS, which we now have, they all rely on probability. So even in the definitions, if you look into the ISO standard on key concepts around AI, machine learning, ISO 22989 standard. it even in one of the nodes for sub-symbolic AI, which is ⁓ narrow, you know, scientific term for what the systems are currently, which we are using sub-symbolic AI. In the node, the definition is just like that. The whole thing with those systems that they produce to result with a specified degree of error. There is always a degree of error. So this is just by definition how they work. They cannot operate with a hundred percent error free probability. This is inherently not possible. And depending on the domain where you use them, level of accuracy, if it's 95 or... 99.999, even that result sometimes will not be sufficient, especially if we are using them in kind of a loop ⁓ or in the kind of a... As it's now beginning more, like becoming more and more popular to use those kinds of systems in an agentic manner. where they execute the workflow, right? So, and if you get a certain specific level of error at each step, And then the errors will accumulate at the end. Right? So the majority of people don't even understand this. Right? So I'm a huge fan of technology. There's specific technology as well. But I tend to be always ⁓ on the critical thinking side, skeptical side in assessing like any claims which are made by the providers, by the developers. Right? So. I tried to check for myself, I tried to see what the scientists say about the aspects, how these tools are useful, how they are not useful and so on. This is my idea. This is what I wanted to deliver also with this graphic, which was so successful. I'm still receiving from time to time, even if it was in 2023. So after three years, I'm still receiving ⁓ occasional requests for permission to reproduce. though I published this graphic about this ChudGPT, you know, use under the creative commons license, like only reference was required. People still at least like at least those old school people who know what is like academic integrity and things like that. They still ask for permission, you know.
speaker-1: See, Alexander, I didn't want to interrupt you, but you touched on four questions that I wanted to ask you. So I'm going to come back to one by one. So let's start by talking about the EU AI Act and say, if you want to summarize it in a simple way, what is it? And also tell me what are the things that companies usually mostly either don't understand or struggle with understanding.
speaker-0: Speaking of the act, the most important thing which most readers do not understand is the fact which I am raising again and again. It's a product safety law, right? So people see it as some kind of a new regulation which was not based on anything in existence before. something out of the ordinary. Very few people actually do understand that grounding, that the EU Act is a part of the broader EU product safety legislation. We have this kind of a horizontal framework for specific technology, which does not prescribe how you must build your systems, right? So there is no prescriptive way of like... specifying what you must do exactly. There are only objectives. there are policy objectives. So we call them essential requirements for products. So what requirements must be met if your product were to enter the European market. And they are not for all AI systems. They are only for certain categories like... High-risk AI systems, they have ⁓ specific requirements as regards to their quality, different aspects of it. This is the main thing. Like we have in the Act, we have the essential requirements for high-risk AI systems. So before they are placed on the market or put into service in Europe, they must comply with certain requirements, expectations, let's say. Right? So, but the law does not say like how you arrive at the meeting those expectations. And one of those, like for example, to have a risk management system in place for the organization to assess specific hazards which may be relevant for the system you are building. So for each system, it may be a different set of hazards which are relevant. So for example, if you're building a facial recognition system, right? So it's a high risk system if you're used in, for example, remote biometrics settings. where it's permissible, but you must have ⁓ certain requirements met. And I must meet certain requirements. And in which case you are, for example, assessing what are the potential hazards for people who are being subjected, affected persons who are being subjected to the use of systems, right? So, and you try to identify what those hazards are for their, for example, fundamental rights. And then you try to identify as far as your risk management process, how you can evaluate what is the probability, what is the severity of the risk, right? To fundamental rights, for example. To what rights exactly, right? So is it, for example, right to... I don't know, a liberty or something like that. So it depends on the use case, right? So, and then you need to assess if the degree of the level of risk is, the probability are such as that overall the assessment is that it's acceptable as regards to like the level of protections has been achieved in Europe. So we do not benchmark against totalitarian regimes or something. We benchmark against our own very high level of protections. if we ⁓ think that this technology is foreseen to be used, like is going to influence material like the level of protections, we need to mitigate, provide mitigations. ⁓ And as a result, the idea is to reduce this risk overall to an acceptable level before they place the product on the market. And there are different other requirements, for example, to data quality for those systems, technical documentation, human oversight, cybersecurity, overall accuracy and resilience, robustness. things like that for high risk and these are expected to be assessed by the provider and sometimes by an independent body. So, conformity assessment body needs to be involved. Oftentimes, if we are talking about a product which has been already regulated, like a medical device which now includes an AI component, they, for example, will already be subject to third-party conformity assessment. but ⁓ the AI component will also have to be included in that assessment. For example, if you have this remote biometric system, they will also usually be subject to this independent assessment, flat-party assessment. But many other systems are just... The regime for them is quite permissive, the provider itself must assess... You know, based on the criteria, right? Which law provide, are they, the systems that are being placed on the market, are they meeting the requirements or not? Right? So it will be an internal assessment, which needs to be, of course, documented. And if there will be any investigation, for example, by a market surveillance authority, then yes, the provider may need to provide those documents for review. ⁓ For the majority, even high-risk systems, is no market barrier. So you just have to comply with the requirements. But there is no so-called licensing or however, like some US techno bros call it, that we in Europe impose like a so-called licensing regime on like on AI. This is absolute nonsense. There is no licensing of that. Some systems even have even the... LSA set of requirements is, for example, the ones we use for generating manipulated content, right? They are only subject to a small set of transparency requirements. And some systems will be subject to an overlap between those transparency requirements and high risk requirements, like emotional recognition systems. are both, you know... be subject to those high risk requirements and transparency requirements. But again, it's not like 100 % of the market, just a certain portion. I know what is the exact percentage of AI market, but it's just a certain portion of the market which is subject to those requirements. Many other users of AI are just not considered to pose ⁓ significant threat so they are just admitted on the market without any problems.
speaker-1: Do you think the development will lead to something similar to how we have financial audits?
speaker-0: They already exist. auditing industry is developing and growing. are requirements to involve ⁓ third party confirmative assessment body for products which are already regulated like medical devices, toys and things like that. Right? So if you use an AI system as a safety component for such a product, right? So, or... Perhaps you have the whole AI as a product, right? Look, it's just software as a product, like medical device software, for example, right? So things like that where you actually already have to involve a third-party conformity assessment body to come and check you independently. And what this means for remote biometrics in the Act case, which has not been previously regulated. What you are required in that case, you have to invite the, you know, auditors from the conformity assessment body who will review your system, your documentation and provide the assessment of whether you are conformant or not to the essential requirements. So in the United States also there is demand on certain topics. they have, they don't have a comp. comprehensive AI safety regulation like we have in the Act in the EU. But they do have some topical protections. For example, they have in the New York City, they have local law, which requires companies to assess AI decision tools, which are used in hiring, like for hiring decisions, things like that. There are high risk in Europe and in the United States at least like... As you see in this example, there is a certain requirement to do those audits on those tools specifically. And they have to, of course, follow the framework which exists in the United States in assessing whether, for example, there is any unwanted, undesirable, and unlawful bias introduced into the systems. By the way, how you made the choices to which training data to use to train the system, any other design choices which may have introduced that undesirable bias and things like that. which would be, let's say, contributing to violating procedural fairness. So it's not something abstract, it's something objective which can be measured. and auditors are coming in and evaluating a system according to certain audit criteria based on the regulatory requirements. So even in countries which lack comprehensive protection, there are some aspects which are audited in AI systems. And in case of Europe, again, there is a subset of AI products which ⁓ require independent auditing and... not only on the organizational aspect, but ⁓ also in terms of the product itself. Is the product safe? Meaning, is it compliant with essential requirements, which the European Union imposes?
speaker-1: It's part of the financial order that usually happens. It's something separate.
speaker-0: It's a completely different specialization. You need to have different skill set for doing AI audits. You may need actually a team of specialists competent in different aspects. Some may be competent in machine learning, some may be competent in some other aspects in regulatory. It's often that you will require a ⁓ competent team of professionals with different specializations to properly analyze and assess such a social, technical system. AI systems are called social-technical. It's exactly because of their complexity and... they interact, right? So, and how they are used to in the context of organizations in broader societal context. Usually the best practice today is to have like a team of, you know, ⁓ as experts from the, coming from different fields. Yeah. And acting as auditors and what you can borrow and what... people tend to borrow from the financial sector is, independency rules. So the general aspects of what is good, what is bad practice in terms of relationships between, for example, organizations which can do pre-audit work, audits themselves, the clients, things like that. So, which are quite universal, I would say for all, more or less. professions which have certain deontology, right? So some code of practice, ethics and so on. So this is quite applicable, both in financial audits and AI audits. But the subject matter is different, so you need to have a different skill set to go.
speaker-1: Alexander, I'm going to ask you a general question now. What concerns you most and what excites you most about AI?
speaker-0: Well, I'm excited about the possibility to, you know, use this tool to improve my work results, for example, right? So even just manage some aspects which have sometimes difficulty managing, for example, right? So if we are talking specifically chatbots, you know, we, I think all have this tendency to be sometimes overwhelmed, right? So emotionally. And you may be like not ⁓ very, let's say pleasant when you, you know, express yourself in that state. You may not be like using the best language and things like that. So the way you can use, right. So for example, a tool like Claude or ChatGPT, could even moderate your language, right? So before you, you know, respond to a person like with an angry email. For me, it helps a lot to give it a try and reward something more like in a more neutral and polite and professional manner when I don't have the internal energy to formulate that from the start. So I have my intentions, I have my like ideas, but you know, in order to maintain a social connection, you of course can take your time and do it yourself. but sometimes you need to act like. respond in some way and sometimes may even help you, right? So to avoid the unnecessary conflict. This is just one example and some quite mundane tasks which you can do with it, right? But again, for example, what I would not do is trying to write a first draft of any serious work or post on my social media. So I would not delegate because, because
speaker-1: Hmm.
speaker-0: There's a very good expression by someone I can't remember right now. I think they were themselves ⁓ quoting Orwell, ⁓ if I'm not mistaken, about writing as thinking. So the idea is that you can do your writing and do your thinking for yourself. Or you can let your thinking down for you if you delegate the writing, right? So not the precise quote, but here's the idea. So the worst thing you could do is try to delegate your thinking to an AI or whoever. So this is the pathway to like destruction of intellectual capacity. Polishing what you've done already. This I understand. double checking, fact checking your own outputs, right? So you may have thought that you have created a very solid piece of work, but you run it through cloud and it would very often signal like what potential like rooms for improvement is there, right? And this is very helpful in this case. This is very helpful. Also stylistic, I know improvements. Although again, It's depend on how you are choosing to use this tool because nowadays the most unpleasant thing which I'm observing, which is why I would like on balance would prefer even those tools not to exist, right? On balance, on balance. Because even for example, let's take LinkedIn, the professional network, right? So I don't think that anyone can argue seriously against the following observation. There has been a lot of content being now published and comments and posts, which are fully generated without the posters at any point are gaining consciousness. Right? So they're ⁓ copy-pasting whatever comes out of ChessGBT or whatever, without ever thinking of like how that looks like. And that looks like, like that looks terrible because they are all Like all lookalikes, right? So because the language, like a language models, like they tend to average out like the style and the typical, you know, language which has been used. And after some time you get, ⁓ like, ⁓ get to see a few of those posts and dozens of them, ⁓ every week you get to understand like, ⁓ okay. Again, another. person who is not using their brain. So it's a good signal to delete, even not, not just to block them, but if you, for example, somebody is commenting under your post and you see that it's clearly AI generated without any edit value. My preference would be to delete the content as well for other people to net. not receive this in their feed, right? If I can control this, at least a little bit for my viewers, for my subscribers, I want to do as much as possible as I can do to not... distract from the signal, right? So because what these boards of people are generating, this is just all noise. There is no signal there. And I don't want in a professional network like that, I don't want there to be noise. Only as much signal as possible. I can filter that based on my own preferences. I want to subscribe to some people. Some others people are not interesting to me, but to others they are. What I think everybody would benefit from is from... Again, in this hypothetical scenario where the society at large would not have access to those tools, I would prefer actually that they would not have access. People who have something to say, they already can say it. They don't need AI for that. Right? So this would be like my takeaway. So of course, I just need to qualify that with observation because, we tend to like use this AI tag broadly for all kinds of technology and becomes meaningless because AI is just a field of direction of scientific research actually. So you have all kinds of systems there and you can, for example, computer vision. which is also sometimes packed into one, you know, rubric under like AI, right? So we have computer vision, have machine learning, have, you know, generative transformers, large models, selection of different technologies, different applications, and all of that, it just holds a call the way. And it detracts from the nuances, right? So, right. So we have certain uses for those tools. said we have certain benefits and. risks, but they are different. They are not set for all those kinds of different technologies and use cases which are broadly coming under the AI rubric. This would be just incorrect. I understand we use it as a shorthand now and kind of myself have been a sinner already today. by saying AI this, AI that, although what I meant specifically was generative AI, right? So one specific type of technology. We have, of course, some predictive AI systems, predictive AI technology has existed for decades. You can imagine, for example, very useful ⁓ sub technologies there, which help ⁓ enterprises of plug trans... transportation do predictive maintenance of their rolling stock or buses or anything. So it has nothing to do with generative AI. And still somehow we all equate it under AI. I acknowledge this is not the best way to... We happened to use this in this way, but this was not the best formulation, of course.
speaker-1: ⁓ Alexander, I find it very bold when you say you not only block people who clearly use AI in their communication, but even like remove the comments from your posts. But it's, yeah, but I think it's kind of the way you see the responsibility as I understood from you.
speaker-0: Yeah, it's not that they're using AI, right? I'm using AI too as well. Again, I'm not using it to draft my posts or anything. This I'm doing like manually, but in principle I'm using AI. I'm not just, I'm trying at least not to be stupid when using AI because in the end, yeah, if you are using the technology mindfully, again, you can check for grammar, right? Or you can double check your assumptions as I said, right? So. This is one thing and you are feel free to use a, but it will not influence your, you know, style, your personal voice, right? And when people are just copy pasting, whatever comes out of GPT nowadays, it's very often visible. So there is no added value in them just regurgitating whatever I have said and presenting that as some points, even if the sentiment is positive, right? So. ⁓ Right? So they may be praising my posts and some words and these kinds of attracts additional engagement. But I want, I don't want that kind of engagement because it's harmful for the general interest, like for the general public. So if people will be receiving LinkedIn, like notifications because somebody left, ⁓ a comment under my post because They like, for example, my post, okay, and then they're receiving 10 notifications and all those 10 notifications are about some bot regurgitating whatever they said. What is the value? There is zero value. There's only damage. So of course I will delete all that stuff to avoid the people being harmed, actually.
speaker-1: Imagine if you had to enable thousands of employees globally to use AI tools. They use Microsoft Copilot and you're leading this project. What would you put as the first three priorities?
speaker-0: Number one is not to consider like this is like a goal to implement a co-pilot or whatever other, you know, technology is out there for the purpose of just implementing the technology and raising my figure. if I were to have this KPI centered around like how many new workplaces have I managed to force use co-pilot, GPD or cloud. I wouldn't be working even in such a position. would resign because it's stupid and it's harmful. What you must start with is assessing whether, for example, it's in a certain process or in a certain population, like organization, right? So you have certain ⁓ aspects which you can optimize. Right? So for example, you have business process. need to think from first principles, whether this process makes sense at all. Right? Before you try to automate this or improve it, right? Maybe the process itself is meaningless and useless and only adds overhead without any value to the organization or to the people. This is what I would start with. So number one is just to... check the process or whatever activity I'm reviewing, right? So for common sense, like common sense check, does it make sense or not? If it doesn't make sense, ⁓ crap it, delete it, obviate the process, retire. So, because it will save much more money for a good reason, you know, like by not having this stupid process in the first place, right? If the process makes sense or some like metric, whatever it makes sense, Then yes, then you can assess what kinds of technological help can be of use there, if any, and what are the pros and cons, right? So what are the benefits and the outcomes, which will be negative. And it's important to understand that oftentimes, especially in the classical commercial context, what people tend to do is they tend to only assess the benefits for themselves, for their organizations. and they tend to externalize all the negative outcomes. Right? So let's, if anyone else is caring or taking the negative outcomes, like the general public or some, you know, even other department, not my department, I'm very happy because my KPS are great. If my colleagues in the other part of the organization are starving, I don't care because I'm such like amazing, like manager of the year. This is, find, very disturbing when people do that. But even if they are not ⁓ as, let's say... as self-centered as like even not to care about other parts of the organization. Let's suppose they care about the whole organization, holistically, okay, this is already better. But what about again, externalizing the harm elsewhere, right? So to other stakeholders, to active persons, this is what corporates are not often thinking about. And this is what regulations forces them to do. things like the act, right? So this forces them to think about others outside the organization, about the harm which can occur to others outside the organizations. Because for example, the enterprise risk management is caring mostly about enterprise risk. It risks like negative outcomes, the risk to the organization. But enterprise risk management does not care about downside risk to, let's say, the... the economy or society or any specific subset of affected persons, which may be vulnerable to the technology or whatever. And this is what regulation requires. And this is where the utility of regulation ⁓ comes. Forcing organizations to think about others, not themselves only. So this is what I think is very important.
speaker-1: So the most important thing is to have a clear intention and purpose of using whatever tool is used and also to think holistically. Like in summary, this is the most important thing that you would focus on.
speaker-0: Yeah, holistically thinking about the organization, the benefits to the organization, but also to other stakeholders, including society at large.
speaker-1: If you had to design also an AI governance framework for a mid-sized company, what would be your core building blocks?
speaker-0: Well, for the organization which wants to succeed with AI, ⁓ like development or deployment, so just using some third-party AI. What I'm usually actually recommending to my clients at least is start with the AI management system, which is... following the requirements of actually the international standards. So in which case I'm talking about ISO 402001, AI management systems. Management system standards. So many organizations already have similar management systems in place like quality management 9001 or information security management. So 27001. And for them it's even easier to implement on top of their pre-existing management system, an additional set of requirements, right? Because they all harmonize in the way structured and things like that. But even if they don't have a management system in place, just having some documented management system in place is already a huge step towards both meeting the expectations of Internal stakeholders within the organization, right? But also the the board and then investors and then hopefully potentially Laying the groundwork for legal compliance. So the standards will not allow you to automatically achieve like legal compliance But it sets the important groundwork for doing that. Because if you don't have a proper documented management system in the organization, you are nowhere near to any regulatory compliance whatsoever. Be it the Act or some US state requirements or whatever. And this is quite universal. Many, many organizations are now taking this up as part of their... like organizational expectations, what they need to achieve. Some companies even require this as a kind of a procurement requirements, right? So for our vendors to be either certified, otherwise having confirmed that they implemented these standards. And I think it's very good standard. Again, for a T-PILK organization to implement, it may take some months to implement, but it's... ⁓ I think worth it and at least from my experience this is what I recommend to clients. To provide full disclosure, I'm a certified implementer in that standard. It's no surprise that I'm recommending it, but it's all based on my experience. throughout those years, what the challenges are in organizations and what is the utility of the standard. I've become of the opinion that it's quite a useful framework.
speaker-1: Alexander now would like to ask you some questions about what do you expect in the future? So the first one is You can tell me any kind of roles that will emerge, maybe does not even exist yet that has relation with AI and AI governance in the next five years probably.
speaker-0: I'm not sure how truthful my prognosis will be, but let me put it this way. So we have, for example, in terms of professional certifications, right? So we have, let's say in privacy, because I'm also a privacy professional, right? So in privacy, we have different types of certifications for people who are specializing, for example, regulatory aspects. Right? So then in managing the systems, which help us achieve like some privacy related outcomes, right? And operating a management program, right? Privacy management program in the organization. So kind of a project management skills and things like that. So we have already seen this specialization showing up in privacy, right? So I'm of the opinion that we will have the same, even if not more. ⁓ In AI, people just nowadays speak of AI governance, but actually if you dive deeper into it, you will see different facets of AI governance. Of course, the corporate governance is it properly is, right? So interacting with, for example, stakeholders on the board level, helping them govern the organization. to the extent it concerns the use of specific technology and things like that. On the other hand, you will see some project management skills useful on a certain level. For example, for those who will be running an AI management system, the one under ISO 4001 or something else, they need to have a project manager profile. ⁓ On the other hand, will be some really, really... like professional technologists, right, who know how to operate the stack, how to deal with, you know, continual improvement, right, which is also, by the way, an aspect of the standard, so it's 42 and one, because you need to continually improve with all what is going on in the field. And then... course, there will be an I security, right? So cyber security as applied to AI because there are specific vulnerabilities such as for example, prompt injections and etc. Which are not, not characteristic to any other technology, but for the AI specifically based on generative pre-trained transformers, this is something like inevitably present in all generative AI like prompt injections. And this means that. you have a certain subset of security professionals, which will take on like some new knowledge, but we'll have a solid security background that will specialize in AI security. and AI security is one thing, right? So this is how potentially the system itself is exposed to some potential harms and you have AI safety, right? So product safety, the way systems... can harm other people and organizations and so on. So external, right? So security is like inwards looking perspective, safety is outwards looking perspective, how the system itself may potentially bring out harms in the external environment. So all those people will have different aspects of their knowledge they need to be experts in and of course to be... ideally on the frontier, so continually develop their expertise and things like that. So, this pretty much like different specializations in what nowadays is sometimes being subsumed under this broad AI governance topic. But actually there are tons of specializations.
speaker-1: And I like how you connected also the human aspect again, we talked about project management and connecting with stakeholders, et cetera. Lots of skills that are related to the human side, which makes you successful also and something that many people perceive that it's more about logic and data only.
speaker-0: Yeah, it's a very complex, you know, ⁓ interrelationship between technology, different people, societies, organizations.
speaker-1: If a professional wants to move into roles that are related to AR transformation, what are your three pieces of advice that you will give them?
speaker-0: Try to play your strongest sides, right? So whatever you already have in your professional portfolio and build from that because AI again is just a field or direction where we are trying to use some advanced automation. You can be as simple as that. And the way you can leverage that is something. to your, towards your goals, your organization's goals, right? So be it your company where you work in or your client, right? So you can find out like what ⁓ the exactly the relevant pertinent questions there in your field, right? So again, you can transform how you do project management. You can transform how you do security work. You can transform how you. approach client work, right? So, and AI could be one of those tools which can be available in your toolkit. But again, I would be advising against focusing on AI as a technology per se. I would just be trying to focus on how I can be my better self, right? In what I do best with account of ⁓ what is going on with technology.
speaker-1: Hmm. So this is the top advice and you see this is the most important thing to focus on. You don't have to give them another two.
speaker-0: Yeah, I mean, for me, that's just foundation.
speaker-1: Alexander, my previous guest, Ralph Thuram, he asked me to ask the future guest, what is holding you back from helping create an economic system that allows life on this planet to prosper? So I didn't edit the question, I kept it as it is.
speaker-0: Yeah, I think it's difficult to take on full responsibility, accountability for this kind of task. Not in my position, but I think realistically we can all think about what we are not yet doing, what we could do theoretically in our lives, what depends on our discernment or what is within our personal control, what we can do. to make life better for everyone, less miserable at least. And this is just one example. Maybe it's very trivial again. The thing which I'm doing with... trying not to expose people to the harm they would otherwise be exposed by, for example, warning them about not only the benefits, but about the risks of using the technology or abusing it, misusing it. I think I'm doing my own part as best as I can. And with all those publications, graphics and everything I'm releasing to the public domain. I'm doing whatever I can.
speaker-1: And Alexander, what would you like to ask future guests? What questions do you think business leaders should be asking?
speaker-0: This is difficult.
speaker-1: Maybe something you are already interested and you are reflecting on.
speaker-0: Yeah, I mean... So, more generally, I'm not sure, I will not be succinct here, but the idea is when you try to... achieve some business results. should really think about what is the evidence, this new technology or approach which is proposed to me actually works. What is the scientific evidence for, right? because oftentimes I think this is completely skipped from any, you know, business equations. People tend to make assumptions which are completely not based on science. based on junk science or nonsense, hype, whatever, right? So they just go with it because it's hype or whatever, right? So because it seems familiar, right? Because everybody done that before me, my predecessors and things. what I find useful is like to pause and ask yourself like what I'm doing or about to do. What evidence? Do I have what scientific evidence do I have that this works and that the. Risk benefit wise, this is good not only for my organization, but also for others, including the society at large.
speaker-1: Hmm. Hmm. Then the last question I would like to ask you, Alexander, how do you celebrate success and life in general?
speaker-0: of the celebrate success. I don't know, I'm usually just enjoying whatever I anyway. Like I love jazz, for example, listening to jazz live on concerts, ⁓ spending time with my close, people who are close to me. So nothing, nothing really special, maybe going to some interesting place. Nothing really. Out of the ordinary.
speaker-1: Thank very much, Alexander. I really enjoyed the conversation with you. It bored my perspective and there were some bold statements that you said that also makes me also rethink about many things also, for example, when you said about how to be responsible in different examples when I talk about AI. So thank you very much. I wish you all the best and yeah, let's stay in touch.
speaker-0: Thank you for enlightening me.
speaker-1: Congratulations for listening until the end. are in the top 25 % of listeners. Studies show that we forget up to 70 % of what we hear within 24 hours. But when we repeat an insight by sharing it with someone, commenting or journaling it, it moves into long-term memory. So now tell me, what are your 1, 2, 3 takeaways you're keeping from this conversation? Enjoy every moment. Until next time.
