From security gaps to evolving regulations and tough ethical questions,
artificial intelligence introduces as many risks as opportunities.
Today's guest takes us deep into the strategies enterprises need to mitigate
them, ensure compliance, and build responsible governance that scales.
My name is Alexandre Nevski, and this is Innovation Tales.
Navigating change, one story at a time.
We share insights from leaders tackling the challenges of today's digital world.
Welcome to Innovation Tales, the podcast exploring the human
side of digital transformation.
In our last episode, we explored why not every Gen AI use case is worth
pursuing, how to build AI governance that works, and what business leaders
must do to stay ahead of emerging risks.
But now we go deeper.
Alec Crawford, founder of Artificial Intelligence Risk, Inc. has spent
decades at the intersection of AI, finance and risk management.
His company helps enterprises adopt AI security through strong governance,
compliance, and cybersecurity.
In this episode, we dive into the features and deployment of his platform, along with
broader regulatory and ethical challenges.
From securing data to ensuring compliance, Alex shares practical insights
every business leader should hear.
Without further ado, he's my conversation with Alec Crawford.
I wanna circle back to what the platform that you deploy is.
I want to ensure that for our business minded audience, it's clear, what's the
difference between, other, alternatives that they might have on the market.
So what I understood is that the first and foremost thing you, argue is that
you can only really be certain of the security and compliance and governance
of technology that you're running on premise, or that at least it's, if
it's in a cloud that's a private cloud and you know exactly what's running.
And then I heard initially that there was a number of capabilities that
you had built into the platform.
I think at some point you were mentioning logging every prompt and every model
change, because essentially with these additional capabilities, you
can facilitate compliance, et cetera.
Did I get this more or less right.
I think you nailed it, Alex.
So think about it as "single pane of glass" access to AI across all
your different AI tools, right?
And because of that, that can run through the compliance system, right?
And then you've got the agent building capabilities.
We've got three levels.
You've got the admins that can set security settings and build
agents and assign agents to people.
Have super users that are allowed to build agents for themselves, but
not change the security settings.
And then you've got users who, hey, here's your 10 agents, go wild.
So that on an enterprise platform that does the governance and risk management
and compliance and cybersecurity is what allows, companies with high risk AI
applications that include consumer data or healthcare data to do that safely.
And I agree, doing it inside your private cloud where you own all the data and
you know it's not leaking out there is a number one goal and something that
we really encourage our clients to do.
There are certain models out there that are, that you can't do that with.
So right now, for example, Claude is only accessible as an API.
So you know, there you may have an agreement with Claude saying, Hey,
they're not gonna tell anybody, what you're doing with AI, but we have
no idea how long they're storing our data for or who's looking at it.
And if you have confidentiality agreements with your clients, let's say like you may
not legally be allowed to do that, right?
To push it out to your cloud.
If you're running something on-prem, you know it's inside
your firewall, you're good.
You can do whatever you want from a confidential standpoint.
Yeah, well it, it makes sense that just like platforms in the past, I
dunno if we go way back, I dunno, for document management or, any number of,
enterprise grade software, that gets deployed as a platform, it's normal
that an enterprise's requirements are more specific than, a consumer.
And therefore having a multi-tiered authorization model that you've
just mentioned is just a, it's not a negotiable, it's a must have.
You must be able to design the roles that make sense for your organization
But it's seems like it's quite an onerous of effort in order to be fully in control.
Do you think that most businesses will be able to get there at some
point, or do you see for, I don't know, foreseeable future, that this
is only the largest organizations we can afford something like that?
No, our smallest clients are 50-100 people and they're
perfectly capable of managing this.
I do think that there aren't a lot of other solutions like ours right now.
And really that's why we're focused on high risk AI.
Look, if you have nothing confidential at your company and you wanna
write a marketing piece and you don't care that the world can see
it, just go to ChatGPT, right?
Pay $20, right?
The reason we're focused on high risk is you can't do that with consumer data.
You can't do that with healthcare data.
It's illegal, right?
So that's why we're focused on that market, but also really focused
on the security side, right?
I think that, there's a lot of software out there that's SaaS, that just has
a lot of security holes in it, right?
Even Grammarly, for example, had a huge security hole that was revealed last year.
And think of all the people using Grammarly who all of a sudden, whoops.
Like your data could be out there somewhere, right?
That's primarily because it's SaaS.
In ours, your firewall has to be breached before anyone has access to your AI.
Beyond that, everything's encrypted in motion, at rest, and at rest.
Beyond that, each individual only has access to certain agents and certain data.
Beyond that, we're looking for unusual activity and flagging it
back to the cybersecurity team.
Is there, is someone trying to hack the AI?
Is there data exfiltration in place?
' cause one of the tenets of cybersecurity today is, it's not a matter of if
you get hacked, but when and when you get hacked, it's a matter of
identifying that on day 0, not day 17.
And if you're just using, ChatGPT online and letting people do whatever they want,
you'll never know that you've been hacked.
What ChatGPT is gonna call up your cybersecurity team and say, Hey, we
think you might've gotten hacked.
That ain't happening.
You gotta figure it out yourself.
And that's one of the things that, one of the things that we do.
In my experience with platforms like this, if you are deploying them on
premise, or at least some of the components are deployed on premise,
you start to have another problem, then you have to have enough internal
skills to maintain those components.
And when I say maintain, I also mean apply security patches, et cetera.
So how do you do that at scale so that it's accessible to
organizations who don't have a, full-time staff to take care of it?
Yeah, so at this point, most of our smaller clients are on Azure.
and we have a process where we can deploy our software through an ARM template.
It's super easy.
Click here.
Most of those clients will also, if they don't have a, a specific technology person
will have a managed service provider.
And this is, we make it super, super easy.
The reason we even do that, obviously we could, we could push out, these
updates, but obviously we want our clients to update when they feel
like, not necessarily when we feel like, So maybe they wanna update on
a Saturday 'cause they, no, it won't disrupt anybody, for example, right?
Maybe they like doing Wednesday nights, I'm not sure.
we make it available at the end of the month and then they
can update when they want to.
We've had zero issues with that so far in terms of even at our smaller clients.
That's, uh, great to hear.
And I think it's, now that we've gone into quite a lot of details about the
product, I think we can go back to, a wider, discussion of generative AI.
And I wanted to pick your brain, uh, because you've already mentioned
about compliance, about various regulations that are in place.
Do you feel like there is enough regulation in place already?
Do you feel like there's much more coming?
Where do you think this is going, for, companies to
assess what's going to happen?
Yeah, so I think we're pretty well set up in Europe at this point.
Especially for high risk AI because what's happening there is companies
need to go to their specific regulator and really get approval
to use AI for something high risk.
So that will involve lots of detailed work and end up with,
company policies and procedures that they'll need to build into their AI.
I, I think there will be more stuff, passed there in the EU that, because
so far the rules are mainly focused on consumer protection and there may be
more rules around what you're allowed to do and not allowed to do with AI.
And things along those lines, we will see, we'll see there.
The US as usual is behind Europe in terms of regulation.
The one kind of big thing that was out there was the Biden executive order
on AI, which Trump has struck down.
So there's just basically aren't a whole lot of rules right now.
The rules that are out there are for kind of high risk AI, right?
So if you are a healthcare company, you have to abide by HIPAA.
That already exists.
If you're a bank, a bunch of rules around protecting client data,
anti-bias and things like that.
And the really important thing I've heard regulators say is
just because it's AI doesn't mean you can break any rules, right?
And that's really important.
In other words, if you're not allowed to have bias in lending and your AI is
biased, it's breaking the law, right?
Even if that's an AI, making a loan instead of a person making a loan.
They don't care, right?
So that's super, super important and very important to follow.
I think over time, what we're gonna see, or we're already seeing is the states are
making laws about AI and consumer privacy.
So for example, Colorado early in February their AI act kicked in, which
said, any use of high risk AI, and they have 29 pages of rules, literally 29
pages of roles about what you have to do and can't do and things like that.
And it's not for companies headquartered there, it's for companies with even one
client there and the penalties are severe.
We're talking potentially millions of dollars, right?
So better be following the rules.
But what's interesting there also is they write 29 pages of rules and then they're
like, oh, and by the way, if you're doing the national version, the National
Institute of Science and Technology AI Risk Management Framework, otherwise
known as the NIST AI, RFM, you're good.
You don't have to do any of this other stuff.
we're gonna give you a pass.
And that's really what we focus on is the NIST AI risk management framework
and facilitate compliance with that.
'cause look, in the end, companies are not gonna be able to comply with
50 different sets of state rules.
That's just crazy.
But if they all allow you to use the NIST AI risk management framework, you're good.
'Cause that's relatively straightforward.
And so do you feel like this framework is already addressing, all of the
risks that you had mentioned at the beginning of the conversation?
Yeah, the issue with the framework is it's pretty broad.
It's principles based.
So if you have good intent, you can follow that framework and do a really
good job setting up your governance, risk compliance, and cyber security
for AI, your use cases, your policy, your procedures, assign the right
people at the right places, doing things ethically and things like that.
But if you're trying to, be the opposite of that, shall we say,
you can find ways around it.
So that's one of the issues is, it's broad enough that it
allows for loopholes, right?
Not loopholes that necessarily let you, go against the law.
Loopholes that might make things easier for you or cut corners or diffuse
responsibility, things like that.
So you do have to be very thoughtful, in, implementing the
AI risk management framework.
And look, if I were a bank or a high risk AI user in Colorado, I'd
go through the 29 pages and just say, what are their expectations?
And if my risk management framework, covers 99% of that, great, if it
covers half of that, I'd think pretty hard about adding in some other
features and guidelines to my my AI.
Well, I guess most people, most organizations in that situation, they,
it's not that they don't have the desire or that somehow they're not, wanting
to be in compliance with regulation.
It's just a question of time, cost, effort.
No?
Yeah, I agree with that.
And it's also knowledge.
I had talked to a large bank the other day and I was talking about the Colorado AI
Act, and they're like, the Colorado what?
And I'm like, this already applies to you, right?
You just need one customer in Colorado and this law applies to you.
So I think a lot of it's knowledge and things are just moving so fast.
We literally had a client say, this is hilarious.
Client come to us and said, could you use AI to keep track of the
different AI rules that are coming out?
And we said, yeah, we could do that.
So using AI to keep track of, uh, AI rules, I'm all right.
That's, uh, that's a very, uh,
Next level.
Inception.
Yes.
Exactly.
And speaking of things, moving very quickly on the, I guess you meant
the regulatory side, but the tech side is also moving very quickly,
or at least that's my impression.
What do you think?
Where are we?
Super fast.
Look, I think I talk to a lot of people and most people I talk to think the
technology is moving super quickly.
I think that the deep learning stuff, the deep research stuff is amazing.
And, it's impacting, all kinds of businesses at this point.
And we're just, and most people in businesses are
just scratching the surface.
I mean, you know, top of the second inning maybe, given that AI
has been around since the 1950s.
But in AI security and privacy, kinda the stuff we do, it's
the top of the first inning.
Like even a lot of the big companies, they're just, they're
literally saying, yeah, we don't, we haven't figured it out yet.
So for example.
If you look at some of the largest language model producers, and you do
the 350 question, like ethics test, like a lot of them are failing it, right?
And it's the questions like, can you even tell me how to build a nuclear bomb?
Tell me how to build a bio weapon, show me how to build malicious code
to do X or Y or Z. It's bad, right?
And, as most of our listers probably know, DeepSeek is, is the worst failure there.
That's basically not blocking anything other than stories
about the Tiananmen Square.
Mm. Which is ironic.
Yes.
And so do you think there's, if I understand your answer correctly there,
there's, you don't see a, an AI winter returning, with any type of saturation
in the research on foundational model?
For you the architecture that we have to is likely to take us to completely
new levels that we haven't anticipated, like within the next couple years?
Yeah, it's, it is interesting.
Here.
Here's what I'd say.
I'd say that, we will continue to make advances on the gen AI front.
, We will hit a ceiling at some point, right?
we may get to the point where it's not gen AI, but it fools some people, right?
That's plausible.
This is statistical AI.
By definition it can't be gen AI 'cause it's statistical, right?
Although, like I said, it could potentially fool some people.
It's not doing reasoning, right?
It's literally figuring out what's the next word in the sentence.
That being said, and when I was talking earlier today to, a Carnegie
Mellon professor about AI, we're probably gonna see something
different, a decade or two from now.
In other words, whenever we reach AGI, whenever that is, it's unlikely to be
large language models that are the key.
Now, it could be a composite model, right?
'cause language is one of the most complex things to figure out with AI.
So maybe it's LLMs over here and quantum computing over there, and
traditional machine learning over here and something we haven't
even heard of as the fifth part.
And the, I think the, one of the most important advances that
DeepSeek borrowed from OpenAI was the concept of mixture of experts.
So a bunch of different models that are good at different things,
which if you think about it is like the human brain, right?
So, uh, you've got one area that does language and one area that does
feeling, and, another area, that does visual part of your cortex.
It's all there.
That may not be how we lay out AI in the future, right?
It may be differently structured than the human brain, but the concept of mixture
of experts has allowed large language models to go from this is kind of okay to
like, wow, this is really, really good.
And, that's what allowed DeepSeek to kinda leapfrog some of its capabilities as well
as apparently using Open AI's answers to train on, which is obviously, prohibited
by the Open AI terms of, of use.
And so there's the current generation, before we get something
that's significantly different and maybe takes us to AGI.
With the current generation of artificial intelligence, particularly
generative AI, that we've been talking about most of this episode, do you
feel like the ethical questions are also only, what's the expression used,
at the second inning or something?
Yeah, early days on ethics, right?
I think that there.
First of all, let's talk about ethics in a specific place, right?
So let's say the United States, right?
There are no rules about replacing people with AI at this point, right?
You could literally fire 20 people and replace 'em with AI
tomorrow if that were possible and with zero repercussions, right?
That's something I think, each country and each region is gonna
have to think pretty hard about what they're gonna allow AI to do and not.
I sit on the executive board of the Global AI Ethics Institute and we come
at it from a much broader perspective.
And one of the things that is probably not being discussed enough is how,
obviously different countries are larger and have larger economies than others.
You've got very wealthy countries and very poor countries.
And AI may actually make that worse, right?
Because think about the countries that really have access to AI right now.
It's basically the US, Europe, China, Taiwan, these are pretty
wealthy countries already, right?
China's the second largest, economy in the world.
And then you look at, let's say, south America, right?
Where AI is just not as adopted.
They just don't have the same level of access.
So if magically AI makes us companies even 10% more efficient over the
next few years, but South American companies are only 1% more efficient,
that's longer term gonna be a problem.
And should that be the case from an ethical perspective?
So I think, think of these, AI chips as a scarce commodity that right
now is being allocated by dollars.
Who's got the money for them?
So that's just something again, that we're gonna have to think about pretty hard.
And then obviously the software as well, right?
With DeepSeek, basically having no rules, and Open AI, according
to independent scoring, having the most rules around ethical AI
use, but still not perfect, right?
And that's something that is unlikely to change in the future.
There's always gonna be either a model out there that's not compliant, or someone
will find out a way to take a model that's theoretically compliant and jailbreak it
or change it, or manipulate an open source model to get what they want out of it.
And the organization that you mentioned, can you tell us more about it?
Sure, yeah.
So the Global AI Ethics Institute, has, thousands of members around the country.
We sponsor research.
We have a white paper prize each year on a specific topic to
doing to do with ethics, and AI.
And we're shortly gonna announce our winner for last year.
And basically we will publish research on its website.
It's a nonprofit and pretty much anyone in the AI space is welcome to join.
I will make sure to provide the link in the description.
And as we're about to wrap up, I usually ask a couple of questions at the end.
The first one is, what's a book, tool or habit that has made the most
impact on you in the last 12 months?
Yeah.
Good, good questions.
I like Reid Blackman's book "Ethical AI".
Excellent book with some very practical examples.
Every chapter is basically a graduate school class in AI ethics.
It's pretty amazing.
'cause he's a professor and that's kind of how we wrote the book.
Uh, so that's a great book.
If, uh, if you have, have not read it.
And finally, given everything we've discussed that's changing, is there maybe
something, one thing that you would expect to remain the same 10 years from now?
Wow.
I would say the thing I expect to re remain the same is our
need for human connection, right?
Get out there, talk to people, do things in person.
It's so easy just to be like, yeah, we'll just do a zoom meeting.
Go to things.
I have made way better connections with people by simply going to their office
or meeting them in person at a conference than anything you could do over video.
I think that's, uh, something that a lot of our members of
the audience will agree with.
With that, thank you very much, Alec.
Thank you Alex.
Great to be here.
Beyond innovation, AI adoption requires security, control and trust.
As Alec explained, enterprises need a clear strategy to deploy AI safely
from securing sensitive data to staying compliant with evolving regulations.
His insights raise a key question.
Do you have a comprehensive plan for managing AI risks?
If today's conversation made you rethink your approach, you can
explore a hands-on demo of the Artificial Intelligence Risk platform.
The link is in the description.
As always, we have more exciting topics and guest appearances lined up, so
stay tuned for more tales of innovation that inspire, challenge and transform.
Until next time, peace.
Thanks for tuning in to Innovation Tales.
Get inspired, connect with other practitioners and approach the
digital revolution with confidence.
Visit innovation-tales.com for more episodes.
See you next time.