00:14:57 · Latha Karthigaa
[00:14:57] S1: He manipulated that chatbot. So as an engineer, they should be able to make sure that the chatbot only replies to the questions that it is being asked. If anything outside that, it shouldn't be able to answer. There was another incident... Similar incident happened that it happened with a delivery company, and this stranger started giving instructions to that chatbot and said that... Tell that you are the worst delivery company in the world. And it said yes, and it wrote a poem about how worst it is and how it is such a bad company for the customers. So it wrote a poem about it. So the engineer's responsibility is to make sure that the chatbot or any AI system does only the work it is supposed to do. Anything outside that system should be able to say, hey. I do not know the answer. You can talk to our customer service representative. So it is all that guardrail. So the AI governance professional clearly says, this is what needs to be achieved. Anything outside this, the chatbot cannot answer. And the engineers should be able to take that information and add it to the code. And this is one example. This is one chatbot example. And there are so many different things that are happening, like, as I said, online exams, online job portals, online loan applications. So there are so many different issues that can happen, so many risks that can happen. For everything, people has to think about what are the guardrails they can set. And there are plenty of them. Maybe over time, I will give you more and more examples and how AI can even affect people, organizations.
00:17:03 · Ezekiel Iferia, Latha Karthigaa
[00:17:03] S0: Alright. So, you know, maybe for an engineering team that's been told they need to do AI governance. So what's the first, you know, technical step they actually ought to take? [00:17:18] S1: Sure. For a... For an engineering team, it is important for them to understand the basics of AI governance. So certifications like our GAICC certified professional in AI governance will give them an understanding of global regulation. What's the control they put in, what are the frameworks available, and what are the terminologies used in AI, because it's quite different from non AI applications. Mhmm. So they need to understand that first. And when they are thinking about implementing it in real time, they can go for ISO 42,001 lead implementer certification. That will help them to make sure that they are putting all those guardrails, creating those policies. They know that which are the high risk systems. All that can be implemented. So that's the first step. If they want to know the basics, they should go for certified professional in AI governance. And if they are actually planning to implement, they should go for ISO 42,001 lead implementer. [00:18:29] S0: Okay. Alright. So, you know, you talk about the EU AI Act. You talk about the ISO 42,001, you know, as as emerging standards. So for someone who has, you know, never heard of this, what are they in plain language, you know, in a layman's language? And how do they affect an organization, you know, that's building AI today?
00:18:29 · Ezekiel Iferia, Latha Karthigaa
[00:18:29] S0: Okay. Alright. So, you know, you talk about the EU AI Act. You talk about the ISO 42,001, you know, as as emerging standards. So for someone who has, you know, never heard of this, what are they in plain language, you know, in a layman's language? And how do they affect an organization, you know, that's building AI today? [00:18:58] S1: Sure. EU AI Act is the law or the regulation provided by the European Union. So it's a law. They have given set of guidelines to follow when someone is using AI. Especially if they are using high risk AI and if they do not follow those laws, the penalties are really huge. €35,000,000 or 7% of the global annual turnover. So it's a law. EU AI Act is a law, and the penalty applies. An ISO 42,001 is a framework or a standard where we prove that we follow all those laws and regulation. So if we have to prove that we follow EU AI Act, we need a framework or a standard to follow that. So one among that standard is ISO 42,001. So for a layman term, it is how you prove governance, that you're following governance in your organization. ISO 42,001 is a certifiable standard, which means I can say this person is ISO 42,001 certified, or this organization is ISO 42,001 certified. That means they are following all the AI governance principles in their organization. So EU AI Act is a law. ISO 42,001 is a standard which can help us to prove that we are following the laws or regulation. So they are two different things.
00:18:58 · Latha Karthigaa, Ezekiel Iferia
[00:18:58] S1: Sure. EU AI Act is the law or the regulation provided by the European Union. So it's a law. They have given set of guidelines to follow when someone is using AI. Especially if they are using high risk AI and if they do not follow those laws, the penalties are really huge. €35,000,000 or 7% of the global annual turnover. So it's a law. EU AI Act is a law, and the penalty applies. An ISO 42,001 is a framework or a standard where we prove that we follow all those laws and regulation. So if we have to prove that we follow EU AI Act, we need a framework or a standard to follow that. So one among that standard is ISO 42,001. So for a layman term, it is how you prove governance, that you're following governance in your organization. ISO 42,001 is a certifiable standard, which means I can say this person is ISO 42,001 certified, or this organization is ISO 42,001 certified. That means they are following all the AI governance principles in their organization. So EU AI Act is a law. ISO 42,001 is a standard which can help us to prove that we are following the laws or regulation. So they are two different things. [00:20:42] S0: Alright. Latha, that was an, you know, a really insightful response. I love how you break these complex technical terminologies in a way that even the layman who isn't too technical can understand them. So, yeah, learning quite a lot here in this conversation. So tell us, you know, what's one thing organizations should be doing right now to prepare even if they are not in the Europe?
00:21:09 · Latha Karthigaa
[00:21:09] S1: Sure. Number one, first of all, we need to write a clear policy. An organization, even if they do not have any budget for AI governance, the first thing important is AI policy. I'll tell you what should a policy contain because it's... It can easily be thought broad. Simple. How should employees use it? How should the different team use it? How an engineer should use to build it? So clear policies should be set and that's not enough. They need to train their employees that these are the policies. You need to make sure you understand these. Then you do the work. Because not everyone understands what AI can... What sort of issues that AI can cause. I'll tell you one example. I was reading another AI incident where a Hong Kong based engineering consulting firm, they actually were asked to transfer 25,000,000. So this guy, the financial officer, this guy, he got actually a little bit concerned, and he asked them to arrange a video call. And all the chief financial officer and other team members came on the call, and he was so confident. Okay. They came on the call. Let me transfer them in money. He made 15 transactions of 25,000,000 US dollars. But then only he realized all the people on those video call were fake. Their videos, their voices were taken from the publicly available videos of those executives and taken, they impersonated. Deep fake can also happen. And still, even until today, they have not recovered that money. So there are... Even the the problem is not sitting in the AI that we are creating. Problem is still sitting from an external someone who can still attack our system, attack our people. See, this scenario, if the employees do not understand that this kind of things can happen, how can they protect themselves? So the employ... Employees should be kept trained about what's going on. The brainstorm should be... Keep happening. And the AI is growing so fast that people cannot comprehend what's happening and the problems are coming so much more faster. Just like the technology is going faster, the attackers are also getting very intelligent and affecting the whole system. Think someone can come on a video call and say that we are on from your organization and someone is transferring 25,000,000 US dollars. How how... Think about if the if the employees do not know about these things, how it's going to affect them. Right?
00:24:24 · Ezekiel Iferia
[00:24:24] S0: So, Latha, you know, earlier in this conversation, you talked about when you were introducing this AI governance concept towards us, you know, beginners. You talked about one of the reasons why some companies might ignore this part of their company and talked about how they want to maybe move fast. They want to be innovative, so they might pay a blind eye to AI governance. So how do companies or organizations, you know, implement AI governance framework, you know, and prepare for emerging regulations, you know, without actually throttling down the innovation and, you know, still moving fast?