00:17:03 · Ezekiel Iferia, Latha Karthigaa
[00:17:03] S0: Alright. So, you know, maybe for an engineering team that's been told they need to do AI governance. So what's the first, you know, technical step they actually ought to take? [00:17:18] S1: Sure. For a... For an engineering team, it is important for them to understand the basics of AI governance. So certifications like our GAICC certified professional in AI governance will give them an understanding of global regulation. What's the control they put in, what are the frameworks available, and what are the terminologies used in AI, because it's quite different from non AI applications. Mhmm. So they need to understand that first. And when they are thinking about implementing it in real time, they can go for ISO 42,001 lead implementer certification. That will help them to make sure that they are putting all those guardrails, creating those policies. They know that which are the high risk systems. All that can be implemented. So that's the first step. If they want to know the basics, they should go for certified professional in AI governance. And if they are actually planning to implement, they should go for ISO 42,001 lead implementer. [00:18:29] S0: Okay. Alright. So, you know, you talk about the EU AI Act. You talk about the ISO 42,001, you know, as as emerging standards. So for someone who has, you know, never heard of this, what are they in plain language, you know, in a layman's language? And how do they affect an organization, you know, that's building AI today?
00:18:29 · Ezekiel Iferia, Latha Karthigaa
[00:18:29] S0: Okay. Alright. So, you know, you talk about the EU AI Act. You talk about the ISO 42,001, you know, as as emerging standards. So for someone who has, you know, never heard of this, what are they in plain language, you know, in a layman's language? And how do they affect an organization, you know, that's building AI today? [00:18:58] S1: Sure. EU AI Act is the law or the regulation provided by the European Union. So it's a law. They have given set of guidelines to follow when someone is using AI. Especially if they are using high risk AI and if they do not follow those laws, the penalties are really huge. €35,000,000 or 7% of the global annual turnover. So it's a law. EU AI Act is a law, and the penalty applies. An ISO 42,001 is a framework or a standard where we prove that we follow all those laws and regulation. So if we have to prove that we follow EU AI Act, we need a framework or a standard to follow that. So one among that standard is ISO 42,001. So for a layman term, it is how you prove governance, that you're following governance in your organization. ISO 42,001 is a certifiable standard, which means I can say this person is ISO 42,001 certified, or this organization is ISO 42,001 certified. That means they are following all the AI governance principles in their organization. So EU AI Act is a law. ISO 42,001 is a standard which can help us to prove that we are following the laws or regulation. So they are two different things.
00:18:58 · Latha Karthigaa, Ezekiel Iferia
[00:18:58] S1: Sure. EU AI Act is the law or the regulation provided by the European Union. So it's a law. They have given set of guidelines to follow when someone is using AI. Especially if they are using high risk AI and if they do not follow those laws, the penalties are really huge. €35,000,000 or 7% of the global annual turnover. So it's a law. EU AI Act is a law, and the penalty applies. An ISO 42,001 is a framework or a standard where we prove that we follow all those laws and regulation. So if we have to prove that we follow EU AI Act, we need a framework or a standard to follow that. So one among that standard is ISO 42,001. So for a layman term, it is how you prove governance, that you're following governance in your organization. ISO 42,001 is a certifiable standard, which means I can say this person is ISO 42,001 certified, or this organization is ISO 42,001 certified. That means they are following all the AI governance principles in their organization. So EU AI Act is a law. ISO 42,001 is a standard which can help us to prove that we are following the laws or regulation. So they are two different things. [00:20:42] S0: Alright. Latha, that was an, you know, a really insightful response. I love how you break these complex technical terminologies in a way that even the layman who isn't too technical can understand them. So, yeah, learning quite a lot here in this conversation. So tell us, you know, what's one thing organizations should be doing right now to prepare even if they are not in the Europe?
00:21:09 · Latha Karthigaa
[00:21:09] S1: Sure. Number one, first of all, we need to write a clear policy. An organization, even if they do not have any budget for AI governance, the first thing important is AI policy. I'll tell you what should a policy contain because it's... It can easily be thought broad. Simple. How should employees use it? How should the different team use it? How an engineer should use to build it? So clear policies should be set and that's not enough. They need to train their employees that these are the policies. You need to make sure you understand these. Then you do the work. Because not everyone understands what AI can... What sort of issues that AI can cause. I'll tell you one example. I was reading another AI incident where a Hong Kong based engineering consulting firm, they actually were asked to transfer 25,000,000. So this guy, the financial officer, this guy, he got actually a little bit concerned, and he asked them to arrange a video call. And all the chief financial officer and other team members came on the call, and he was so confident. Okay. They came on the call. Let me transfer them in money. He made 15 transactions of 25,000,000 US dollars. But then only he realized all the people on those video call were fake. Their videos, their voices were taken from the publicly available videos of those executives and taken, they impersonated. Deep fake can also happen. And still, even until today, they have not recovered that money. So there are... Even the the problem is not sitting in the AI that we are creating. Problem is still sitting from an external someone who can still attack our system, attack our people. See, this scenario, if the employees do not understand that this kind of things can happen, how can they protect themselves? So the employ... Employees should be kept trained about what's going on. The brainstorm should be... Keep happening. And the AI is growing so fast that people cannot comprehend what's happening and the problems are coming so much more faster. Just like the technology is going faster, the attackers are also getting very intelligent and affecting the whole system. Think someone can come on a video call and say that we are on from your organization and someone is transferring 25,000,000 US dollars. How how... Think about if the if the employees do not know about these things, how it's going to affect them. Right?
00:24:24 · Ezekiel Iferia
[00:24:24] S0: So, Latha, you know, earlier in this conversation, you talked about when you were introducing this AI governance concept towards us, you know, beginners. You talked about one of the reasons why some companies might ignore this part of their company and talked about how they want to maybe move fast. They want to be innovative, so they might pay a blind eye to AI governance. So how do companies or organizations, you know, implement AI governance framework, you know, and prepare for emerging regulations, you know, without actually throttling down the innovation and, you know, still moving fast?
00:25:16 · Latha Karthigaa
[00:25:16] S1: Sure. First of all, I read through most of the regulations that are already there, like European Union, US, UK. I even published all of them on my YouTube channel. So when I read about all the regulation, there are some common things that are in most of the regulation that people need to understand. Any country trying to have their regulation, they are getting inspired from EU AI Act. EU AI Act is the first comprehensive AI law in the whole world. So they are getting inspired from that, and so that's one thing everyone needs to know. We don't need to mean... Understand all the regulation around the world. They are almost similar. So answer your question about how to implement it. I started off with regulation because we are creating all these frameworks to prove that we are following all the laws and regulation. Right? So the first way of implementing is we need to choose a proper framework. And there are so many frameworks around the world. The first one, like OECD principles that came in 2019. Then NIST AI RMF, it is AI risk management framework which was released by National Institute of Science and Technology in The USA. So that's another framework for AI. And ISO 42,001 is another framework also for AI. And there are so many of them. Google released their own framework few days ago. And even GAICC, we have our full enterprise level AI framework as well. So there are so many frameworks that are being released. So people have to choose a correct framework and follow the instructions to implement that framework for their AI systems. But here now, I told you so many frameworks. I'll tell you how to pick the correct one. I said about OECD. It is a voluntary framework, which means you can choose to do it or not. NIST AI RMF. That is also a voluntary framework, so organization choose to do it. But ISO 42,001 is the world's first certifiable framework, which means I can say today, okay, this company is ISO 42,001 certified, which means we know that they have implemented the ISO 42,001 framework. But you can't do with any other frameworks. So organization quite commonly choose a framework that they can get certified upon. And if they don't have a budget, they can even still choose another framework like NIST AI RMF. That's not going to cost them anything, but they adopt and use it.