00:18:58 · Latha Karthigaa, Ezekiel Iferia
[00:18:58] S1: Sure. EU AI Act is the law or the regulation provided by the European Union. So it's a law. They have given set of guidelines to follow when someone is using AI. Especially if they are using high risk AI and if they do not follow those laws, the penalties are really huge. €35,000,000 or 7% of the global annual turnover. So it's a law. EU AI Act is a law, and the penalty applies. An ISO 42,001 is a framework or a standard where we prove that we follow all those laws and regulation. So if we have to prove that we follow EU AI Act, we need a framework or a standard to follow that. So one among that standard is ISO 42,001. So for a layman term, it is how you prove governance, that you're following governance in your organization. ISO 42,001 is a certifiable standard, which means I can say this person is ISO 42,001 certified, or this organization is ISO 42,001 certified. That means they are following all the AI governance principles in their organization. So EU AI Act is a law. ISO 42,001 is a standard which can help us to prove that we are following the laws or regulation. So they are two different things. [00:20:42] S0: Alright. Latha, that was an, you know, a really insightful response. I love how you break these complex technical terminologies in a way that even the layman who isn't too technical can understand them. So, yeah, learning quite a lot here in this conversation. So tell us, you know, what's one thing organizations should be doing right now to prepare even if they are not in the Europe?
00:21:09 · Latha Karthigaa
[00:21:09] S1: Sure. Number one, first of all, we need to write a clear policy. An organization, even if they do not have any budget for AI governance, the first thing important is AI policy. I'll tell you what should a policy contain because it's... It can easily be thought broad. Simple. How should employees use it? How should the different team use it? How an engineer should use to build it? So clear policies should be set and that's not enough. They need to train their employees that these are the policies. You need to make sure you understand these. Then you do the work. Because not everyone understands what AI can... What sort of issues that AI can cause. I'll tell you one example. I was reading another AI incident where a Hong Kong based engineering consulting firm, they actually were asked to transfer 25,000,000. So this guy, the financial officer, this guy, he got actually a little bit concerned, and he asked them to arrange a video call. And all the chief financial officer and other team members came on the call, and he was so confident. Okay. They came on the call. Let me transfer them in money. He made 15 transactions of 25,000,000 US dollars. But then only he realized all the people on those video call were fake. Their videos, their voices were taken from the publicly available videos of those executives and taken, they impersonated. Deep fake can also happen. And still, even until today, they have not recovered that money. So there are... Even the the problem is not sitting in the AI that we are creating. Problem is still sitting from an external someone who can still attack our system, attack our people. See, this scenario, if the employees do not understand that this kind of things can happen, how can they protect themselves? So the employ... Employees should be kept trained about what's going on. The brainstorm should be... Keep happening. And the AI is growing so fast that people cannot comprehend what's happening and the problems are coming so much more faster. Just like the technology is going faster, the attackers are also getting very intelligent and affecting the whole system. Think someone can come on a video call and say that we are on from your organization and someone is transferring 25,000,000 US dollars. How how... Think about if the if the employees do not know about these things, how it's going to affect them. Right?
00:24:24 · Ezekiel Iferia
[00:24:24] S0: So, Latha, you know, earlier in this conversation, you talked about when you were introducing this AI governance concept towards us, you know, beginners. You talked about one of the reasons why some companies might ignore this part of their company and talked about how they want to maybe move fast. They want to be innovative, so they might pay a blind eye to AI governance. So how do companies or organizations, you know, implement AI governance framework, you know, and prepare for emerging regulations, you know, without actually throttling down the innovation and, you know, still moving fast?
00:25:16 · Latha Karthigaa
[00:25:16] S1: Sure. First of all, I read through most of the regulations that are already there, like European Union, US, UK. I even published all of them on my YouTube channel. So when I read about all the regulation, there are some common things that are in most of the regulation that people need to understand. Any country trying to have their regulation, they are getting inspired from EU AI Act. EU AI Act is the first comprehensive AI law in the whole world. So they are getting inspired from that, and so that's one thing everyone needs to know. We don't need to mean... Understand all the regulation around the world. They are almost similar. So answer your question about how to implement it. I started off with regulation because we are creating all these frameworks to prove that we are following all the laws and regulation. Right? So the first way of implementing is we need to choose a proper framework. And there are so many frameworks around the world. The first one, like OECD principles that came in 2019. Then NIST AI RMF, it is AI risk management framework which was released by National Institute of Science and Technology in The USA. So that's another framework for AI. And ISO 42,001 is another framework also for AI. And there are so many of them. Google released their own framework few days ago. And even GAICC, we have our full enterprise level AI framework as well. So there are so many frameworks that are being released. So people have to choose a correct framework and follow the instructions to implement that framework for their AI systems. But here now, I told you so many frameworks. I'll tell you how to pick the correct one. I said about OECD. It is a voluntary framework, which means you can choose to do it or not. NIST AI RMF. That is also a voluntary framework, so organization choose to do it. But ISO 42,001 is the world's first certifiable framework, which means I can say today, okay, this company is ISO 42,001 certified, which means we know that they have implemented the ISO 42,001 framework. But you can't do with any other frameworks. So organization quite commonly choose a framework that they can get certified upon. And if they don't have a budget, they can even still choose another framework like NIST AI RMF. That's not going to cost them anything, but they adopt and use it.
00:28:13 · Latha Karthigaa, Ezekiel Iferia
But if they have to prove themselves to someone, hey, we are certified, is much more stronger than we say, hey, we follow NIST AI RMF framework. You know? You see the difference? So Yeah. Organizations need to choose what is their liability. Based on that, they have to choose which framework would be more suitable for their organization. [00:28:40] S0: So I'd like to know know... Before we wrap things up, there any situations where too much governance killed a good idea and, you know, a situation where too little governance created a disaster?
00:28:56 · Latha Karthigaa
[00:28:56] S1: There are so many situations where without governance, they had created disasters. I read all the incidents. There are thousands of incidents around the world that are very popular ones. There are situations where governance have slowed down the innovation in many cases because especially in European Union, there are certain systems that are... They cannot implement it because as I said, their penalties are so huge. So when they think about doing that, they can't do it. Even there are certain things even in our organization because we are also selling our certification in the European Union, and we use online exams, AI proctored exams. So we need to be very clear in terms of what do we do. Sometimes we even think like, probably shall we stop selling in European Union, you know, because we don't want to take the risk of, you know, going through that. So we have to be very clear in what we think before we even... We went into the European Union market. So sometimes these regulations can slow down the growth of an organization. So it happens, and... But having correct governance can actually, in the longer run, will speed up the things that we'll do. It's the same like as I said before, a highway. Of course, initially it will take a long time to build a highway. But once it is done, hundred years, we can keep traveling on that highway in such a high speed. That's what AI governance is gonna give.