Brian Allen Replaces AI Committees with Five-Pillar Governance Model

Brian Allen 提出五支柱治理模型取代 AI 委员会 组织必须从委员会主导的会议模式转向程序化治理框架，明确决策容忍度与问责机制，以跟上 AI 发展步伐并规避法律风险。 Brian Allen 提出了一个五支柱程序化 AI 治理框架，旨在通过结构化、基于风险信息的决策机制取代临时的委员会模式。他强调了具体的实施步骤，包括确立领导层授权、区分可解释性（explainability）与可诠释性（interpretability），以及指定如总法律顾问等强有力的项目负责人。面对 AI 时代的指数级发展速度，Allen 敦促高管从因恐惧而暂停转向战略赋能，并在平衡即时风险、文化维系以及技术持续演进之间找到平衡。 Brian Allen 提出企业必须确立“知情决策标准”（Informed Decision Standard），并介绍了 AI 监督中心基于 NIST AI RMF 与判例法构建的治理框架，涵盖治理、风险导向系统、信任与保证、基于风险的策略以及上报与披露五大核心支柱。 (20:43) 针对高管普遍关注的可解释性难题，Allen 强调应将透明决策过程与底层神经网络的“可理解性”（Interpretability）相区分；同时，治理落地需要由总法律顾问等强力高层主导，并针对具体业务场景设定细化的风险容忍度。 (25:10) 面对第四次工业革命带来的指数级技术迭代，企业需摆脱陈旧季度流程造成的无谓停滞，将程序化 AI 治理从被动防守转化为兼顾商业回报、决策敏捷性与法律免责保护的赋能机制。 (28:42) Allen 指出推动组织变革的四大动力为重大事件、诉讼、法规和卓越的管理；相较于遥远的灭绝级生存风险，当前企业更应关注直接替换员工所带来的文化与认知主权流失，确保 AI 充当人类能力的放大器而非组织底蕴的替代品。 (34:03)

Brian Allen argues that organizations must replace fragmented, ad-hoc AI oversight with a structured, five-pillar governance framework that satisfies an "Informed Decision Standard." Rather than halting deployments over manageable risks or distant existential threats, programmatic oversight enables business speed, regulatory defensibility, and the preservation of human institutional knowledge. The Five-Pillar Programmatic Governance Architecture (20:43) Allen asserts that current AI regulation remains incoherent and piecemeal because society has not yet experienced a catastrophic harm that would inevitably spur heavy legislative mandates. To establish an "Informed Decision Standard" ahead of such events, the Center for AI Oversight designed a reference program mapped to the NIST AI RMF, case law, and existing regulations. The architecture organizes oversight across 14 domains into five core pillars: Governance (defining accountability and governing bodies), Risk-Informed System (methodologies for risk tolerances and opportunity scoping), Trust and Assurance (operational resilience, cybersecurity, agent oversight, and data governance), Risk-Based Strategy (balancing tool selection, budget, and deployment speed against risk), and Escalation and Disclosure (protocols for when risks exceed tolerances alongside regulatory reporting pathways). Allen notes that most enterprises already possess these component capabilities. However, because they operate through isolated initiatives, ad-hoc committees, and quarterly reports, organizations fail to achieve the operational speed and legal defensibility required in production environments. Implementation Authority and Reframing Explainability (25:10) Operationalizing AI oversight requires conducting baseline assessments of current capabilities, establishing formal organizational mandates, and defining use-case-specific risk tolerances rather than vague statements like having a "moderate appetite" for risk. Allen emphasizes that executive authority is critical to programmatic success. Recounting his experience at PwC, he notes that positioning the General Counsel as the head of the cyber governance body provided essential board-level defensibility, whereas resistant technical leadership was eventually dismissed because organizations ultimately require transparency. To address C-suite anxieties surrounding explainability, Allen distinguishes between technical interpretability and functional explainability. Demanding full interpretability of complex models is akin to expecting a human to map every active neuron during thought—a standard that would paralyze AI deployment. Allen states that senior regulators accept a model grounded in transparency: clearly documenting the input data, underlying intentions, expected outputs, and the specific rationale for why leadership trusts the system. Aligning Oversight with Fourth Industrial Revolution Velocity (28:42) A programmatic oversight program is designed to shift executive mindset from fear of downside risk to strategic enablement under pressure from Wall Street, competitors, and substitution risks. Allen observes that corporate focus has moved beyond initial headcount reductions toward measuring return on investment and efficiency gains. Over the prior two years, he argues, organizations imposed unnecessary pauses through legacy quarterly review processes, even though risks were fully manageable outside of critical domains like warfare, biological threats, or broad societal measurement. Citing a perspective shared four years prior by the Executive Director of the World Economic Forum, Allen contrasts the 70-to-80-year timeline of the Third Industrial Revolution's IT era with the exponential velocity of the Fourth Industrial Revolution. To close this velocity gap, leadership must tune out noisy daily social media advice and adopt structured frameworks that provide business agility and defensibility under evolving judicial standards. Structural Change Drivers and Cognitive Sovereignty (34:03) Allen identifies four forces that compel organizational reform: major incidents, lawsuits, regulations, and proactive executive leadership, the latter being the only positive mechanism. When addressing audience concerns about existential AI risks, Allen dismisses apocalyptic scenarios in favor of immediate cultural challenges, terming this issue "cognitive sovereignty." While AI is currently more knowledgeable but not smarter than humans, Allen expects the technology will eventually become smarter. Consequently, Allen warns that replacing human staff with AI risks destroying institutional principles, foundational knowledge, and corporate culture. He urges executives to train junior talent in subtle nuances so that AI acts as an amplifier of human capability rather than a substitute for institutional ethos, while actively dismantling defensive corporate siloes. Allen concludes that operating effectively requires executives to embrace persistent uncertainty rather than attempting to predict future technological outcomes with legacy software cadences. As evidenced by middle-management restructuring across major technology firms, organizations must continually adapt their governance systems to maintain oversight at the speed of ongoing technological evolution.

Brian Allen提出，企业不应依赖零散的临时应对或等待灾难性事件引发严厉监管，而应建立基于五大支柱的程序化AI治理体系，在满足合规与司法“知情决策标准”的同时，赋能业务匹配第四次工业革命的指数级发展速度。 程序化治理框架与五大核心支柱 (20:43) Brian Allen指出，由于社会尚未目睹大规模、灾难性的AI危害，当前的监管尝试仍处于零散且不连贯的状态；然而一旦发生重大危害，严厉的监管必将随之而来。在此过渡期，社会必须要求领导层达到“知情决策标准”。为此，AI监督中心对标NIST AI RMF、判例法和行业法规，提出了涵盖14个领域的五大核心支柱框架：一是治理，即确立治理机构、最终问责人及参与席位；二是风险知情系统，建立明确方法来界定风险容忍度，并针对下行风险与上行机遇设定颗粒化的决策点；三是信任与保障，覆盖运营弹性、网络安全、Agent监督和数据治理；四是基于风险的战略，将业务目标、工具选型、预算执行与部署速度与风险回报平衡相对齐；五是升级与披露，规范风险越限及强制或自愿披露的处置规程。 Allen强调，多数组织实际上已具备上述框架中的许多底层组件。然而，若企业仅以临时委员会或季度汇报等被动、孤立的形式运行这些组件，将无法达到现代业务所必需的响应速度与法律抗辩力。 实施路径与“可解释性”认知重构 (25:10) 在实施层面，Allen提出了一套实操路径：企业应首先对现有能力开展基线评估，随后在法律、审计与合规负责人的支持下确立正式授权；同时，领导层必须摒弃如“对网络风险持温和偏好”等模糊表述，转而设定与具体用例挂钩的颗粒化容忍度。针对高管普遍关注的“可解释性”难题，Allen将其与底层“可解释机制”进行了区隔。他认为人类决策同样无需展示大脑神经元的物理运转细节，关键在于透明说明所用数据、意图、预期目标、最终输出以及信任该结果的依据。监管高层已认可这一区分，因为苛求底层神经网络的绝对可解释机制将使AI应用彻底陷入停滞。 推进治理落地的关键一步在于指定明确的项目负责人。Allen回顾了其在普华永道任职时的实践：他主动推动总法律顾问牵头治理机构，从而为项目确立了自上而下的权威并保护董事会与管理层免受法律追责；相反，当时持抵制态度的CIO与CISO因对抗透明化而在六个月内被免职。 商业速度与指数级发展鸿沟 (28:42) 一套成功的治理方案能将高管的精力从对下行风险的恐惧转变为战略赋能，进而匹配激烈的市场竞争节奏。董事会与高管层目前面临来自华尔街、行业竞争与技术替代的多重压力。在经历以裁员为主的阶段后，企业重点已转向衡量投资回报率与运行效率。Allen观察到，在过去两年中，企业受制于遗留的季度汇报流程，设立了大量不必要的停顿与障碍；事实上，除涉及战争武器、生物威胁或全社会尺度的特定风险外，绝大多数AI应用风险均处于可控范畴。 为说明当前所处的速度鸿沟，Allen援引世界经济论坛执行董事四年前提出的观点指出：第三次工业革命（信息技术时代）大约持续了70至80年，而第四次工业革命（AI时代）则具有持续且指数级加速的特征。面对这种演进速度，领导者必须过滤掉外部杂乱无章的日常建议，通过程序化框架向管理层提供敏捷性与风险回报平衡，从而在演进中的司法标准下获取合规保护。 组织变革动力与应对文化风险 (34:03) 基于安全管理经验，Allen总结了推动组织产生实质变革的四种力量：重大安全事件、引发结构性变化的诉讼、滞后出台的严厉法规，以及能够主动承担精算风险的良好高管治理。针对有关AI存在性威胁的提问，Allen认为现阶段更紧迫的矛盾在于“认知主权”问题。他判断，当前AI虽然在知识储备上超过人类，但智慧并未超越人类，尽管未来其智慧水平确有可能实现反超。 相较于遥远的世界末日设想，Allen敦促管理者警惕过早替代人类专业人员对组织文化带来的即时冲击。草率替换员工会侵蚀企业的文化根基、基础认知与核心原则。领导层应着力训练年轻人才洞悉业务细微差别的能力，使AI成为赋能人类专业能力的倍增器，而非组织精神的替代品。面对传统软件开发流程无法匹配AI速度的现实，管理层需接受高不确定性常态，打破部门壁垒，通过重构中层管理来适应动态治理需求。 Allen总结指出，在系统性外部监管成型之前，企业不应因合规焦虑而陷入停滞，而应主动构建制度化的治理框架。当前尚未完全解决的问题在于，组织如何在不侵蚀内部专业技能储备与文化主权的前提下，迅速重构中层管理流程以适应AI时代的指数级技术速度。

## Background 该内容由 Ai4 频道于 2026 年 8 月 18 日在 YouTube 平台发布，主讲人为人工智能监督中心（Center for AI Oversight）执行董事布莱恩·艾伦（Brian Allen）。视频简介指出，AI 是一场管理转型而非单纯的技术变革，企业应摒弃流于形式的“委员会谬误”，通过引入程序化 AI 监督框架与“知情决策标准”，在满足法定义务与合规抗辩要求的同时实现业务的高速推进。 ## TL;DR 布莱恩·艾伦结合在网络安全与风险管理领域的长期从业经验，指出不承担风险本身就是企业最大的下行风险，治理应成为推动业务敏捷决策的使能器而非阻碍。他剖析了 Caremark 判例法等司法趋势对董事及高管个人责任的严格追究，指出企业普遍陷入“委员会谬误”与滞后的季度汇报陷阱。为此，他系统阐述了包含 5 大支柱与 14 个领域的程序化监督框架，主张通过治理决策系统、精细化界定风险容忍度以及确立成文化授权，帮助企业跨越第四次工业革命的速度鸿沟，并警惕算法对组织文化底蕴与人类认知主权的隐性侵蚀。 ## Atmosphere & style 整场演讲沉稳干练且极具实战说服力，艾伦以资深 CSO 的从容姿态娓娓道来，巧妙穿插“削减 50% 预算对决”与“高管对抗透明度被解雇”等真实故事，瞬间拉紧叙事张力。分享风格既有对司法判例和治理架构冷静缜密的专业拆解，又充满对技术狂热下人才断层与组织异化的深切警示。整体给人的观感既有高屋建瓴的战略威慑感，又带有抽丝剥茧、落地破局的从容与通透。 ## Key takeaways - [01:28](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=88s) 安全与治理的本质不是被动的战术防御，而是为战略决策提供风险信息，帮助企业在风险与回报之间找到最佳平衡。 - [03:41](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=221s) 在 AI 快速演进的竞争环境下，不承担风险本身就是最大的下行风险，企业若因繁琐流程阻碍创新将面临被市场淘汰的风险。 - [06:13](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=373s) 破解“委员会谬误”：委员会仅是一个治理机构而非治理本身，治理的核心是建立一套确保组织做出明智知情决策的系统与机制，而非直接治理技术。 - [09:30](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=570s) 清晰界定 AI 治理的三层架构：监督层聚焦“谁与做什么”（界定范围与容忍度），管理层设计“怎么做”的机制，操作层负责具体执行落地。 - [12:23](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=743s) 监督职责必须实现授权成文化（Codified），依托制度化的升级机制与清晰的颗粒度标准，摆脱对人际关系的依赖，构建可抗辩的合规证据链。 - [15:04](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=904s) Caremark 等重大判例法表明，司法问责正从董事会延伸至企业高管，要求针对关键任务建立具有方法论支撑的“风险知情系统”。 - [19:24](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1164s) 负责任 AI 的合规核心是“知情决策标准”（Informed Decision Standard），强调决策流程具备充分的数据支撑与风险考量，而非苛求结果永远无误。 - [21:08](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1268s) 程序化 AI 监督框架包含五大支柱：治理体系、风险知情系统、信任与保障、基于风险的战略，以及升级与披露机制。 - [24:52](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1492s) 摒弃宽泛无意义的风险偏好口号，将风险偏好细化到具体应用场景的精确容忍度（Tolerances），并借助法务与合规力量推动高层授权落地。 - [26:05](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1565s) 重新定义“可解释性”：可解释性不是死磕底层算法机械维度的拆解，而是关于数据来源、初衷、预期目标与信任依据的决策逻辑透明度。 - [27:32](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1652s) 治理机构需由法务或合规高管领头负责以保护董事会，任何对抗风险决策透明度的技术或业务负责人都将面临被组织淘汰的结局。 - [30:10](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1810s) 第四次工业革命呈现出指数级演进速度，传统线性、按季度的审批机制造成了严重的“速度鸿沟”，需建立敏捷的程序化治理体系以适应变革。 - [35:02](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2102s) 警惕过度依赖 AI 带来的“认知主权”流失，企业应重塑人机协同文化，将 AI 视为高阶智囊以赋能人才，而非简单粗暴地套用在老旧流程上。 - [36:44](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2204s) 盲目裁减底层岗位将导致企业文化沉淀断裂与青年人才培养断层，缺乏业务底层磨砺会侵蚀企业的核心价值观与长期战略根基。 - [37:42](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2262s) 承认“不可知”是科学风险管理的成熟起点，企业必须打破传统软件工程开发逻辑与部门壁垒，通过程序化治理实现合规、安全与快速执行并进。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=4s) 讲者背景与过往教训：网络安全治理花了20年才走出的误区 作为人工智能监督中心（Center for AI Oversight）的执行董事，Brian Allen 在开场简要回顾了自己的职业履历。他曾担任《财富》100 强企业时代华纳有线（Time Warner Cable）的首席安全官（CSO），随后在安永会计师事务所（EY）与多家董事会及 C-suite 高管团队合作，指导网络安全与新兴技术的监督职责；此后他又加入银行政策研究所（Bank Policy Institute），代表全美顶尖银行与国会及监管机构交涉。如今，该中心的核心使命是向董事会、高管及监管层普及“什么是真正的 AI 监督”以及相关的法定义务。 Brian 提到，他刚与 Tomorrow Today 播客的 Shakir 录制完一期节目，对方极具深度的思考让他深有感触。他指出，当前企业对 AI 监督的讨论之所以迫切且截然不同，是因为过去在网络安全监督上犯过严重的认知错误——法庭和监管机构整整花了 20 年时间才逐渐理清网络安全的治理逻辑。面对全新的 AI 环境，企业绝不能再重蹈覆辙，沿用陈旧的思维方式和框架。 --- ### [01:28](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=88s) “把预算砍掉50%”：安全不是防御战术，而是战略风险决策 Brian 分享了他在时代华纳有线担任 CSO 大约第 10 年时经历的一桩真实事件。当时他掌管着约 1 亿美元的庞大预算，管理职责涵盖网络风险、实体安防、业务连续性、内部调查、职场暴力防范乃至配合政府的合法监听拦截。新任 CEO 和 CFO 上任后的第一次预算会议上，Brian 带着两名副总裁走进会议室，刚一坐下，对方就直接抛出一句话：“Brian，我们想把你的预算砍掉 50%。”全场随即陷入死一般的寂静。 Brian 当时平静地回应会去评估，但事后很久他一直在反思这个提问背后的逻辑漏洞：“把安全预算当成可有可无、随手可砍一半的开销，这本身反映了极大的误解。”在传统安全领域，从业者往往习惯用具体战术定义自己（如做危机管理、取证调查、身份与访问管理 IAM 等），然而安全的本质是一个“风险函数”。安全的最终产出并不是单纯的技术防护，而是**为企业战略决策提供风险信息**，以帮助企业在风险与回报之间找到最佳平衡，界定风险胃口（Appetite）与容忍度（Tolerance），从而合理配置人员与工具。 回到团队后，Brian 没有盲目硬抗，而是将每个项目分别按削减 5%、10%、15%、20% 的梯度进行压力测试，明确每项预算所保护的核心资产及其业务负责人，并拿着清单直接向这些业务利益相关方询问：“在不同削减幅度下，你们的心理舒适底线在哪里？”最终，他们得出了一个精确的数字——13.5%。在下一次会议上，Brian 明确向管理层说明：最多削减 13.5%，否则就必须把承担对应业务风险的高管请到现场表态。管理层当场认可了该方案，并且在此后很多年里再也没有质疑过他的安全预算。 ```mermaid flowchart TD accTitle: 预算削减与风险对齐机制 subgraph S1["传统战术思维（单向防护）"] A["战术堆砌: 调查 / IAM / 危机管理"] --> B["被视为纯成本中心"] B --> C["管理层盲目要求削减 50% 预算"] end subgraph S2["战略风险思维（权衡与责任）"] D["资产与业务利益相关方识别"] --> E["阶梯测试 (5% / 10% / 15% / 20%)"] E --> F["明确风险容忍度底线 (13.5%)"] F --> G["高管达成共识: 风险与回报战略平衡"] end ``` --- ### [03:41](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=221s) 拥抱新型风险关系：不承担风险本身就是最大的下行风险 Brian 强调，当年的这一教训在今天的 AI 时代尤为关键。在网络安全和传统安防领域，风险往往被视作纯粹的“下行损失”（Downside Risk），即一切可能发生的坏事。但在当下的商业环境中，“不承担风险本身就是最大的下行风险”。如果员工因为受制于繁冗流程而无法快速使用 AI 提升效率，而竞争对手已经全面提速，企业就会面临严峻的“被替代风险”（Risk of Substitution）。 因此，现代企业必须与风险建立一种全新的共生关系——**风险即战略**。董事会和高管的本职工作就是在不确定性中权衡战略的价值。然而，当前业界最大的危险在于“用旧流程去套新技术”（Taking new technology and putting it on old process），这注定会走向失败。AI 革命不仅仅是一场技术革命，它更是一场**管理革命**。如果治理体系只能像推巨石上山一样吃力，就说明监督框架的设计从一开始就偏离了方向。 --- ### [06:13](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=373s) 破除“委员会谬误”与过时的季度报告机制 AI 监督中心的研究显示，目前绝大多数（至少 88% 以上，实际比例可能更高）的企业从未公开披露过自身具备合规的监督机制，甚至根本说不清什么是“具有抗辩能力的监督”（Defensible Oversight）。许多组织依然依赖老旧的全面风险管理（ERM）和网络安全流程，采用“季度报告”的形式进行 AI 汇报。在 AI 快速演进的节奏下，季度报告的速度实在太慢，而且这类报告往往只充斥着事后的下行指标（KRI/KPI），完全忽略了错失市场机会带来的巨大损失。 在探讨风险容忍度时，合规与安全团队通常将其视作一条死线，一旦触碰就只能说“不”；但事实上，**容忍度是战略决策触发点**（"Tolerances are decision points"），它应该促使管理层思考：“我们能不能做？该不该做？现行流程是否阻碍了业务速度？该升级给谁裁决？”审计机构和监管检查往往只审计合规清单或行业标准（Best Practice/Dot your i's and cross your t's），却极少审计企业是否真正履行了对董事会做出的“容忍度承诺”。 在组织评估中，最常见的误区被称为**“委员会谬误”（The Committee Fallacy）**： - 当被问及“你们是否有 AI 治理？”时，企业通常回答：“有，我们成立了委员会，每季度开一次会。” - **委员会仅仅是一个治理机构（Governing Body），而不是治理本身。** - 治理机构不直接治理技术本身，而是治理一套**能够确保组织在风险与回报之间做出明智决策的系统与机制**（"Govern the system/program, not the technology"）。 ```mermaid flowchart LR accTitle: 委员会谬误与系统化监督对比 subgraph CF["委员会谬误 (Committee Fallacy)"] direction TB A1["设立跨部门委员会"] --> A2["按季度听取汇报"] A2 --> A3["信息知情机构<br>(Informed Body)"] A3 --> A4["无实质决策与治理效能"] end subgraph PG["系统化治理 (Programmatic Oversight)"] direction TB B1["明确治理程序与系统"] --> B2["界定风险容忍度与决策点"] B2 --> B3["赋能关键岗位快速权衡"] B3 --> B4["做出具备抗辩力的知情决策<br>(Informed Decision)"] end ``` --- ### [09:30](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=570s) 跨越“愚昧山峰”：从技术堆砌到三层治理体系（谁、做什么与怎么做） 谈及高管心态时，Brian 引用了著名的**达克效应（Dunning-Kruger Effect）**。许多领导层一开始只了解一点皮毛，自信心极度膨胀，处于所谓的“愚昧山峰”（Mount Stupid），对外宣称一切尽在掌握（"Yeah, we got it"）；但随着对技术复杂性和监管责任的了解加深，他们会跌入“绝望之谷”（Valley of Despair），私下坦言“过去我对战略充满信心，现在我完全没有把握了”。最终，通过持续认知迭代，企业才能达到真正的成熟阶段——坦然承认自身认知的局限并依靠体系进行科学管理。 ```mermaid flowchart LR accTitle: 达克效应在 AI 认知中的体现 A["初涉 AI 知识<br>极度盲目自信"] -- "登上" --> B["愚昧山峰<br>(Mount Stupid)"] B -- "认知深化与受挫" --> C["绝望之谷<br>(Valley of Despair)"] C -- "构建体系化治理能力" --> D["科学成熟阶段<br>(清晰界定已知与未知)"] ``` 针对目前社交媒体（如 LinkedIn）上充斥的各种大杂烩式治理言论（将数据治理、网络安全、董事会治理等混为一谈的“厨房洗碗槽”模式），Brian 指出这只会让管理者感到不堪重负。没有人喜欢参加枯燥的治理合规会，但每个人都乐于参与战略研讨，而风险本身就是战略的核心组成部分。 从架构上看，AI 治理必须进行清晰的分层划分： | 治理层级 | 核心关注点 | 包含内容与职责范围 | |:--- |:--- |:--- | | **监督层 (Oversight)** | **谁 (Who) 与 做什么 (What)** | 明确谁对 AI 决策承担最终问责责任，界定监督范围与风险容忍度底线。 | | **管理层 (Management)** | **怎么做 (How) 的机制设计** | 制定评估方法、危机管理方案、跨部门汇报路线及关键风险指标（KRI）建设。 | | **操作层 (Operational)** | **具体执行落地** | 算法调优、日常审计、数据清洗与模型实际部署运行。 | 监督治理的重心在于自上而下确立预期与容忍度，明确问责归属（Who & What），而不是越俎代庖去插手底层的具体技术与操作细节（How）。随着法庭开始依据董事监督职责（如 Caremark 判例法理）追究责任，这种清晰分层的系统化治理程序将成为企业防范法律风险与加速业务创新的核心保障。 ### [12:23](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=743s) 监督职能与运营职能的区别及授权成文化 网络安全、数据治理与风险管理在日常操作中关注的是具体的执行实践，而监督（Oversight）的核心则在于如何界定范围（Scoping），确保所有既定计划得到有效落实，并让决策层听到必须了解的信息。董事会与高管层常遵循“深度关注，不加干预”（Heads in, hands off）的原则：治理层制定整体程序与框架，运营团队负责具体执行。监督职能必须明确该体系适用于哪些范围——是全面覆盖、针对关键业务、还是根据具体细微情境有所区分。 ```mermaid flowchart TD accTitle: 监督职能与运营职能的分工 subgraph 治理与监督层["治理与监督层 (Heads In)"] A["确立治理大纲与授权 (Charter)"] --> B["界定范围与颗粒度 (Scoping & Granularity)"] B --> C["设定风险容忍度 (Tolerances)"] end subgraph 业务运营层["业务运营层 (Hands Off)"] D["一线员工识别业务机会"] --> E["依据成文化政策执行"] E --> F["触发机制向上呈报 (Escalation)"] end C -. 监督执行情况.-> E F -. 报送关键决策信息.-> B ``` 在 AI 时代，颗粒度（Granularity）的设定变得尤为关键。如果要求敲键盘的一线员工事事汇报，会造成管理过载；但若完全放任，当基层员工发现 AI 增效机会或看到竞品做法时，又缺乏畅通的向上呈报（Escalation）路径。因此，治理体系必须拥有清晰的章程（Charter）并将治理授权进行成文化（Codified）。在实际业务场景中，由于人际关系与层级阻碍，基层无法单纯依赖上级领导自觉向上汇报，必须依托经由高管层与治理机构正式批准的成文政策，从而构建出具备可问责性（Accountability）与可抗辩性（Defensible Governance）的合规证据链。 - **监督与运营的界限**：监督界定治理范围与汇报路径，运营负责在既定程序框架内自主执行。 - **颗粒度标准**：明确何种级别的信息需要向上汇报，防止基层信息过载或关键创新/风险被隐匿。 - **成文化授权（Codification）**：摆脱对个别管理者人际关系的依赖，依靠制度化的升级机制确保信息畅通。 --- ### [15:04](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=904s) 传统治理滞后与 Caremark 判例法下的个人问责 当前 AI 技术的演进速度极快，而采用传统治理模式的企业反应迟缓，两者之间的剪刀差正在不断扩大。业务部门正在迅速推进各类 AI 首创项目，但如果缺乏高效治理，仅仅依赖滞后的季度报告，组织将完全无法跟上技术迭代步伐，导致风险不断累积。 ```mermaid flowchart LR accTitle: Caremark 判例法演进脉络 A["Caremark 案<br/>(确立善意原则与监督门槛)"] --> B["Marchand 案 (Blue Bell)<br/>(关键任务需具备风险知情系统)"] B --> C["波音案 (Boeing)<br/>(收到红线预警未行动亦需担责)"] C --> D["麦当劳案 (McDonald's)<br/>(责任从董事会延伸至企业高管)"] ``` 司法判例正对董事与高管施加越来越严格的法律义务。以 Caremark 判例法系（Caremark Doctrine）为代表的重大诉讼确立了清晰的合规问责路径： 1. **Caremark 案**：确立了董事会必须“善意行事”（Act in good faith）的基本原则，设定了极高的注意义务门槛。 2. **Marchand 案（Blue Bell 冰淇淋李斯特菌事件）**：法院明确指出，要证明善意履职，必须建立针对所有关键任务（Mission-critical）的“风险知情系统”（Risk-informed system），并具备清晰的风险容忍度判定方法论。 3. **波音案（Boeing）**：法院进一步强化了问责机制，认定公司即便拥有治理章程，但如果在收到“红旗”（Red flags）预警信号后未采取实质行动，仅做到“知情”并不足以免责。 4. **麦当劳案（McDonald's）**：涉及前首席人力资源官（CHRO）的性骚扰及管理失职问题，董事会虽履行了职责，但高管人员未予执行。法院最终将 Caremark 监督过失责任从董事会直接延伸至企业高管（Corporate officers）。 当前集体诉讼正从网络安全领域迅速蔓延至 AI 领域。监管机构（如美国货币监理署 OCC 等）在检查银行等受监管机构时，已经拥有现成的法定监管权；他们不再只是事后询问合规执行情况，而是前置性地要求机构出示网络安全与 AI 风险容忍度的方法论、治理范围界定、颗粒度标准以及治理机构的正式审批记录。 --- ### [19:24](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1164s) 负责任 AI 的“知情决策标准”与国家安全考量 监管与合规的核心标准并不是要求管理者“做出绝对正确的决策”，而是要求其“做出知情决策”（Make informed decisions）。这是一条理性、平衡且全社会应当共同推崇的基准线。如果少数企业及其内部少数个人对技术走向拥有不成比例的巨大影响力，那么通过将治理机制分发到各业务场景中，确保每个团队在使用工具时都在做知情决策，是平衡技术创新与风险防控的最有效手段。 AI 治理还必须兼顾国家安全以及与网络威胁之间的“猫鼠游戏”。如果因为过度僵化的管控而束缚自身手脚，其他竞争对手或技术就会填补空白。目前全球的 AI 监管尚处于拼凑与摸索阶段，尚未发生全社会级别的巨大灾难；但当实质性重大损害发生时，严苛的监管必将迅速降临。组织提前建立知情决策体系，既能维持业务加速度，又能构建抵御诉讼与监管问责的安全屏障。 - **知情决策标准（Informed Decision Standard）**：核心在于决策流程具备充分的数据支撑与风险考量，而非苛求结果永远无误。 - **动态博弈**：治理必须适应技术快速演进，避免因“把控制措施锁进盒子里”而丧失竞争先机。 - **监管前瞻**：在重大行业损害与强监管全面到来之前，预先构建规范的内部决策与风控程序。 --- ### [21:08](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1268s) 程序化 AI 监督的五大支柱与十四个领域 针对缺乏统一治理标准的现状，AI 监督中心提炼出了一套可映射至 NIST AI 风险管理框架（NIST AI RMF）、各类判例法及各行业法规的程序化框架。该框架由“五大支柱”（Five Pillars）和 14 个领域（Domains）构成，帮助企业将零散的应对措施整合为可重复、可信赖的快速决策系统。 | 支柱名称 | 核心定义与关键要素 | 常见认知误区 vs. 体系化要求 | |:--- |:--- |:--- | | **1. 治理体系 (Governance)** | 明确治理机构的组成、职责授权以及各利益相关方席位。 | 误区：仅成立委员会开会讨论。<br/>要求：明确治理对象与成文授权。 | | **2. 风险知情系统 (Risk-informed System)** | 对应 Marchand 案要求，明确划定治理范围、颗粒度及测算风险容忍度的方法论。 | 误区：仅按季度收集零散风险信息。<br/>要求：具备到达容忍度红线的量化与定性标准。 | | **3. 信任与保障 (Trust & Assurance)** | 涵盖网络安全、智能体管理（Agent Management）、数据治理及系统整体韧性。 | 误区：仅停留在打勾合规的日常操作。<br/>要求：确保技术实施始终运行在既定容忍度内。 | | **4. 基于风险的战略 (Risk-based Strategy)** | 依据风险容忍度方法论，设定业务目标、预算分配、工具选型及推进速度。 | 误区：战略脱离风险考量。<br/>要求：实现风险与商业回报（Risk-reward balance）的紧密挂钩。 | | **5. 升级与披露 (Escalation & Disclosure)** | 建立清晰的内部越级呈报路线与外部法定披露机制。 | 误区：仅具备传统突发事件响应计划（IRP）。<br/>要求：风险超出容忍度（包括正面收益风险）即触发升级；达到门槛时向监管机构及公众合规披露。 | 大多数企业其实已经具备了部分要素（例如设有委员会、定期汇报机制或应急预案），核心问题在于这些举措处于临时拼凑（Ad hoc）状态，没有形成闭环程序。通过将 5 大支柱与 14 个细分领域结合，企业能够迅速盘活现有资产，将合规负担转化为兼顾合规防御与高速创新的运营支撑体系。 ### [24:52](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1492s) 启动AI治理项目：现状评估、高层授权与精细化风险偏好 启动一个程序化 AI 治理项目并非一蹴而就，企业需要明确治理的广度与颗粒度。布莱恩·艾伦（Brian Allen）指出，组织首先应在官方平台（如 cfio.org）获取相关评估工具，对企业现有的管理构件与能力进行全面摸底。在推进这项自下而上的变革时，必须确立明确的高层授权（Mandate）。由于推动这种变革阻力重重，审计、合规和法务部门往往是最佳的内部盟友，借由这些支持力量，才能将治理转化为顺畅推行战略的护栏。 布莱恩特别指出，制定宽泛的风险偏好声明（如“我们对网络安全有中等偏好”）毫无实操意义，甚至引人发笑。真正的治理需要将风险偏好细化到具体的容忍度（Tolerances）和特定的应用场景。 ```mermaid flowchart TD accTitle: AI治理项目启动流程 subgraph S1["准备阶段"] A["现状评估与差距分析"] --> B["获取高层授权与盟友支持<br/>(法务/合规/审计)"] end subgraph S2["落地执行"] B --> C["定义精细化风险容忍度<br/>(具体场景与用例)"] C --> D["建立程序化治理体系与实践"] end ``` - **现状评估**：在立项前摸清现有组织架构中已具备哪些合规与风险管理碎片。 - **寻找倡导者**：审计、合规和法务是自上而下推动 AI 治理落地的核心支持力量。 - **摒弃模糊陈述**：拒绝形同虚设的“中等风险偏好”口号，转向场景化、指标化的容忍度设定。 --- ### [26:05](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1565s) 破解黑箱迷思：重新定义“可解释性”与监管沟通 许多高管常将 AI 的“可解释性”（Explainability）与“可解释/可机械拆解性”（Interpretability）混为一谈，因模型是“黑盒”而陷入决策瘫痪。布莱恩打了一个生动的比方：“我的大脑也是一个黑盒。你问我一个问题，我不会向你解释大脑中的神经元是如何放电运作的；但我会告诉你我的数据来源是什么、我的初衷是什么、我试图达到什么目标、产出是什么、我为什么信任这个结果，以及如果情况有变，我会透明地说明改变决定的原因。”这正是可解释性的真正内涵。 布莱恩透露，他在与高级别监管机构沟通时发现，监管方完全接受这种基于透明度与数据决策逻辑的解释路径。如果死磕技术底层机械维度的可解释性，AI 将永远无法在商业中落地。企业必须在治理程序中建立关于数据决策与持续学习的新实践，以满足监管对透明度的实质要求。 --- ### [27:32](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1652s) 明确项目负责人：借法务之势与对抗透明度的代价 确立明确的项目负责人（Program Owner）是治理成败的关键。布莱恩分享了自己在时代华纳有线（TWC）时期的亲身经历：他找到总法律顾问（General Counsel）直言需要成立网络治理机构。当总法务官随口说“那你去建吧”时，布莱恩回答：“不，得由你来领头。因为这项机制最终是为了保护董事会和高管层。”总法务官意识到这向董事会汇报是一个极具价值的成果，欣然成为该项目的挂帅倡导者，而布莱恩则在幕后负责准备议程与演讲要点。 然而，当时的 CIO 和 CISO 却极力抵制这种跨部门的透明机制。布莱恩直言：“在随后的六个月里，这两位高管双双被解雇，因为你永远无法与透明度对抗，风险管理部门的核心职责就是提供透明的风险信息。” ```mermaid flowchart LR accTitle: 治理负责制与透明度闭环 A["总法律顾问 (GC)<br/>挂帅负责 / 保护董事会"] --- B["治理项目团队<br/>制定议程 / 输出风险证据"] B --> C{"运营透明度"} C -->|抵制透明| D["被组织淘汰"] C -->|拥抱透明| E["敏捷战略推进与免责抗辩"] ``` - **高管挂帅**：将法务或合规高管推上治理所有者席位，使其成为向董事会汇报的政治倡导者。 - **透明度不可逆**：任何试图掩盖风险、对抗决策透明度的技术或业务负责人都将面临被组织淘汰的结局。 - **证据留痕**：监督程序必须配套充分的运营证据，证明治理机制正在实时生效。 --- ### [28:42](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1722s) 优秀治理的特质：在市场压力与商业速度中保持敏捷 优秀的治理程序能够将对话焦点从“下行风险防范”转向“商业战略赋能”，并以匹配 AI 发展和业务需求的极高速度运转。当前高管和董事会承受着来自竞争对手、资本市场及华尔街对利润率和投资回报率（ROI）的巨大压力。从前期的“盲目裁员跟风”到如今全行业对 AI ROI 的重新校准，企业前期的激进并非出于鲁莽，而是源于对被市场替代的深刻恐惧。 因此，治理系统必须具备高度的灵活性与适应性，去接纳并化解这些现实压力。董事会需要的不仅是按季度的例行通报，而是需要确保战略推进是有根基的、合规可防守的。两年前业界充斥着对 AI 的过度叫停与无所适从，本质上是因为组织沿用了过时的流程，无法在非极端威胁（如社会动荡、战争武器或生物威胁）的常规商业风险中快速决策。 --- ### [30:10](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1810s) 第四次工业革命的“速度鸿沟”与层级化治理 世界经济论坛执行董事曾指出，第三次工业革命（信息技术时代）持续了约 70 到 80 年，而第四次工业革命与以往最大的区别在于其呈现出“指数级的演进速度”。传统的季度审批和陈旧管理机制在指数级扩散的技术面前造成了巨大的“速度鸿沟”（Velocity Gap）。 面对社交网络上铺天盖地的治理框架，布莱恩告诫切忌采取“大杂烩”（Kitchen Sink）的方式全盘照搬。治理内容应当被分层分类、按需取用。许多企业实际上已经拥有了大量的治理构件，欠缺的只是将它们有机串联成一个体系。 ```mermaid flowchart TD accTitle: 速度鸿沟与治理机制对比 subgraph Old["旧管理模式 (滞后且阻碍)"] O1["按季度层层审批"] --> O2["无差别叫停项目"] O2 --> O3["产生速度鸿沟 (Velocity Gap)"] end subgraph New["程序化治理体系 (敏捷且赋能)"] N1["指数级速度适应"] --> N2["分层分类的风险/回报平衡"] N2 --> N3["为董事会建立前瞻法律防护"] end ``` - **速度鸿沟**：传统治理的线性节奏与 AI 技术的指数级发展之间的断层，是导致企业错失战略机遇的主因。 - **分层解构**：对外部涌现的海量治理概念进行分层解构，提取适配企业自身的模块，而非盲目堆砌。 - **重构汇报语言**：向上沟通治理价值时，强调其带来的“速度、敏捷性与风险回报平衡”，而非指责管理层过去的失职。 --- ### [33:51](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2031s) 驱动变革的四大力量与前瞻性管理 布莱恩总结了在安全与治理领域能够真正撬动实质性变革的四种力量： 1. **重大安全事件**：代价惨痛，是企业极力避免的被动驱动力。 2. **司法诉讼**：带来巨大的法律和声誉风险。 3. **监管法规**：通常极度繁琐且碎片化。鉴于技术迭代过快，监管者永远无法跟上技术速度，只能在医疗、金融或各州层面上进行补丁式立法，导致合规环境愈发复杂。 4. **卓越的前瞻性高管管理**：这是唯一健康的主动驱动力。 在激进推进 AI 的过程中，犯错和局部失败不可避免，企业甚至必然会面临诉讼风险。但只要具备完善的程序化监督与良好的合规卫生习惯（“做好细致准备，经得起推敲”），建立起独立的监督责任机制，管理层就能获得坚实的保护屏障。 --- ### [35:02](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2102s) 问答互动：认知主权与人机协同的文化重塑 在问答环节，针对现场关于“奇点降临与 AI 灭绝人类的生存危机（Existential Risk）”的提问，布莱恩直言组织当下有更切近的现实问题需要解决。他重点提出了**“认知主权”（Cognitive Sovereignty）**的隐忧：当员工和组织极度深度地依赖 AI 时，AI 会在人们毫无察觉的情况下逐步接管决策权。 布莱恩强调，当前的 AI 比人类更有知识储备（Knowledgeable），但在综合判断上尚未比人类更聪明（Smarter）。企业不能将 AI 简单粗暴地套用在陈旧的流程之上，高管应当更加关注组织文化的重塑——核心在于“赋能人才”，而非仅仅“驾驭技术”。应当让员工将 AI 视为坐在会议桌旁、精通各领域的顶级专家智囊，借助其放大人类的知识、效能与效率，从而在根本上实现人机协同的组织转型。 - **认知主权流失**：警惕在深度使用 AI 过程中，决策主导权在无意识中被算法侵蚀。 - **知识与智慧的区隔**：AI 具备海量知识，但真正的商业洞察与价值判断仍依赖人类智慧。 - **组织文化转型**：从指令式使用（“替我写这个、查那个”）升级为将 AI 视为高阶智囊同僚，实现组织能力的倍增。 ### [36:44](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2204s) 替代人类的代价：文化流失与底层磨砺的断层 盲目引入 AI 来直接取代员工，正在将企业推向一条充满未知风险的道路。在与同行业人士（如现场提到的 Shakir）交流探讨后，这种担忧变得愈发深刻且令人震撼。当企业开始用自动化工具取代具体岗位上的员工时，随之被剥离的并不仅是劳动力成本，更包含组织内部长久沉淀的文化底蕴、深层知识库、核心准则以及真正对业务饱含热忱与关怀的员工。企业不能忽视人才培养的链条——如果底层岗位全部被取代，组织要如何去“回填”这些流失的能力？年轻一代必须通过底层业务的切实磨砺，才能真正理解何为优秀的标准，并掌握业务中细微而微妙的专业判断力。 作为 Center for AI Oversight 的倡导方向，核心目标正是推动董事会与高管层拓宽视野。企业的治理重心绝不能仅仅停留在应对法规与合规条款的层面上，虽然合规至关重要，但更深远的长战线在于文化与战略价值。如果企业只是按部就班地这里裁掉一人、那里替换一个环节，最终丢失的将是公司的核心精神（Ethos）与立足之本。面对如今每周都在不断刷新认知、甚至连专家也无法预知的技术演进与技术奇点，承认自己的无知才是理性的出发点。 - 替代岗位带来的隐形成本：组织知识库的断裂、核心价值观与关怀文化的削弱。 - 青年人才成长困境：缺乏底层实际业务的“磨砺（grind）”，未来人才将难以把握业务深处的细微差异（nuance）与质量标准。 - 董事会与管理层的盲区：往往仅聚焦于眼前的监管与法律诉讼风险，却忽视了剥离人力后对企业长期战略根基的侵蚀。 --- ### [37:42](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=2262s) 拥抱“未知”的清醒：首席风险官的午餐与摆脱传统研发范式 在认知层面，认清自身的局限并接纳“我们并不知道所有答案”，恰恰是开展有效治理的最佳立足点。演讲者分享了与一位首席风险官（CRO）好友共进午餐的经历：那位高管坦言，自己过去对自身立场和引导公司的方向深信不疑且充满底气，但面对眼前的 AI 变革，他第一次由衷感到“我真的不知道了”。演讲者对此的回答是：“太完美了，就保持在这个状态，千万别动，这才是你当下最该身处的管理位置。”与其假装全知全能，不如在这个审慎谦卑的位置上构建扎实的管理体系。这进一步说明，企业绝不能依赖零敲碎打的临时对策来应对 AI。 在技术落地层面，目前许多企业正陷入一种令人咋舌的僵局：技术团队试图把全新的 AI 研发与落地流程强行塞入传统的软件工程开发模式中。然而，AI 的不确定性和演进逻辑与常规软件截然不同，套用老旧范式只会让技术执行寸步难行。组织需要赋予团队以崭新的流程去敏捷行动与快速执行，但现实中各部门往往由于壁垒分明而陷入防御姿态，人人固守“这是我的职责边界”。要打破这种画地为牢的内耗，必须建立一套程序化、系统性的治理框架，推动职能重塑。许多科技巨头对中层管理架构进行重组与洗牌，在某种程度上正是敏锐地捕捉到了这一痛点，从而在组织转型上走在了行业前列。 ```mermaid flowchart TD accTitle: 从传统软件范式向程序化AI治理的转变 subgraph Trap["传统模式的误区与停滞"] A["传统软件开发流程 (SDLC)"] --> B["强行套用至 AI 探索"] C["部门防御姿态<br/>('这是我的职责边界')"] --> B B --> D["研发陷入停滞与零碎应对"] end subgraph Solution["程序化 AI 治理转型"] E["管理层确立'审慎未知'的清醒定位"] --> F["构建程序化治理系统 (Programmatic Oversight)"] F --> G["打破部门职责藩篱与管理层重组"] G --> H["实现合规、安全与快速执行并进"] end D -.->|"亟需打破与重构"| F ``` - 首席风险官的认知转折：从以往盲目的“极度自信”转变为承认“不可知”，正是科学风险管理的成熟起点。 - 研发范式错配：强行使用传统软件工程管理逻辑去推进 AI 项目，是导致执行停滞的核心阻力。 - 突破部门本位主义：通过自上而下的程序化治理制度（Programmatic Oversight），打破各职能部门划地自限的防御姿态，赋能业务快速响应变革。 ## Notable quotes > [01:28](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=88s) Brian, we want to cut your budget by 50%. — Brian Allen > [03:41](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=221s) Taking new technology and putting it on old process — Brian Allen > [06:13](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=373s) Tolerances are decision points — Brian Allen > [06:13](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=373s) Govern the system/program, not the technology — Brian Allen > [09:30](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=570s) Yeah, we got it — Brian Allen > [12:23](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=743s) Heads in, hands off — Brian Allen > [19:24](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1164s) Make informed decisions — Brian Allen > [26:05](https://www.youtube.com/watch?v=hyuKzCw7OjM&t=1565s) My brain is also a black box. You ask me a question, I won't explain how neurons fire; but I will tell you where my data came from, what my intent was, what I tried to achieve, what the output was, and why I trust it. — Brian Allen ## Mentioned Brian Allen, Center for AI Oversight, Time Warner Cable, EY, Bank Policy Institute, Tomorrow Today Podcast, Shakir, Caremark Doctrine, Marchand v. Barnhill (Blue Bell Ice Cream), Boeing, McDonald's, Office of the Comptroller of the Currency (OCC), NIST AI Risk Management Framework (NIST AI RMF), EU AI Act, AI RegRisk Think Tank, World Economic Forum, LinkedIn, Dunning-Kruger Effect ## Video description Brian Allen - Executive Director, Center for AI Oversight AI is not just a technology transformation. It is a management transformation, and it demands a fundamental change in how organizations govern. Yet most organizations are responding with the wrong model: forming committees, assigning working groups, and layering review processes on top of existing structures. This is the Committee Fallacy: the assumption that oversight means assembling people to discuss AI, rather than building a governance system that ensures the right decisions are made by the right people, at the right time, with the right information. The committee-driven approach fails on every front that matters. It does not deliver the acceleration the business needs. It does not drive the cultural change the moment demands. And it does not protect against the legal and regulatory oversight obligations that are already taking shape. Regulators and courts are already treating AI as a governance obligation, not a technology issue. Director oversight duties are being tested under Caremark liability doctrine. The EU AI Act imposes compliance requirements with enforceable deadlines. U.S. state legislatures have introduced hundreds of AI-related bills, and federal regulators are signaling enforcement through existing authority. Organizations without a structured governance program are not just moving slowly; they are accumulating unmanaged legal and regulatory exposure with every AI deployment. This session introduces a different discipline: programmatic AI oversight governance. Rather than asking who should sit on a committee, programmatic governance applies the Informed Decision Standard: defining what must be governed, who is accountable, and what information decision-makers need to act with both speed and defensibility. Built on the AI Governance Maturity Model developed by the AI RegRisk Think Tank, this framework treats governance as the mechanism that enables acceleration, embeds accountability into the operating model, and builds defensible compliance against the regulatory landscape already in motion. Attendees will leave with a diagnostic lens for identifying whether their current governance model is actually governing or merely convening, a clear picture of the legal and regulatory obligations bearing down on boards and senior leadership, and a practical framework for building governance that increases decision velocity rather than impeding it. This session is designed for board directors, C-suite executives, chief risk officers, general counsel, and anyone responsible for ensuring their organization moves fast on AI without accumulating indefensible risk. [Source](https://www.youtube.com/watch?v=hyuKzCw7OjM)

[1:28] Brian Allen: Brian, we want to cut your budget by 50%. [3:41] Brian Allen: Taking new technology and putting it on old process [6:13] Brian Allen: Tolerances are decision points [6:13] Brian Allen: Govern the system/program, not the technology [9:30] Brian Allen: Yeah, we got it [12:23] Brian Allen: Heads in, hands off [19:24] Brian Allen: Make informed decisions [26:05] Brian Allen: My brain is also a black box. You ask me a question, I won't explain how neurons fire; but I will tell you where my data came from, what my intent was, what I tried to achieve, what the output was, and why I trust it.

[25:10] Brian Allen: My head is a black box. You ask me a question, I don't tell you how the neurons in my brain work. But what I do tell you is, 'Hey, this is my data. This was my intention. This is what I'm trying to get to. Here's my output. Here's why I trust it.' [25:10] Brian Allen: I went to the GC and I said, 'We need a cyber governance body.' They said, 'Okay, start it.' And I said, 'No, you're in charge.'... 'And by the way, we're going to protect the board and the executives.' And he's like, 'Oh, that's great.' [28:42] Brian Allen: There were no stop signs unless you're measuring society or using it for weapons of war or biological threats... and all of these risks were manageable, but there was so much pause and they didn't know quite how to manage through that. [34:03] Brian Allen: We have such bigger problems. Oh my god... I think about this part a lot of cognitive sovereignty... Right now, it's more knowledgeable than us, but it's not smarter than us. But it will get smarter than us at some point.

[0:04] So Brian Allen, just real quick background, I  was a former chief security officer for a Fortune [0:08] 100 [clears throat] at Time Warner Cable. I worked  at EY for a little bit. We worked with boards and [0:14] uh seuite on their oversight obligations with  cyber and emerging tech. I went to the bank [0:19] policy institute. We represented uh the top banks  in front of Congress, the regulators. And then [0:24] today I'm the executive director of the center for  AI oversight. Our mission is education with boards [0:31] um seuite regulators on oversight obligations  or what is AI oversight and I just finished a [0:41] podcast with um uh tomorrow today and it just he  blew my mind incredible thoughtful person um his [0:48] name is Shakir I recommend diving in because he  has my head spinning right now and want to just [0:54] share like why are we talking about oversight  And why is this different? Because it is this [1:01] is incredibly different. And the oversight piece  is the part that we got wrong on cyber in a lot of [1:08] ways. And it took like 20 years for the courts and  the regulators to finally catch up on this piece. [1:15] But I want to talk about why it's important and  some of the the problems that we cannot go into [1:20] this environment using that old space and that  old mindset. And so I was about 10 years into [1:28] my cso role and we did cyber risk and physical  security, business continuity investigations, [1:34] workplace violence. We did the intercept  work for the government. My budget was about [1:38] $und00 million. So we have a new CEO, new CFO, and  I walk into the room. I've got my two VPs behind [1:45] me in our first budget meeting. And I sit down and  they say, "Brian, we want to cut your budget 50% [1:51] 50- silence." And I said, ' Okay, we'll go take a  look. Do you know how effed up that question is? [2:01] Like, it's taken me a really long time to resolve  what what that was. As if it was so expendable, [2:09] right? As if like, and I know why they thought  that, but you know, in the security space, [2:17] we're defined by our tactics. I do this. I'm an  investigator. I do crisis management. I do I do [2:22] forensic. to identity uh uh access management  [gasps and sighs] risk is a it's a security is [2:28] a risk function. The output of security is  not necessarily protection. The output is [2:33] risk information for strategy reasons to  find balance of risk and reward right to [2:41] identify appetites and tolerances so that we  can execute too. so that we can you know find [2:48] that you know execute that balance find the right  people find the tools [sighs] and for them to come [2:55] into that room and and say that like it didn't  hit me at the time I'll tell you what we did we [3:01] we I went to my team and I said okay we'll come  back and we took every program we cut it 5 10 15 [3:07] 20% I said identify the asset we're protecting  identify the asset owners stakeholders tell me [3:12] what happens at 5 10 15 let's go to them and ask  them where their comfort level is. And we got to [3:18] 13 and a half%. We went back to the next meeting  and I said 13 and a half% otherwise you know we [3:24] need to bring those folks back in. There's a is  an uncomfortable level and they said okay. And [3:28] they never question our budget again. But  where was that thought in the beginning, [3:35] right? That's the core of what we do. That's  the core of of business. It's it's riskreward. [3:41] It's balance. And so I think this matters more  today and I think we have such an opportunity [3:48] today to reshape this conversation where risk is  you know in the cyber space anyway and a lot of [3:56] other things that we did in the security space  the other it's all downside all this downside [4:00] can happen but not taking risks today is downside  and so we now now we have to take risks and now [4:08] we have to have a new relationship with risk And  risk is strategy. And does strategy have value? [4:18] Strategy has value. That is their job, right? To  find this balance of strategy. They do it all the [4:25] time on on all this other stuff. But what we're  starting to see a little bit today is taking this [4:32] new technology and putting it on old process.  It is not going to work. And so, how do we get [4:39] through that? And so this is what I want to talk  about today is um you know why what is it like [4:46] what is what is oversight governance governance  has layers we're talking about oversight and in [4:53] that is governance strategies a whole bunch of  things so as much as I think we as much as this [5:02] feels that we are in a technology revolution  I think it's a management revolution also So, [5:10] and we need to treat it this way with boards.  We can't always just put this push this boulder [5:15] uphill. We've got to, you know, have this  expectation of downhill. So, the question is, [5:21] what is their role, right? How would you define  AI oversight? And that's what I want to, you know, [5:28] dive into a little bit. So at the center of AI  oversight um you know we do a lot of research [5:35] uh we talk with executives we do training with  executives we write bodies of knowledge on what AI [5:40] oversight is and you know this number probably 88%  probably feels a bit old it's probably higher than [5:48] that today but the majority of of organizations  that we see are not disclosing that they've got [5:54] oversight and that they're not disclosing  what that means what is defensible oversight [6:01] So what is defensible oversight? Right? How would [6:04] you say I'm providing I'm I'm I'm  executing the right oversight. [6:13] You know the um a lot of a erm practice cyber  practice [clears throat] this is the old process [6:18] that we're seeing them throw this new technology  on of quarterly reporting. Quarterly reports today [6:24] are way too slow for this technology. We talk  those reports that come in are mostly about [6:30] downside, KIS, KPIs. [clears throat and cough]  If an employee has their hands on something and [6:36] they're using AI and they can move quickly and  find efficiency because their competitors are, [6:43] the risk of substitution is a risk. So that that  missed opportunity needs to escalate too. I don't [6:50] think we're including that. I don't think we  did not include that in the cyber space. And [6:54] this is a new environment. Um, tolerances in the  compliance world and security world felt as like, [7:02] oh, we reached a tolerance. It's a no. Tolerances  are decision points. Can we? Should we? Right? Are [7:11] we moving too slow? Hey, that's getting in the  way, right? So, who does that get escalated to? [7:18] And we've seen audit a lot of times,  including regulators and examinations, [7:23] audit to compliance, audit to a standard.  What they're not auditing to is a tolerance, [7:28] is a commitment to a tolerance. We should  do both. We should be auditing to a standard [7:35] because it's best practice. Have good hygiene,  dot your eyes, cross your tees. But we should [7:39] also be auditing to have I made a commitment to  the board. Has the board decided something? as [7:44] the have the executives defined what tolerance  is. Are we executing to that? One of the biggest [7:50] things when we go and assess organizations  we call it the committee fallacy. When you [7:56] say do you have governance? I say yeah we  have a committee and we meet quarterly. A [8:00] committee is not governance. A committee is a  governing body. Give you that. So the question [8:08] is what are you governing? If you're not if  the committee isn't governing it's just a [8:13] body. what are you governing? Right? And so what  normally happens is there are quarterly reports [8:19] that come in and you have an informed body. But  it's not necessarily governing. It's also not [8:26] governing the technology. The governance body  does not govern technology. What it governs is [8:33] a program to put the organization in a position  to find informed balance of risk and reward. [8:39] So it's governing the program that puts the  organization in a position to make informed [8:45] decisions of risk and reward. That's what it's  governing. That's the oversight governance. [8:53] I've seen very very very few organizations  including global fortune50s that have this [8:59] down. So that's where I think this  opportunity lies is that we have a [9:05] novel technology. We have something new. We  have a new environment. I would tell you that [9:11] the boards and executives are asking what to  do. Of course, in the public, they're like, [9:18] "Yeah, we got it. We got it. We got it." Behind  doors, they're like, "I used to be confident [9:21] with my strategy. I'm no longer confident with my  strategy." That's exactly right. And that's okay. [9:30] Just a quick concept that I that [clears throat]  you know when we talk to boards and executives [9:34] if you're not familiar with Dunning Krueger  it's a really interesting concept where you [9:39] laughter [laughter] mount stupid. So  Dunning Krueger is when people know a [9:43] little bit they're very confident and they're  at this they call it mount stupid. I'm like, [9:47] "Yeah, yeah. I got this. I know what I'm  doing." And eventually they start learning [9:52] and they go into this valley of despair  and their confidence waines. And then [9:55] eventually they get more confident and they  get to another level of confidence that they [9:59] don't know [ __ ] That's where we've got to get  to, right? That's where we've got to manage to. [10:07] And so these kind of this committee structure, [10:09] this like committee structure without  this programmatic approach of, you know, [10:13] how do we find balance? What's the speed? What's  the scope? what's the granularity is slow. [10:22] So this is about governing the system or  governing the program that's appropriate [10:27] on the oversight piece. Um there are layers  of governance and you know one of the things [10:33] that I'm seeing on LinkedIn that I think  is there's amazing content out there but [10:38] a lot of it is not appropriate because it's  the kitchen sink right it's data governance [10:45] it's cyber it's board governance  it's all this stuff and I think in [10:49] there that message of what governance is  gets lost a little bit it's overwhelming [10:57] nobody likes going to like governance meetings.  But what they do like to go to are strategy [11:02] meetings. Strategy is fun. It's thoughtful. Risk  is strategy. And so this is this opportunity [11:11] that I think we have and we need. I feel for  you know the folks in the room that you know [11:19] we've been you've been saying this you've been  pushing trying to push this boulder uphill. It's [11:23] got to come downhill. It has to. And I think  we can approach it in in two different ways. [11:29] One is setting the expectation of what is needed.  Tolerance. Without tolerance, what am I budgeting [11:35] to? What am I executing to? What are you measuring  to? We also need regulators to start redefining [11:43] what governance is. The courts are getting  there, which I'll I'll hit on in a second, [11:49] which I think is really interesting. It's becoming  pretty influential with boards. [sighs and gasps] [11:55] So oversight governance, the way that we position  at the center anyway is the who and what, [12:02] right? Who's responsible and what are  you responsible for? We don't touch the [12:07] how. There's a ton of how. How do we do  assessments? How do we report? How do we [12:11] build KRIS? How do we do crisis management?  How do we do all these things? There are [12:17] layers to this. You've got oversight,  management, and operational. operational [12:23] cyber data governance management. How do we do  risk management? What's what's the practice of [12:28] it? And oversight is how do we scope all  this that we make sure that all of that [12:34] should be executed and that we're hearing what  we need to to make sure our program is working. [12:42] As a concept of boards, heads in, hands off, [12:45] right? That's kind of what we're dealing with.  Heads in. Here's our program. Go execute it. [12:51] do with it how you will but the expectation  is that you're executing to the program. [12:58] So there's a you quite a bit of difference  between the oversight function and the operational [13:05] function. I won't go through all of these but its  essence is what does it apply to? How are we going [13:12] to scope it? Is it everything? Is it nuance? Is  just the critical things? granularity I want to [13:18] hit on because this is an important concept  I think today with AI is how granular through [13:24] the organization does this need to apply to right  sometimes it could be only overwhelming somebody's [13:29] on a keyboard it's too much not necessary  their boss needs to know but that should [13:34] be defined because you may have somebody that  has hands on the keyboard like we were talking [13:41] about where they've identified an opportunity  to be more effective and more efficient they may [13:47] heard their competitors are or seen it  somewhere and that needs to escalate. So, [13:52] so do we need to think about  granularity differently today? [13:59] We need a mandate needs a charter,  right? Who provides that mandate? Is [14:05] that mandate is it is it codified?  It's important that it's codified. [14:15] um you know the the codification the  reason why I think that's important is [14:22] when you're in the the heat of things a lot  of times I mean there's relationships your [14:27] boss the boss's boss and all these things I  can't in some of these positions rely on my [14:35] boss or they're going to do this or things  are going to flow uphill the right way I [14:38] need to be able to lean on a policy the  program things that need to get escalated [14:43] it. So I need to lean on the program that  has been approved by a governance body by the [14:50] executives. There needs to be accountability  and there needs to be evidence for what is [14:57] defensible governance. How would you how  would you explain that and disclose that? [15:04] So partly um what we're seeing is you know the  speed of this technology is moving uh you know [15:10] incredibly fast and we're seeing this kind of  separation of organizations that are moving slow [15:17] with traditional governance versus the speed of  you know this technology and the gap is widening [15:24] because more people are using it. We're seeing it  executed. We're seeing every department trying to [15:29] you know build initiatives as they should. But  without good governance and without that speed, [15:38] we end up with this like we're leaning  on these quarterly reports. We just can't [15:42] keep up. And it's it's compounding. And we're  starting to see that in in some organizations. [15:50] So there are there are obligations on boards and  executives. I want to hit on this for a little bit [15:56] because it's it's um it's influential at [clears  throat] the center. We don't preach obligations [16:03] um but we do talk about is the need for  speed and change. So there's a set of [16:08] uh legal cases that are important that hold  boards and corporate officers liable and [16:13] they're called the Caremark cases. The Caremark  case was the first court case and it said to [16:20] boards you have to act in good faith. It was a  really really high bar. There was a second case [16:25] called Marchant. The Marchin is a company that  sold bluebell ice cream. A couple people died [16:30] of lististeria. And the court said in order to  act in good faith, you you need a riskinformed [16:36] system. Apply it to everything missionritical.  And so the question is what is a risk-informed [16:43] system? Right? We're starting to get at what  is the system? What is the program? How what's [16:48] your methodology to get to tolerance to get to  your tolerance? Boeing happened and the court [16:54] came down even further and solidified it and  basically said you have a charter. You were [16:58] getting red flags. You didn't do anything about  it. Just because you were informed isn't enough. [17:06] And then the last one was this McDonald's case.  It was a um chief human resource officer. There [17:13] was some sexual harassment. The board actually  did its job, but the officers never executed [17:19] to it. And the court extended the liability from  the board to the corporate officers. And I think [17:25] this is kind of fascinating. We're starting  to see class action lawsuits being applied [17:29] to this. We've definitely seen it with cyber  cases and we're seeing it now with with AI. [17:36] And this is right the focus that the regulators  are on. Um, the reason I bring this up is that, [17:42] you know, if you're an auditor, you're dealing  with consultants, you're consultants, this [17:46] is important and boards listen to this. It's a  driver. Again, shouldn't be the number one driver, [17:52] but it's a driver. The second thing we're seeing  in the regulatory space is that one, they already [18:00] know they have the existing authority. They  have the word governance in their regulations. [18:05] They just need to interpret it differently. And  some of them are starting to the OC for example [18:12] was going to banks in the cyber space and saying  show me your cyber tolerance and instead of then [18:19] going and saying show me how you're executing  it they went the other way and said show me [18:23] your methodology show me that it's scoped show  me how granular it is and show me that your [18:29] governance body approved that. That was really  fascinating. I probably helped two dozen banks [18:34] through those MAS. So, what we're seeing is this  dual responsibility. Have good hygiene. There's no [18:42] zerorisk environments. Are you managing your risks  right? Right. And I think this space is the one is [18:51] the lead conversation right now with AI. That's  what we're hearing with regulators. That's we're [18:56] hearing from regulators. The conversation  of responsible AI, ethical AI, it's this [19:03] Um, and we are starting to see it in some  exams that they're paying attention to [19:07] this space. It's very early. So, you've got  benefits of moving fast. You're protecting [19:13] the company against liability and the boards  against li the executives against liability. [19:17] And you're meeting you're you're getting to  that point to meet regulatory obligations. [19:24] And I think the great thing  about this is the standard [19:30] isn't make all the right decisions. The  standard is make informed decisions. [19:39] That's a healthy balance, right? That's a bar that  we should we should as a community, as a society, [19:48] that's a bar that we should ask for and demand.  So, I just finished the the podcast. I was talking [19:54] about we were talking about this type of this  conversation and we have too few companies and too [20:00] few people within those companies that have just  massive massive influence on where this is going. [20:07] But what we can do is distribute that on how  you use the tools, where you use the tools, that [20:13] you're making informed decisions, not the right  decision, that we're making informed decisions. [20:20] That's a healthy balance. It also allows the  technology to move fast, right? We acknowledge [20:27] that there are national security issues to this.  We've got a cat and mouse game with cyber issues, [20:33] right? If you pull Fable back and there's another  opportunity and there's another technology that [20:38] allows to do the same thing, then we just put  the control in the box. So, we have to it's [20:43] incoherent right now. We're not going to be  able to regulate this technology effectively. [20:50] It's going to be a peace meal. I don't think  we've seen major harm yet. When we see harm, [20:54] we'll see regulation and we'll see response.  I don't think we're quite there yet. But [21:00] I think the expectation to make informed  decisions society, we should ask for this. [21:08] So the oversight approach and I'll give  you the centers the cent's approach. [21:12] Um [clears throat] there isn't one standard  out there that kind of meets all of this, [21:18] right? What's the program? So, I'm going to show  you. I would think about it as an illustrative [21:23] reference. You can do this a thousand different  ways. We've mapped our program to NIST ARMF. We [21:31] mapped it to case law um different standards um  uh laws, regulations by industry. In essence, [21:42] they say all the same thing. So there are  five components that we've we call them [21:48] pillars. There are five pillars that we've  identified that make up a governance program, [21:52] an oversight program. And the first is governance.  The committee, right? The governing body. Who is [21:59] in charge? Who needs to be there? Who needs to  be at the seat at the table? And the second is [22:04] a riskinformed system. The marching case, right?  What's your methodology to get to tolerance that [22:12] needs to be defined? What are you going to  scope it to? How granular should that be? [22:18] The tolerances. Is it known that tolerances  are not a no? That those are decision points, [22:25] trust and assurance, the cyber space,  agent management, data governance, [22:32] right? All those those pieces, resilience  generally. The fourth is a riskbased strategy. [22:38] Now that I I have a methodology get to tolerance, [22:42] what's our what what are our objectives?  What do we budget to? How do we execute? [22:46] What tools do we need? How fast are we going?  And then the last is escalation and disclosure. [22:55] So an incident when I talk to folks and we do  these we hear I've got governance. I have a [23:01] committee. Okay. What are they governing? We have  you know I get risk information quarterly. Okay. [23:06] What's your system to get to tolerance? What's  your methodology? Right? Trust and assurance. [23:11] Everyone's got practice. Dot your eyes, cross  your tees. Are we executing to tolerance? The [23:16] riskbased strategy. Of course, everyone has a  strategy, but is it based on that riskreward [23:22] balance? And then escalation disclosure. We  always hear I have an incident response plan. An [23:29] incident can cause escalation, but a risk falling  outside of a tolerance can also cause escalation, [23:36] including upside risk. And disclosure is, you  know, if you're public and it's material, you have [23:44] to disclose it to the public. If you're regulated  and meets a certain threshold, you disclose it [23:50] to the regulator. If you want to maintain trust  with the public, you disclose it to the public. [23:56] So the collect of all these is the program.  The balance and the granularity to all of it [24:04] is dependent on your organization, the risk  you want to take. But not considering this in [24:09] that is liability and in that is bad practice.  The I think the great thing is what I have seen [24:17] is that most organizations have all the have a  lot of the pieces and parts. They just haven't [24:23] put it together. It's an ad hoc response.  They do reporting, they have a committee, [24:27] they have a like different pieces. They  just haven't put it into that program [24:31] to make this repeatable, trusted, fastm moving  process. So most organizations are not far off. [24:41] So within I won't go through all of these, [clears  throat] but in our program there are there are [24:47] five pillars and 14 domains. The domains are  broken down. We again we've mapped these to laws, [24:52] regulations, standards, and these should be  considered as you're pushing through and saying, [24:56] "All right, let's build our program.  Do we need this? Yes. No. How big? [25:00] How granular?" You know, how much  time do we want to spend on it? [25:10] If you go to our our website  is cfio.org. If you go there, [25:14] you can download this. It talks about the program.  There there's a there's a PDF you can download. [25:19] So our recommendation when we go and look at  organizations is um you know do an assessment [25:31] first you know find out like what pieces  and parts do you have establish a mandate [25:39] right I know pushing this uphill is really  complicated I've been I've been in your shoes [25:44] in those situations there are great great um  champions for this audit, compliance, legal, [25:54] right? To help establish because the benefit  that comes downhill, the programs that you can [25:57] lean on and execute to strategy is incredibly  helpful. Set an appetite. Appetite statements, [26:05] I'm not a huge fan of them where there's like  we have a moderate appetite for cyber. I don't [26:10] know what that means. [gasps and laughter] But  then get granular to tolerances, right? to use [26:17] cases to certain things. Explainability. Hey, we,  you know, we have to explain this. Okay. Well, [26:22] how do we get there? Just quick on explanability  because we hear this a lot from executives. So, [26:30] the AI models, it's a black box. Kick something  out, you can't interpret it. That's different than [26:36] explanability. My head is a black box. You ask me  a question, I don't tell you how the neurons in my [26:42] brain work. But what I do tell you is, hey, this  is my data. this was my intention. This is what [26:47] I'm trying to get to. Here's my output. Here's why  I trust it. And if something changes, I'll, you [26:53] know, I'll tell you why I changed my mind. I'll be  transparent about that. We just met the intention [26:57] of explanability. I've talked to regulators at a  really high level on this because if we're leaning [27:03] on interpretability, you have to interpret  it, we'll never be able to use it. They're [27:08] okay with it. But in that is practice, right?  Data decision- making, right? uh know like keep [27:15] learning about your environment that doesn't sit  in one function today. And so when executives ask, [27:20] well, we've got this explanability risk. Okay, you  can manage through that, but we need new practice [27:26] and build that into the program that this is  important because the regulators are interested. [27:32] Name the program owner critical. Um, you know,  when I was at TWWC, we um, you know, I went to the [27:42] GC and I said, "We need a government, we need a cy  cyber governance body." They said, "Okay, start it [27:47] And I said, "No, you're in charge." Right? And you  know, I said, "This is why this is what it means. [27:53] And by the way, we're going to protect the board  and the executives." And he's like, "Oh, that's [27:56] great. So now he's got a good story to go tell  the board." And so he championed it. Of course, [28:01] I did all the work and the agendas and the talking  points, right? Um, but I found a champion and he [28:07] loved it. And then we we kicked off. [snorts]  the CIO and the SISO at the time fought it and [28:13] they were both got fired in the next by with with  within the next six months because you can't fight [28:18] transparency right our job is risk information and  they fought that um you know and then the practice [28:28] of okay so how like you've got this oversight  program what what do you what information do [28:34] you need to show that it's working that this is  operational right have the evidence behind it. [28:42] So, what does good look like? Um, it operates, [28:44] it moves fast. You move the conversation  from risk downside to strategy, right? It's [28:51] operating at the speed that the business needs  it to, the speed that AI is kind of pushing. [29:00] You know, one of the indicators that we  see like pressures boards and executives [29:04] are feeling is they're getting pressures from  not not just their competitors but from the [29:09] marketplace. I need to find, you know, I need to  find better margins. Wall Street has expectations, [29:18] right? We went through this whole couple  months a year of cut your headcount. There was [29:23] an expectation around that. It was silent, but  there was pressure. I feel like now everyone's [29:29] rec-alibrating a bit. There's a ton on the floor  about ROI. I love that. Right. But there was like [29:35] go go go. That wasn't recklessness. That's  because they were feeling pressure, right? [29:41] And now it's now there's like oh you're getting  your money. They're like whoa hold on everybody. [29:45] And then like backing off a little bit pressure  different pressure. But they're not, you know, [29:50] they're not reckless, right? This isn't just hey  go AI go. They were doing it because they because [29:55] their competitors were the risk of substitution  was on their minds. And so the speed is that you [30:03] know that we're meeting and flexible and adaptable  to those pressures that they're feeling. Um the [30:10] board is informed not just quarterly of this is  a informative strategy of what's happening. Is it [30:16] grounded? Can we protect it? Right? We went  through [sighs] I think about two years ago [30:23] um we went through a uh a period of like there  were so many hurdles and like what pauses there [30:29] was no there were no stop signs unless you're  measuring society right or using it for weapons of [30:36] war biological threats besides that there were no  stop signs and all of these risks were manageable [30:44] but there was so much pause and they didn't know  quite know how to manage through that and I it's [30:49] because we were leaning on old process of hey get  get me to this quarterly and they're getting all [30:54] these pieces right and they didn't quite know  what to do with it so ground it because this is [30:59] not going to stop the um the executive director  for the world economic forum like four years [31:07] ago said something that I just I I think about  often and said so we're in the middle of we're [31:12] in the very beginning of the fourth industrial  revolution we came out of information technology [31:18] the third industrial revolution that lasted for  80 years right who knows where like where were we [31:23] 80 years ago I don't even know but that was the  start of it 70 80 years ago and if we're at the [31:27] very forefront of this and we we don't know  where we're going next month but he said you [31:33] know the difference between the third and fourth  industrial revolution is going to be exponential [31:37] speed and if you feel that I think I think that's  where we are right and so if that's the case and [31:45] this thing picks up is exponential speed. We  need something like this. The velocity gap. [31:57] So I want you to like when you think  when you see governance in on LinkedIn, [32:01] there's something daily. There's multiple  things daily. Um [sighs] look at it through [32:06] layers, right? It's not all the same and it's not  appropriate. It's confusing people. There's really [32:13] good content in there though, right? That's good.  but compartmentalize it of what's good, where does [32:18] that land, and take the pieces and parts from it,  but the kitchen sink approach is not a good one. [32:25] There's good content in there, but think about  what it's appropriate for. Compartmentalize it. Um [32:35] the and you know, one of the thing I would try to  identify too is do you have the pieces and parts, [32:40] but it's not a program? because I think you'll  find that you're doing a lot of this now. Can we [32:48] shape it the benefit if you bring this uphill to  the executives without telling them they haven't [32:53] been doing their job for 20 years? They haven't.  I didn't want to say that. Um I have said that in [32:58] meetings um not good. Um but what you're bringing  is speed, adaptation, sense of agile, the balance [33:07] of riskreward, which is what they want, not just  downside. All these bad things could happen. [33:13] But you're also bringing protection for them  where the courts are going. It may not be your [33:16] position to tell them that, but that's where  you've got partners in legal and compliance [33:20] and the regulatory space. The regulators are  looking at this. This is their conversation. So, [33:24] you're bringing protection and speed and best  practice, right? I think that's a healthy [33:28] conversation. We're doing a lot with boards  trying to push this conversation downhill. [33:33] We're writing bodies of knowledge for,  you know, board trade organizations. [33:37] We're talking with regulators not to not to  put this accountability component on top of it, [33:43] but the balance the interpretation of  balance that's flexible and adaptable. [33:51] So this is the center. Um would love some  conversations. Um you know we do education [33:56] like I said with boards. We write these bodies of  knowledge constantly do research. Um, you know, [34:03] there are four things that I've seen in the  security field that move needles. Big needles like [34:08] in programs. One are major incidents. We don't  want that. Two are lawsuits. We don't want that. [34:16] Three is regulations usually very very burdensome.  The regulators are never going to be able to keep [34:22] up with the speed of this technology. Never. It is  moving way too fast. But we will see this pieces [34:28] and parts healthcare something happened. We'll  regulate that. We'll regulate this piece. We'll do [34:32] it by state. It's going to get crazy complicated.  But the last is is good executive management. It's [34:40] proactive. It's good. You get out in front  of it. You're going to make mistakes. You're [34:43] going to take risk. There's going to be failure.  Risk's going to flop. But if they're informed, [34:49] right? Like if you're a company and you something  happens, you're going to get sued. Just going to [34:53] happen. [laughter] But can you protect yourself,  right? Dot your eyes, cross your tees, have good [34:57] hygiene. Look at the other one as a completely  different separate responsibility. That's where [35:02] the program and oversight sits. Any questions,  comments, challenge it. Extential risk. What do [35:11] you think must do now while we have control stills  to try to kill us all in the modern singularity? [35:25] We have such bigger problems. Oh my god. Excuse  me. Um [clears throat] I think about this part [35:33] a lot of cognitive sovereignty, right? Of  like what if you used ALI AI very deeply, [35:41] right? Eventually it starts pulling  down the and starts making decisions [35:44] for you whether you're aware of it  or not. And um right now, right, [35:49] it's more knowledgeable than us, but  it's not smarter than us. But it will [35:53] get smarter than this at some point. Maybe  there's interpretation of that. [sighs] Um [36:01] you know I think when you don't have these ad  hoc processes and we think about strategy more [36:10] I think executives and this is the context we're  talking about will pay more attention to culture [36:16] about what it means what you know how do you  harness people versus harness the technology. [36:21] How do you, you [clears throat] know, give them  the skills and the tool sets to not say, "Hey, [36:26] do this, write this, do this, research this," but  to sit at a seat at the table that have PhDs in [36:32] every topic that can harness my knowledge, harness  my effectiveness, and harness my efficiency. And [36:38] that is why like that's why we can't take this  topic and put it on top of old process because [36:44] we're heading down a path that we just don't  know. And we also like when you this came up [36:49] in this this is why my head's exploded with  this guy Shakir. He killed me. It was great. [36:54] But when you like when when you start replacing  people, you're also replacing part of the culture, [37:00] the knowledge base, the principles, the people  that care, right? And eventually like you got [37:06] to backfill that somehow. You got to train young  people of like grind so you know what good is. So [37:12] you know what it takes to understand the kind  of nuance in there and that's cultural pieces [37:18] and at the center this is what we're trying to  like get the boards and execs to not just think [37:23] about the regulatory and legal pieces which  is important but also like the the long-term [37:28] strategy of if we replace this and replace  this we're losing core we're losing like ethos [37:35] um you know singularity I I don't know what I  I'm surprised weekly at what I find what can [37:42] do I have no idea none but it but like to manage  to right side Dunning we don't know is a really [37:52] good place to be it's a good place to manage  there was a a friend of mine a co chief chief [37:58] risk officer he said hey can we go to lunch we  sat down and after we chatted he said he said [38:05] I used to be confident in where I stood and  where I was guiding the company I don't know [38:09] anymore I said Perfect. Stay right there. Like  don't move. Like that's where you need to be [38:16] and that's what you need to manage too. But this  is why I like this like we can't just do this ad [38:22] hoc pieces and parts. it doesn't work in this  like even the even the technology folks right [38:29] what I'm what I've I've seen sometimes and this  is this is kind of staggering me but where you [38:34] know the the AI process is going into like this  software development approach and technology is [38:39] getting stuck and it it can't right because  it's not the same thing and maybe we should [38:45] allow them to go and move and execute and do  something with a different process that allows [38:50] for that speed but there's like this defense  defensive posture and some this is my role and [38:55] this is my role and this is my role like blow it  up but that that's got to come from this kind of [39:01] programmatic piece that hey we need to move we  need to allow these pieces to shift and right [39:06] and I I you partly when you saw these technology  companies you know reshuffle middle management I [39:13] think they're ahead of the game in a lot of ways  I think that's partly what was driving some of Uh,