McDonald's, Bank Leaders Enforce AI Guardrails Ahead of US Law

麦当劳与银行业高管赶在美国立法前设立AI护栏 企业必须立即建立内部数据治理、供应商审查和人在回路控制机制，而非被动等待联邦指令，以规避合规与偏见责任风险。 专家组驳斥了AI处于法律真空的观点，强调现有的消费者保护和民权法规已在对AI进行管辖，同时《欧盟AI法案》和《科罗拉多州AI法案》等新兴的州级、联邦及全球监管体系也正逐步确立。发言嘉宾概述了建立内部治理支柱（人员、政策与流程）的实用策略，并以严格的数据卫生、安全的容器化环境以及主动的“人在回路”监管为基础。他们还审视了关键的合规挑战，包括主观意图与实际影响责任模型、招聘与信贷领域大语言模型的去偏见问题，以及向智能体AI的过渡。最终，讨论敦促各机构积极对董事会和监管机构进行沟通引导，严格审查供应商能力，并主动推进治理举措，而非被动等待自上而下的指令要求。 AI 并非处于法律真空，FTC 法案及民权法案第七章早已规制其下游影响，而欧盟 AI 法案以及科罗拉多州、德克萨斯州等地的专门立法正加速落地。 (1:18) 银行业等受高度监管的行业须严格禁止使用公共大语言模型，转向容器化私有环境部署 Agentic AI，以杜绝敏感数据泄露并应对合规审查。 (5:05) 数据治理是企业落地 AI 的核心基石，在构建模型前必须做好数据清洗与血缘核查，防止大模型继承历史偏见并在住房与信贷等敏感领域造成算法歧视。 (13:58) 全球监管哲学呈现显著分化：德克萨斯州采用基于“主观意图”的归责模式以保护善意创新，而欧盟与科罗拉多州则针对算法造成的下游实际“影响”实行严格责任制。 (19:10) 为防范员工私自向外部工具输入机密数据，企业应提供受控的内部实验沙盒，并可借鉴网络安全 FS-ISAC 机制主动协助监管部门理解技术实践。 (26:25)

Rather than waiting for uniform federal mandates that may take one to two years to crystallize, enterprise leaders must proactively build internal governance programs anchored in foundational laws, rigorous data hygiene, and continuous human oversight. Existing Legal Foundations and Split Liability Frameworks (1:18) Contrary to the perception that artificial intelligence operates in an unregulated vacuum, long-standing statutory protections such as the FTC Act and Title VII of the Civil Rights Act already govern downstream algorithmic outcomes regarding consumer deception and employment discrimination. However, emerging regimes are shifting toward regulating AI as a standalone product. While the European Union enforces prescriptive requirements through the EU AI Act and the Digital Operational Resilience Act (DORA), U.S. states are advancing fragmented approaches. May Sethaphanich contrasts the core philosophical divide emerging across jurisdictions: Texas has pursued an intent-based liability model that evaluates bad faith or developer intent, whereas the EU and the Colorado AI Act impose impact-based liability centered strictly on downstream harm to individuals. To navigate this patchwork without paralyzing technological adoption, panelists argue that enterprises should adopt structured frameworks like the NIST AI Risk Management Framework to draft customized, values-based internal rules. Data Hygiene and Infrastructure as Governance Bedrocks (22:40) Enterprise AI success depends entirely on baseline data quality, rendering premature model investments vulnerable to the classic "garbage in, garbage out" dilemma. Corporate boards and technology leaders frequently spend millions on sophisticated tools while neglecting core data classification, lineage tracking, and hygiene. Sachin Vaidya stresses that data governance is an immediate, actionable priority that organizations can execute without waiting for statutory mandates. In highly supervised environments like commercial banking, data privacy requirements strictly preclude the use of public large language models due to confidential data leakage risks. Instead, deployments must rely on containerized, private perimeter environments. Vaidya notes that technical safeguards alone are insufficient if employees lack secure experimentation channels; organizations must establish controlled internal sandboxes to deter staff from leaking proprietary workflows to public consumer AI platforms. Mitigating Algorithmic Bias in High-Stakes Deployments (7:00) Because foundational models are trained on historical data containing systemic disparities and past statutory discrimination, unmonitored deployments risk automating bias across sensitive domains. Penny Tilghman highlights this friction within housing and lending, where the Fair Housing Act outlines seven protected classes, yet privacy regulations prevent institutions from directly testing algorithms on protected demographic variables. Tilghman advocates for multi-stakeholder oversight models and structured regulatory sandboxes to safely evaluate underwriting, mortgage origination, and credit scoring algorithms. Algorithmic risks also manifest in human resources and recruitment. Vaidya illustrates a use case where an internal AI tool screened 120 applicants down to 10 ranked candidates in four minutes, halving total hiring turnaround time to two weeks. However, panelists caution that automated screening can favor keyword gaming or replicate legacy hiring biases, necessitating that human operators retain ultimate decision-making authority as the non-negotiable "human in the loop." Operationalizing Governance: People, Sandboxes, and Vendor Scrutiny (10:36) Proactive governance requires operationalizing three core pillars: policies, processes, and people. Beyond formulating internal codes of conduct, organizations must budget directly for workforce upskilling and continuous learning rather than directing all capital solely into software procurement. Sethaphanich and Vaidya emphasize that leaders should frame enterprise AI pragmatically as advanced automation—"RPA on steroids"—and empower employees as directors of automated workflows. This operational discipline extends to external procurement. With market hype saturating commercial software offerings, enterprise leaders must treat external suppliers as collaborative partners while actively interrogating their marketing assertions. Technology teams must be trained to move beyond vendor promises and require verifiable architectural documentation, threat mitigations, and compliance evidence under an operational standard of "show us, not just tell us." As enterprise workflows transition toward autonomous agentic AI over the next one to two years, operational complexity and attack surfaces will expand significantly. While federal policy initiatives and public-private information exchanges mature, organizations remain challenged to balance disciplined compliance, workforce enablement, and risk management without falling behind international competitors.

## Background 本视频由行业机构 Ai4 于 2025 年 8 月 29 日发布在 YouTube 平台上。视频记录了一场围绕“应对不断演进的 AI 监管格局”的专题圆桌讨论，汇聚了来自麦当劳、商业银行及国家公平住房联盟等跨行业专家，共同探讨全球前沿监管政策、行业标准以及企业在推动 AI 创新与坚守伦理合规之间的平衡策略。 ## TL;DR 圆桌深入剖析了全球及美国各州 AI 立法加速背景下，企业如何依托“政策、流程与人”三大支柱建立主动治理的“内部家规”。来自金融与民权领域的嘉宾结合严苛的隔离部署、信贷去偏见测试等实操案例，强调坚实的数据治理才是决定 AI 成败的根本底座。讨论进一步指出，面对向智能体 AI（Agentic AI）演进的技术浪潮，企业必须坚持“人在回路”与沙盒测试机制，通过内部全员赋能和严审第三方合作伙伴，打破合规阻碍并释放真正的业务生产力。 ## Atmosphere & style 整场对话务实、严谨且充满行业洞见，嘉宾们以幽默轻松的破冰开场，彻底打破了监管合规议题固有的枯燥沉闷感。企业法务的前瞻合规视野、银行 CIO 扎根一线的实操痛点与民权专家的伦理警醒相互碰撞，形成了兼具深度与温度的高密度交锋。整场讨论传递出一种在技术狂热与监管真空面前拒绝盲从的清醒感，以及呼吁各界从被动防守转向敏捷行动、主动驾驭技术变革的笃定力量。 ## Key takeaways - [01:22](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=82s) AI 应用并非处于法律真空：在专项立法全面出台前，FTC Act 与民权法案等既有法律长期发挥约束作用，同时全球（如 EU AI Act）与美国各州正加速构建多层次监管体系。 - [03:27](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=207s) 企业在联邦监管完善前无需被动等待，应依托 NIST AI RMF 等既有指南及自身价值观，制定明确采购、开发与使用的企业内部“家规”。 - [05:05](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=305s) 金融等强监管行业严禁在核心业务中使用公有大模型，必须通过容器化隔离部署保障数据安全，并主动向监管机构科普技术边界以实现双向赋能。 - [07:11](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=431s) 大语言模型内嵌历史训练数据的结构性偏见，在信贷与住房分配中极易放大不公，亟需跨行业多元利益相关者模型（MRO）推动去偏见与认证机制。 - [10:36](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=636s) 企业主动治理应建立在“政策、流程、人”三大支柱之上：完善审查护栏的同时，必须加大对员工的技能重塑投资，让人类始终充当人机协同的“指挥家”。 - [13:58](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=838s) 数据治理是 AI 落地的底层基石，“垃圾进，垃圾出”的铁律决定了企业在缺乏清洗与高质量数据资产时盲目采购 AI 必将沦为空中楼阁。 - [16:54](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1014s) 监管应平衡合规与创新，相比过于严苛的限制，更应推广基于意图、安全港（Safe Harbors）与沙盒测试的务实监管范式。 - [21:01](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1261s) 借鉴网络安全领域的 FS-ISAC 协作机制，私营部门与政策制定者应建立常态化双向沟通，避免脱离一线实际痛点的过度监管扼杀技术发展。 - [26:25](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1585s) 银行业推进负责任 AI 需对数据资产进行精准打标与严格权限控制，并通过受控的“沙盒”环境引导业务人员合规探索，防止数据泄露至公网模型。 - [29:19](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1759s) 数据治理团队的角色必须发生范式转变，从阻碍业务的“合规警察”转变为通过业务自助服务释放数据生产力的“竞争优势赋能者”。 - [30:34](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1834s) 在招聘等敏感业务场景中，AI 虽然能将筛选周期大幅压缩，但管理者必须落实“人在回路（Human in the loop）”原则，防范算法偏差与简历作弊。 - [34:43](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2083s) 面对隐私法规与公平性检测之间的冲突，金融与住房领域亟需监管沙盒（Regulatory Sandbox）支持，在保护隐私的前提下对黑盒模型进行歧视性压力测试。 - [35:40](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2140s) 企业内部推行 AI 创新应采取“快赢（Quick Wins）”策略，聚焦 1-2 个易落地的“低垂果实”，用可量化的提效成果建立标杆并争取高层支持。 - [37:07](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2227s) 技术浪潮正从生成式 AI 迅速转向智能体 AI（Agentic AI），组织需打破职能孤岛实施跨学科再培训，员工个人亦需主动转型为技术驾驭者。 - [40:26](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2426s) 对第三方 AI 合作伙伴的治理必须秉持“拿证据说话”的原则，穿透营销口号，严格审查其底层技术架构、合规记录与安全护栏设计。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=4s) 圆桌开场与嘉宾介绍 在主持人 Tiffany Benitez（Compass Group USA 数据治理负责人）的开场下，本场围绕“应对不断演进的 AI 监管格局”的专题讨论正式拉开序幕。Tiffany 坦言，监管议题在行业会议中往往容易显得枯燥乏味，但小组在登台前已私下达成默契，“今天一定要把这个话题聊得生动有趣”。随着全球政府与监管机构加速制定相关政策，如何在合规与创新之间找到平衡，已成为企业领导者迫在眉睫的课题。 随后，三位来自不同行业前沿的重量级嘉宾分别进行了自我介绍：负责麦当劳（McDonald's Corporation）AI 及 AI 治理法律事务的高级法律顾问 May Sethaphanich；统领 Heritage Bank of Commerce 整体 IT 与 AI 业务的执行副总裁兼首席信息官 Sachin Vaidya；以及来自华盛顿特区国家公平住房联盟（NFHA）负责任 AI 实验室的 AI 治理助理副总裁 Penny Tilghman。 --- ### [01:22](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=82s) 法律与企业视角：从既有法案到各州新规的演进 当 Tiffany 向 May 提问企业当前如何应对 AI 监管时，May 首先亮出了律师的标准免责声明，强调发言仅代表个人观点，不代表麦当劳公司。May 明确指出，在 ChatGPT 问世之前，AI 的应用就并非处于法律真空之中：例如美国联邦贸易委员会法（FTC Act）以及民权法案第七章（Title VII of the Civil Rights Act），长期以来都在保护消费者与员工的合法权益。 然而过去几年中，针对 AI 产品本身的专项立法正在迅猛推进。欧洲出台了极其详尽严苛的《欧盟人工智能法案》（EU AI Act），其影响力堪称 AI 领域的 GDPR；而在美国本土，州级立法的步伐同样迅速： ```mermaid flowchart TD accTitle: 全球与美国多层次 AI 监管框架演进 subgraph Global["国际与跨国标准"] EU["欧盟: EU AI Act / DORA"] NIST["美国联邦框架: NIST AI RMF"] end subgraph US_States["美国各州专项立法"] CO["科罗拉多州: Colorado AI Act"] TX["德克萨斯州: Responsible AI Governance Act"] CA["加利福尼亚州: SB 813 / 治理框架提案"] end subgraph Foundation["既有基础法律体系"] FTC["FTC Act (消费者保护)"] CIVIL["Civil Rights Act Title VII (员工权益)"] end Foundation --> US_States Global -.-> US_States ``` 无论企业身处受严格监管的行业还是非强监管领域，也不论团队成员来自技术部门还是法务部门，负责任的 AI 治理都是一项“全员协同（all hands on deck）”的跨职能工程，必须建立起既能服务企业本身、又能保障社区与客户权益的治理架构。 --- ### [03:27](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=207s) 监管真空中企业的乐观态度与内部“家规”制定 对于 Tiffany 提出的“联邦层面的滞后是否令人沮丧”这一疑问，May 给出了出人意料的积极反馈。她认为，美国拥有极为健全的法律体系与核心价值观基础。即便在缺乏全面联邦 AI 立法的当前过渡期，注重声誉与员工福祉的优秀企业，完全可以依托自身的价值蓝图来开发和销售 AI 系统，确保充分尊重消费者与员工的权利。 此外，美国国家标准与技术研究院（NIST）发布的《人工智能风险管理框架》（AI Risk Management Framework, AI RMF）也为企业落地提供了明确指引。May 强调，企业无需被动等待法规喂养，而是应该利用行业现有指南并与专家交流，制定出一套明确的“家规（house rules）”，规范 AI 的外购、自建以及内部员工和外部客户的使用边界。 - **既有指引依托**：NIST AI RMF 提供了系统化的风险控制基准。 - **治理自治权**：在外部法律完全定型前，企业可通过内部政策明确 Buy（采购）、Build（构建）与 Use（使用）的具体边界。 --- ### [05:05](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=305s) 金融强监管领域：容器化部署与前瞻性监管沟通 Sachin Vaidya 从银行业的严苛合规环境出发，分享了金融机构落地 AI 的实践路径。在作出个人免责声明后，Sachin 指出，金融机构当前虽未迎来颠覆性的全新法案，但现有的金融与隐私法律框架本身就构成了极高的合规壁垒。客户数据安全与隐私保护是银行的底线，因此金融机构严禁使用任何公开的公共 LLM（Public LLMs），所有大模型应用必须在严格隔离的容器化环境中部署。 Sachin 同时也关注到了欧洲《数字运营弹性法案》（DORA）和《欧盟人工智能法案》等国际监管动态。就银行内部的技术探索而言，他将核心精力投向了智能体 AI（Agentic AI）在后台业务流程自动化改进以及客户支持服务场景的应用。面对严格的合规边界，Sachin 不仅主动遵循监管设定的“护栏（guardrails）”，更选择在日常沟通过程中主动向监管机构科普前沿技术潜能与边界，实现双向赋能。 - **部署铁律**：禁止使用公有 LLM，所有模型与数据交互必须在安全容器化环境内运行。 - **落地重点**：优先聚焦 Agentic AI 驱动的后台流程再造与客户服务流程支持。 - **政企互动**：从被动受审转向主动沟通，在对话中协助监管机构理解技术机制。 --- ### [07:11](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=431s) 民权视角、模型去偏与多元利益相关者治理模型 Penny Tilghman 代表全美最大的民权组织之一——国家公平住房联盟（NFHA）发声，阐述了算法公平与民权保护的核心诉求。Penny 刚参加了在华盛顿特区举办的 AI 行动峰会（AI Action Summit），会上特朗普政府宣布了国家 AI 行动计划，白宫 AI 与加密货币主管（AI & Crypto Czar）David Sacks 预计在未来 1 至 2 年内将出台国家层面的 AI 治理框架。NFHA 赞赏该计划中对劳动力技能投资、AI 数据中心能源供应多元化以及强化国家竞争力的布局。 但 Penny 强调，NFHA 最核心的攻坚方向在于大语言模型的“去偏见（LLM de-biasing）”。由于 LLM 是基于美国历史上带有偏见和歧视性法律的数据集训练而成的，因此在住房与信贷审批等核心场景中极易放大不公。为了填补未来两年的联邦监管空白，私营部门应积极拥抱加利福尼亚州参议院第 813 号法案（SB 813，由曾起草 2020 年《政府人工智能法案》的前国会议员 Jerry McNerney 提出）所倡导的多元监管利益相关者模型（Multi-regulatory Stakeholder Model, MRO），推动跨行业垂直领域的 AI 认证与风险评级机制落地。 - **核心治理挑战**：历史训练数据固有的系统性偏差会导致 LLM 在信贷与住房分配中产生歧视。 - **立法过渡期方案**：依托加州 SB 813 所代表的 MRO 框架，联合银行与麦当劳等大型消费品牌建立行业自律与认证标准。 ### [10:36](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=636s) 企业主动治理的三大支柱：人、政策与流程 面对 AI 监管法规尚未完全明朗的现状，企业不应采取消极等待的态度，而必须主动建立安全合规的防护机制。麦当劳的高级法律顾问 May Sethaphanich 提出了企业主动应对 AI 变革的“三大支柱”核心框架： ```mermaid flowchart TD accTitle: AI主动治理三大支柱 subgraph Pillars["企业主动治理三大支柱"] P1["<b>政策 (Policies)</b><br/>制定企业AI家规、明确使用规范与外部沟通叙事"] P2["<b>流程 (Processes)</b><br/>工具引入审查、设置设计/开发/部署护栏"] P3["<b>人 (People)</b><br/>人机协同、技能升级投资、消除员工替代恐慌"] end P1 --> Synergies["打破跨职能孤岛与自上而下赋能"] P2 --> Synergies P3 --> Synergies ``` - **政策（Policies）：** 企业需要根据自身核心价值观建立一套“企业内部家规”（house rules），明确规定 AI 工具如何引入、如何使用，以及如何向外部公众与内部员工进行沟通。消费者需要了解企业如何使用 AI，而员工则需要知道 AI 会如何影响其工作岗位以及公司将如何为其提供培训。 - **流程（Processes）：** 建立严格的 AI 工具审查流程至关重要。对于有资源和技术能力自行构建 AI 工具的企业，必须设立覆盖设计、开发到部署全生命周期的安全护栏（guardrails）。 - **人（People）：** May 强调，谈论 AI 时把人放在核心并非悖论，人类是不可或缺的。在由各种 AI Agent 和工具交织的“交响乐”中，人类必须充当守护者与指挥家（"conductor in this symphony of AI agents"）。领导层必须向员工传达明确信号：引入 AI 的同时会全力提供技能重塑培训，员工依然是工具的指挥官。 这种组织级变革需要跨部门打破壁垒，自上而下获取管理层支持。考虑到技术迭代与监管演进的极高速度，企业必须立即行动，并将预算切实投入到员工的技能提升（upskilling）上，而不能只把资金花在购买和开发技术上。 ### [13:58](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=838s) 数据治理为基石与理性务实的 AI 投资战略 Heritage Bank of Commerce 执行副总裁兼首席信息官 Sachin Vaidya 对 May 的观点表示高度赞同，并着重补充了**数据治理（Data Governance）**这一核心支柱。他指出，业内常说的“垃圾进，垃圾出”（Garbage in, garbage out）在 AI 时代尤为真实：没有扎实准确的数据资产作为基础，根本不可能训练或运行高质量的 AI 模型。数据治理是任何企业从第一天起就能够立即启动的基础工作，完全无需等待监管细则出台。 谈及员工赋能时，Sachin 引用了英伟达（NVIDIA）CEO 黄仁勋（Jensen Huang）的名言：“淘汰你的不会是 AI，而是掌握了 AI 的人。”因此，无论是企业领导者提供培训机制，还是员工个人投入时间学习，持续精进都是立足之本。 ```mermaid flowchart LR accTitle: 监管前置行动路径 subgraph DataGov["数据治理为根基"] A["准确的数据要素与治理"] --> B["可靠的AI模型与应用"] end subgraph Execution["务实推进路径"] C["追踪国际监管趋势<br/>(EU AI Act / CCPA)"] --> D["精细化预算管理"] D --> E["明确董事会AI治理战略<br/>(视AI为'强效RPA')"] end ``` - **持续自主学习：** AI 技术每两三周就会发生巨大变化，从国际前沿模型迭代到法规变动都需要密切关注。例如欧洲推出法规后，加州的《加州消费者隐私法案》（CCPA）等规则也紧随其后。 - **审慎的预算分配：** Sachin 坦言，传统金融机构不像初创公司那样拥有数百万美元可以在“沙盒”里随意试错挥霍。每一笔资金的流向与价值都必须向高管层及董事会清晰阐明。 - **董事会认知转变与 AI 定位：** 如今董事会纷纷惊醒并追问企业的 AI 战略与治理机制。Sachin 幽默地提到，他在上一期战略会议上就曾向董事会汇报过，AI 对他而言并不是全新陌生的黑科技，本质上就是“打了强心剂的 RPA”（"RPA on steroids"），只要为其装上坚固的护栏即可规范运行。 ### [16:54](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1014s) 创新与负责任使用的平衡：国际与区域治理范式 针对主持人关于如何在创新与合规之间取得平衡的问题，来自 National Fair Housing Alliance 的 Penny Tilghman 与麦当劳的 May Sethaphanich 展开了深入探讨。主持人强调，在谈论风险和合规时，不能营造恐惧文化，而应引导员工负责任地使用工具。 Penny 分析了全球范围内不同地区在 AI 监管与发展上的策略差异： - **欧盟模式（EU Model）：** 侧重于直接监管技术的底层开发阶段。 - **美国模式（US Model）：** 倾向于从具体用例（use cases）切入进行监管，以避免扼杀技术创新。 - **海湾阿拉伯国家（GCC）与卡塔尔模式：** 卡塔尔等中东国家正在大力引领 AI 的开发与落地，卡塔尔本土拥有规模达 560 亿美元的 AI 市场，并作为美国重要的非北约盟友，在双边 AI 投资合作中起到了关键促进作用。其核心在于“以人为本”，在优先投资劳动力发展的同时，允许企业在有益于整体社会的框架内探索应用场景。 May 从餐饮与零售等实体行业的角度呼吁，监管政策必须具备“务实性与常识性”（practical and common sensical），不能过于繁苛： | 监管维度 | 欧洲/部分美国州（如科罗拉多州）模式 | 得克萨斯州治理范式（Texas Approach） | |:--- |:--- |:--- | | **责任归属基础** | 基于 AI 系统对个人产生的**实际影响/后果 (Impact-based)** | 基于开发与使用主体的**主观意图 (Intention-based)** | | **创新保护机制** | 设立较为严格的合规准入门槛 | 提倡监管沙盒与“安全港”（Safe Harbors）机制 | May 呼吁监管机构应与积极践行合规的企业保持紧密对话，为企业提供沙盒测试中的安全港保护，并在充分考量企业需求、技术创新者活力、消费者权益与员工福祉的基础上，制定出兼具前瞻性与包容性的治理框架。 ### [21:01](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1261s) 监管与私营部门的双向沟通：在安全合规与创新之间寻找平衡 Sachin Vaidya 从 IT 与企业落地的角度指出，当前美国联邦及各级监管政策仍处于拼凑与追赶的状态。从未来发展来看，至少还需要一到两年的时间才能逐步完善监管框架，并形成与私营部门紧密合作的机制。他提到在网络安全领域有成熟的金融服务信息共享与分析中心（FS-ISAC）等协作组织，AI 治理也应当建立类似的行业互动机制，由相关机构与私营部门共同制定实用且可行的指导方针和安全护栏。 Sachin 强调，企业与技术人员肩负着“教育监管机构”的责任，必须让监管者了解底层实际落地的痛点与真实诉求。当“理论落地到现实（when the rubber meets the road）”时，企业在执行层面往往会遭遇大量技术与运营挑战，这些来自一线的反馈应当被高层政策制定者倾听。制定护栏与监管的目标固然是为了把控安全与风险，但绝不能过度束缚从而阻碍技术演进与行业未来发展，这必须是一个双向学习与互动的过程。 ```mermaid flowchart LR accTitle: AI 治理中的双向协作机制 subgraph Private["私营部门与企业实践"] A["一线落地挑战与技术痛点"] B["制定企业内部护栏与标准"] end subgraph Regulatory["监管层与行业组织"] C["类 FS-ISAC 协作机制"] D["务实、适度的监管法规"] end A -->|"教育监管者 / 反馈实际需求"| C C --> D D -->|"提供合规指引 / 安全护栏"| B B -->|"保障安全同时释放创新潜力"| A ``` - **追赶周期**：预计监管法规与政策的完善至少需要 1 至 2 年的追赶期。 - **协作标杆**：借鉴网络安全领域 FS-ISAC（金融服务信息共享与分析中心）模式推动 AI 治理。 - **核心诉求**：在控制安全风险的同时，避免过度监管扼杀行业技术创新的前景。 --- ### [22:40](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1360s) 从狂热转向底层：AI 时代的“垃圾进，垃圾出”与数据质量危机 Tiffany Benitez 将讨论焦点从宏观的 AI 愿景拉回到了最根本的“数据”层面。她指出，AI 技术本身并非横空出世的新事物，但过去几年爆发式的技术迭代彻底打破了原有的节奏，发展速度让许多企业难以跟上。这种狂热驱使各大企业投入数百万美元盲目采购最新、最炫酷的技术工具，并聘请咨询顾问制定所谓完美的“AI 路线图”，以满足董事会和高管层对拥抱 AI 的迫切渴求。 然而，当这些系统部署之后，企业高管们才惊觉一个残酷的现实——“垃圾进，垃圾出（garbage in, garbage out）”。长久以来，数据在很多组织中一直被边缘化，被视作仅由特定技术团队负责的后台资产，从未真正进入核心战略视野。现在大家终于意识到，如果不在源头解决数据质量、清洗、伦理及偏见问题，任何 AI 投资都将沦为空中楼阁。Tiffany 随即向 Penny Tilghman 提问：如果企业继续忽视数据治理与伦理偏见，整个行业最终会走向何方？ - **盲目投入现象**：企业过去几年豪掷数百万美元购买最新工具、聘请咨询机构绘制 AI 战略图谱。 - **治理断层**：数据长期被归类在特定角落由后台团队维护，未曾获得最高优先级的重视。 - **核心痛点**：缺乏清洗、充斥偏见的高风险数据直接导致 AI 系统输出不可靠的“垃圾结果”。 --- ### [24:03](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1443s) 民权视角与大模型偏见：DEIA 原则、政府对话与两党立法进展 Penny Tilghman 直言，如果不正视数据问题，整个行业将陷入难以自拔的深渊（"down the rabbit hole"）。从民权视角来看，大语言模型（LLM）的训练数据深深植根于美国各地的历史法规与社会结构之中，其中天然包含历史偏见与歧视性信息。因此，在讨论负责任 AI 时，必须确保民权组织在行业与公共部门的对话桌上占有一席之地。全国公平住房联盟（NFHA）等民权组织正积极倡导在 LLM 训练中引入 DEIA（多样性、公平性、包容性与可及性）原则，以消除模型偏见并实现真正的客观性。 Penny 提到，虽然各方在是否采用 DEIA 具体路径上存在理念分歧（例如特朗普政府更侧重直接追求大语言模型的客观性），但民权团体目前正与新一届政府展开建设性对话，政府对沟通持开放态度。此外，面对监管真空，除了私营部门自主建立治理标准外，由参议员 Todd Young 与 Brian Schatz 联合提出的两党立法提案《人工智能教育与公众意识法案》（AI Education and Public Awareness Act）值得业界高度关注。该法案致力于向社区与产业普及 AI 基础认知，为全社会理性拥抱 AI 提供了极具建设性的法制路径。 - **模型训练缺陷**：LLM 训练集内嵌历史法律与社会环境留下的结构性偏见与歧视。 - **民权倡导诉求**：要求在技术标准与治理框架中融入 DEIA 原则以实现模型去偏见（Debias）。 - **两党立法推动**：参议员 Todd Young 与 Brian Schatz 牵头提出《人工智能教育与公众意识法案》，推动全民与产业层面的 AI 认知教育。 --- ### [26:25](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1585s) 董事会教育与负责任 AI：从数据分类分级到沙盒机制 Sachin Vaidya 回应了关于治理委员会与董事会职责的讨论。他指出，董事会负责把控全行的战略与愿景，而推进“负责任 AI（Responsible AI）”的基石正是扎实的数据治理。在银行业，首席信息官的核心职责既包括保护敏感的客户及企业金融数据，又要通过数据挖掘商业机会。实现这一平衡的前提是建立完善的数据分类分级制度，对数据湖（Data Lakes）与数据仓库（Data Warehouses）中的资产进行精准打标，从而实施严格的访问权限控制——确保“并非所有人都能随意接触全部数据”。 Sachin 分享道，Heritage Bank of Commerce 在两年前就启动了对董事会的持续教育。传统金融机构的董事会往往精通信贷审批、贷款合规与财务风控，但对底层数据架构及其使用方式相对陌生。幸运的是，其所在银行的董事会成员对新兴技术抱有高度敏锐度，常在项目构思初期就主动提出尖锐问题。Sachin 同时警示，仅靠规则约束远远不够，只要有一名员工擅自将敏感数据粘贴到公有云端的大模型（如 ChatGPT）中，整个防护体系就会瞬间崩溃。因此，企业不仅要设置安全边界，还必须为员工提供可控的“沙盒（Sandboxing）”环境，让业务人员在安全受控的空间内学习与探索。 ```mermaid flowchart TD accTitle: 企业级负责任 AI 与数据安全防护体系 subgraph Governance["顶层设计与董事会参与"] Board["董事会持续教育与战略把控"] Strategy["负责任 AI 战略推进"] end subgraph DataMgmt["底层数据治理与分类分级"] Repo["数据湖 / 数据仓库"] Label["数据打标与分类分级"] Access["基于角色的严格访问权限控制"] end subgraph SafeEnv["员工赋能与风险隔离"] Sandbox["受控探索沙盒 (Sandboxing)"] Block["防止敏感数据泄露至公有 ChatGPT"] end Board --> Strategy Strategy --> Repo Repo --> Label Label --> Access Access --> Sandbox Access -.->|"拦截违规调用"| Block ``` - **银行数据核心诉求**：在严格保护消费者与商业客户隐私的前提下，合规释放数据价值。 - **技术防线建设**：数据资产全面打标、细粒度权限控制与防止公网 LLM 违规泄密。 - **沙盒机制价值**：避免单纯封堵，通过安全沙盒为业务人员提供合规探索与实验的环境。 --- ### [29:19](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1759s) 业务自助服务与治理范式转变：从“合规警察”到“竞争优势赋能者” Tiffany Benitez 引入了“业务自助服务（Business Self-Service）”这一前沿趋势。她指出，越来越多的企业正朝着让业务部门真正实现自主使用数据的方向发展。要实现这一目标，技术与治理团队必须彻底改变以往晦涩的技术话术，主动使用“业务能够理解的语言”进行沟通交流。 Tiffany 强调，数据治理的定位必须发生根本性转变：治理绝不应被视作高高在上的“审查与限制（policing and restricting）”，而应当向全公司证明——数据是企业的“核心竞争优势”，数据治理的真正使命是为各业务团队赋能，让数据不再局限于小部分专业技术人员手中。随后，Sachin 赞同这一观点，并主动切入一个真实的业务用例，准备分享银行在人力资源（HR）招聘及职位描述优化中如何安全借助 AI 提效的实际经验。 - **沟通语言转化**：技术与治理团队需摆脱纯技术术语，转向业务驱动的表达体系。 - **治理认知重塑**：从被动的“限制合规与监管警察”转向主动的“业务赋能与竞争壁垒构建”。 - **落地实践前瞻**：即将展开探讨 AI 在 HR 职位匹配与招聘场景中的具体应用用例。 ### [30:34](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1834s) 招聘中的 AI 实践与“人在回路”原则 Sachin Vaidya 分享了一个他在企业内部实际应用 AI 辅助招聘的生动案例。在一次招聘中，岗位收到了约 120 份简历，为了向其他部门展示 AI 的实际落地效果，他亲自“手把手”带领团队实践。他们使用了一款内部 AI 工具，将岗位职责描述（JD）与候选人简历进行匹配，并输入包含特定定制条件（X、Y、Z 条件）的简单提示词，要求模型筛选出前 10 名最匹配的候选人。整个运行过程仅耗时约 4 分钟，系统便输出了 Top 10 名单。基于这份名单，Sachin 迅速安排了面试并最终完成了录用。从职位发布到发出最终 Offer，整个周期仅用了两周时间，彻底摆脱了过去耗费三四周逐一人工翻阅 110 多份简历的漫长过程。 然而，Sachin 也敏锐地指出了这种做法潜在的风险：算法模型本身可能存在偏见，或者求职者可能针对职位描述刻意“调优”甚至粉饰简历以迎合算法匹配。他强调，作为管理者和面试官，核心职责是在面试环节深入追问、层层把关，确保人选真实可靠。现场其他嘉宾对此深表赞同，指出许多人往往只夸耀 AI 带来的惊人效率，却忽略了模型训练数据中潜藏的传统招聘偏见。Sachin 坚定地表示，自己就是那个“人在回路”（Human in the loop）的关键把关人，AI 负责大幅减轻工作负担，但最终决定权始终掌握在人类手中。 - **120 份简历筛选**：AI 工具耗时约 4 分钟直接生成前 10 名候选人名单。 - **招聘周期缩短**：从发布职位到发出录用通知仅耗时 2 周，大幅快于传统的 3 至 4 周。 - **关键风险与防范**：防范算法偏见及候选人针对关键词的简历作弊，必须依赖管理者在面试环节深度介入核实。 ```mermaid flowchart LR accTitle: AI-assisted hiring workflow subgraph S1["筛选阶段"] A["120+ 份简历与 JD 输入"] --> B["内部 AI 模型匹配与筛选"] B --> C["4 分钟生成 Top 10 候选人"] end subgraph S2["人工把关阶段"] C --> D["管理者深度面试与验证"] D --> E["2 周内完成 Offer 发放"] end ``` --- ### [32:49](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1969s) 数据治理、隐私与网络安全是 AI 合规的基石 针对招聘等敏感场景中的 AI 应用，May Sethaphanich 强调了合规与风险意识的重要性。她指出，AI 的普及已是大势所趋、不可逆转，但各类工具的技术架构与应用场景千差万别，“并非所有 AI 工具生而平等”。在人力资源等高风险领域，缺乏经验的团队极易误用技术，因此企业赋能员工的核心在于将他们培养成敏锐、懂技术且负责任的成熟使用者。 May 进一步从法律与合规视角剖析了 AI 治理的本质：AI 的运行完全建立在数据之上，如果企业没有稳固的数据治理、数据隐私保护以及网络安全防线，盲目扩大 AI 规模只会带来巨大的混乱与灾难。任何健全的 AI 监管与治理框架，其底层支柱依然是传统但至关重要的基础数据规则。 - **工具差异性**：不同 AI 产品的构建方式与风险等级各异，不可一概而论。 - **治理底座**：AI 监管与合规并非孤立存在，必须以健全的数据治理、隐私合规和网络安全为前置基础。 --- ### [34:43](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2083s) 公平住房与金融场景中的监管沙盒与测试挑战 主持人提出如何让合规与治理摆脱“事后补救”的被动地位，Penny Tilghman 结合住房与金融领域的痛点给出了深入见解。在美国《公平住房法》（Fair Housing Act）下，法律明确划定了 7 类受保护群体（Protected Classes）。然而在实际操作中，出于数据隐私保护的法律限制，金融机构在模型训练中无法直接使用或测试这些受保护群体的特征数据，导致信用评分、房屋抵押贷款审批和保险承保等核心 AI 模型演变成了难以检验歧视风险的“黑盒”。 Penny 呼吁行业与监管机构探索“监管沙盒”（Regulatory Sandbox）或其他创新的政策框架，在保护隐私的前提下对这些模型开展公平性与合规性压力测试。住房是全美乃至全球经济扩张与社区建设的基本基石，唯有确保承保与评分模型的公平透明，才能有效带动商业招商、人才保留与社区投资的良性发展。 - **合规黑盒困境**：因隐私法规限制，AI 模型难以直接在 7 类受保护群体的数据上进行偏差测试。 - **破局路径**：借助监管沙盒（Regulatory Sandbox）等创新政策机制，在安全受控的环境下对信贷、房贷与保险承保模型进行合规与去偏见测试。 --- ### [35:40](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2140s) 激发内部创新：寻找“低垂果实”与打造快赢范式 Sachin Vaidya 分享了 Heritage Bank of Commerce 在内部推进 AI 创新的务实策略。他借鉴了大学时期做家教的辅导经验，在企业内部建立了开放式的“Open House”机制，鼓励跨部门员工踊跃提出痛点、业务改进方案以及潜在的 AI 使用场景。 面对纷繁复杂的需求，领导者的关键角色在于倾听与优先级排序。Sachin 强调，管理者不应贪多求全试图同时推进十几个项目，而是要精准锁定一到两个“低垂的果实”（Low-hanging fruits），即那些能快速落地并带来显著成效的项目。通过快速取得实效（Quick Wins），团队不仅能验证 AI 带来的时间节省与流程提效，更能树立内部标杆、建立案例库，进而向其他业务部门展示价值，为全行范围内的技术创新与采纳积累势能。 - **Open House 沟通机制**：搭建开放沟通渠道，自下而上收集业务部门的 AI 创新需求。 - **快赢（Quick Wins）策略**：聚焦 1-2 个易落地的低垂果实，用量化的效率提升和时间节约案例为后续规模化推广铺路。 --- ### [37:07](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2227s) 下一代前沿：从生成式 AI 迈向智能体 AI（Agentic AI）与人本赋能 谈及未来一至两年的技术演进趋势，May Sethaphanich 直言，下一波浪潮将是“智能体 AI”（Agentic AI，亦称代理型 AI）。当前许多资源有限的企业甚至尚未完全分清传统 AI 与生成式 AI（GenAI）的界限，但智能体时代已然扑面而来，企业别无选择，只能“扼住命运的咽喉”（grab the bull by its horns）。 面对技术的飞速更迭，May 强调组织转型与个人自驱学习至关重要： 1. **组织重塑与再培训**：管理层必须系统性地考虑全员技能重构（Retooling），帮助员工跟上技术步伐。 2. **跨学科主动学习**：个人需要走出舒适区。May 以自身为例，作为企业法务律师，她积极与 AI 工程师、数据科学家交流，并从跨行业的合规挑战（如公平住房领域的痛点）中汲取经验，以此提升自身的合规治理视野。 主持人最后补充了此前主持“数据与 AI 领域女性圆桌会议”时的观察：面对技术浪潮，人们特别是女性从业者往往容易产生被动接受的“接收者”（Receivers）心态。各方应彻底转变观念，认识到人类自身掌握着主动权与主导能力，应当积极行动、主动拥抱并塑造 AI 的应用与治理生态。 - **技术前沿演进**：产业焦点正从生成式 AI 快速向智能体 AI（Agentic AI）迁移。 - **学习与治理范式**：通过跨部门/跨行业协作（如法务与算法工程师对接），强化全员技术素养，确保“负责任的 AI”真正由具备责任感的人类来引导与监管。 - **心态转变**：从被动承受技术冲击转变为主动驾驭技术的主人。 ### [40:26](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2426s) 领导者的教育职责与第三方合作伙伴的 AI 治理要求 领导者必须在个人与专业层面主动拥抱成长，并为团队制度化地留出学习空间。面对永远做不完的待办事项清单，管理者不能仅仅埋头于日常事务，而应主动将跟进技术前沿与个人成长纳入团队成员的发展规划和绩效目标中。作为领导者，核心职责之一就是充当“教育者”（Educator），不仅要对团队进行持续赋能与培训，还要主动承担起向执行高管团队及董事会成员普及 AI 发展与治理知识的重任。 在金融机构的实际业务中，AI 技术的迅猛迭代伴随着显著扩大的威胁敞口，其中信息安全是最为严峻的挑战。企业在应对这些安全威胁时，必须重新审视与第三方供应商的关系——将其视作共同攻坚克难的“合作伙伴”（Partners）而非单纯的供应商。随着各家企业高管在展厅或行业交流中言必称 AI，领导者必须保持清醒与审慎，严格检验合作伙伴在底层技术上的真实投入与支持力度。 ```mermaid flowchart TD accTitle: AI合作伙伴治理与赋能流程 subgraph Edu["内部赋能与教育"] A["领导层作为教育者"] --> B["赋能执行层与董事会"] A --> C["指导业务团队设定目标"] end subgraph PartnerMgmt["合作伙伴治理与验证"] C --> D["向合作伙伴提出高标准诉求"] D --> E["穿透 AI 营销口号"] E --> F["审查合规文档与安全护栏"] end subgraph Execution["落实落地"] F --> G["落地安全可控的 AI 方案"] end ``` 企业需要赋能并指导一线团队向合作伙伴提出深度质询，不能仅满足于对方口头上宣称“我们正在利用 AI 提供更好的支持”，而必须建立“拿证据说话”（"Show us not just tell us"）的核验机制： - 明确要求合作伙伴展示其 AI 技术的实际运作机制与部署架构。 - 调阅完整的技术文档与开发记录。 - 审查其是否严格遵循现行的监管合规要求。 - 验证系统是否设置了完备的风险防范与安全护栏（Guardrails）。 --- ### [42:38](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2558s) 行业自律、多方协同与落地行动号召 面对不断演进的监管环境，行业自身必须发挥带头引领作用，主动建立私营部门的 AI 治理框架。无论是应对各州立法层面的前沿 AI 监管法案，还是构建跨行业的内部自律准则，都需要在支持技术研发创新的同时，设立合理的“避风港”机制（Safe Harbors），并时刻警惕包括国家安全在内的各维度潜在威胁。 未来的 AI 治理不能依靠单一主体闭门造车，而必须依赖多方力量的深度跨界协同。要真正构建负责任的 AI 生态，必须紧密连接非营利组织、行业企业、政府监管机构以及顶尖科研院所，形成跨部门的常态化协作网络。 在会议尾声，全体与会者为嘉宾们的精彩分享报以热烈掌声。最后，主持人向所有参会者发出了明确的行动号召（Call to Action）：面对飞速变革的 AI 时代，绝不能退缩观望、被动等待监管或技术结果的降临；参会者离开会场后，核心任务是将收集到的信息与见解迅速转化为具体的落地行动，以高频、敏捷的执行力投身于 AI 治理与应用实践之中。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=4s) 今天一定要把这个话题聊得生动有趣 — Tiffany Benitez > [01:22](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=82s) all hands on deck — May Sethaphanich > [03:27](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=207s) house rules — May Sethaphanich > [10:36](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=636s) conductor in this symphony of AI agents — May Sethaphanich > [13:58](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=838s) Garbage in, garbage out — Sachin Vaidya > [13:58](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=838s) 淘汰你的不会是 AI，而是掌握了 AI 的人。 — Sachin Vaidya > [13:58](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=838s) RPA on steroids — Sachin Vaidya > [21:01](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1261s) when the rubber meets the road — Sachin Vaidya > [24:03](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1443s) down the rabbit hole — Penny Tilghman > [32:49](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=1969s) 并非所有 AI 工具生而平等 — May Sethaphanich > [35:40](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2140s) Low-hanging fruits — Sachin Vaidya > [37:07](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2227s) grab the bull by its horns — May Sethaphanich > [40:26](https://www.youtube.com/watch?v=p7hMa8Zk1XI&t=2426s) Show us not just tell us — Sachin Vaidya ## Mentioned Tiffany Benitez, Compass Group USA, May Sethaphanich, McDonald's Corporation, Sachin Vaidya, Heritage Bank of Commerce, Penny Tilghman, National Fair Housing Alliance (NFHA), ChatGPT, FTC Act, Title VII of the Civil Rights Act, EU AI Act, DORA, NIST AI RMF, Colorado AI Act, Responsible AI Governance Act (Texas), SB 813 (California), Jerry McNerney, David Sacks, Jensen Huang, CCPA, FS-ISAC, Todd Young, Brian Schatz, AI Education and Public Awareness Act, Fair Housing Act ## Video description Tiffany Benitez, Head of Data Governance, Compass Group USA May Sethaphanich, Senior Counsel, AI / AI Governance, McDonald's Corporation Sachin Vaidya, EVP Chief Information Officer, Heritage Bank of Commerce Penny Tilghman, AVP, AI Geogovernance, Responsible AI Lab, National Fair Housing Alliance Abstract As AI technologies continue to advance, regulatory frameworks are evolving to address the ethical, legal, and social implications of their use. This session will explore the current state of AI regulation, discussing the latest government policies, industry standards, and international guidelines shaping AI governance. Panelists will share insights on how organizations can stay compliant with emerging regulations while fostering innovation. Learn about the challenges of balancing regulatory requirements with AI deployment and strategies for ensuring ethical AI practices in a complex and rapidly changing regulatory environment. [Source](https://www.youtube.com/watch?v=p7hMa8Zk1XI)

[0:04] Tiffany Benitez: 今天一定要把这个话题聊得生动有趣 [1:22] May Sethaphanich: all hands on deck [3:27] May Sethaphanich: house rules [10:36] May Sethaphanich: conductor in this symphony of AI agents [13:58] Sachin Vaidya: Garbage in, garbage out [13:58] Sachin Vaidya: 淘汰你的不会是 AI，而是掌握了 AI 的人。 [13:58] Sachin Vaidya: RPA on steroids [21:01] Sachin Vaidya: when the rubber meets the road [24:03] Penny Tilghman: down the rabbit hole [32:49] May Sethaphanich: 并非所有 AI 工具生而平等 [35:40] Sachin Vaidya: Low-hanging fruits [37:07] May Sethaphanich: grab the bull by its horns [40:26] Sachin Vaidya: Show us not just tell us

[21:01] Sachin Vaidya: It's our job to also educate the regulators to see what is needed and what's practical. You know, when the rubber meets the road and when you're trying to implement a few things, you run into many challenges and those challenges should be heard at that level. [26:25] Sachin Vaidya: Collaboration is the biggest key. You can put all the guards and controls, but if your user is the one who's, you know, putting all that ChatGPT data into the cloud, there you have it... It only takes one instance to have something be broken. [30:34] Sachin Vaidya: I'm the human that is in the loop. I didn't ask anything for the final decision to be made not by AI, but I was the one who was seeing that. [42:38] Tiffany Benitez: There's action to be taken. Right? We shouldn't be sitting back and just waiting to receive. There's action to be taken. And we need to be doing that fast. We need to be doing it often... It's not just about the information you collect. Now, take that and put action around it.

[0:04] Thank you guys. Um I'm Tiffany Bonitez. [0:06] I'm the head of data governance for [0:08] Compass Group USA. I'll be moderating [0:10] the panel today and super excited to be [0:12] here. [0:13] >> Hi everyone. My name is May Satifin. Um [0:16] I lead AI and AI governance uh for [0:18] McDonald's Corporation. [0:20] >> Hi everyone. Uh my name is Sachin. I'm a [0:23] CIO at Heritage Bank of Commerce and I [0:26] oversee all areas of IT um including AI. [0:30] >> Hello, I'm Penny Tilman. I'm associate [0:32] vice president of AI governance at the [0:35] National Fair Housing Alliance [0:37] Responsible AI lab which is based in [0:39] Washington DC. [0:42] So, I know I was talking to the panel [0:44] before we got on stage and I get it. The [0:46] topic that we're here to talk about [0:47] really around regulation isn't always [0:50] the most uh fun topic, but we're gonna [0:53] make it fun. We kind of vowed to that. [0:54] So, I would say again, AI regulation [0:57] something that's on top of everyone's [0:59] mind right now. I think as our [1:00] government, global government [1:02] governments are trying to navigate and [1:04] figure that out. Um, conversations like [1:06] these are particularly important. And [1:08] so, we've brought together, as you [1:09] heard, some incredible leaders today to [1:11] navigate have this conversation and kind [1:13] of navigate through some of these [1:14] topics. You guys ready? [1:16] >> Okay. See the energy? They're ready. All [1:18] right. Okay. So, I really want to talk [1:20] about [1:22] >> I really want to talk about how we see [1:24] the regulation and the impact or maybe [1:27] lack thereof today with regards to AI. [1:30] So, I want to start with you may um kind [1:32] of with your role at McDonald's. Tell us [1:34] where and how you see current AI [1:38] regulations. I would say especially with [1:40] regards, you could just speak from [1:42] local, national, um, whichever [1:44] preference, but I would say how is it [1:46] affecting your work? [1:48] >> Yeah. So, before I launch into this, I [1:50] just want to say as a typical lawyer, [1:52] uh, the views that I express are mine [1:53] and do not reflect that of McDonald's [1:55] Corporation. So, frankly, there's been [1:59] laws that apply to the use of AI all [2:02] this time, even before Chad GBT became a [2:04] thing. There are laws that protect our [2:06] rights such as the the FTC act and the [2:09] title 7 um of the civil rights act to [2:12] basically protect uh our uh rights as [2:14] consumers and our rights as employees. [2:17] But of course um over the last couple of [2:19] years there there have been uh laws that [2:21] are more specific more focused on uh on [2:24] AI as a product. So for those of you who [2:27] are aware of you know what's going on in [2:28] Europe there's the EU AI act that is [2:30] extremely prescriptive. It's basically [2:33] like the uh privacy the the AI [2:36] equivalent of the GDPR and over here in [2:38] the US uh we are not uh slow as well. Um [2:42] Colorado for instance have passed their [2:44] Colorado AI act and Texas um on the [2:48] other end of the spectrum very [2:49] conservative but they have also passed [2:51] their own law uh the Texas Responsible [2:54] AI governance act. So the long and short [2:57] of it is that you know all of us in this [3:00] room whether we are in regulated [3:02] industries or unregulated industries [3:04] this is a thing that we need to be [3:06] thinking about whether we are tech folks [3:09] or legal folks and this is entirely [3:11] crossunctional this is something that [3:13] all decks have to be on board all hands [3:16] have to be on board to build a [3:18] responsible AI framework that would work [3:20] for all of us the corporations that we [3:22] work for as well as the communities the [3:25] customers that we serve. [3:27] So when the attorney is positive in the [3:29] room, that's always a good sign. So um [3:31] that's refreshing. I don't know about [3:32] you guys, but that's refreshing to hear. [3:35] So you're saying really while it may [3:37] feel slightly defeating from a federal [3:38] perspective right now that really how [3:41] states are tackling this, you have a lot [3:43] of um positivity around that or you feel [3:46] good? Yes, I feel good because we in [3:49] this country there is a very robust [3:51] legal system that is very focused on our [3:54] on on our values and on our rights. And [3:57] frankly, even in the current vacuum or [3:59] the lack of AI regulations, companies [4:02] that pride themselves on being good [4:05] companies on selling a good product that [4:07] cares for their employees are building [4:09] they we do have a a blueprint of our own [4:12] values to build AI systems to sell [4:15] products that would respect the rights [4:17] of our customers as well as respect our [4:20] employees on whom these AI systems are [4:22] being designed and deployed. And besides [4:24] there is the US uh NIST um that has um [4:28] issued their AI risk uh risk management [4:30] framework. So I wouldn't say that there [4:32] are no guidelines as to how we should be [4:34] going about it. There are definitely [4:36] guidelines and of course there there is [4:38] there are these you know experts in this [4:41] conference with whom you can interact [4:42] with to really frame your own house [4:46] house rules as to how you want to either [4:48] buy AI, build AI, use the AI with your [4:52] employees or with with your consumers. [4:54] So yes, I'm very optimistic. [4:56] >> I think that's good because it's it's [4:58] not just waiting for it all to be fed to [5:00] us. It's reframing our eyes and and [5:02] looking to what is already in place. So [5:05] I know Sachin you're in a heavy heavily [5:07] regulated industry right with banking. [5:09] So what are your thoughts on this? [5:10] >> Absolutely. And prior to I started also [5:12] a disclaimer these are my views and not [5:14] the views of Heritage Bank of Commerce. [5:16] Um disclaimers out of the way. Um so [5:19] yeah financial institutions you know [5:20] there is not necessarily a newer actu or [5:23] or regulations that is there. I think [5:25] most of the federal regulations are [5:27] currently overseeing with already [5:28] existing laws and impact that are there. [5:31] Privacy is the biggest thing for us [5:33] right. um securing customer data uh and [5:35] and privacy is the most important thing. [5:38] So many times when we are implementing [5:40] AI or if we are delving into AI we need [5:44] to be mindful about that and we cannot [5:46] use anything that is public uh in in [5:48] that nature. So no public LLMs or [5:50] anything like that everything has to be [5:52] containerized and uh worked upon that. [5:55] Um while you know those are a few acts [5:57] that are there you mentioned about [5:59] European AI act as well as DORA that [6:02] also came about. So I know European [6:04] nations are slightly ahead of us when it [6:06] comes to regulatory um items and and [6:09] notifications but they're so important [6:11] in terms of regulating the environment [6:13] and to do that. So as a financial [6:15] institutions when I'm looking into [6:17] engaging into an AI uh solutions uh [6:20] largely I I delve more into uh Agentic [6:24] AI and process improvement process [6:26] improvement on the backflow. Um you can [6:28] also talk about Agentic AI on a customer [6:31] service level uh from a client support [6:33] teams. Um um so I I've delved very much [6:36] into that and many times I feel like as [6:39] a technologist leader I want to do more [6:41] things. we do it but in a confined [6:44] boundaries and and guardrails uh that [6:46] have been assigned by the regulators and [6:48] I also see an opportunity to educate [6:50] them as well uh to a degree. So whenever [6:52] we have a conversations with them uh I I [6:55] try to engage in those and and have open [6:57] conversations. So yeah thank you. [7:00] >> Sounds like you're taking a proactive [7:01] approach. I think I think sometimes [7:03] we're in the middle of like proactive [7:05] and reactive and I think that with this [7:07] particular topic it's important to be [7:09] proactive. So Penny, I'd like to know [7:11] what risks do you think companies face [7:14] if they wait for regulations to really [7:16] come down the line and finalize before [7:17] they put AI controls in place? [7:19] >> Uh well, in terms of I don't think in [7:22] there's an inherent risk factor uh for [7:26] you know waiting to see what happens at [7:29] the national level. Uh fortunately I was [7:32] able to attend the um AI action summit [7:35] in Washington DC uh whereby President [7:38] Trump announced the AI action plan. Um [7:41] with that said within 1 to two years uh [7:44] there will be uh a national regulation [7:48] um you know on AI in terms of looking at [7:51] government's framework according to uh [7:54] David Saxs the white house AI and [7:56] cryptos are but I just want to take a [7:59] step back and have my own disclaimer as [8:01] well uh in terms of the views that I'm [8:03] expressing are the views of the [8:05] organization for which I work the [8:07] national fair housing alliance which is [8:09] one of the largest civil rights [8:12] organizations and exclusively focuses on [8:15] housing and credit in terms of fair [8:18] access to both. Um that's how we're [8:20] looking at uh AI regulation uh [8:24] domestically as well as globally. And [8:27] with that said, you know, we're [8:28] committed to ensuring that emerging [8:31] technologies such as AI in our enablers [8:35] for all communities. you know, looking [8:37] at economies of scale, making businesses [8:39] more efficient, workforce investment, [8:42] you know, that's facilitating economic [8:44] mobility. Uh, so we do commend the Trump [8:47] administration on certain elements, you [8:50] know, of their plan, prioritizing [8:52] workforce investment, also uh [8:55] diversifying the energy sources for AI [8:57] data center buildouts. Um in addition to [9:00] of course you know looking at [9:02] opportunities uh you know to advance [9:05] American competitiveness and being able [9:07] to lift up all communities. Um with that [9:10] said we're primarily focused on LLM [9:14] debias. You know obviously large [9:16] language models are trained on [9:18] historical data that can in fact be [9:21] biased looking at various statutes [9:23] throughout the United States [9:24] historically. Uh so that's our main [9:27] priority and working with uh [9:29] organizations and private sector of [9:31] course is a key uh priority for us um in [9:35] terms of you know I I think at this [9:38] point to fill the quote unquote vacuum [9:40] within the next two years working with [9:43] banks working with um major consumer [9:46] brands such as McDonald's uh focusing on [9:49] a private AI governance framework uh [9:52] which has been codified in California [9:54] Senate Bill 813 authored by Jerry [9:57] Mcernney who is the chair of the [9:59] taxation and revenue committee of the uh [10:02] state uh legislature in California who [10:05] happened to be a former member of [10:07] Congress who authored the 2020 AI uh [10:10] government act um on which President [10:13] Biden uh largely based his AI plan. Uh [10:16] so there's areas of opportunity to look [10:19] at a multi-regulatory stakeholder uh [10:23] model, MRO model for the private sector [10:26] uh to be able to establish [10:28] certifications across industry verticals [10:31] uh as well as uh risk factors. [10:34] >> Yeah, I mean that's a really incredible [10:36] perspective. I do know that there's [10:38] likely anyone in the room have concerns [10:40] about not being proactive though until [10:42] we can figure out some of these things. [10:45] Yes, I see some heads nodding. Um, I I [10:48] think it is coming, but I think there's [10:49] also some action that our companies and [10:51] organizations need to take to make sure [10:53] that we're safe until we kind of get [10:54] there. May, what's your perspective? Do [10:56] you think there's any proactive steps we [10:58] could take um while we're waiting on [10:59] some of that? [11:01] >> Yeah. Yes, absolutely. I think if I [11:03] could summarize it, people, [11:06] policies, and processes, these are three [11:09] key pillars that we can focus on. um [11:12] policies obviously AI governance [11:14] policies we need an AI governance [11:16] program every company with their own [11:19] values should be developing their own [11:21] house rules as to how AI should be used [11:24] how AI should be brought into the [11:25] company how AI should be um you know [11:29] talked about uh externally and [11:31] internally how you know that [11:32] communication that external narrative [11:34] your consumers want to know how AI is [11:37] going to be used and your employees [11:39] would also want to know how they would [11:41] be upskilled in using AI and also how AI [11:43] would be could potentially be be [11:45] affecting uh their their roles. So [11:48] policies is really important. Processes [11:50] for the review of AI tools that are [11:52] being brought into the company is [11:54] absolutely critical. Processes for the [11:57] purposes of you know um setting out [11:59] guide rails as to how um your tools are [12:02] going to be designed and developed and [12:03] thereafter deployed as well for those [12:05] organizations that have you know [12:07] capabilities and resources to build your [12:09] own AI tools. And finally, but [12:12] definitely last but not the least at all [12:15] are people. People absolutely key. I [12:18] mean, it's not a paradox. It's not [12:20] paradoxical that we're talking about AI, [12:23] but people is absolutely critical in in [12:25] this piece. We need our people to be [12:27] confident that they still have a very [12:29] important role to play. And frankly, we [12:31] need human in the loop to be that [12:34] guardian to be that conductor in the the [12:36] in in this symphony of AI agents and all [12:39] the AI tools that are being being [12:41] deployed. And they need to know that [12:43] they are part of this as well. And when [12:46] management and leadership were to, you [12:48] know, let them know that, hey, you know [12:50] what, while these tools are being being [12:51] brought in uh in huge ways, you are [12:54] going to be upskilled and trained to use [12:56] this tool. You are are going to continue [12:57] to be that commander of that tool. So [13:00] being proactive in crafting this huge um [13:05] company organizational uh transformation [13:08] is entirely crossunctional and as you [13:10] guys know when we need to go outside of [13:12] our silos and get buy in from leadership [13:16] top all the way down and across all the [13:18] different functions it takes time. It's [13:21] like you know sewing seeds and if you [13:23] want to reap the rewards of our efforts [13:25] and frankly we don't have that much [13:26] time. the tech is evolving so fast and [13:28] the regulatory landscape is evolving [13:30] very quick as well. This is really [13:32] something that we should be super [13:34] proactive about and just you know bust [13:36] through our silos and start talking to [13:38] one another and I think just you know on [13:40] on this piece about our people we really [13:43] need to put the budget behind up be [13:46] behind upskilling our people the budget [13:48] shouldn't be allocated only on the tech [13:51] on buying the tech or you know [13:53] developing the tech we should absolutely [13:55] have budget to invest in our people [13:58] >> yeah I think I agree uh investing in [14:00] people is the key but I think one The [14:02] other thing that organization can take a [14:04] proactive approach on is data [14:06] governance. You cannot have a proper AI [14:10] tool or proper AI models without having [14:13] a proper data as everybody understands [14:15] garbage and garbage out right. So having [14:17] a data governance uh is something that [14:20] any organization can start at an earlier [14:22] age. Um as well as to verify that the [14:25] data elements that are going in there [14:27] are accurate uh for you to model upon [14:29] and for you to build upon. So that is [14:31] the key and I couldn't agree with you [14:33] more upskilling employees is the key. Um [14:36] you know these are the newer [14:37] technologies um that is coming about um [14:40] it is not to replace the workforce that [14:42] is there but you know everyone is saying [14:45] with Mr. H from Nvidia said you know [14:48] it's not AI that's going to replace your [14:50] job is the people who actually knows how [14:52] to use AI is going to take over your [14:54] job. So it is a key to upskill your [14:57] employees as a leader you need to [14:59] provide that mechanism and as an [15:01] individual too you need to invest your [15:03] own time to learn about it. Um I [15:06] constantly learn about new things and as [15:08] we learned today from a keynote sessions [15:10] AI changes you know every two weeks 3 [15:12] weeks uh chat GPD5 just came out a [15:15] couple of weeks ago right so uh it's [15:17] investing your own time as well as [15:19] investing time in people where people [15:21] process u and and procedures are are are [15:24] talked about is is a key to it. Uh but [15:27] you can start that journey today. Uh you [15:30] don't have to wait for any regulatory [15:33] guidance to come about. you can see [15:34] what's happening in the environment. Um, [15:36] you know, I I travel quite a bit in [15:39] Europe and attend few conferences and [15:40] speak there. And when the EU act came [15:43] out, it was just a matter of, you know, [15:45] privacy that came out. I'm from [15:47] California and CCPA just came out right [15:50] following that. They may be calling it [15:51] differently, but essentially it is the [15:53] same u privacy law that came about. So, [15:56] educate yourself, educate constant [15:58] learning, advocate for that for yourself [16:01] as as well for your team. Budget it. um [16:04] because there's not much you know I'm [16:05] from a financial institutions and not [16:07] from any startup or anything like that [16:09] and we don't have a million dollar to [16:10] just to go play in the sandbox right so [16:13] you need to try it you need to be [16:14] mindful about where is your dollar being [16:16] spent and how it is being spent um to [16:19] articulate that to the upper executive [16:21] team members as well as to your board u [16:23] interestingly enough now board is [16:25] finally waking up on AI and asking what [16:27] is our AI strategy uh how how are we [16:30] governing with AI and uh uh I I kind [16:33] chuckle about that because I said I I [16:35] spoke to you about that at last [16:36] strategic session. You know AI is not [16:38] new for me. AI is not a new technology. [16:41] I I call it AI is RPA on steroids. Um [16:45] and u essentially you're putting a guard [16:47] rail around that is is a key to it. So [16:49] data governance is that's very much [16:51] important to me which anybody can start [16:53] today. [16:54] >> I really love that you guys talk about [16:56] people being in the forefront because [16:57] while we are talking about risk and [16:59] regulation, we don't want to invoke a [17:01] culture of fear, right? So we we it's [17:03] happening. They're going to use it. What [17:05] we want to do is to really have them [17:07] understand how to use it in a [17:08] responsible way that don't put our [17:10] companies or organizations at risk. Um [17:12] so speaking of So Penny, do you want to [17:14] share I'm going to ask a general [17:16] question. Okay. And I get it. When I ask [17:18] what AI regulation should look like, [17:20] what I really want is to know are your [17:23] thoughts on how do we strike a balance [17:25] between innovation and responsible use? [17:29] Um, you know, I'd say everyone's looking [17:31] at the EU model. Um, the EU, you know, [17:35] is looking at ways to regulate the [17:37] development rather the use case. The US [17:40] is looking at vice versa, wanting to [17:43] make sure that innovation is not going [17:44] to be um impeded, right? But with [17:47] respect to I think the Qatari model is a [17:50] great model to look at in terms of the [17:52] the Arab Gulf GCC nations um or you know [17:56] leading in AI development and [17:58] employment. Uh Qatar alone has a 56 [18:01] billion market in AI tons of investment [18:05] is going in from the United States into [18:07] Qatar. Qatar is a a partner of the US [18:11] major non-NATO ally uh contributed into [18:15] about facilitating about two trillion [18:17] with the T dollars in and AI investment [18:21] uh with the US companies during [18:23] President Trump's uh visit in May. Uh so [18:27] balancing it is making sure that uh [18:29] people first uh people centric investing [18:32] in workforce development um but also [18:35] allowing companies uh to develop uh you [18:38] know use cases but within a framework [18:41] that it is going to benefit society as a [18:44] whole. So, you know, there's as you [18:47] know, there's a a key balancing act. Um, [18:50] and I think currently in certain [18:53] provisions within the AI action plan in [18:55] the United States models this and those [18:58] leaders are engaging uh with the Trump [19:01] administration and vice versa on this [19:03] model which most likely will come to [19:05] come to be be you know introduced within [19:08] one or two years time. [19:10] May what what are your thoughts on just [19:13] again we purposely have people up here [19:15] from different industries but and I [19:16] think the perspectives and viewpoints [19:18] from all are really important so from [19:21] you know more the food and retail side [19:22] what are your thoughts on the balance [19:27] I think it's is it has to be practical [19:30] it has to be common sensical it can't be [19:32] overly uh ownorous I think the [19:34] regulators need to speak uh with uh [19:36] organizations like us who are trying to [19:38] do the right thing But we're trying also [19:40] not to fall too far behind. So um I I [19:44] think having uh giving giving [19:48] um giving organizations safe harbors [19:50] under regulations for us to experiment [19:52] with with uh in within sandboxes would [19:55] be extremely uh useful. I like the the [19:58] the very innovative uh approach that the [20:01] that the state of Texas has taken under [20:04] the Texas uh responsible AI act [20:06] governance act. their framework is based [20:09] on um intention. So liability based on [20:13] intention versus the European approach [20:17] uh of um you know um legislating [20:21] liability based on the impact that an AI [20:24] system would have on individuals. Um [20:26] some of the states um in in in the US [20:29] for instance um Colorado has taken that [20:31] particular approach. But I I think that [20:35] we we need to be very creative. I think [20:37] that regulators uh need to have a robust [20:39] debate to have a sense of what their [20:41] vision for AI is for their communities [20:44] uh for their people and from there [20:46] expert uh and and from there draw out a [20:49] framework that makes sense for their [20:50] people that is sensitive to the needs of [20:53] the business to innovators as well as to [20:56] the the concerns frankly uh of consumers [20:59] as well as employees. [21:01] >> Yeah, I think I agree. uh one of the [21:03] things that I would say we're all IT [21:05] folks around here mostly I said there's [21:07] a patchwork that needs to be done from [21:09] the US governance and and and federal [21:12] roles uh who are coming into it in terms [21:14] of adoption of of the regulatory laws [21:17] and things like that that they need to [21:19] catch up um the proactive approach on [21:21] governance tools is I think also a key [21:23] to it uh that something that that we [21:26] will see uh coming in the future so uh [21:28] from what's next perspective I think at [21:31] least it'll be a year or two of catching [21:33] up on on mostly the regulatory work that [21:36] will be coming about and working with [21:38] private u uh uh sectors I think is a key [21:42] um you know there's a from a security [21:43] perspective there is a entity called [21:45] FSIC that they meet on the security side [21:47] of things I think the same entities uh [21:50] would need to take an active role on AI [21:52] governance as well um and work with [21:55] private sectors to come up with [21:56] guidelines and guardrails um to be there [21:59] um but again I think it's our job to [22:01] also educate the regulators to see what [22:03] is needed and what's practical. U you [22:05] know when the rubber meets the road and [22:07] when you're trying to implement few [22:08] things you run into many challenges and [22:10] those challenges should be heard at that [22:12] level. You want to have a guardrails and [22:14] regulation where yes you want to secure [22:17] you want to contain um the security side [22:20] of things and you want to contain that [22:21] but at the same time you don't want to [22:23] impede the progress or the the futureess [22:26] of of your environment or your industry [22:27] that is coming about. So I think uh from [22:30] that perspective it is a learning [22:32] opportunity and and both ways um that [22:35] can be done and uh I think we can pay [22:38] play an active role on that. [22:40] >> So I kind of want to shift for a second. [22:42] Um I know we're talking a lot about AI [22:44] clearly that's why we're all here but [22:45] can we pivot for a second to data? Um I [22:48] know you kind of touched on it but I [22:50] mean the reality is [22:52] AI has been around for a really long [22:54] time. Okay, this isn't a new thing, but [22:55] the past couple of years have really [22:58] shed some light on, okay, this new thing [23:01] is happening. It's taking place. It's [23:03] moving at speeds that we're having a [23:05] hard time keeping up with. And so all [23:07] these organizations went and spent [23:09] millions of dollars to buy, they did a [23:11] couple things. They went and bought all [23:12] the new shiny and then they hired a lot [23:14] of consultants to come in and say, [23:16] "Here's your AI roadmap. Every every [23:19] seauite and every board wanted those [23:20] over the last couple of years. Great, we [23:22] did it." And then all of the sudden what [23:24] they've realized is you put it so [23:26] eloquently, garbage in, garbage out. [23:28] Like our data, no one has focused on our [23:30] data. Data has always been this thing [23:32] that exists in this area over here and [23:35] this team manages it, but it's never [23:37] been at the forefront. And what is now [23:39] really, really important for us to focus [23:41] on is the data and the quality of. So [23:44] I'd like to know um I'll start with you, [23:46] Penny. Um, but I'd really like to know [23:48] what are your thoughts around just kind [23:50] of some of those statements like what do [23:51] you think the data is actually like if [23:54] we don't focus on our data being where [23:56] it should be cleansed ethics biasy like [24:00] if we don't focus on that where do you [24:02] think that will take us [24:03] >> uh down the rabbit hole obviously in [24:06] terms of from a civil rights lens I mean [24:08] you need civil rights organizations to [24:10] be at the table to discuss responsible [24:12] AI alongside industry and the public [24:16] sector I mean, I think it's just an [24:17] essential voice that needs to be at the [24:19] table. Um, with respect to large [24:22] language models, you know, the data [24:24] shows in terms of research that LLMs are [24:27] trained on, you know, data that can be [24:30] discriminatory because of just the the [24:32] the history and the composition of [24:34] statutes, you know, throughout, for [24:36] example, throughout the country in the [24:38] US. So with that said, the civil rights [24:41] organizations including the National [24:42] Fair Housing Alliance, they're [24:44] advocating for DEIA principles to be [24:48] included in, you know, LLM in terms of [24:51] training uh to debias LLMs to if you [24:54] know to actually have objective LLMs and [24:58] that's something the Trump [24:59] administration wants objectivity in [25:01] large language models. However, where we [25:04] diverge is, you know, on DEIA, [25:07] obviously. So, that's a key point and of [25:10] concern um for the civil rights [25:14] community. But they are having [25:15] constructive conversations with the [25:17] Trump administration who are open to [25:20] having these conversations and that's [25:22] something that's very important, I [25:24] think, to share with this audience and [25:26] to other stakeholders. Um going back to [25:30] uh looking at you know what's going to [25:31] fill the void or the vacuum. Of course, [25:34] the private sector stepping up, [25:35] introducing their own governance [25:37] standards and frameworks within their [25:39] respective industries and you know, [25:41] internally within their companies, but [25:43] you know, again, I would also uh look [25:46] toward the legislation that was [25:48] introduced by Senator Todd Young and [25:50] Senator um Brian Shatz, bipartisan [25:53] legislation um the AI uh artificial [25:56] intelligence um education uh public [25:59] awareness act. And you know it's saying [26:01] okay we're building a campaign to [26:03] educate communities as well as [26:05] industries on what is AI and how can we [26:08] you know pretty much wrap our arms [26:10] around this phenomena right and I think [26:13] that law uh the build text rather should [26:16] be read by everybody in this room um [26:18] including us on stage because it's a [26:21] it's a way to to move forward in this [26:23] conversation constructively. [26:25] I love that. Satchin, I know you're [26:28] super like it made my heart happy when [26:29] you went straight to governance before I [26:31] even went there. Um, just because that [26:32] that's my thing. But, um, from a if you [26:35] think about it from data overall, if you [26:38] think about the direction that we're [26:39] going, what do you think you semi [26:41] mentioned it, but I like you maybe go a [26:42] little deeper like what do you think [26:44] data governance and really like a lot of [26:46] the ethical boards that are being put [26:48] together, like what do you think the [26:49] importance of really moving AI forward [26:52] in the way that it should be? Um what [26:54] what role do you think they play? [26:55] >> Sure. I think they play a larger role. [26:57] Uh the board obviously drives a vision, [26:59] drives a strategy. Um the word that I [27:02] like to use is responsible AI, right? [27:04] The use of responsible AI. How can you [27:06] do that? U you can do that by putting [27:08] data governance in place and that and [27:10] what I meant by that was, you know, I [27:12] work in a in a sector where I'm I'm [27:14] protecting consumer information, [27:16] customer information. We're business [27:17] bank and u um I my sole job is to [27:21] protect that data and however use that [27:23] data to maximize you know opportunities [27:26] um when can you have that and that's [27:28] when I said data governance is the first [27:30] key um you know going back to the [27:32] sectors of you know is it a private [27:34] public all that data you go to that [27:36] classification sense identify your data [27:39] within your data links or data [27:41] warehouses that you have in place uh [27:43] label it so that way you can provide a [27:46] proper security governance over it to to [27:49] really um uh assess your uh [27:51] accessibility too and also um not [27:54] everyone needs to have that access to so [27:57] your governance on the access to the [27:59] data is also a key to it. So definitely [28:02] uh but I think it's a conversation that [28:04] like I said we began to have this [28:06] conversation two years ago educating the [28:09] board as well uh because many times you [28:11] know the the financial institution [28:13] boards is more aware about governance [28:16] with credit uh access and then lending [28:19] and and and that financial access not [28:21] much about data or how that's being [28:23] used. So it's an opportunity for us to [28:25] educate them um and it it starts there. [28:28] So I think the educating the board on [28:30] your constant opportunities that you [28:32] receive with the board is a key to it. [28:34] Um and I think from a organizational [28:36] standpoint at the board level you need [28:39] to also have a board member who are more [28:41] in tune to new technologies and to do [28:44] that I'm and I'm proud to say that we [28:46] have that in our board. They ask [28:47] questions to us saying hey what about [28:49] this what about that prior to even [28:51] something being formulated. So I think [28:53] it is a key um and collaboration is is [28:55] the biggest key. you can put all the [28:57] guards and controls but if your user is [28:59] the one who's you know putting all that [29:01] chat GPT data into the cloud um there [29:04] you have it I mean it just breaks it [29:06] only takes one instance to have [29:08] something to be broken right so you need [29:10] to guard against that at the same time [29:12] you need to provide them with an [29:14] opportunity to explore to learn and [29:16] that's where the sandboxing comes into [29:18] play [29:19] >> I think you um have a very important [29:21] point there so how many of you have [29:23] heard of business uh self-service [29:25] service organizations are started [29:27] talking starting to talk about business [29:29] truly being self-service. So if you [29:31] haven't heard that term you will soon [29:32] that I think most companies are moving [29:34] towards that and why that's really [29:36] important with regards to what you're [29:37] talking about is that we have to start [29:39] speaking their language. So even with [29:42] regards to data data governance we're [29:44] off speaking a very technical terms and [29:46] then you have a few people that can go [29:47] translate that but we're going to have [29:49] to start speaking the language that the [29:50] business understands and we're also [29:52] going to have to start looking at things [29:53] differently. So like instead of looking [29:55] at governance as like policing and [29:57] restricting um there are some functions [29:59] of that but why don't we start showing [30:01] them that their data is their [30:03] competitive advantage why don't we start [30:05] showing them that data governance is [30:07] really about enabling them and to use [30:09] the data and not just particular [30:11] technical teams what are your thoughts [30:13] may on um like [30:15] >> may I jump on that if you don't mind me [30:17] thank you um I I'll provide a use case [30:19] that we recently did on that um you know [30:21] we I was looking for a position to to be [30:23] filled and this is coming to HR uh area [30:26] and where you can use the AI and to use [30:28] for that. Um I was looking for a [30:31] position to be filled. I have job [30:33] description that is out there. I [30:34] received probably 120 applicants uh to [30:37] come from that and this is where I would [30:40] say you need to actually hold the pinky [30:41] of folks and other departments to show [30:44] how this can be done. Um so we used a a [30:48] internal uh AI I won't mention the name [30:50] uh to match against the job descriptions [30:53] and the resumes that we received and [30:55] just compare and a simple query that [30:57] told me okay I asked for give me a top [30:59] 10 candidates that are based on this job [31:02] description that I have and on top of [31:04] that I want X Y and Z and run against [31:07] that model. It took them probably about [31:08] four minutes for them to run that [31:10] against the applicants that came in um [31:13] and gave me a top 10 list within four [31:15] minutes. Now my focus turned into say [31:18] okay I only want to interview this 10 [31:20] people um based on that schedule the [31:24] interview calls and then you know made a [31:26] hire. Now from the time that I published [31:29] this and from the time that I actually [31:31] made a offer to a candidate it only took [31:34] two weeks to fulfill. I don't have to [31:36] wait three weeks, four weeks to go [31:37] through all that 110 applicants that [31:39] have may have come in who are more that [31:42] um the risk of that is that it could be [31:44] biased or an individual [31:46] may have tweaked their resume based on [31:49] uh the job description, right? Which we [31:51] have not heard about that at all. Right? [31:53] So, but as a leader, as a manager, when [31:55] you're interviewing them, that is your [31:57] job to, you know, ask those questions [31:58] and and go deeper on that. And uh I'm [32:01] proud to say that, you know, I I I made [32:02] a good hire. I'm I'm proud of you for [32:05] saying that because yeah, that's usually [32:07] the piece we all leave off the tables [32:08] like we used this really amazing method [32:10] and we got the candidate that we wanted [32:12] but also like really understanding that [32:14] there is a lot of bias there. [32:16] >> It's all the old data. It's all the [32:18] traditional ways of hiring and it's [32:20] really important that you are proactive [32:22] and identifying bias when you do that. [32:24] Otherwise, you skip over a whole lot of [32:26] people. [32:27] >> It is that human in the loop. Correct. [32:28] Right. I'm the human that is in the [32:30] loop. I didn't ask anything for the [32:32] final decision to be made not by AI but [32:35] I was the one who was seeing that but it [32:37] did make my life much more easier right [32:40] >> humans just need to remember they are [32:41] still part of the loop right which is [32:43] part of the fear um but they are still [32:44] in the loop and they still have a [32:46] responsibility so may what are your [32:47] thoughts [32:49] >> yeah for sure I mean it's um there's no [32:52] turning back on this um but we do do [32:55] need to emphasize that people need to be [32:57] cognizant of the risk associated with [32:59] different AI I tools and different use [33:02] cases. Um not all tools are uh are [33:05] equal. They are not built equally and um [33:08] you know part of training empowering our [33:11] people is to make them very smart savvy [33:13] users uh of AI tools. So using AI tools [33:17] in the area of employment for instance [33:19] in in HR would be you know it's is [33:22] something that you know it's a lot of [33:24] responsibility and you know you are very [33:28] experienced you're very experienced uh [33:30] executive leader and you know what [33:31] you're looking for um but a lot of times [33:34] I think for those of us who are not as [33:36] familiar who are not as experienced in [33:38] recruitment for instance I think we need [33:40] to be very careful with how we're using [33:42] this in a way that's responsible and [33:44] that's fair. Um I want to say that it's [33:48] uh you know talking about governance at [33:50] the end of the day AI regulations it's [33:53] built on foundations of data governance [33:55] and privacy AI it's run on on on data [34:00] and if we don't even have those [34:02] foundational pieces in place and cyber [34:04] security as well I mean you you know [34:06] what it's it's it's it's going to be a [34:09] mess if you were to go big on on AI. So [34:11] those are fundamental uh guide rules. Um [34:14] yeah, [34:16] >> I think it's really good insight. Um I [34:18] think a lot of times like governance and [34:20] cyber like privacy like some of those [34:22] become afterthoughts. Like again, let's [34:24] be real. If this particular audience is [34:26] listening in for this particular topic, [34:29] but how do we make this topic not one [34:31] that you just have to go to a specific [34:32] place or a particular role to hear [34:34] about? like how do we really start to [34:36] get this to be on the these [34:38] conversations and these topics on the [34:40] forefront instead of being [34:41] afterthoughts? Penny, what are your [34:42] thoughts there? [34:43] >> Um, I think it's very important. I mean, [34:45] in terms of the housing industry, well, [34:47] more so the Fair Housing Act, there's [34:49] seven protected classes under the Fair [34:51] Housing Statute, right? Um, however, [34:54] there's like a black box because you [34:55] can't necessarily test on these [34:57] protected classes because of data [34:59] privacy. So one of the areas on which [35:02] you know we're saying let's focus is a [35:04] way to unlock you know maybe within a [35:07] regulatory sandbox or some other [35:09] creative policy framework to be able to [35:12] test these models in terms of credit [35:14] scoring mortgage underwriting insurance [35:17] underwriting because what that be [35:19] opportunities for economic development [35:22] business recruitment and retention you [35:24] know further investment workforce [35:26] investment and it builds out the [35:27] community. So housing is the you know [35:30] fundamental economic building block to [35:32] economic expansion and opportunity in [35:35] the United States and across the world. [35:39] >> Sachin [35:40] >> yeah I would say you know I I I did [35:42] tutoring while I was doing college um [35:44] and I I I take that same approach to [35:47] this. I we create openhouse uh [35:49] environment where people within our [35:51] organization can come with ideas um and [35:53] lowhanging fruits where we can start [35:55] using AI or process improvements within [35:57] the place. Um so you need to have that [36:00] communication you need to have that [36:01] dialogue and openness and be able to [36:03] listen to them. uh as well as you know [36:05] provide your own priorities um and [36:07] that's when the leader comes in to say [36:09] hey I won't be able to do you know 12 [36:11] different or 15 different things but why [36:13] don't we focus on one or two those are [36:15] lowhanging fruits that provides you with [36:17] a a quick wins it also builds momentum [36:21] when you have short and quick wins you [36:23] can showcase that to the team showcase [36:25] that to the other departments and say [36:27] hey we were able to do this by this it [36:29] was able to save us x or improve process [36:31] by this much amount of time and uh you [36:34] know you can provide those examples to [36:36] build that repository of items and and [36:38] to do that. So I think being open to [36:41] that being open to receiving as well as [36:43] being open to teach them is a is a key [36:46] to innovation and and driving this [36:48] forward. [36:50] >> That's really good perspective. Um I [36:51] know um what's probably on top of [36:54] everyone's mind is what's next, right? [36:56] We're this is moving at light speed. Um [36:59] and may I think you have a you probably [37:01] have a very interesting perspective. So [37:03] if we could say in the next one to two [37:05] years what should people expect next? [37:07] >> I think we are going to be hearing a lot [37:09] about uh agentic AI. Uh we we might be [37:12] already tired of of this but I think [37:14] it's going to be the next frontier the [37:16] next thing after gen AI. Um so how do we [37:20] even start preparing our people because [37:22] I think for a lot of organizations that [37:24] don't have as much resources people are [37:26] barely grappling with gen AI when they [37:29] don't and and a lot of times folks are [37:31] not even able to discern the difference [37:33] between classical AI and Gen AI and now [37:35] they've we've got to worry about agentic [37:37] AI right uh but the reality is that it's [37:40] here we just need to grab the this bull [37:43] by its horns is a huge task but like you [37:47] know what Penny and Sashin have been [37:49] saying a lot of it has to do with [37:51] upscaling training ourselves the humans [37:54] I think it would be terrific if [37:55] organizations were to to uh you know [37:58] organization leaders were to come [37:59] together and think about [38:03] transformation about how we're going to [38:05] to just help everyone get retoolled to [38:09] make the most of this uh technology I [38:12] think that's super important but at the [38:14] individual level as well there's a lot [38:17] of us. There's a lot for us to do. I [38:19] know we have full-time day jobs, but the [38:21] reality is that I think for a lot of us, [38:23] we need to be learning this tech in a [38:25] huge way. We got to be learning this [38:27] stuff like we've never learned anything [38:30] before. So, from actually using the [38:32] tools to self-arning, reading a lot of [38:35] books, there are a lot of free materials [38:36] out there, but there are some really [38:38] good materials as as well. And as well [38:41] as talking to other people like you know [38:43] people from so I'm I'm an attorney. I [38:46] love talking to my uh AI engineers. I [38:48] love talking to my data scientists and I [38:50] love coming into conferences like this [38:51] and I've learned so much from from [38:54] people from completely different u [38:56] disciplines and from different functions [38:58] as well. So be proactive. I feel like [39:00] this is like the great impetus for the [39:03] community of humanity to come together [39:06] and to learn from one another and learn [39:09] about the risks, the pain points, the [39:11] challenges from different industries [39:13] like you know fair housing. I although I [39:16] work in the consumer um space but but [39:20] knowing about the the challenges that I [39:22] faced um by penny for instance and in [39:26] the banking industry I think would just [39:28] help me be a better attorney in this [39:31] part particular space that that I'm I'm [39:32] I'm speaking to because at the end of [39:35] the day when we build an AI governance [39:37] uh framework or responsible I love how [39:40] session has talked about this is about [39:42] responsible AI and How is it going to be [39:45] responsible if if the humans themselves, [39:47] you know, are not involved in this, [39:48] right? We want to be responsible, but we [39:50] need to know how to be responsible about [39:52] it. [39:53] >> You have a really good point. We [39:55] actually I let a women in data and AI [39:57] round table before this and there was a [39:59] question of a lot of us are receiving [40:02] like we we feel like we're the receivers [40:04] of AIS, especially from a general [40:06] perspective, women. Um, but so how do we [40:09] like we really need to start like [40:10] shifting our mindset to we're not the [40:12] receivers, right? We we h we have the [40:15] power here. We h we have the ability and [40:17] we should be taking action. So instead [40:19] of kind of sitting back and receiving. [40:21] So I really like that point. I think [40:23] it's important for people to understand [40:25] and to build in for themselves [40:26] personally and professionally. And as [40:28] leaders, you can even build that in on [40:30] your teams. Like how are you being [40:31] proactive? Like listen, our to-do lists [40:34] are never going to be done. Like we're [40:35] always going to have a million things on [40:37] there. but you prioritizing yourself, [40:39] your growth, your ability to stay up to [40:41] speed. And then also taking that [40:42] initiative if you're a leader to [40:44] prioritize that into your teams, right? [40:46] Whether that's on their development [40:48] plans or whether that's on right, you [40:49] build that into their goals, but it's [40:51] essential that we're making space to [40:52] consistently do that. Sasha, what are [40:54] your thoughts? [40:55] >> Oh, absolutely. I I think we have about [40:56] five minutes left, so I'll be brief [40:58] here. Um, absolutely. You have to be an [41:00] educator. uh you have to take that [41:02] leadership role and educate your your [41:04] team, your educate your uh you know like [41:06] I said executive team members, board [41:08] members and you have to take that [41:09] approach on on doing so. Um the one [41:11] thing that does worry me uh and you know [41:14] this is part of my additional role as [41:15] well is AI is advancing quite rapidly [41:18] and when I look at financial [41:20] institutions and threats um security is [41:23] the biggest concern that I have and you [41:25] know the the landscape of threat is also [41:28] broadening. Um so I think you know [41:31] investing time in people to really come [41:33] up with that technology but I think our [41:35] third party providers um I don't call [41:38] them vendors I call them partners u [41:40] because they're really you know [41:42] assisting us on on on tackling all those [41:44] things and they need to be very [41:45] proactive on doing that you know as we [41:47] walk the executive hall everyone's using [41:49] the AI as their as their tagline right [41:52] but really is it how much are they [41:54] really investing in that technology to [41:55] really assist you and and to help you [41:57] with that so demanding getting slightly [41:59] more from your partners is also [42:01] important and as a leader um I think you [42:05] have a you have to take that lead as [42:07] well and to do that so um you need to [42:09] empower your teammates as well I can't [42:11] do my job alone right I have team that [42:13] that that's fantastic and uh uh but you [42:16] need to empower them you also need to [42:18] coach them to say hey this is what we [42:20] expect from our partners and this is the [42:22] questions that you should be asking and [42:25] show us not just tell us that okay we [42:28] using AI AI to you better support you in [42:30] this way. How are you doing it? Where [42:31] are the documentations? Where is the [42:33] regulatory requirement? Where are the [42:34] guardrails? So, uh being proactive about [42:36] that is the key to it. [42:38] >> Penny, what's next? [42:39] >> Uh what's next? Uh in terms of you know, [42:43] I think industry has to lead. Uh there [42:46] has to be a private AI government's [42:48] framework. you know, whether it's, you [42:50] know, MRO's as what Senator Mcnney's [42:53] introducing in the California [42:54] legislature or, you know, just internal [42:58] uh framework across industries. That's [43:00] something that's going to be important, [43:01] you know, with safe harbors and being [43:03] able to develop the technology, but [43:05] being cognizant of the threats, [43:06] including national security. Um, so that [43:09] that's what's next. but engaging you [43:11] know across sectors nonprofit industry [43:15] government working together and even you [43:17] know major research and development [43:19] institutions. [43:21] >> So first of all I want to do a round of [43:23] applause for our panelists because [43:24] they've been incredible. [43:29] >> The other thing is just a call to action [43:31] not just from this session but from each [43:32] and every one of us here today is that [43:34] there's action to be taken. Right? We [43:36] shouldn't be sitting back and just [43:37] waiting to receive. There's action to be [43:38] taken. Um, and we need to be doing that [43:41] fast. We need to be doing it often. So, [43:44] just making sure that you leave this [43:45] conference or you leave this session or [43:47] any session today knowing that it's not [43:49] just about the information you collect. [43:50] Now, take that and put action around it. [43:52] Thank you guys so much for your time. [43:54] >> Thank you, Tiffany. [43:55] >> Thank you.