Blackman Urges Firms to Scrap Central AI Boards as Agent Risks Mount
Ai4
Traditional governance frameworks take up to a year and create operational bottlenecks for autonomous agents, requiring companies to replace centralized review boards with decentralized, harm-focused frontline assessments.
## Background
Published on YouTube by Ai4 on August 20, 2026, this presentation features Reid Blackman, CEO of Virtue Consultants, exploring why conventional AI governance fails when applied to AI agents. The session outlines five structural causes of enterprise governance breakdowns, extracts five non-negotiable criteria for modern AI safety, and introduces a practical alternative framework.
## TL;DR
Reid Blackman argues that traditional AI governance is fundamentally broken for agentic AI due to slow policy drafting cycles, centralized review board bottlenecks, six-month sequential approval gauntlets, static generic controls, and linguistic silos across departments. To overcome these failures, organizations must adopt an agile governance model that federates authority to frontline teams, executes simultaneous multi-disciplinary reviews, dynamically adapts to operational contexts, and establishes a shared risk vocabulary. In place of abstract aspirational ethics, Blackman introduces the Ethical Nightmare Challenge (ENC)—a three-question framework paired with structured deliberation worksheets to align cross-functional teams around concrete harm prevention.
## Atmosphere & style
The presentation is candid, sharp, and refreshingly pragmatic, driven by Blackman's self-deprecating humor and unvarnished critique of standard corporate governance playbooks. Moving past vague philosophical ideals, the delivery feels like an energetic, practical wake-up call tailored for frustrated practitioners navigating enterprise bureaucracy. The engaging Q&A exchange further grounds the talk in real-world friction, balancing rigorous analytical diagnosis with actionable, frontline problem-solving.
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=4s) Traditional corporate AI governance playbooks are fundamentally broken and unable to keep up with the autonomous capabilities of agentic AI.
- [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) Enterprise AI policy lifecycles take 9 to 12 months to ratify, causing governance rules to constantly lag behind rapid shifts from traditional ML to generative and agentic AI.
- [04:20](https://www.youtube.com/watch?v=da3ocZD08dA&t=260s) Centralized AI Risk Boards create unsustainable bottlenecks because frontline teams lack the training to resolve risks locally, swamping senior executives with submissions.
- [06:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=364s) Sequential compliance reviews across cybersecurity, privacy, legal, and compliance can drag on for six months, actively driving shadow AI and governance bypasses.
- [08:08](https://www.youtube.com/watch?v=da3ocZD08dA&t=488s) Static, one-size-fits-all compliance checklists fail for agentic AI because agents are hyper context-sensitive based on their foundation models, data access, and digital tools.
- [09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) A lack of shared terminology between technical engineers and non-technical stakeholders prevents the cross-departmental collaboration needed to govern multi-silo AI agents.
- [11:33](https://www.youtube.com/watch?v=da3ocZD08dA&t=693s) Any viable AI governance strategy must fulfill five core criteria: fast implementation, frontline enablement, simultaneous reviews, contextual adaptability, and unified collaboration.
- [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) The Ethical Nightmare Challenge (ENC) replaces abstract ethical debates with three portable questions: identifying specific nightmares, building preventative resources, and training teams.
- [15:56](https://www.youtube.com/watch?v=da3ocZD08dA&t=956s) Decentralized ENC teams can be deployed within weeks using modular, just-in-time training tailored to specific project risks instead of waiting for comprehensive enterprise policies.
- [18:19](https://www.youtube.com/watch?v=da3ocZD08dA&t=1099s) Strict legal and regulatory compliance requirements fit cleanly into the ENC framework as non-negotiable baseline organizational nightmares.
- [19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) Stakeholder alignment and adoption are far more effectively driven by defining shared concrete catastrophes ('what hell looks like') rather than vague aspirational values like fairness or privacy.
- [19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) Scaling governance across distributed teams requires foundational AI literacy, structured facilitation via trained team leaders, and collaborative risk worksheets.
## Detailed walkthrough
### [00:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=4s) The Crumbling State of Traditional AI Governance
Reid Blackman, CEO of Virtue Consultants, opens by reflecting on his eight years advising large organizations on how to avoid ethical, reputational, and legal blunders with artificial intelligence. While that work has historically succeeded, Blackman candidly admits that the standard governance playbook—the very methods he, his competitors, and his colleagues have long prescribed—is fundamentally broken. The emergence and rapid rise of agentic AI has accelerated this collapse, rendering traditional frameworks obsolete.
Blackman structures his argument into two distinct phases. First, he presents a general, framework-agnostic case: standard AI governance is crumbling, demonstrated by five structural failure modes, which necessitate five corresponding criteria for any viable path forward. Second, he proposes a proprietary method designed specifically to fulfill those five criteria. With self-deprecating humor, Blackman acknowledges that while audiences might easily agree on the five flaws of modern governance, they are free to critique his proposed solution: "You might say, 'Hey Reid, I totally agree with you. It's crumbling... but your particular way of solving the problem, it stinks.'"
[01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) Failure #1: Enterprise Policies Cannot Keep Pace with AI Evolution
The standard corporate governance lifecycle begins with an aspirational AI ethics or responsible AI statement centered on abstract principles like fairness, transparency, accountability, and privacy. Organizations then attempt to operationalize these values into comprehensive, enterprise-wide policies backed by detailed compliance controls and procedures. Finally, the policy must undergo extensive stakeholder reviews before being submitted to the board of directors for formal ratification.
```mermaid
flowchart TD
accTitle: Traditional Policy Lifecycle Delay
subgraph Traditional["Traditional Policy Bottleneck (9-12 Months)"]
A["Ethics Statement"] --> B["Draft Enterprise Policy"]
B --> C["Stakeholder & Legal Review"]
C --> D["Board Approval & Awareness Campaign"]
end
subgraph TechDrift["Technological Reality"]
E["Traditional ML"] --> F["Generative AI"] --> G["Agentic AI"]
end
D -. "Always Lags Behind".-> TechDrift
```
This bureaucratic process moves at a glacial pace compared to the technology it seeks to regulate. While drafting a policy takes a human consultant a couple of days—or an LLM mere seconds—gathering input from legal and cross-functional stakeholders and securing a slot on the board's agenda typically takes an entire year. Blackman notes that the absolute fastest his team has ever pushed an enterprise policy through was nine months for a Fortune 500 consumer packaged goods (CPG) company. Once passed, organizations face the uphill battle of internal education, as employees rarely get excited about policy rollouts: "Most people don't wake up, jump out of bed, and they're like, 'Did you hear the hot new policy just dropped? I can't wait to read it and apply it to my workflows.'" By the time a policy written for traditional machine learning is finally implemented, generative AI has arrived; by the time generative AI policies are ratified, agentic AI has taken over, leaving organizations in an endless loop of enforcing obsolete rules.
- **Fastest Enterprise Approval**: 9 months (Fortune 500 CPG client); average baseline is 12 months.
- **Root Failure**: Static, centralized governance creation cannot match the velocity of technological shifts.
- **Core Lesson**: AI governance design and implementation must be agile enough to keep pace with rapid AI evolution.
[04:20](https://www.youtube.com/watch?v=da3ocZD08dA&t=260s) Failure #2: Centralized AI Risk Boards as Bottlenecks
The second structural failure lies in the organizational architecture of responsible AI programs. Typically, frontline teams are asked to score their AI use cases against risk criteria. If a use case is flagged as high-risk, it is escalated to a centralized AI Risk Board or Responsible AI Review Board. However, this model creates an unsustainable operational bottleneck.
```mermaid
flowchart LR
accTitle: Centralized Risk Board Bottleneck
subgraph Frontline["Frontline Teams"]
U1["Use Case 1 (High Risk)"]
U2["Use Case 2 (High Risk)"]
U3["Use Case 3 (High Risk)"]
end
subgraph Bottleneck["Central Bottleneck"]
RB["Centralized AI Risk Board\n(Senior Execs with Day Jobs)"]
end
U1 --> RB
U2 --> RB
U3 --> RB
RB --> Output["Delayed Approvals / Abandoned Projects"]
```
This breakdown happens for three core reasons:
1. Frontline project teams are rarely given the training, operational resources, or authority to mitigate and manage the risks themselves—they are merely taught to flag them.
2. The risk boards consist of senior executives who have full-time day jobs and cannot dedicate their days to reviewing an endless queue of project submissions.
3. As enterprise AI adoption scales, the submission volume surges. With agentic AI—where LLMs are granted access to databases, internal software, and autonomous action—nearly every deployment qualifies as high-risk, completely swamping the board.
- **Root Failure**: Centralized review structures do not scale with enterprise-wide AI adoption.
- **Core Lesson**: Governance must push capabilities, training, and accountability directly down to frontline teams so they can resolve high-risk issues locally rather than merely escalating them.
[06:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=364s) Failure #3: The Drag of Sequential Review Processes
The standard operational workflow for deploying AI solutions forces project teams into an exhausting sequential review gauntlet. Once a team finishes building a system, the project is passed one by one down a siloed compliance corridor: first to cybersecurity, then to data privacy, followed by legal, and finally to regulatory compliance.
```mermaid
flowchart LR
accTitle: Sequential Review vs Simultaneous Review
subgraph Sequential["Current Sequential Drag (~6 Months)"]
direction LR
S1["Build Complete"] --> S2["Cybersecurity"] --> S3["Privacy"] --> S4["Legal"] --> S5["Compliance"]
end
subgraph Simultaneous["Desired 'Quantum' Review"]
direction LR
P1["Build Phase"] --> P2["Simultaneous Multi-Disciplinary Review\n(Cyber + Privacy + Legal + Compliance)"]
end
```
Every department demands its own set of revisions, requiring teams to wait in separate queues and undergo iterative feedback loops that can easily consume six months. By the time all sign-offs are secured, the business opportunity or underlying technical relevance of the use case has often vanished. Worse, this friction actively incentivizes development teams to bypass governance entirely to avoid delays. Blackman stresses that the solution is not attempting to speed up each sequential step, but shifting to a parallel, "quantum" model where cybersecurity, privacy, legal, and compliance assessments occur simultaneously.
- **Average Sequential Review Timeline**: Frequently exceeds 6 months.
- **Unintended Consequence**: Friction drives shadow AI practices and attempts to circumvent oversight.
- **Core Lesson**: Abandon sequential reviews in favor of simultaneous, cross-functional risk evaluations.
[08:08](https://www.youtube.com/watch?v=da3ocZD08dA&t=488s) Failure #4: Static Generic Controls in a Dynamic, Context-Sensitive World
Agentic AI systems—defined as LLMs integrated with external digital tools, internet access, internal databases, enterprise software, or other AI models—are hyper context-sensitive. The risk profile of an agent depends entirely on which foundation model is used, which specific tools and data stores it can execute actions against, who the end users are, and the exact business environment in which it operates.
Despite this dynamic reality, current compliance regimes rely on static, generic checklists intended to cover all AI systems uniformly. Blackman illustrates the mismatch through a concrete scenario:
- Out of a hypothetical checklist of 20 generic controls, perhaps **10 controls** are genuinely relevant to the agent.
- Another **10 controls** are completely irrelevant to the use case, yet teams are forced to waste time implementing them simply to satisfy bureaucratic compliance requirements.
- Crucially, **10 additional controls** that are vital for that specific agent's operational context are absent from the generic list altogether, leaving critical risk vectors unaddressed.
Static controls fail because they lack the adaptability required for autonomous and context-heavy AI agents. Without dynamic, context-aware governance, organizations will find themselves unable to safely deploy agents at scale.
- **Root Failure**: One-size-fits-all, static control lists create compliance theater while missing use-case-specific risks.
- **Core Lesson**: Governance controls must be adaptable, dynamic, and tailored to the context-specific architecture and operational scope of each AI agent.
[09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) Failure Five: The Babel of AI and the Cross-Departmental Challenge
The fifth cause of AI governance failure is one of the most underappreciated drivers of AI risk: nobody in the enterprise speaks the same language. People use the terms "AI" and "AI agent" with wildly divergent meanings. For instance, organizations seeking bragging rights might define an agent as "anything with a big prompt" and boast about deploying 5,000 agents when in reality they have done nothing of the sort.
```mermaid
flowchart TD
accTitle: Cross-Departmental Collaboration for AI Agents
accDescr: Diagram showing how different departments must share a common risk language to govern cross-departmental AI agents.
subgraph SharedLanguage["Shared Language: Nightmare Framework"]
COMM["Common Risk Terminology"]
end
subgraph AgentOps["AI Agent Governance"]
AGENT["Cross-Departmental AI Agent<br/>(Cross-silo databases & tools)"]
end
ENG --> COMM
MKT --> COMM
LEG --> COMM
COMM --> AGENT
```
This linguistic disconnect becomes fatal when engineers building a marketing or human resources application attempt to coordinate with legal and compliance departments. Without a shared vocabulary, collaboration breaks down completely. True AI agents are inherently "cross-departmental beasts" that pull data and invoke tools spanning multiple functional silos. Designing, deploying, and governing these systems requires tight cross-departmental collaboration, which is impossible without unified communication.
- **The Agent Inflation Fallacy**: Calling every large prompt an "AI agent" skews risk assessments and creates false confidence in scale.
- **Cross-Departmental Nature**: AI agents operate across departmental boundaries, making multidisciplinary risk alignment mandatory.
---
[11:33](https://www.youtube.com/watch?v=da3ocZD08dA&t=693s) The Five Non-Negotiable Criteria for Successful AI Governance
Reflecting on these failures leads directly to the core requirements for an effective AI governance strategy. Pausing with some self-deprecating humor about his eyesight deteriorating in his late 40s while squinting at the presentation monitor, Blackman outlines five necessary criteria that any functional governance framework must satisfy:
1. **Fast Implementation**: Governance cannot rely on year-long design phases followed by months or years of rollout; execution must be rapid.
2. **Enabled Frontline Teams**: Risk identification and mitigation must be decentralized and federated so frontline practitioners do the heavy lifting at scale.
3. **Simultaneous Review**: The sequential, bottleneck-heavy review model must be replaced with parallel, concurrent evaluations.
4. **Contextual Adaptability**: The governance mechanism must fit the specific context of how AI agents are created and deployed.
5. **Fostering Communication and Collaboration**: The framework must establish a shared language across technical and non-technical stakeholders.
These five points represent strategic necessities rather than a merely sufficient checklist. Any approach that violates these baseline criteria is fundamentally doomed to failure. Most corporate executives and practitioners are attempting to manage AI risk using traditional, legacy risk-management playbooks that directly contradict every single one of these imperatives.
---
[13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) The Ethical Nightmare Challenge: A Three-Question Framework
To satisfy these criteria without getting bogged down in years of policy drafting, Blackman introduces a practical framework called the **Ethical Nightmare Challenge (ENC)**. Rather than opening broad, philosophical debates about abstract values like "fairness, justice, benefiting humanity, and privacy"—topics Blackman notes he could easily discuss all day given his ten years as an academic philosophy professor specializing in ethics—the framework zeroes in on concrete harm prevention.
```mermaid
flowchart LR
accTitle: The Ethical Nightmare Challenge Framework
accDescr: The three-part recursive framework applied across all organizational levels.
The Ethical Nightmare Challenge distills governance into three simple, portable questions:
1. **What are the organization's AI ethical, reputational, and legal nightmares?**
2. **What resources will you create or deploy to avoid those nightmares?**
3. **How will you train your people to use those resources effectively?**
The power of these three questions lies in their portability across every operational level. A frontline team building an individual AI solution can use them to isolate specific failure modes. A department-level ENC team (such as within Marketing) can apply them across all departmental initiatives. Finally, an enterprise-wide ENC team can apply them to evaluate broad organizational exposure.
---
[15:56](https://www.youtube.com/watch?v=da3ocZD08dA&t=956s) Deploying Agile ENC Teams and Just-in-Time Governance
ENC teams exist specifically to answer these three core questions within their designated jurisdictions. Because the framework does not require waiting for massive, all-encompassing policy manuals, organizations can spin up functioning ENC teams in a matter of weeks through targeted, asynchronous training.
This structure allows for modular, just-in-time training. For example, if a financial services team builds a specialized application combining AI and blockchain, the organization does not need to pause for months to author a unified "AI and Blockchain Policy." Instead, the specific project team receives immediate, tailored training focused strictly on the risks and interactions unique to that deployment.
Crucially, this approach creates the shared language required for cross-functional collaboration. An HR professional and a machine learning engineer can sit down and immediately align on what hiring nightmares they must avoid, what guardrails are needed, and what operational training is required, cutting through jargon and bureaucratic paralysis.
---
[18:19](https://www.youtube.com/watch?v=da3ocZD08dA&t=1099s) Q&A: Addressing High-Stakes and Regulated Environments
During the audience Q&A, an attendee asks how this framework applies to highly regulated industries where system failures can lead to fatal consequences or severe legal liability.
Blackman clarifies that regulatory compliance fits cleanly into the framework: regulatory non-compliance is simply treated as a defined subset of the organization's "nightmares." When an ENC team asks what catastrophic outcomes must be prevented, violating specific statutory or regulatory mandates (such as Regulations A, B, or C) represents a non-negotiable baseline. While regulatory adherence does not exhaust every ethical or reputational nightmare an AI agent might create, it serves as an immediate starting point for defining operational boundaries.
[18:52](https://www.youtube.com/watch?v=da3ocZD08dA&t=1132s) The Incentive Problem in Distributed Teams
During the audience Q&A, an audience member—identifying himself as a tech lawyer who builds regulatory architectures and has worked inside InfoSec startups—praises the presentation's analytical framework as "pretty amazing" and seemingly "bulletproof." However, he raises a pragmatic challenge based on his experience seeing how the "sausage is made": theoretical perfection often falters during real-world implementation across distributed teams. Because only a small subset of cross-functional personnel typically follow top-down governance prescriptions, he asks how Virtue Consultants plans to penetrate organizational incentives and motivate diverse teams to actually adopt this collaborative approach over time.
[19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) Motivating Action Through Shared Nightmares and Structured Deliberation
Reid Blackman frames this challenge as a universal dilemma for all AI governance programs—"how do you get anyone to care?"—and presents a two-pronged solution. First, he argues that the traditional language of aspirational AI ethics fails because preaching vague ideals like "we're for fairness" or "we're for privacy" prompts polite head-nodding without driving action; falling short of high ideals is easily excused with "we're all human, no one's perfect." By contrast, defining concrete catastrophes and operational "nightmares" instills an immediate sense of urgency. While executive stakeholders across security, legal, and compliance may have wildly differing visions of what "heaven" looks like, Blackman observes that the Chief Information Security Officer (CISO), Chief Legal Officer (CLO), and Chief Compliance Officer (CCO) share an identical conception of "what hell looks like."
```mermaid
flowchart TD
accTitle: Alignment Through Shared Nightmares and Structured Worksheets
subgraph Alignment ["1. Motivation Alignment"]
A["Avoid Aspirational Ideals<br/><i>'Fairness & Privacy'</i>"] -.->|Lacks Urgency| B["Focus on Shared Catastrophes<br/><i>'What Hell Looks Like'</i>"]
end
subgraph Training ["2. Foundational E&C Training"]
C["AI Literacy & Intrinsic Risks<br/><i>Hallucinations, Privacy, Cascading Failures</i>"] --> D["Three Core Questions Framework"]
end
subgraph Execution ["3. Structured Deliberation"]
E["Trained E&C Team Leader"] --> F["Seven-Step Deliberation Method"]
F --> G["Nightmare Risk Worksheet<br/><i>Identify, Score, Prioritize, Allocate Resources</i>"]
end
B --> C
D --> E
```
The second operational component relies on structured enablement rather than simply throwing disparate teams into a room and expecting them to figure it out. Virtue provides foundational Ethics and Compliance (E&C) training across teams to establish a common baseline of AI capabilities and intrinsic risks—including privacy violations, hallucinations, and cascading agentic system failures. Cross-functional teams are guided through the core three-question governance framework by a trained E&C team leader using a standardized seven-step deliberation method:
- **Foundational Literacy:** Establishing baseline fluency across technical and non-technical stakeholders regarding how AI works and where structural agentic risks emerge.
- **Seven-Step Deliberation Method:** Equipping designated E&C team leaders with a structured facilitation process so multidisciplinary discussions remain rigorous and focused.
- **Collaborative Nightmare Worksheets:** Co-authoring a shared risk artifact where teams systematically identify worst-case outcomes, score their severity, prioritize interventions, and allocate necessary mitigation resources.
## Notable quotes
> [00:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=4s) You might say, 'Hey Reid, I totally agree with you. It's crumbling... but your particular way of solving the problem, it stinks.' — Reid Blackman
> [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) Most people don't wake up, jump out of bed, and they're like, 'Did you hear the hot new policy just dropped? I can't wait to read it and apply it to my workflows.' — Reid Blackman
> [09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) anything with a big prompt — Reid Blackman
> [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) What are the organization's AI ethical, reputational, and legal nightmares? — Reid Blackman
> [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) What resources will you create or deploy to avoid those nightmares? — Reid Blackman
> [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) How will you train your people to use those resources effectively? — Reid Blackman
> [19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) how do you get anyone to care? — Reid Blackman
> [19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) we're all human, no one's perfect. — Reid Blackman
> [19:37](https://www.youtube.com/watch?v=da3ocZD08dA&t=1177s) what hell looks like. — Reid Blackman
## Video description
Reid Blackman - CEO, Virtue Consultants
You can't successfully deploy AI agents if you can't govern them. But the standard way of governing AI *does not work* when it comes to agents. . I'll explain 5 causes of AI governance failure, each of which comes with a lesson for what we need to do instead. This culminates in 5 criteria that any successful approach to AI governance must meet.
智能体风险加剧，Blackman敦促企业废弃集中式AI委员会
传统治理框架耗时长达一年并对自主智能体构成运营瓶颈，促使企业需以去中心化、聚焦危害的一线评估取代集中式审查委员会。
Reid Blackman 认为，鉴于政策起草周期缓慢、集中式审查委员会造成瓶颈、长达六个月的串行审批流程、静态通用的管控措施以及各部门间的语言壁垒，传统 AI 治理在应对智能体 AI（agentic AI）时已从根本上失效。为解决这些问题，组织机构必须采用敏捷治理模型，将权限下放至一线团队，推行并行的多学科同步审查，动态适应实际业务场景，并建立统一的风险词汇表。Blackman 还提出了“伦理噩梦挑战”（ENC）以取代抽象且流于口号的愿景式伦理，该框架包含三个核心问题并搭配结构化研讨工作表，旨在让跨职能团队聚焦于切实防范具体危害并达成一致。
传统企业 AI 政策审批周期通常长达 9 至 12 个月，导致治理规则在面对从传统机器学习向生成式及 Agentic AI 的快速迭代时陷入持续滞后的困境。 (1:31)
集中式 AI 风险委员会因一线团队缺乏就地处置权限与培训而沦为严重瓶颈，加之长达 6 个月的跨部门串行审查流程，直接诱发了影子 AI 与规避治理的行为。 (4:20)
一刀切的静态合规清单无法适配高度依赖上下文、数据权限与外部工具的 AI Agent，而跨部门沟通中术语定义的不统一更进一步阻断了多领域协同治理。 (8:08)
Virtue Consultants 提出“道德噩梦挑战”（ENC）三问框架，摒弃抽象伦理讨论，转而聚焦具体灾难预防、防范工具建设以及即时培训，以实现去中心化且敏捷的跨职能治理。 (13:43)
Reading summary
Reid Blackman, CEO of Virtue Consultants, argues that traditional corporate AI governance is collapsing under the rise of agentic AI because centralized risk boards, slow policy drafting, and generic checklists cannot keep pace with autonomous systems. He proposes replacing abstract ethics with an agile, harm-focused framework centered on identifying concrete operational catastrophes and empowering frontline teams.
Bureaucratic Lag in Policy and Approval Pipelines (1:31)
Blackman identifies bureaucratic inertia as a core failure of legacy AI governance. Standard corporate policy lifecycles take 9 to 12 months from initial drafting to board ratification—with nine months representing the fastest turnaround Blackman's team has achieved, working with a Fortune 500 consumer packaged goods client. In that time, underlying technology shifts rapidly from traditional machine learning to generative and agentic systems, leaving organizations enforcing outdated rules for obsolete tools.
Operational workflows compound these delays. Centralized risk boards staffed by executives become swamped bottlenecks as adoption scales, largely because frontline teams are trained only to flag risks rather than mitigate them. Furthermore, projects endure a sequential review gauntlet across cybersecurity, privacy, legal, and compliance that frequently exceeds six months. Blackman notes this friction actively incentivizes development teams to bypass governance entirely through shadow AI.
Static Checklists and Cross-Departmental Language Gaps (8:08)
Agentic AI systems interface directly with internal databases, external digital tools, and enterprise software, making their risk profiles hyper-dependent on operational context. Blackman observes that standard compliance programs rely on static, generic control checklists that create compliance theater. For instance, in a hypothetical 20-control generic checklist, 10 items may be relevant, 10 completely irrelevant, and 10 vital context-specific controls absent entirely, leaving critical risk vectors unaddressed.
This structural vulnerability is worsened by an enterprise-wide communication breakdown. Departments use terms like 'AI' and 'agent' inconsistently, sometimes exaggerating single prompts into 'agents' to claim technological scale. Because true AI agents operate across organizational boundaries, the lack of a shared risk vocabulary prevents engineers, legal counsel, and business units from coordinating effectively.
Reframing Governance Around the Ethical Nightmare Challenge (13:43)
To bypass years of theoretical debate over abstract concepts like fairness and benefiting humanity, Blackman introduces the Ethical Nightmare Challenge (ENC). The framework focuses on concrete harm prevention through three portable questions: What are the organization's AI ethical, reputational, and legal nightmares? What resources will be built to avoid them? How will personnel be trained to use those resources?
This structure operates recursively across individual project, departmental, and enterprise levels. Rather than pausing work for months to draft monolithic policies for novel technical integrations—such as combining AI with blockchain—organizations can spin up agile ENC teams in weeks. Frontline personnel then receive modular, just-in-time training tailored strictly to the risks of their specific deployment.
Driving Adoption Through Concrete Failure Modes (19:37)
Addressing concerns regarding organizational incentives and adherence across distributed teams, Blackman asserts that fear of disaster unites stakeholders far more effectively than aspirational ethics. While executives hold divergent definitions of success, the Chief Information Security Officer, Chief Legal Officer, and Chief Compliance Officer share an identical view of catastrophic failure. In highly regulated environments, statutory and regulatory non-compliance serves as the non-negotiable baseline of those defined nightmares.
Operationally, Virtue Consultants pairs basic AI literacy training with a standardized seven-step deliberation method led by trained team leaders. Cross-functional teams co-author collaborative nightmare risk worksheets to systematically identify worst-case outcomes, score their severity, and allocate mitigation resources directly at the operational level.
Blackman concludes that while practitioners may debate his specific proprietary method, any viable AI governance model must be rapidly deployable, context-sensitive, cross-functional, and decentralized to prevent institutional paralysis as autonomous agents proliferate.
## Background
该视频由 YouTube 频道 Ai4 于 2026 年 8 月 20 日发布，主讲嘉宾为 Virtue Consultants 首席执行官 Reid Blackman。视频简介指出，传统 AI 治理方式在 AI Agent（智能体）时代已经彻底失效，演讲旨在剖析治理失败的 5 大根源并提出成功治理必须满足的 5 项核心准则及全新破局框架。
## TL;DR
Reid Blackman 深入剖析了传统 AI 治理在 Agent 时代崩溃的五大根源：政策落地周期漫长、中心化风险委员会沦为瓶颈、串行审查拖垮创新、静态通用控制项脱节以及缺乏通用语言。针对这些致命病灶，他推导出了敏捷实施、赋能一线、并行审查、上下文自适应与促进沟通等 5 项核心准则。为此，他提出了“伦理噩梦挑战”（ENC）框架，主张从抽象的道德理想转向具体的灾难性“噩梦”共识，通过三大核心问题、7 步协作法与噩梦工作表，让分布式跨职能团队具备敏捷且结构化的落地治理能力。
## Atmosphere & style
整场演讲风格犀利直率、逻辑严密且极具实战针对性，打破了传统伦理与合规演讲那种空泛玄妙的学术说教。Blackman 兼具前哲学教授的深邃思辨与一线企业顾问的务实作风，语言生动幽默又充满危机紧迫感。从系统性揭露行业现行治理体系的破裂，到提出聚焦“噩梦”的实操工具，情绪节奏层层递进，给听众带来醍醐灌顶且高度可落地的现场体验。
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=4s) AI Agent（智能体）的兴起使得传统的 AI 治理体系彻底失效，企业急需转向全新的治理范式。
- [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) 传统政策制定与自上而下的推进流程通常耗时数月至一年，导致全员落地时政策早已落后于技术代际演进。
- [04:22](https://www.youtube.com/watch?v=da3ocZD08dA&t=262s) 高度中心化的 AI 风险评审委员会无法应对指数级增长且自主性极高的 AI Agent 用例，沦为企业创新的致命瓶颈。
- [04:22](https://www.youtube.com/watch?v=da3ocZD08dA&t=262s) 必须将风险控制职责与能力下沉赋能一线团队，使其具备在现场独立识别并化解高风险用例的能力。
- [06:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=364s) 网络安全、隐私、法务与合规等部门的单线串行审查耗时过长，容易诱发业务团队钻空子绕过合规机制，需推行跨部门并行同步审查。
- [08:09](https://www.youtube.com/watch?v=da3ocZD08dA&t=489s) AI Agent 具有强烈的上下文敏感性，一刀切的静态通用控制清单既容易遗漏关键特异风险，又会造成大量无意义的合规资源浪费。
- [09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) 跨部门缺乏对 AI 概念与风险的统一语言，会严重阻碍跨部门调取数据与工具的 AI Agent 系统的协作与落地。
- [11:33](https://www.youtube.com/watch?v=da3ocZD08dA&t=693s) 合格的 AI 治理框架必须同时满足快速实施、赋能一线、并行审查、上下文自适应以及促进沟通协作这 5 项核心准则。
- [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) 伦理噩梦挑战（ENC）框架摒弃抽象道德词汇，通过聚焦‘组织面临的噩梦是什么’、‘需要哪些资源避免’以及‘如何培训员工使用资源’三个核心问题实现落地。
- [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) ENC 框架具备高度便携性，可灵活嵌套应用于项目级、部门级以及全企业级的治理场景中。
- [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 相比追求抽象的‘伦理理想’，聚焦明确具体的‘灾难性噩梦’更容易让 CISO、CLO、CCO 等不同跨职能高管迅速达成共识并激发行动紧迫感。
- [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 通过基础 ENC 培训、7 步引导法与噩梦工作表等结构化工具，能有效解决分布式跨职能团队缺乏执行动力和协作流程的现实痛点。
## Detailed walkthrough
### [00:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=4s) 传统 AI 治理体系的崩塌与破局前提
在过去的八年时间里，Reid Blackman 一直致力于为大型跨国组织提供咨询，指导他们如何在利用 AI 技术的同时，避免在伦理、声誉和法律层面“把事情搞砸”。然而他坦率地承认，尽管过去的咨询业务运作良好，但行业目前所依赖的整套治理模式——包括他自己过去向客户推行的方案、同行与竞争对手开出的药方——已经彻底失效。导致其失效的核心催化剂正是 AI Agent（智能体）的兴起。整个现行的治理大厦正在瓦解，企业必须寻求全新的范式。
这场演讲并非单纯为了促成客户签署另一份商业合同，而是要向全行业揭示治理失灵的深层病灶。整个论述分为两个层次：首先是“中立视角”的诊断，系统剖析当前标准治理范式溃败的 5 大根源，并由此推导出一套合格的治理方案必须达标的 5 项核心准则；其次是“Reid 定制视角”的具体方法论，提出一套能够同时满足这 5 项准则的实操解法。即便听众可能不认同他后续提出的具体解法，但现行治理体系的破裂与 5 大失败原因却是无可争议的客观现实。
### [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) 失败之一：政策落地周期漫长，永远追不上技术演进
传统 AI 治理的第一项典型败局，在于其旷日持久的“政策制定与自上而下推进”流程。大多数企业的起步动作极为相似：先起草一份充满隐私、透明度、问责制与公平性等宏大辞藻的“负责任 AI 声明”或“AI 伦理声明”，然后面对空洞的价值观面面相觑，思考“这到底该怎么落地”。随后，团队着手将其具象化为全企业范围的正式政策，并配套制定合规控制项与操作流程。
```mermaid
flowchart LR
accTitle: 传统 AI 治理政策滞后流程
subgraph S1["政策制定流程 (耗时 9-12 个月)"]
A["价值观与伦理声明"] --> B["全企业政策起草与法务会签"]
B --> C["董事会排期与最终审批"]
end
subgraph S2["技术代际脱节"]
C --> D["全员宣贯与部门落地"]
E["技术演进: 传统机器学习"] -.-> F["生成式 AI"]
F -.-> G["AI Agent"]
end
D -.->|"落地时政策已过时"| G
```
这一整套自上而下的政策流程极其拖沓：
- 在大型组织中，全企业政策走完流程通常至少耗时一年；即便是 Reid Blackman 团队曾辅导过的一家财富 500 强快消（CPG）企业，创下的最快纪录也足足用了 9 个月。
- 实际撰写政策文本极快，“给我一到两天就能写完，交给大语言模型只要几秒钟”，但真正的耗时黑洞在于拉通各利益相关方、法务层层合规审查，以及漫长等待并挤入董事会的议程排期。
- 政策本身枯燥乏味，“没有人早上从床上跳起来高喊：‘听说最新政策出炉了，我迫不及待要通读并在业务流程里执行！’”，因此企业又不得不发起耗费数月的全员宣贯与跨部门适配。
- 这种滞后带来了致命错位：企业辛辛苦苦为传统机器学习（Machine Learning）制定的全企业政策刚刚过审落地，生成式 AI 就爆发了；等管理层手忙脚乱召集高管和董事会更新并推行生成式 AI 政策时，AI Agent 又已经普及。企业永远在推行过时的政策，永远在追赶技术变革的尾巴。
**治理教训**：AI 治理体系的设计与落地实施，必须拥有一种能够真正匹配 AI 技术演进步伐的全新机制。
### [04:22](https://www.youtube.com/watch?v=da3ocZD08dA&t=262s) 失败之二：中心化风险评审委员会沦为致命业务瓶颈
标准负责任 AI 或 AI 治理架构的第二个通病，是设立了高度中心化的“AI 风险委员会”（AI Risk Board 或 Responsible AI Board）。在这种机制下，通常由一线业务与技术团队负责根据既定规则为用例打分，一旦识别为所谓的高风险（High-risk）用例，便统一上报并呈递给中心化风险委员会进行最终把关。
然而，这种设计直接导致了严重的通道堵塞：
- 一线技术人员缺乏应对和化解复杂风险的专业培训与实操资源，其角色仅仅是机械化的“风险标记员”，只能将皮球踢给上层。
- 随着企业内部 AI 采用率的爆炸式上升，需要审查的项目呈指数级涌向委员会。
- 风险委员会的席位通常由资深业务高管兼任，他们日常本职工作极其繁重，“不可能整天泡在用例评审里”。
- 随着 Agentic AI（智能体 AI）的落地，LLM 被赋予访问各类数据库、企业内部软件、API 工具以及自主采取行动的权限。这种高度自主性意味着绝大多数 AI Agent 在现有标准下都会被自动划归为高风险。中心化评审机制根本不具备可扩展性（Scalability），不仅拖慢了业务落地，更导致治理全面失灵。
**治理教训**：必须将风险控制的职责和能力下沉，赋能一线团队（“push more responsibility, more capability to that frontline team”），使他们在标识风险的同时，具备在一线独立解决高风险用例的能力。
### [06:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=364s) 失败之三：串行审查流程拖垮创新速度并诱发合规绕行
第三个普遍的治理失败在于开发与审查之间的“串行接力跑”模式。研发团队在独立完成 AI 解决方案的构建后，必须带着项目依次排队穿越层层关卡：先移交网络安全（Cybersecurity）部门，通过后再送审数据隐私（Data Privacy）部门，接着呈递给法务（Legal），最后再由合规（Compliance）团队审核。
每个审查部门都会基于自身的职能立场提出一整套修改意见。开发团队只能反复等待排期审查、排队接收反馈闭环、再返工修改以满足各项合规指标，这一链条走完常常需要耗费长达六个月的时间。在此期间，原本极具商业价值与时效性的用例甚至已经丧失了市场意义。面对这种扼杀创新节奏的漫长串行审核，业务团队不可避免地会滋生投机心理，想方设法“钻空子、绕过审核机制（sneak by）”，从而使企业暴露在更不可控的隐蔽风险之中。
要打破这种恶性循环，答案绝不是指望提升各个单点部门串行审查的琐碎效率，而是需要重构底层逻辑。正如量子计算能够实现状态叠加一样，治理流程需要一种“量子式（Quantum）解决方案”——彻底打破先后次序，让网络安全、法务、隐私与合规等跨职能部门能够同步（Simultaneously）且无缝地展开协同评审。
### [08:09](https://www.youtube.com/watch?v=da3ocZD08dA&t=489s) 失败之四：静态通用控制项与动态上下文严重脱节
第四个系统性失败，源于传统治理习惯于依赖“一刀切”的静态、通用控制项（Static, Generic Controls），这与 AI Agent 高度依赖上下文的本质形成了直接冲突。所谓 AI Agent，其典型结构是将大语言模型与外部世界的多样化数字工具相连——包括公网环境、各类专有数据库、企业内部核心软件以及其他 AI 代理协同网络。
AI Agent 具有极其强烈的“上下文敏感性（Context-sensitive）”：底层调用了哪个大模型？赋予了哪些工具与权限？使用者是谁？具体的部署场景与业务目标是什么？这些维度的排列组合极其复杂，使得通用控制清单漏洞百出：
- 假设企业制定了一份包含 20 条静态控制项的通用清单，其中可能只有 10 条真正切中该 Agent 的技术现实。
- 剩余的 10 条控制项与该用例毫不相干，但为了形式上的“合规审查”，团队不得不投入大量精力和工时逐一履职勾选，纯属资源浪费。
- 与此同时，该特定场景下还有另外 10 个关乎系统安全与业务风险的关键隐患，却因为根本没有被列入通用清单而被彻底无视。
这种静态控制机制完全无法应对 AI 技术的动态演进与上下文多样性。如果治理方案无法根据 Agent 的具体使用场景保持高度灵活性（Adaptable）与上下文感知能力，企业要么寸步难行不敢真正部署智能体，要么在蒙眼狂奔中将企业置于巨大的危险之中。
### [09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) 治理失败之五：缺乏通用语言导致跨部门协作破裂
AI 治理失败的第五个诱因，是 AI 风险领域中最被忽视的“幕后推手”：各方在谈论 AI 及其风险时完全在“自说自话”。组织内部对“AI”甚至“AI Agent（智能体）”的定义毫无共识。有些团队为了夸大自身成果，把“任何带有一段长 Prompt（提示词）的东西”都标榜为 Agent，声称自己拥有 5,000 个智能体，但这显然脱离了实际。这种术语与认知上的分裂，直接导致工程研发人员在与市场营销、人力资源、法务以及合规部门沟通时产生严重的语境隔阂。
```mermaid
flowchart TD
accTitle: Cross-departmental AI Agent Collaboration Challenge
subgraph Silos["部门孤岛与语境分歧"]
ENG["工程师团队<br/>(关注技术实现)"]
BIZ["业务/HR/市场<br/>(关注业务落地)"]
LEG["法务/合规部门<br/>(关注监管合规)"]
end
subgraph Core["核心矛盾"]
FAIL["缺乏统一语言与共识"]
end
subgraph AgentGoal["AI Agent 协作目标"]
CROSS["跨部门数据调用与协同治理"]
end
ENG -. 术语分歧.-> FAIL
BIZ -. 认知脱节.-> FAIL
LEG -. 标准不一.-> FAIL
FAIL ==>|阻碍| CROSS
```
AI Agent 本质上是一种“跨部门物种”，其核心优势在于能够跨越部门边界运行，调取分布在各部门的数据与工具。如果缺乏统一的风险与技术语言，跨部门协作便无从谈起，而无法协同就根本无法真正构建和部署 AI Agent。要实现有效的治理，必须让组织内的所有角色在统一的语境下沟通。
- 如果工程人员与法务、合规及业务部门没有统一的风险语言，协作就必然崩溃。
- AI Agent 的设计、运行和治理高度依赖跨部门协同，顺畅的沟通机制是底层前提。
---
### [11:33](https://www.youtube.com/watch?v=da3ocZD08dA&t=693s) 成功 AI 治理的五项核心准则
从上述五大失败教训反推，任何可行的 AI 治理战略都必须满足五项基本准则。演讲者自嘲视力衰退、调侃自己在小屏幕上看不清字，但明确指出传统企业治理那种动辄耗时数月甚至数年的漫长流程在 AI 时代是完全不可接受的。
```mermaid
flowchart LR
accTitle: Five Criteria for AI Governance Success
subgraph Criteria["成功治理的 5 项必要条件"]
C1["1. 快速落地实施<br/>(数周内见效)"]
C2["2. 赋能一线团队<br/>(去中心化/联邦制)"]
C3["3. 并行审查机制<br/>(告别单线串行)"]
C4["4. 上下文自适应<br/>(匹配 Agent 场景)"]
C5["5. 促进沟通协作<br/>(统一风险语言)"]
end
```
绝大多数企业高管和从业者仍在试图套用传统的风险管理模式，这与上述五项准则背道而驰，注定走向失败。这五项标准构成了 AI 治理战略的必要条件：
- **快速实施（Fast Implementation）**：摒弃长达数年的方案设计与落地周期，敏捷上线。
- **赋能一线团队（Enable Frontline Teams）**：风险识别与管理的大部分重任必须下放给一线团队，通过联邦化或去中心化实现规模化。
- **并行审查（Simultaneous Review）**：打破低效的单线串行审批链条，推行多方同步审查。
- **上下文自适应（Context Adaptability）**：机制必须能够动态适配 AI Agent 开发与部署的具体业务场景。
- **促进沟通与协作（Foster Communication & Collaboration）**：提供低门槛的交流框架，打破专业壁垒。
---
### [13:43](https://www.youtube.com/watch?v=da3ocZD08dA&t=823s) 解决方案：伦理噩梦挑战（ENC）框架与三核心问题
针对上述标准，演讲者提出了名为“伦理噩梦挑战”（Ethical Nightmare Challenge，简称 ENC）的治理框架。作为拥有 10 年伦理学研究背景的前哲学教授，他直言虽然自己能整天大谈美德与善，但在企业治理落地场景中，高谈阔论“公平、正义、造福人类”等崇高词汇毫无用处。企业治理必须直面最糟糕的具体后果，聚焦于三个简单易懂的核心问题：
| 核心问题序号 | 问题内容 | 核心聚焦 |
|:--- |:--- |:--- |
| **问题一** | 组织面临的 AI 伦理、声誉与法律**噩梦**是什么？ | 识别需要规避的极端负面后果 |
| **问题二** | 需要建立哪些**资源**来避免这些噩梦？ | 落地工具、流程与防护机制 |
| **问题三** | 如何**培训**员工以有效使用这些资源？ | 确保能力下沉与资源执行力 |
这三个问题具备极强的通用性与便携性，可以无缝嵌套在组织内的各个层级：
1. **项目级（Project Level）**：针对具体的 AI 解决方案，识别该方案特有的风险噩梦、对应资源与团队/终端用户所需培训。
2. **部门级（Department Level）**：如市场部门设立 ENC 团队，排查营销场景下的合规与声誉噩梦及专属资源配置。
3. **企业级（Enterprise Level）**：统筹全公司的宏观风险基线、跨组织资源沉淀与全员培训体系。
---
### [15:56](https://www.youtube.com/watch?v=da3ocZD08dA&t=956s) ENC 团队落地运作与强监管行业问答
ENC 团队的核心使命就是持续回答上述三个问题。相比耗时数年的传统政策制定路线，企业可以通过轻量化的异步培训，在短短数周内建立起运转良好的 ENC 团队。这种模式赋予了一线团队明确的“管辖权”，使其具备高度的自适应性。
例如在金融服务领域，当团队研发涉及 AI 与区块链结合的创新产品时，企业无需等待分别制定出完备的“区块链政策”和“AI 政策”，而是直接为该专项团队提供实时的“即时培训”（Just-In-Time Training），快速厘清两种技术交织带来的具体风险。同时，当 HR 部门与技术工程师就“AI 招聘筛选或评估工具”进行对接时，双方不再纠缠于晦涩的技术参数或抽象的道德定义，只需对齐“我们必须避免哪些人事噩梦”，即可建立起顺畅的协同对话。
- **快速部署**：依托异步培训，几周内即可完成团队组建并投入实战。
- **即时赋能**：针对前沿/复合型项目（如 AI + 区块链）提供定制化定向支持。
- **强监管行业适用性**：在现场问答环节，针对“在涉及人命安全的强监管行业中框架如何运作”的提问，演讲者指出，违反特定法律法规就是该团队面临的“核心噩梦之一”；合规底线是噩梦集合的明确子集，构成了排查治理的坚实起点。
### [18:52](https://www.youtube.com/watch?v=da3ocZD08dA&t=1132s) 现场提问：如何真正激励分布式跨职能团队践行 AI 治理？
在问答环节中，一位拥有科技法律背景且参与过多间信息安全（InfoSec）初创企业的观众提出了一个直击痛点的现实挑战。这位提问者坦言，自己长期协助企业搭建监管合规架构，亲眼目睹过产品与治理在幕后“灌香肠式的混乱制造过程”（"seen the sausage being made"）。他指出，演讲中展示的分析框架虽然非常严密、近乎无懈可击，但在现实中却容易流于理论化——在由工程、法务、产品等不同专业构成的分布式团队中，真正有动力去主动执行这些治理建议的人往往只是极少数。提问者据此发问：随着这套方法的推进，究竟该如何设计激励机制，提升不同职能团队在日常协作中的渗透率与执行意愿？
```mermaid
flowchart TD
accTitle: 治理激励困境与落地解决方案
subgraph Problem["现实落地痛点"]
A["理论框架完备"] --> B["分布式跨职能团队"]
B --> C["仅少数人有动力执行"]
end
subgraph Solution["黑格曼的破局路径"]
D["聚焦'噩梦'而非'理想'<br/>（凝聚危机共识）"]
E["统一基础 ENC 培训<br/>（建立共同语言）"]
F["7步协作法与噩梦工作表<br/>（结构化审议流程）"]
end
Problem --> Solution
```
---
### [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 聚焦“噩梦”而非“理想”：利用危机共识与结构化流程驱动落地
里德·黑格曼（Reid Blackman）首先对问题进行了梳理与确认：“归根结底，问题在于如何让跨部门协作真正发生，或者说如何激发大家的积极性？”他承认这是所有 AI 治理路径都会面临的普遍难题——“如何让大家真正产生在乎的动力？”针对这一痛点，黑格曼提出了两大核心解决策略。
第一点在于**转变沟通语言：从宣讲崇高的“伦理理想”转向明确具体的“灾难性噩梦”**。黑格曼直言，当团队泛泛而谈“我们要追求公平与隐私”时，大家都会礼貌地点头附和，觉得“听起来很美好”，但这种抽象口号根本无法让人看清失败的具体代价；一旦系统未能达到这些崇高愿景，人们也会轻易以“我们都是凡人，没人是完美的”为借口自我开脱。相反，如果直接明确指出“大祸临头究竟长什么样”（"what catastrophe looks like"），这种对噩梦的精准刻画反而能激发强烈的紧迫感。更重要的是，“噩梦往往比理想更容易达成共识”。首席信息安全官（CISO）、首席法务官（CLO）和首席合规官（CCO）对于完美的“天堂”可能各有各的定义，但他们对“地狱”的长相却拥有高度一致的共识。
第二点在于**提供统一的基础培训与结构化的审议工具**。黑格曼强调，不能把各部门人员扔进会议室让他们“自己想办法”，而是必须提供配套落地的支持机制：
- **基础 ENC 培训（Foundational ENC Training）**：为所有跨职能成员普及统一常识，包括 AI 的基本运作原理、内在技术风险（如隐私泄露、模型幻觉，以及在 Agent 智能体系统中常见的连锁级联故障 cascading failures），并熟练掌握核心的三问评估框架。
- **7 步法引导流程（Seven-Step Method）**：由经过专门培训的 ENC 团队负责人带领各部门按既定步骤协作推演。
- **噩梦工作表（Nightmare Worksheet）**：团队在审议过程中共同填写风险工作表，协作识别潜在的系统噩梦、进行量化打分评估、排出优先级次序，并落实所需的应对资源。通过结构化流程，使跨领域的 AI 治理从虚无缥缈的道德说教，转变为具备操作性的日常风控行动。
## Notable quotes
> [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) 给我一到两天就能写完，交给大语言模型只要几秒钟 — Reid Blackman
> [01:31](https://www.youtube.com/watch?v=da3ocZD08dA&t=91s) 没有人早上从床上跳起来高喊：‘听说最新政策出炉了，我迫不及待要通读并在业务流程里执行！’ — Reid Blackman
> [04:22](https://www.youtube.com/watch?v=da3ocZD08dA&t=262s) push more responsibility, more capability to that frontline team — Reid Blackman
> [06:04](https://www.youtube.com/watch?v=da3ocZD08dA&t=364s) 钻空子、绕过审核机制（sneak by） — Reid Blackman
> [09:47](https://www.youtube.com/watch?v=da3ocZD08dA&t=587s) 任何带有一段长 Prompt（提示词）的东西 — Reid Blackman
> [18:52](https://www.youtube.com/watch?v=da3ocZD08dA&t=1132s) seen the sausage being made — 现场提问观众
> [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 归根结底，问题在于如何让跨部门协作真正发生，或者说如何激发大家的积极性？ — Reid Blackman
> [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 如何让大家真正产生在乎的动力？ — Reid Blackman
> [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) what catastrophe looks like — Reid Blackman
> [19:50](https://www.youtube.com/watch?v=da3ocZD08dA&t=1190s) 噩梦往往比理想更容易达成共识 — Reid Blackman
## Mentioned
Reid Blackman, Virtue Consultants, Ai4, Ethical Nightmare Challenge (ENC), AI Agent, Generative AI, Machine Learning, LLM, CISO, CLO, CCO
## Video description
Reid Blackman - CEO, Virtue Consultants
You can't successfully deploy AI agents if you can't govern them. But the standard way of governing AI *does not work* when it comes to agents. . I'll explain 5 causes of AI governance failure, each of which comes with a lesson for what we need to do instead. This culminates in 5 criteria that any successful approach to AI governance must meet.
[Source](https://www.youtube.com/watch?v=da3ocZD08dA)
Source quotes
[1:31] Reid Blackman: 给我一到两天就能写完，交给大语言模型只要几秒钟
[1:31] Reid Blackman: 没有人早上从床上跳起来高喊：‘听说最新政策出炉了，我迫不及待要通读并在业务流程里执行！’
[4:22] Reid Blackman: push more responsibility, more capability to that frontline team
[6:04] Reid Blackman: 钻空子、绕过审核机制（sneak by）
[9:47] Reid Blackman: 任何带有一段长 Prompt（提示词）的东西
[18:52] 现场提问观众: seen the sausage being made
[19:50] Reid Blackman: 归根结底，问题在于如何让跨部门协作真正发生，或者说如何激发大家的积极性？
[19:50] Reid Blackman: 如何让大家真正产生在乎的动力？
[19:50] Reid Blackman: what catastrophe looks like
[19:50] Reid Blackman: 噩梦往往比理想更容易达成共识
Source quotes
[0:04] Reid Blackman: You might say, 'Hey Reid, I totally agree with you. It's crumbling... but your particular way of solving the problem, it stinks.'
[1:31] Reid Blackman: Most people don't wake up, jump out of bed, and they're like, 'Did you hear the hot new policy just dropped? I can't wait to read it and apply it to my workflows.'
[9:47] Reid Blackman: anything with a big prompt
[9:47] Reid Blackman: cross-departmental beasts
[13:43] Reid Blackman: fairness, justice, benefiting humanity, and privacy
[13:43] Reid Blackman: What are the organization's AI ethical, reputational, and legal nightmares?
[13:43] Reid Blackman: What resources will you create or deploy to avoid those nightmares?
[13:43] Reid Blackman: How will you train your people to use those resources effectively?
[19:37] Reid Blackman: how do you get anyone to care?
[19:37] Reid Blackman: we're all human, no one's perfect.
[19:37] Reid Blackman: what hell looks like.
Original transcript
[0:04] All right. So, my name is Reed Blackman.
[0:05] Um, I've spent the past eight years or
[0:07] so advising large organizations how not
[0:10] to ethically, reputationally, and
[0:11] legally screw up with AI, that's gone
[0:14] reasonably well. But the truth is that
[0:16] at this point, I think that the way that
[0:18] we've been doing governance, the way
[0:19] that I've advised clients to do
[0:21] governance, the way that my competitors
[0:22] and colleagues have been advising people
[0:24] to do AI governance, it no longer works.
[0:27] There's a variety of reasons for why it
[0:28] no longer works. Of course, AI agents is
[0:31] a large part of that picture. And the
[0:33] thing that I want to try to persuade you
[0:35] of in this talk is that the way that
[0:38] we're doing governance is crumbling and
[0:39] that we need a new approach.
[0:42] It's not just a way for me to get my
[0:44] clients to sign another so, although
[0:46] hopefully that happens. Um, but that's
[0:48] what I'm going to try to convince you
[0:49] of. Now, there's really two things I'm
[0:51] going to do. One, I'm going to try to
[0:52] convince you that the way that we do AI
[0:55] governance is broken. We need a new
[0:57] solution. And that new solution has to
[0:59] meet a certain set of criteria, five
[1:02] criteria that I'll lay out for you.
[1:04] After that, I'm going to give you I sort
[1:06] of think of that as the the read neutral
[1:09] version of what I have to say. And then
[1:11] the read specific version is and here's
[1:13] a method that meets those five criteria.
[1:16] So you might say, hey Reed, I totally
[1:18] agree with you. It's crumbling. Those
[1:20] five reasons are legit, but your
[1:22] particular way of solving the problem,
[1:24] it stinks. That's you could think that
[1:26] that's possible. I'll um hopefully you
[1:28] don't but that's that's where we're
[1:29] headed. Okay.
[1:31] So I'm going to run through as the talk
[1:34] uh title says five failures of how
[1:37] standard governance goes now. So here's
[1:39] how it goes. Usually you start with
[1:42] something like an AI ethic statement or
[1:44] responsible AI statement or now an AI
[1:47] governance statement. And you look at
[1:50] these values that talk about things like
[1:52] privacy and transparency and
[1:53] accountability and fairness and you say,
[1:55] "Well, what the heck do we do with
[1:56] that?" Eventually, what happens is that
[2:00] stuff gets translated to a policy, an
[2:01] enterprisewide policy. That policy is
[2:04] then accompanied with various procedures
[2:06] or controls that constitute compliance
[2:09] with the policy. And then once the board
[2:12] passes it, once the board passes that
[2:14] enterprisewide policy, now you start
[2:16] implementing it.
[2:18] This takes forever. This takes so long.
[2:22] If you want to go through this process
[2:24] of passing an enterprisewide policy in a
[2:26] large organization, a year is pretty
[2:29] standard. The fastest we've done it with
[2:31] a Fortune 500 CPG company, 9 months,
[2:36] because you need to get all the
[2:38] stakeholders involved. I mean, to draft
[2:40] the policy, you give me a day or two,
[2:42] it's done. Uh, give an LLM the job of
[2:45] drafting a policy, it'll have it done in
[2:46] a few seconds. But now you have to get
[2:48] all the stakeholders involved. You have
[2:49] to get legal involved. It has to get on
[2:52] the agenda for the board. And by the
[2:54] time it actually gets on their agenda
[2:55] and they approve it, it's about a year.
[2:59] Here's the thing. Policies are mindn
[3:02] numbingly boring. Sorry for those of you
[3:04] who work on policy, but it's boring.
[3:06] Most people don't wake up, jump out of
[3:08] bed, and they're like, "Did you hear the
[3:09] hot new policy just dropped? I can't
[3:12] wait to read it and apply it to my
[3:13] workflows." So, no one does that. So now
[3:15] you have to start engaging in this
[3:17] awareness campaign, implementing the
[3:19] policy, translating it to various
[3:22] departments and roles and all this takes
[3:24] a tremendous amount of time and
[3:25] meanwhile
[3:27] AI has moved on. So you create your
[3:30] enterprisewide policy for traditional
[3:32] machine learning. Awesome. That's great.
[3:34] And then generative AI comes along. You
[3:36] update that policy. You know, you're
[3:39] scrambling to update the policy and to
[3:41] implement it. And you finish it.
[3:43] Congratulations. And now AI agents are a
[3:46] thing. And so what you're stuck doing is
[3:48] you're implementing an outof-date policy
[3:51] while scrambling to get the seuite and
[3:53] the board back in the room to update the
[3:56] policy again and etc etc. It's a
[3:58] neverending process uh that you're never
[4:00] going to catch up with in time. You're
[4:02] never going to keep up with the pace of
[4:03] AI. And so the overall lesson from this
[4:05] failure is pretty straightforward. We
[4:07] need a method of AI governance where the
[4:11] design and implementation of that
[4:12] governance can keep pace with the change
[4:15] of AI.
[4:17] If you can't do this, your governance is
[4:18] going to fail. No question. And we don't
[4:20] have it. Failure number two. Here's a
[4:24] standard part of if you like the
[4:26] architecture or structure of a standard
[4:29] responsible AI or AI governance uh
[4:31] program. You have something like an AI
[4:33] risk board or a responsible AI board.
[4:35] Different people call it different
[4:36] things and you have your frontline teams
[4:39] just look to see hey is your use case a
[4:42] high-risisk use case and they know how
[4:45] to score that and if it is it gets
[4:47] escalated to the review board or the
[4:49] risk board to really handle the risk
[4:50] there. What happens though is that that
[4:53] risk board becomes a major bottleneck
[4:56] for a variety of reasons. One is the
[4:58] problem is one problem is that the
[5:01] firstline people who are scoring it as
[5:03] high risk they have not been given the
[5:06] training or the resources to deal with
[5:07] the risk themselves.
[5:10] Secondly, as AI implementation
[5:13] increases, as AI adoption increases,
[5:15] that board gets more and more cases that
[5:18] they have to review.
[5:20] And the people that are on this board,
[5:22] they're standardly fairly senior
[5:24] executives with day jobs. they can't
[5:26] spend all day every day looking at cases
[5:28] to review. So as your AI adoption
[5:31] increases, your risk board becomes more
[5:33] and more of a bottleneck. It's only
[5:35] going to get worse with Aentic AI
[5:38] because with Agentic AI, we're giving
[5:40] them we're giving LLMs access to various
[5:42] databases and software and other kinds
[5:44] of tools and then giving them autonomy
[5:46] to pursue those goals and to take action
[5:49] which means that the vast majority of AI
[5:52] agents are going to turn out to be high.
[5:55] Having this centralized risk board as
[5:57] far as I'm concerned is is it's not
[5:59] scalable and it leads to governance
[6:01] failure.
[6:04] Failure number three.
[6:06] Right now, standard thing is the project
[6:08] team that who's building the solution,
[6:10] the AI solution, they build the thing
[6:13] and then it has to go through review.
[6:16] This takes forever. It goes to cyber. It
[6:19] goes to privacy. It goes to uh Right.
[6:22] Yeah. It Oh, did I not hit the right
[6:25] thing? There we go. Oh, so the lesson
[6:27] there was
[6:30] how do you operating? You have to enable
[6:33] the frontline team to do more lifting.
[6:34] That was the lesson of failure. Number
[6:35] two, we have to we have to push more
[6:38] responsibility, more capability to that
[6:40] frontline team. So they're not merely
[6:42] flagging high risk, they're also dealing
[6:44] with the high-risisk cases themselves.
[6:46] Okay. Now let's go to the sequential
[6:48] review thing. So they finish the
[6:50] project, hopefully they give it to
[6:52] cyber, then it goes to privacy, then it
[6:55] goes to legal, then it goes to
[6:56] compliance.
[6:57] And all these people want changes to it.
[6:59] And as you go through this process, once
[7:01] again, it's taking forever. So you have
[7:03] teams waiting to be seen and waiting for
[7:06] the review process to begin and all the
[7:08] all the feedback loops to end for them
[7:09] to comply with the requirements blah
[7:11] blah blah. This can take, you know,
[7:12] easily six months. Meanwhile, the
[7:15] relevance of the use case has moved on.
[7:18] And once again, the more we have AI
[7:20] adoption, the more this sequential
[7:22] review process just destroys the speed
[7:25] at which innovation needs to happen. And
[7:27] then you get things like, hey, how can
[7:28] we get around the review process? How
[7:30] can we how could we sneak by and that's
[7:32] not going to be good for the risk
[7:34] profile of your organization. You might
[7:36] think that the answer here is to figure
[7:39] out how to engage in that sequential
[7:42] review faster and faster. And I think
[7:44] that's the wrong lesson to learn. I
[7:46] think the right lesson to learn is that
[7:48] we need to figure out how do we do
[7:50] sequential review? How does legal and
[7:53] cyber and compliance etc. How do they do
[7:55] their reviews simultaneously?
[7:59] For those of you who are familiar with
[8:00] how quantum computers work, we need, you
[8:01] know, if you like a quantum solution, we
[8:02] need we need these things being done not
[8:04] sequentially but simultaneously.
[8:08] Failure number four,
[8:11] one of the issues that we have is that
[8:12] agents, when I say agents, I mean
[8:14] something like an LLM that's connected
[8:17] to a variety of digital tools. So it
[8:18] could be the internet. It could be a
[8:19] variety of databases. It could be
[8:21] different kinds of software within the
[8:22] organization. It could be connected to
[8:24] other AIS.
[8:26] They're phenomenally contextsensitive.
[8:29] What LLM are you using to what tools are
[8:32] you connecting it? Who is using the
[8:34] agent? What's the context of deployment?
[8:37] All that varies wildly across different
[8:40] agents. And what we have now are
[8:43] standard generic controls that are meant
[8:45] to apply to all AI systems.
[8:48] Let's suppose that you've got 20
[8:50] controls, just a random number. 20. You
[8:52] got 20 controls. 10 of those are
[8:54] probably going to be relevant to your
[8:55] agent. So that's great. Yay. 10 of them
[8:58] are going to be irrelevant. This doesn't
[9:00] speak to our use case. But, you know, I
[9:02] guess we have to do it because that's
[9:03] what compliance calls for. We have to do
[9:05] these controls. And so then you do those
[9:06] things. There's another 10 things that
[9:09] you really ought to do, but it's not on
[9:10] the list. And you have to do them. you
[9:12] you ought to do them anyway because it's
[9:14] relevant to your particular agent who's
[9:16] using it in what context for what
[9:18] purposes.
[9:21] So if we just take these static
[9:23] controls, they're simply not built for
[9:26] the dynamism and the contextsensitivity
[9:28] that is AI. So the lesson is pretty
[9:30] clear. We need that governance that's
[9:32] going to be adaptable
[9:35] and contextsensitive
[9:37] given how AI agents work. if it can't
[9:39] adapt, if it if it's going to be static,
[9:41] we're not going to be able to govern
[9:43] agents in the right kind of way. And
[9:44] then you don't really get to deploy
[9:45] agents. And if you do, you're not just
[9:47] going to have various kinds of ethical,
[9:49] reputational, and legal risks. I promise
[9:51] you, your agent's going to fail. It's
[9:52] it's too easy for them to go off the
[9:54] rails.
[9:56] Failure number five,
[10:00] this is, I think, one of the most
[10:02] unsung, if that's a word, unsung heroes
[10:05] of AI risk. One of the big problems is
[10:08] that everyone is speaking a different
[10:10] language when it comes to AI in general
[10:13] and AI risk in particular. People don't
[10:15] even mean the same thing when they say
[10:16] AI and they don't mean the same thing
[10:18] when they say AI agent. Like if you
[10:20] really want to brag about how many
[10:21] agents you have, you define your agent
[10:23] as it's anything with a big prompt. Uh
[10:25] and that's your agent and you say, "Oh,
[10:26] we have 5,000 agents." No, you don't. Uh
[10:30] but the problem is if you have engineers
[10:33] who are meant to work with let's say the
[10:35] marketing department or HR if they're
[10:37] making a marketing or HR solution and
[10:40] they're have to talk to legal and they
[10:41] have to talk to compliance and they have
[10:43] to figure out how to work together but
[10:45] none of them speak the same language
[10:46] then you can't collaborate you just
[10:48] can't do it and so what we need here's
[10:50] the lesson obviously is we need to have
[10:53] everyone speaking the same language
[10:56] about AI and AI risks If they're not
[10:59] speaking the same language, you can't
[11:01] have collaboration. And if you can't
[11:03] have collaboration, I don't think you
[11:04] have AI agents. And that's because one
[11:06] of the sort of the beauty of AI agents,
[11:09] at least one of the one of the beauties,
[11:11] is that a way of speaking that makes
[11:12] sense? One of the beauties is that
[11:14] they're cross-up departmental beasts.
[11:16] They can operate across departments.
[11:17] They can draw from databases and tools
[11:19] that are across departments. So if you
[11:22] you're going to need cross- departmental
[11:24] collaboration in the design, operation,
[11:27] and governance of AI agents and you
[11:30] can't have that if you don't have proper
[11:31] communication.
[11:33] Okay, so those are the five failures.
[11:36] Here's what I think success looks like
[11:38] then. It's just a sort of derivative of
[11:39] what the lessons are that we've learned.
[11:41] Um, we need a method of governance where
[11:44] there's very fast implementation. We're
[11:46] not going through this, you know,
[11:48] year-long design process, months and
[11:50] years of implementation. That's just
[11:51] unacceptable. Secondly,
[11:54] I can't read this. This is so small. I'm
[11:56] getting old. I I don't know if how many
[11:58] of you are in your late 40s or older,
[11:59] but does anyone else's eyesight just
[12:01] fall off a cliff at some point? Can't
[12:03] see anything. Okay. Um, we need to
[12:06] enable frontline teams. If you're if
[12:08] you're not enabling your frontline teams
[12:10] to do the vast majority or the heavy
[12:12] lifting for AI risk identification and
[12:14] management, you can't scale. It's not
[12:17] going to happen. It's got to get
[12:18] federated or decentralized.
[12:21] Third criteria for success,
[12:24] we need simultaneous review. It can't
[12:26] just be the sequential thing. Number
[12:29] four, it has to be adaptable to the
[12:32] context of AI agent creation and
[12:34] deployment.
[12:37] Oh, I see. Sorry, this is a confusing
[12:39] screen. And finally, whatever the method
[12:41] is, it has to foster communication and
[12:43] thereby collaboration.
[12:46] I take these to be
[12:48] necessary criteria for any successful
[12:51] approach to AI governance. Notice I say
[12:53] approached AI governance. This is if you
[12:55] like this is AI governance strategy that
[12:56] we're doing here, right? It's what
[12:58] however we're going to approach it,
[13:00] whatever the actual method is, it's got
[13:02] to meet these criteria. I'm not saying
[13:04] it's sufficient. I'm saying it's got to
[13:06] at least meet these five criteria. So
[13:08] this is the point at which I think you
[13:10] can say yeah read totally on board and
[13:12] what I'm going to say next you can say
[13:13] totally offboard.
[13:15] Maybe there's a better method than the
[13:16] one I'm about to articulate.
[13:18] But I hope that you agree that any
[13:20] approach or strategy to AI governance
[13:22] that doesn't meet these criteria is
[13:24] doomed to failure. And unfortunately I
[13:26] have to say I talk a lot with executives
[13:28] and practitioners in this space. the
[13:30] vast majority of them are trying to
[13:33] implement a strategy that defies each
[13:35] and every one of these things. They they
[13:37] want to do standard risk management and
[13:40] unfortunately they're going to fail.
[13:43] So here's my solution. It sort of has
[13:45] two parts, two two main ports of the
[13:47] core solution. I've only got six minutes
[13:49] so there's lots more details to go into
[13:50] that I won't but I'll give you the core
[13:52] of it and I think it meets these five
[13:53] criteria.
[13:56] First there's a framework. It's what I
[13:59] call the ethical nightmare challenge.
[14:01] The ethical nightmare challenge consists
[14:03] of, as you can see, three very simple
[14:05] questions that I bet each and every one
[14:06] of you can understand. What are your
[14:08] organization's AI ethical, reputational,
[14:10] and legal nightmares? Notice that we're
[14:13] not looking at values and privacy and
[14:15] fairness and justice and benefiting
[14:17] humanity. Lovely sentiments. By the way,
[14:20] I was a philosophy professor for 10
[14:21] years, specialized in ethics. I could
[14:23] talk about ethics and values and virtue
[14:25] and the good life all day long. In this
[14:27] context, I think it's not relevant. I
[14:29] think we need to focus on the bad
[14:30] outcomes that we need to avoid. So, what
[14:33] are the nightmares that you need to
[14:34] avoid? Number two, what resources will
[14:37] you create in order to avoid those
[14:39] nightmares? And number three, how will
[14:41] you train your people to use those
[14:43] resources effectively?
[14:46] There's a number of things that I like
[14:47] about these three questions. One of my
[14:49] favorite things is that it can be asked,
[14:51] these three questions can be asked at
[14:53] every level of the organization. So a
[14:55] project level team working on a
[14:57] particular AI solution can say okay for
[15:00] this particular AI solution what are the
[15:02] relevant ethical reputational legal
[15:04] nightmares what resources do we have to
[15:05] avoid them and is any training needed by
[15:08] our team or by end users in order to use
[15:10] those resources effectively
[15:12] you could ask it at the department level
[15:14] right so let's say marketing is using
[15:15] lots of AI solutions you can have a team
[15:18] at that level I call them ethical
[15:20] nightmare challenge or ENC teams you can
[15:23] have them ask what are the marketing
[15:25] departments ethical, reputational, legal
[15:27] nightmares. What resources does
[15:28] marketing have to avoid those
[15:30] nightmares? And what training do
[15:31] marketing personnel need in order to
[15:33] avoid those nightmares or to use those
[15:35] resources? And finally, you can ask at
[15:37] the enterprise level as a whole for our
[15:39] organization. This is a enterprisewide
[15:41] ENC team. What are the ethical
[15:43] nightmares for our organization as a
[15:45] whole? What resources, what training?
[15:46] So, what I really love or one thing that
[15:48] I really love about these three
[15:49] questions is that they're highly
[15:50] portable across the organization.
[15:54] Okay,
[15:56] when I think about ENC teams,
[15:59] I think about them as their mission is
[16:02] to answer those three questions. That's
[16:04] their mission. There's more to say about
[16:06] how they can go about answering those
[16:07] questions, which I won't talk about, but
[16:09] their mission is to answer those three
[16:10] questions. And we can create ENC teams
[16:15] very rapidly. They need a little bit of
[16:18] training. That's one thing that we
[16:19] deliver to our clients. Of course, we
[16:21] deliver very rapid asynchronous training
[16:23] and you can have ENC teams up and
[16:25] running literally in weeks as opposed to
[16:27] the months and years of that standard
[16:29] approach that starts with a policy.
[16:31] They're highly adaptable because they
[16:33] have their own, if you like, specific
[16:35] jurisdiction in which they operate. Oh,
[16:37] I'm working on this AI solution over
[16:38] here that's going to do this sort of
[16:40] thing. Great. Okay, so maybe I need I
[16:42] need to think about this kind of
[16:43] nightmare, but I don't need to think
[16:44] about those kinds of nightmares over
[16:45] there. Um maybe if like you're in
[16:47] financial services, there are some
[16:48] people in financial services that are
[16:50] working on AI and blockchain solutions.
[16:53] So here's another nice thing about these
[16:54] teams. Oh well, we don't have a
[16:56] blockchain policy and an AI policy. We
[16:58] have this AI blockchain solution though
[17:01] and this team right here needs some
[17:04] training on the risks of AI and
[17:05] blockchain and how they interact. And so
[17:07] we can deliver just in time training if
[17:09] you like to those teams where it's
[17:10] relevant.
[17:12] And it fosters communication. If you
[17:14] have everyone in a company who just
[17:16] knows those three questions, hey, what
[17:18] are the ethical nightmares that we need
[17:19] to avoid? What are the resources we have
[17:21] to avoid them? What's the training that
[17:22] we need people to have in order to use
[17:24] those resources effectively? That does a
[17:26] tremendous amount to foster the
[17:29] communication that we need. We're all
[17:30] talking the same language. You could
[17:31] have someone from HR talk to an engineer
[17:33] and say, "Hey, listen. We want to use AI
[17:36] for whatever it is in this hiring
[17:37] capacity or in this evaluation capacity.
[17:40] Here's the things that we're really
[17:41] worried about here. Here's the
[17:42] nightmares that we need to avoid. And
[17:44] that's a language that both the HR
[17:46] person can speak and the engineer can
[17:48] speak.
[17:49] There's more to say, of course, but what
[17:51] I hope to have convinced you of is that
[17:54] even if you don't like the ethical
[17:55] nightmare challenge approach, I hope
[17:58] that you agree that the standard
[17:59] approach is really fundamentally broken
[18:02] and we need a new approach. And if you
[18:04] do want to learn more, I have a book
[18:06] called guess what? The ethical nightmare
[18:07] challenge. And that's just a QR code to
[18:09] Amazon. If you are interested in the
[18:11] book, I have a minute and 40 seconds if
[18:14] you've got any questions. Thank you so
[18:15] much.
[18:19] >> How does this uh new framework work with
[18:22] highly regulated industries where risk
[18:25] is like if you may someone can get
[18:27] killed if something happens the wrong
[18:29] way.
[18:29] >> Yeah. Great. So question, how how does
[18:31] this interact with existing regulations?
[18:33] I see violations of regulations that are
[18:36] relevant to your ENC team as a subset of
[18:38] the nightmares that you can run into. So
[18:40] when you're saying, "What are the
[18:41] nightmares that we can run into for this
[18:42] team?" Well, we can violate or be
[18:44] non-compliant with regulations A, B, and
[18:46] C. That won't exhaust the set of
[18:48] nightmares that you can run into, but
[18:49] it's a place to start. Read, that's a
[18:52] pretty amazing analytical framework. Um
[18:53] I'm a tech lawyer and help people build
[18:55] uh regulatory architecture all the time
[18:58] and I've also been part of infosc
[19:00] startups. So I've seen the sausage being
[19:02] made from that side. One of the big
[19:05] problems is actually making it part of
[19:08] the incentive set of people in
[19:10] distributed teams to do some of the
[19:12] things you're talking about. And the
[19:14] analytical framework seems bulletproof
[19:16] in a way, but also very theoretical in
[19:18] the sense that for all of these people
[19:21] in different disciplines, there's only a
[19:23] small subset who are going to actually
[19:25] follow some of the prescriptions you
[19:27] have. So as you're building out this
[19:29] sort of approach over time, what's your
[19:32] plan to increase the penetration of
[19:35] those incentives across different teams?
[19:37] >> Yeah, that that's a great question. So I
[19:39] mean tell me if I'm hearing your
[19:40] question right but it's something like
[19:41] how do we actually make that
[19:44] collaboration happen in practice? Is
[19:45] that the is that a fair way of putting
[19:46] the question?
[19:47] >> Yeah. How do you motivate people to do
[19:49] it? So so there's two things to say
[19:50] here. One thing to say is that this is a
[19:52] general problem for any approach to AI
[19:54] governance, right? How do you get anyone
[19:56] to care? Um so that's a that's a very uh
[19:59] general question that besets anyone. my
[20:01] particular answer at least in part
[20:03] there's lots more to say here but I
[20:04] think that the focus on nightmares is
[20:06] one way of fostering that kind of
[20:08] motivation because when you talk about
[20:10] where for fairness and where for privacy
[20:12] for people nod that's lovely that sounds
[20:14] great but you know you don't have a
[20:16] clear view of what failure looks like
[20:17] and if you do fall short of your AI
[20:19] ethics values ideals you know that's
[20:21] okay we're all human no one's perfect
[20:24] and so I think it's the wrong language
[20:25] to talk about it in on the other hand I
[20:27] think when you can specify what
[20:29] catastrophe looks like what really bad
[20:31] looks like that tends to be a lot more
[20:33] motivating than the specification of the
[20:36] ideals. So I think nightmares have a
[20:38] sense of urgency that's important. And I
[20:40] also think that nightmares are more
[20:41] shared than ideals are that the the
[20:45] chief, you know, chief information
[20:47] security officer has similar nightmares
[20:48] to the chief legal officer has similar
[20:49] nightmares to the chief compliance
[20:50] offic. Do they all have the same ideals?
[20:53] I don't know. Do you know does heaven
[20:54] look the same for all of them? I don't
[20:55] know. But there's a very much shared
[20:57] conception of what hell looks like. Um
[20:59] so I find that helpful. That's that's
[21:00] sort of one part of the answer. The
[21:02] second part of the answer is that they
[21:05] all need the same kind of training. So
[21:07] we give everyone that training on what
[21:10] are the B I call it foundational ENC
[21:12] training. So everyone needs to know what
[21:14] the heck is AI because I don't know what
[21:17] are the risks that are baked in. So now
[21:18] we're talking about privacy violations
[21:19] and hallucinations and cascading
[21:21] failures in agentic systems. And then
[21:23] what's a simple framework? That's the
[21:24] three questions. And then the thing that
[21:26] I didn't talk about is that when the ENC
[21:29] teams are answering those three
[21:30] questions, they're following a sevenstep
[21:33] method that we train an ENC team leader
[21:35] on. And as they're going through those
[21:37] seven steps together, they're also
[21:39] collaboratively filling out essentially
[21:41] a risk worksheet, a nightmare worksheet,
[21:43] collaboratively identifying the
[21:45] nightmares, scoring the nightmares,
[21:46] prioritizing them, identifying requisite
[21:48] resources, etc. So that's meant to not
[21:51] only just give them a common language
[21:52] and not just throwing them in a room and
[21:54] saying figure it out, but giving them a
[21:55] structured method of deliberation so
[21:57] they can answer those questions.
