# Building Trust Through Responsible AI with Shea Brown (BABL AI)

Episode 18 of AI with Sach, a podcast hosted by Sacha Gucciardo in Montréal, features Shea Brown, CEO of BABL AI and former astrophysics professor. Shea Brown of BABL AI explains how independent AI audits work, why companies need them, and where to start with risk assessment.

- Show: AI with Sach, hosted by Sacha Gucciardo in Montréal (https://aiwithsach.com/)
- Episode: 18
- Published: 2024-12-03
- Length: 38 minutes
- Language: English
- Page: https://aiwithsach.com/episodes/18-building-trust-through-responsible-ai-with-shea-br/
- Video: https://www.youtube.com/watch?v=5CPQWXFepOU

## Guests

- Shea Brown: CEO of BABL AI and former astrophysics professor (https://aiwithsach.com/guests/shea-brown/)

## Summary

Shea Brown, CEO of BABL AI and a former astrophysics professor, explains how independent AI audits work and why companies are asking for them. Around 2017, after Cambridge Analytica and biased facial recognition and recidivism tools, he left academia to build a firm that tests and audits AI systems with human flourishing at the center. He describes attestation-style audits, where a company documents what it has done and BABL verifies it through interviews, records, code and test results. He presents risk assessment as the starting point: who the stakeholders are, which features of the system could affect their rights, and which metrics to measure, such as bias or accuracy. He explains why bias testing cannot be cookie-cutter, how explainability helps a human catch problems like zip code acting as a proxy for race, and why systems built on large language models are harder to audit. On regulation, he says compliance usually slows innovation but is still worth it for the trust it earns. He compares the EU, US, Canada, UK, Australia and China. His advice: begin with a basic risk assessment, then align with ISO 42001 and the EU AI Act. Today, enterprise procurement is what pushes most clients to seek an audit.

## Key takeaways

1. Start with a basic risk assessment: list who the system affects, where it could cause harm, and what you will measure, then record it and act on it.
2. Bias testing needs the right metric for the context; an off-the-shelf benchmark rarely fits, so a structured risk assessment should choose the metrics.
3. Explainability helps humans spot failure modes, such as zip code acting as a proxy for race in a loan model.
4. Compliance probably slows innovation somewhat, but innovation that brings value and earns trust is the better goal than innovation alone.
5. Large enterprises increasingly require proof of responsible AI from vendors, so independent audits and certifications like ISO 42001 are becoming a cost of doing business.
6. Larger companies should align with the EU AI Act and ISO 42001; startups should begin with a lightweight risk management system.

## Verified quotes

Each quote is checked word for word against the recording.

> I think compliance will in most circumstances, slow innovation down. So that, that's, that's my take on it. However, I, I still think it's better to focus on compliance because you can innovate quickly, but you can also increase your risk by innovating too quickly.
> — Shea Brown, AI with Sach episode 18, at 24:46 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1486s)

> the bottom line is if you want to do business with big companies, they have to trust you. And the only really way to do that is to get an independent third party to somehow verify that you are trustworthy
> — Shea Brown, AI with Sach episode 18, at 33:00 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1980s)

> Very soon the differentiator is like brand. I trust this brand. And how do you build brand trust? Well, there are lots of different ways, but demonstrating your due diligence and understanding of risks is going to be an important part of that.
> — Shea Brown, AI with Sach episode 18, at 35:34 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=2134s)

> And it could be as simple as just calling a meeting with your friends, your co-founders and saying, Hey, let's sit down in the room for 60 minutes and get a whiteboard out and just try to figure out where could this tool harm people or where could it harm our brand or harm our company and record that and then do something about it.
> — Shea Brown, AI with Sach episode 18, at 37:10 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=2230s)

> a law passed in New York City that required bias audits of automated employment decision tools, but there was no real standard for what that means. So the law had some information about what does it mean to be independent, which is great, although I think a lot of people still were kind of confused about what that means.
> — Shea Brown, AI with Sach episode 18, at 13:26 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=806s)

> And so when we started auditing systems, ChatGPT had not come out yet, or stable diffusion had not come out yet. So generative AI was still something that was just a research exercise that wasn't being used for production systems. And now we're starting to see that many AI systems are built on top of these large language models. And that's a totally different beast to audit.
> — Shea Brown, AI with Sach episode 18, at 15:08 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=908s)

> It's very rare. It depends on the case where it's like, oh, there's this beautiful benchmark. We can just take it and it will tell us what we need to know. Because if that were the case, the client would have probably done it anyway.
> — Shea Brown, AI with Sach episode 18, at 16:32 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=992s)

> And I saw that zip code was a really high, high importance feature. I would automatically tell that that's probably not a great way of categorizing whether somebody should get a loan or not, just because they live in a particular area. And I know it correlates with race, right? At least in the United States.
> — Shea Brown, AI with Sach episode 18, at 21:52 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1312s)

> But framing it in terms of like innovation versus compliance, I think is potentially the wrong framing. It's really, it's not so much about innovation. It's about innovation that brings value.
> — Shea Brown, AI with Sach episode 18, at 25:24 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1524s)

> Like Microsoft, for instance, is going to start requiring ISO 42001 audits for their vendors. And so that's a good signal that that's going to be a valuable credential, no matter what a valuable certification.
> — Shea Brown, AI with Sach episode 18, at 30:53 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1853s)

> So basically what we are seeing in the market right now is the majority of the cases where companies come to us for an audit is because they are having problems getting through the procurement system of enterprise companies.
> — Shea Brown, AI with Sach episode 18, at 31:50 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=1910s)

> Which that is a critical, that is the hub. That's the central point for all of the AI governance. If you can't do that, then you're not doing anything meaningful.
> — Shea Brown, AI with Sach episode 18, at 36:53 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=2213s)

> our preference even though we started out in this field doing a lot of that stuff ourselves like doing the testing ourselves and all of that it's better if the company can do it because most of these regulations are going to require internal capacity to do this kind of monitoring over time
> — Shea Brown, AI with Sach episode 18, at 12:51 (https://www.youtube.com/watch?v=5CPQWXFepOU&t=771s)

## Transcript

Automatic transcript; speaker labels are automatic.

[0:00](https://www.youtube.com/watch?v=5CPQWXFepOU&t=0s) **Sacha:** Okay, so today I'm pleased to welcome Shea Brown, CEO of BABL, a pioneering firm in Responsible AI Solutions, established in 2018. With a PhD in astrophysics from University of Minnesota, Shea has transitioned into a leading voice in AI ethics, algorithmic auditing, and AI governance. Through BABL AI, he helps organizations navigate the complex landscape of AI regulations, offering certified independent AI audits and consulting services that prioritize human flourishing. His work focuses on ensuring AI systems are developed, deployed, and governed with rigorous ethical standards and compliance with emerging technological regulations. Shea, it's a pleasure to have you with me today. Welcome.

[0:49](https://www.youtube.com/watch?v=5CPQWXFepOU&t=49s) **Guest:** Thank you so much. Appreciate you having me.

[0:51](https://www.youtube.com/watch?v=5CPQWXFepOU&t=51s) **Sacha:** So could you start by sharing the mission behind BABL AI? What motivated you to create a company focused on AI audits and certifications?

[1:01](https://www.youtube.com/watch?v=5CPQWXFepOU&t=61s) **Guest:** Yeah, so I was an astrophysics professor for 11 years, and I, in my research, I used machine learning, just because it was, there, there's so much data that we're getting from the sky that it's just impossible to go through it all by hand, even if everybody on the planet was working on it. And so we kind of had to explore different mechanisms for automatically filtering through that data. So machine learning was a natural thing. And around 2017, of was getting bored teaching a little bit and i and and doing research and i kind of wanted to get into ai as a business and around that time was sort of when things like cambridge analytica happened where there was a lot of talk about algorithms and social media being problematic there was a lot of talk about biased algorithms used in like recidivism in the u.s of trying to predict whether someone would uh would um re-offend uh facial recognition systems turned out to be biased against people uh of color and so it felt like um there was a real need for people to sort of audit and to test these systems and so i just felt like that was something that my my scientific brain would be good at and so uh that's when babble.ai started and in the early days we really just focused on a lot of early uh senior team at babble are all professors of philosophy or law or astrophysics or or machine learning and so we spent a lot of time really trying to identify what are the key elements of of of of auditing these systems and we kind of use the term audit uh fairly loosely there and now we have a much sort of narrower term uh or use of the term but the the main goal and the mission of the human flourishing in the age of ai so the idea is in the future and the future is coming very quickly ai was going to be permeating everything that we do it's going to be working with on our data it's going to be making critical decisions about us and so the mission really was to make sure that people and and human flourishing uh and and fundamental human rights were were this at the center of that conversation and auditing was one way of doing that to to make sure that systems are tested and governed in ways that that do prioritize human flourishing so that's our that's our mission and that's what we really focus on yeah

[3:39](https://www.youtube.com/watch?v=5CPQWXFepOU&t=219s) **Sacha:** it's beautiful and ai governance is gaining traction is gaining significance nowadays how do you envision the future of ai governance and how does babble fit into that vision so

[3:51](https://www.youtube.com/watch?v=5CPQWXFepOU&t=231s) **Guest:** yeah ai governance is something that a lot of people are are talking about now and the the basic idea is that ai and algorithmic systems in general or autonomous systems pose some extra risks uh to to people to society uh to the fundamental rights of people who interact with these systems and so ai governance is meant to limit those risks and there's also business risk for companies that deploy these systems and so i think in what we what has become obvious is that there has to be some guardrails there have to be some oversight there has to be some testing some assessment of that risk within companies that deploy these systems or that produce these systems and so that can take all sorts of different forms uh from like an ethical review to a technical test or a metric that gets measured to uh kind of a robust internal audit program that kind of thing so where i see babble fitting in this ai governance is that there will need to be a independent third party that assesses whether a company has adhered to those standards which we're now uh honing in on so standards like there's iso 42001 uh nist has a ai risk management framework they've come out with the eu ai act will specifies other kind of risk mitigation measures and so i envision babble as being one of these independent third party auditors that will assure that companies are following those regulations and adhering to best practice could

[5:35](https://www.youtube.com/watch?v=5CPQWXFepOU&t=335s) **Sacha:** you walk us through an example of how an audit typically typically goes and like from start to finish

[5:42](https://www.youtube.com/watch?v=5CPQWXFepOU&t=342s) **Guest:** yeah so the fun thing about this field is that there there aren't really typical audits uh but that but there are some that we have done over and over again that i guess are i could describe as being like a an attestation style audit so what that means is uh a company has has done some some things that they think are important for governing their system so they might have a governance committee they might have a risk management framework they might have done some technical testing and have some metrics that they've measured some the accuracy or the bias or something like that and so a typical attestation style audit of that type is that the company is going to write up uh basically a detailed description of all of the things that they've done and so sometimes like let's say they're trying to sell their product to a bigger company like ibm or microsoft or something like that those companies will often say well how do we know that you're doing all these things because we want you to do all of these things and so they would call up a company like babble and say okay could you audit us against these things that we say we've done so this is what's typically considered an assurance engagement so we're we're providing assurance that the company has done all of these things and so in order to do that then we have to of course review the documentation but that's just the beginning and make sure but once we review the documentation we have to go in and verify that they've done all of these things and sometimes the verification process it involves just having an interview with someone uh reviewing some records let's say that they're like if if there's some results or documents that they say have been produced we'll have to ask for those and review those it could be getting into the code and looking to make sure that the code is doing what they say that's doing maybe looking at the test results and so that's a very typical structure for this type of engagement now sometimes the specifications for what they have to have done are spelled out in a in a law or a standard and in those cases it's very straightforward so if someone wants to say i adhere to iso 42001 or i adhere to the niss risk management framework then we have this external list of things that they're supposed to have done and we can provide assurance against that list other times where it's a really bespoke engagement where the you know either the microsoft or the ibms of the world are asking a very specific thing that they want to check and so the company has to articulate that they've done those things and then we have to go in and check against that really narrow like it's not biased against a particular group or they've done the accuracy of a certain level and so yeah that's the but that's a standard kind of way these engagements go i'd

[8:40](https://www.youtube.com/watch?v=5CPQWXFepOU&t=520s) **Sacha:** like us to dig a little deeper in that in that um last comment you made when you audit an ai system or an ai model what are some like key criteria that you that you would evaluate yeah

[8:53](https://www.youtube.com/watch?v=5CPQWXFepOU&t=533s) **Guest:** so if we're talking about just the system itself um because we can we audit both the system but also the organization and the processes that govern that system so in the case of an individual system the way we like to think about it ties to risk and so here's the ideal scenario the ideal scenario is that the company or us depending on what the relationship is in terms of the contractual relationship goes through kind of a structured risk assessment process and what that process does is it really identifies who what are the who are the stakeholders that this system interacts with right the the end users it might be the the people whose data gets put into the system it might be the business it might be other people so who are the stakeholders what are their interests or rights that they that uh this could be impacted by the system uh what are the features of the system that could potentially impact those interests or rights and then what we would do ideally or the company would do is to hone in on some particular metrics that will be measurements of that those features of that system so the obvious one of course is like bias is a is a is a clear one but then there's accuracy it might be some level of robustness that might be you know if there's some variability in the system that could impact uh or cause be a risk for certain harms so the idea is you go through the structured assessment you come up with this laundry list of metrics which are relevant for the risk that you're you care about and then that's what gets tested either it's tested by the company in which case we just check to make sure it was done correctly if we're they've hired us to do that testing ourselves then we would construct the data that we need or or assemble the the correct kind of testing data to get those metrics i'd

[10:54](https://www.youtube.com/watch?v=5CPQWXFepOU&t=654s) **Sacha:** like us to talk a little bit about challenges what common challenges or issues do you find most organization face when they undergo an ai audit and how how can can they be addressed yeah

[11:08](https://www.youtube.com/watch?v=5CPQWXFepOU&t=668s) **Guest:** so there there are a number of challenges probably the biggest one or the most obvious one is uh a lack of understanding on the on the part of the the client as to what they need to do for this audit so to go back to the the scenario that i talked about before a lot of times clients will come to us because they're getting some external pressure either a regulator or one of their clients is saying hey you got to go do this thing and that thing could be you need to have a risk management framework in place or it could be that you have to test for a particular thing and and you need to be audited for that right so the the first is this uncertainty they don't know what so are they doing it are we doing it do they find somebody else uh to do both like to do the audit and the testing what's the what what do we have to do and how does it get done and so that's a big challenge because it's it's sometimes not obvious exactly what what that structure is and so there's often a lot of education on the part of here are the options either you can go do it if you feel comfortable you can do it and then we audit what you do or we can do it and and and the audit will essentially be uh you know whatever we find we're going to find um and then we're going to write a report about that and but there's less control because we have to be independent either way um or you go and find another partner who knows how to do this they do it for you and then we audit those results and so those are kind of the options that are possible um so that's that's a big challenge is like understanding what's happening and our preference even though we started out in this field doing a lot of that stuff ourselves like doing the testing ourselves and all of that it's better if the company can do it because most of these regulations are going to require internal capacity to do this kind of monitoring over time these kind of testing and so it's better if they can do it so that's where we're kind of pushing people in that direction so that's a big challenge internal capacity internal understanding to do those things the other is a lack of really hard standards out a law passed in New York City that required bias audits of automated employment decision tools, but there was no real standard for what that means.

[13:38](https://www.youtube.com/watch?v=5CPQWXFepOU&t=818s) So the law had some information about what does it mean to be independent, which is great, although I think a lot of people still were kind of confused about what that means. And there was some information about what metric they needed to measure, but there was no real guidelines on exactly how you do that. And so we had to come up with our own guidelines. Now there are standards out there like ISO and NIST. NIST is not really a standard, but it's a voluntary kind of framework. But the problem is those things are so big that it's really hard for companies to just comply with those immediately. And so now we're in this weird transition period where companies are just starting to get themselves aligned with some of these frameworks. But there's a ton of things in those frameworks that people don't really have a great idea exactly how to do. And what does it mean to do well? And those kind of like best practices are just being built up now. And so I guess it's the same challenge as before.

[14:39](https://www.youtube.com/watch?v=5CPQWXFepOU&t=879s) It's a lack of capacity. It's a lack of understanding. But I don't see that going away anytime soon. It's going to be over the next probably three or four years. Well, three to 10 years, let's say there's going to be a big learning curve for everybody on how do we actually do this correctly. And the final thing I'll say, and I'll stop talking, is basically we have the additional challenge of the technology changing extremely rapidly. And so when we started auditing systems, ChatGPT had not come out yet, or stable diffusion had not come out yet. So generative AI was still something that was just a research exercise that wasn't being used for production systems. And now we're starting to see that many AI systems are built on top of these large language models. And that's a totally different beast to audit. And so we have to adapt, companies have to adapt to the changing technology.

[15:42](https://www.youtube.com/watch?v=5CPQWXFepOU&t=942s) We've

[15:42](https://www.youtube.com/watch?v=5CPQWXFepOU&t=942s) **Sacha:** touched upon it a little bit in the beginning, but algorithmic bias is a major part of responsible AI. Can you share some of the methods or tools that Babu uses to identify and mitigate those biases?

[15:56](https://www.youtube.com/watch?v=5CPQWXFepOU&t=956s) **Guest:** Yeah. So most of the time we use our own tools when we do it. So because I mean, there are plenty of like open source tools out there. So it depends on the type, the type of system. And it depends on meaning like, is it a predictive AI versus generative AI? It depends on the details of the socio technical details of how the system is getting used as well. And so for that reason, taking like an out of the box set of tests or algorithms is typically not useful. It's very rare. It depends on the case where it's like, oh, there's this beautiful benchmark. We can just take it and it will tell us what we need to know. Because if that were the case, the client would have probably done it anyway. So we always end up having to go through that kind of structured risk assessment to come up with the right kind of metrics. Now, if we're landing on bias as a critical measure, bias can be measured in a bunch of different ways.

[17:00](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1020s) And so the, the most kind of the dumbest way to do it, or the most straightforward way to do it is to say, okay, I pick a metric. That metric can be anything, not anything, it can be anything that's relevant. So let's say accuracy is the thing I really care about that related to harm. So I could take the accuracy and I could say, is this metric the same across different groups. So if depending on who you are as a person, you can, you can take different users and slice them up into different ways, according to like gender, according to age, according to race or ethnicity, according to ability status, there's all sorts of different ways, socioeconomic status. There are all sorts of ways that you can, you can categorize people and put them into categories that might be potentially risky or that might make them vulnerable in some way. And so I could take that one metric like accuracy, and I could say, how does that change if I look at these different groups?

[18:01](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1081s) And so what that takes is basically grouping the data that goes through the system in labeling it according to those different categories. So that's one, one way of doing it. Now, the challenge there is that you don't always have a label for all the data. And so you have to come up with sort of proxies for figuring out what group a particular person belongs to, let's say. And then of course, there's a choices of different metrics, maybe accuracy is not the thing I want, maybe it's like the false positive rate, like how often do I falsely assign a positive output to a person, or maybe it's the false negative rate or some other fairness metric. And because there are so many options, and because it depends so much on the context, we try to avoid doing this cookie cutter kind of approach where we take an algorithm and we apply it. Now, that being said, I think that we're going to, there will eventually be a maturing of the field where certain industries and certain types of algorithms will know what the right metric is.

[19:08](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1148s) Like if I'm trying to apply for a job, then disparate impact is something that the EEOC has said, it's enshrined in law that that's an important metric. And that's an obvious one to choose. There will be other cases, let's say with fraud detection or something like that, where there might be a different metric that one of the regulators says, we want to see this number, and it had better be either above or below a particular value. But we're still not in that place yet. And it still has to be, which is why it's so fun, it has to be a bit of a puzzle to sort out what are the right ways to measure bias.

[19:44](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1184s) **Sacha:** Are there like two terms that come up often are transparency, explainability? What roles do you think they play in mitigating bias? And also how does Babel help companies be more transparent or help their models be more explainable?

[20:03](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1203s) **Guest:** So transparency and explainability are, they're important for mitigating risk in general. So what transparent, so there are different kinds of transparency and there are different kinds of explainability. The transparent, so transparency can be the transparency of like whether the algorithm is being used at all, right? Do I know that there's an algorithm being used? Or it could be transparency in terms of, do I understand what inputs went into the algorithm so that I could better explain, let's say, or better understand the outputs or explain transparency in terms of what kind of algorithm it is. There's all sorts of different kinds. Now there are some kinds of transparent and explainability is more like, how did I come up with this particular, how did the AI come up with this particular output, right? Now those can mitigate in particular bias because it allows a human to recognize a common failure mode, right?

[21:05](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1265s) So if I know, if I know that there's a good chance, so let's take the most obvious example is zip code. Like there's a proxy variable like zip code. So this is, this is a cartoon example that nobody would ever use, but it, but it's good for explaining the concept. If I, let's say I had an algorithm that was predicting some, like whether I'm going to give someone a loan or not, explain, an explainable algorithm might tell me that, and let's say for some reason I was not being sensible and I use zip code, which I shouldn't do, but let's say I did. And if I got an algorithm, a result out that says I should deny this person a loan. And then I looked at how important the features were, which is one way of doing explainability. And I saw that zip code was a really high, high importance feature. I would automatically tell that that's probably not a great way of categorizing whether somebody should get a loan or not, just because they live in a particular area.

[22:07](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1327s) And I know it correlates with race, right? At least in the United States. So that's a cartoon example, but you can see how it's useful in other situations where if you understand how the AI came up with this decision, you as a human might be better informed as to whether you can trust it in that particular instance, or whether there's a potential for it to be biased or incorrect in that particular instance. Now, Babbel doesn't really help people do that. Like we're auditors. So, and you know, we don't typically do consulting in this area, but what we, the way we help is that we kind of, the fact that we have to come in and audit people oftentimes will force them to think about those things. And especially when we require risk assessments to happen, because ideally a risk assessment would have identified that there might be features of this, the system, which could lead to bias.

[23:10](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1390s) And if you have an explainable algorithm that allows the human oversight, the person who's in charge to recognize that there's a higher probability that this is a false positive, let's say, then they should have, they should recognize that in the risk assessment process. And so that's one way that going through an audit will kind of help force you to think in that risk with that risk mindset.

[23:34](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1414s) **Sacha:** I'd like to get your take on a different topic. How do you balance compliance with regulation like the EU AI Act and others, while also ensuring that AI systems, they remain innovative and efficient as well? Like, do you feel like there's any tensions between these two?

[23:54](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1434s) **Guest:** Yeah. I think, I think the short answer is yes. I don't think anybody who says, you're going to hear a lot of people, especially in the compliance field who are going to say that compliance is a, is a, uh, helps you innovate now. And what, how could it help you innovate? Well, it could help you innovate in theory by building a structure through which people can feel confident to both use the systems, and work and innovate in a compliant way and come up with new things. Um, now, while I think that in general is a good argument and there are some, there are situations in which that is the truth or could, could be the truth. I don't think it's in general, a default position for compliance. I think compliance will in most circumstances, slow innovation down. So that, that's, that's my take on it.

[24:56](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1496s) However, I, I still think it's better to focus on compliance because you can innovate quickly, but you can also increase your risk by innovating too quickly. And so I think the slowing of the innovation down by a little bit is going to be better because you'll add more value. Your product will add more value if it's compliant and ethical, and you will have, you will have more trust in the long haul. But framing it in terms of like innovation versus compliance, I think is potentially the wrong framing. It's really, it's not so much about innovation. It's about innovation that brings value. And if you think about it that way, then yes, you can have, you can relieve the tension between the two. But if you frame it as innovation versus compliance, there will be tension no matter what, in my opinion.

[25:49](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1549s) **Sacha:** That's a great point. Um, I want to, I want to touch about, because we know that Europe is a little bit more strict on regulations. Do you feel like there is notable differences in how different regions, for example, the U S Canada, um, or Asia approach AI governance?

[26:08](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1568s) **Guest:** Um, so I think there's a, there is kind of general consensus about the approach to governance kind of writ large globally. So I think there are some, there are some differences between some regions of the world in terms of what things they value. So when we're thinking about what are the risks that we want to worry about most, clearly places like Europe and the U S and the West in general will have a bigger emphasis on things like privacy, for instance, than maybe the, some, some of the countries in the East might have just because a slightly different small differences in value system, right? Uh, so there might be different things that get prioritized, but in terms of like what structure you would put around to mitigate risks, I think AI governance in general, we have a pretty good idea of the kind of things we want to put in place in general. We still don't know a lot about the details of how they get implemented, but that's a, that's a general research question in the field, period.

[27:14](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1634s) There is a big difference in terms of, uh, from a policy perspective, Europe and the U S are definitely different where in the U S there is deaf, there's more of a tendency to avoid over-regulation, whether what they would call over-regulation because they, this exact innovation versus compliance issue. And so from a policy perspective, I think there are different countries speeds at which they, or, you know, uh, philosophies at which they want to apply this. So Canada is much closer to, uh, Europe. Um, but it, then the U S is, but it's, it's also a little bit, it has some elements of U S, um, as well. UK, I would say, and the U S are fairly aligned. Although UK is also closer to Europe, um, geographically, but also in terms of philosophy as well. Australia is getting much more active now in, in, uh, AI governance and really starting to actually pass some laws.

[28:21](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1701s) China has been passing laws, you know, the way the Chinese system works, they can pass laws very quickly. And so they have actually beat a lot of the other countries and having kind of hard regulations in place. But the, you know, the, the things that they prioritize for are going to be slightly different. Anyway, that's a bit of a rambling answer, but the short answer is, I think we know what kind of we need to, to, for AI governance, we don't know the details of it. I think everybody agrees on it, but the political philosophies of how you apply that are going to be different.

[28:51](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1731s) **Sacha:** What advice would you give to organizations that are starting to consider the ethical and regulatory implications of AI? Like how can, how can they begin to integrate responsible AI practices into their workflows?

[29:05](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1745s) **Guest:** So I would say the, if it depends on the size of the company, I think if you're like a small company, so let's take a startup that has, um, that doesn't have a ton of resources, right. And, but also may not be necessarily in scope or the targets for a lot of compliance, but if they, but then maybe they produce AI systems that are, might be in the high risk category. Potentially they're trying to be innovative, like in hiring or education or something like that. My advice would be to focus on risk assessment and risk, putting together a risk management system, period, a very basic one. So understand how you would assess risk, how you might, so putting policies in place for, we are going to assess the risk of our system. We're going to have this kind of structure. We're going to have this kind of cadence. This is how we're going to respond to it even if you don't have all the answers, putting some basic structure of a risk management framework in place is a good way to start.

[30:09](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1809s) Now, if you're a little bit bigger of a company, you have more resources. I would go straight for, um, the biggest regulations and standards as you can and start to align with those. So in particular, the EU AI act, and in some sense, if you're in the U S like Colorado has a very similar law, which has some elements like the EU AI act, but take something like the EU AI act and start figuring out how are you going to align your organization to that act. Now, a good intermediate step there is to take a, uh, a framework like ISO 42001, which is already becoming or gaining some momentum as a standard. That's a very good place. Like Microsoft, for instance, is going to start requiring ISO 42001 audits for their vendors. And so that's a good signal that that's going to be a valuable credential, no matter what a valuable certification. And so start thinking about how could I get certified for ISO and how would I add on to that to potentially cover some of the gaps where it doesn't fill perfectly the EU AI act obligations.

[31:21](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1881s) So if that's for more mature straight for the end goal and start working your way there,

[31:28](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1888s) **Sacha:** I would, I want to ask one simple, but very important question that needs to be, I think, explicitly, uh, answered. Why should company do that? What benefits do they get from being compliant?

[31:44](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1904s) **Guest:** So the, at the bottom line, the answer is the bottom line. So basically what we are seeing in the market right now is the majority of the cases where companies come to us for an audit is because they are having problems getting through the procurement system of enterprise companies. So every like SAS company wants to work with the big enterprise, right? That's what you do. You try to sell big, big ticket items to the enterprise companies. And so those enterprise companies now recognize that the risk, there's a significant risk. If they procure some AI system that turns out to be biased, it turns out to, to leak their, their proprietary information. It turns out to be toxic in terms of like a, you know, um, toxic outputs, like chatbots and things that might be, um, uh, causing problems like that. So the, you need to convince those enterprise companies that you are responsible and you, you're worth their time and money.

[32:52](https://www.youtube.com/watch?v=5CPQWXFepOU&t=1972s) And so right now, if you look at the history of like cybersecurity audits and information security audits and financial audits, for that matter, the bottom line is if you want to do business with big companies, they have to trust you. And the only really way to do that is to get an independent third party to somehow verify that you are trustworthy and how that looks like which audit, which certification, what type of audit, there might be some variability there, but the motivation is that you want to do more business with big companies that want to take you seriously. And so that's the, that I think is enough. Like that, I think that it's going to be the price of doing business. Um, and so whatever that looks like now, you know, find the, the easiest thing to do first and then work your way up to something more, more robust as you get more mature.

[33:46](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2026s) **Sacha:** And what if you're a B2C, let's say I'm, I'm starting my company tomorrow and I'm AI native and I'm selling directly to consumers. What would be the benefit for me to be compliant?

[34:00](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2040s) **Guest:** So there, um, besides mitigating like compliance risk, which is, you know, you don't want to get, you don't want to get fined. That's a, that's a big one. Or there would be the mitigating the downside risk of liability. So getting sued because let's say you're, it's something that's like providing recommendations to somebody and, and that there's a problem with that and they end up suing you because of it. You want to mitigate that. So mitigating that means more structure in place, getting audits, right? Or, uh, the trust factor. So if I have, if I have tons of, let's say I have lots of options for AI tools. I know that there's some risk. I'm the consumer. The critical currency in right. It's like, I probably know that your tool is using chat GPT or, or GPT four as, as a, as a baseline. So it's, so I know that it's probably going to be similar to this other person's tool and what's going to be the difference.

[35:03](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2103s) Well, you have a certification for ISO, or you have an audit done where you, it's demonstrated that you've put all these guardrails in place to make sure that my data is safe, that you're not, that it's not going to harm me, that kind of thing. That's the trust that is going to get your tool to be, uh, the default tool for those people in that market. And so it's going to be a trust game because people are innovating so quickly. Now there's just so many different AI products. Very soon the differentiator is like brand. I trust this brand. And how do you build brand trust? Well, there are lots of different ways, but demonstrating your due diligence and understanding of risks is going to be an important part of that.

[35:49](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2149s) **Sacha:** Say that it was a great discussion. And I'd like to give you the floor to, um, say any last words to anyone listening.

[35:57](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2157s) **Guest:** Yeah. I mean, I think probably the, the last thing I'll say is a lot of the compliance and regulatory stuff around AI governance can feel very daunting. You know, it can feel like a lot, like if you get ISO 42001 or you get NIST risk management framework, or you look, or you try to read the EU AI act, right? Those things are like massive. And you feel like, how could I possibly do this? There's just too much. I would, I would encourage people to focus on one thing to do and do my personal opinion and Babel's opinion is that risk assessment, being able to identify where in your product or in your services or, or whatever it is that's related with AI, where in that does risk arise? Which that is a critical, that is the hub. That's the central point for all of the AI governance.

[37:00](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2220s) If you can't do that, then you're not doing anything meaningful. And so if I had one, thing to say is that focus on that one thing, get good at that one thing. And it could be as simple as just calling a meeting with your friends, your co-founders and saying, Hey, let's sit down in the room for 60 minutes and get a whiteboard out and just try to figure out where could this tool harm people or where could it harm our brand or harm our company and record that and then do something about it. That's the starting point for all of it. And so I think don't be intimidated by it. Just try to go for what's most germane to the whole enterprise, which is that risk assessment process.

[37:42](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2262s) **Sacha:** Thank you so much, Shane. It was a great pleasure.

[37:45](https://www.youtube.com/watch?v=5CPQWXFepOU&t=2265s) **Guest:** Yeah. Thanks for having me. Appreciate it.