Shea Brown

An AI auditor admits compliance slows innovation, and says it is still worth it.

I think compliance will in most circumstances, slow innovation down. So that, that's, that's my take on it. However, I, I still think it's better to focus on compliance because you can innovate quickly, but you can also increase your risk by innovating too quickly.

AI audits will follow the path of cybersecurity audits: no verification, no big customers.

the bottom line is if you want to do business with big companies, they have to trust you. And the only really way to do that is to get an independent third party to somehow verify that you are trustworthy

When every AI product runs on the same models, trust becomes the only differentiator.

Very soon the differentiator is like brand. I trust this brand. And how do you build brand trust? Well, there are lots of different ways, but demonstrating your due diligence and understanding of risks is going to be an important part of that.

Your first AI risk assessment can be a 60-minute whiteboard session with your co-founders.

And it could be as simple as just calling a meeting with your friends, your co-founders and saying, Hey, let's sit down in the room for 60 minutes and get a whiteboard out and just try to figure out where could this tool harm people or where could it harm our brand or harm our company and record that and then do something about it.

New York required bias audits of hiring AI but never said how to do one.

a law passed in New York City that required bias audits of automated employment decision tools, but there was no real standard for what that means. So the law had some information about what does it mean to be independent, which is great, although I think a lot of people still were kind of confused about what that means.

AI auditing before ChatGPT and after ChatGPT are two different jobs.

And so when we started auditing systems, ChatGPT had not come out yet, or stable diffusion had not come out yet. So generative AI was still something that was just a research exercise that wasn't being used for production systems. And now we're starting to see that many AI systems are built on top of these large language models. And that's a totally different beast to audit.

There is no magic benchmark that tells you whether your AI is biased.

It's very rare. It depends on the case where it's like, oh, there's this beautiful benchmark. We can just take it and it will tell us what we need to know. Because if that were the case, the client would have probably done it anyway.

Zip code in a loan model: the simplest example of how bias hides in AI.

And I saw that zip code was a really high, high importance feature. I would automatically tell that that's probably not a great way of categorizing whether somebody should get a loan or not, just because they live in a particular area. And I know it correlates with race, right? At least in the United States.

Innovation versus compliance is the wrong framing. The real question is whether it brings value.

But framing it in terms of like innovation versus compliance, I think is potentially the wrong framing. It's really, it's not so much about innovation. It's about innovation that brings value.

Microsoft will ask vendors for ISO 42001 audits. Here is why that matters.

Like Microsoft, for instance, is going to start requiring ISO 42001 audits for their vendors. And so that's a good signal that that's going to be a valuable credential, no matter what a valuable certification.

Most companies don't get an AI audit because of regulators. They get it because big buyers won't sign without one.

So basically what we are seeing in the market right now is the majority of the cases where companies come to us for an audit is because they are having problems getting through the procurement system of enterprise companies.

If you can't say where your AI creates risk, you aren't doing AI governance.

Which that is a critical, that is the hub. That's the central point for all of the AI governance. If you can't do that, then you're not doing anything meaningful.

An AI auditor says companies should do their own testing, not hand it off.

our preference even though we started out in this field doing a lot of that stuff ourselves like doing the testing ourselves and all of that it's better if the company can do it because most of these regulations are going to require internal capacity to do this kind of monitoring over time