Everyday AI Podcast – An AI and ChatGPT Podcast - Ep 737: AI Governance in Plain English: 5 AI Rules Every Company Needs to follow (Start Here Series Vol 14)

Starting point is 00:00:00 This is the Everyday AI Show, the Everyday Podcast where we simplify AI and bring its power to your fingertips. Listen daily for practical advice to boost your career, business, and everyday life. Meet Firefly AI Assistant, now live in Adobe Firefly, the All In One Creative AI Studio. Just describe what you want to create and the assistant handles the rest, orchestrating multi-step workflows across Photoshop, Premiere Express, and more in one conversational interface. You direct the outcome. The assistant accelerates execution. If you're forced to have an opinion on stoplights,

Starting point is 00:00:48 I think most people would fall in one of two camps. Either one, these stoplights are annoying. I'm trying to get somewhere and they're slowing me down or two. Hey, stoplights, great. They keep people safe. And I think you can have the same two train of thoughts when it comes to AI governance. You could say, hey, this is slowing me or, my company down and it's annoying or, hey, this is probably keeping us safe, this AI governance thing.

Starting point is 00:01:18 But I don't think most people care or even know too much about AI governance for a variety of reasons, but probably the main one being AI's capabilities are changing so fast that it becomes almost impossible to govern them. I mean, when you even think about cars, cars have been the same for like 110 years. So the stoplights are relatively effective, right? But AI isn't even the same this week as it was last week. So how can we keep up with governance and understand it and make it work for us? Well, that's what we're going to be diving into on today's show. So let's get to the big picture here. And that's right now. According to a state of AI report from Deloitte, 74% of companies expect to use agenic AI within the next two years, but only about 21% report having a mature model for governance.

Starting point is 00:02:18 So just about every single company wants to use autonomous AI that will act without someone watching over it, yet most people admit to not even having a plan. And compared to the prior year, state of AI report from, Deloitte, the number of companies reporting that they have a mature model of governance has actually gone down. It's because companies can't keep up and is getting scary, both in a good and bad way. So that's what we're going to be tackling on today's show. And if you do stick around, here's what you're going to learn. You're going to learn why the governance rules that you built for chatbots are already broken.

Starting point is 00:03:03 What real lawsuits against big companies reveal about. ungoverned AI. And I'm going to leave you with five operational rules that turn AI governance into a scaling advantage. Yeah, I'm going to tell you the five AI rules that literally every company needs to know and follow because then you don't have to worry about this. Hey, what the heck is AI governance? I'm going to tell you and how you can keep up with it. All right. Let's get into it. Welcome to Everyday AI and this is our start here series. It is the essential podcast series to both learn the AI basics and to double down on your AI knowledge. So yeah, make sure you go start with volume one, all right, and then listen to them in order if you're

Starting point is 00:03:42 brand new here. And also if you're brand new here, make sure to go to start here series.com. That will give you exclusive access to our private and free AI community called the inner circle. All right. And then there you can listen to every single episode from the Start Here series. We even have an ongoing playlist and keep everything updated. And one easy to find space. All right. And if you did miss our last episode, like I said, they all go in order. We talked about the AI labor shift when it'll happen and what it means for jobs. All right. But today we're talking about AI governance in plain English in the five AI rules that every company needs to follow. Let's start with definitions. All right. AI governance, people think it's

Starting point is 00:04:27 ethics. It's, it's rules. And it's sure, kind of true, but more than anything, it is. quite literally how your company operates when it comes to AI. It's the roles, the rules, and the controls that manage how AI works in your company. So it's not just who can use AI, but it's what data goes into the AI systems and ultimately what happens after. So that is governance, right? AI governance in a nutshell. It's the before, during, and after and the who, the what the why and the how of AI. And it's not a debate on should we be doing this. It is an operational layer.

Starting point is 00:05:13 It is foundational. And this is, you know, it's obviously going to look a little different. If you're a small business of 10 employees versus if you're a company with a trillion dollar, multiple trillion dollar market cap. And I know we have listeners who represent both sides of, of that pendulum. But regardless, AI governance is extremely important. So think of it, and this is obviously an extremely oversimplified kind of analogy here.

Starting point is 00:05:43 But I'm sure at some point, you've, you know, when working for your company, you had to sign, you know, some sort of, you know, computer report, some kind of technology policy or something like that, right? That says, here's how we use our computers, right? It's like that. But it's ever evolving because the technology is ever evolving, which is why I think some people are kind of ignoring it. And because without proper AI governance, it is just kind of chaos in the streets. And here's the reason why it's, well, it's problematic now more than ever.

Starting point is 00:06:20 Because in, you know, in 2023 or in 2024, right, when AI governance was this big hot topic, because I think it took a year after Chad Cheptis launch for companies to realize like, oh, this is actually going to be a thing that companies use, right? I think as these chatbots started to mature, right? But at the time, AI governance was, well, it's what happens if something is wrong when we use a chatbot to summarize a PDF or if it rewords an email and it's not the right way, right? The repercussions were technically rather small.

Starting point is 00:06:58 But fast forward to today. And obviously, AI agents can. modify files, send emails, make purchases, and execute workflows. It's obviously so different because when AI just talks, governance is about accuracy. But when AI acts, governance is about accountability. And it is about your foundational operation as a company. Because, you know, companies built governance, I think originally for chatbots, right? And they probably kick the can in 2023, finally got it going in 2024, maybe got it approved in 2025. And by the time anyone has read it in 2026, it makes no sense anymore. And that's why companies, according to

Starting point is 00:07:46 Deloitte's study, which is a really good one, that's why companies feel less prepared this year in infrastructure, data, risk, and talent than they did the previous year. And I think the main thing is, well, now we are seeing this, you know, this true jump in agetic capabilities from these models. And I think to truly understand governance, you unfortunately have to look at some of the cases of AI that have gone awry. All right. And there's dozens of them, but probably some names that you've heard, right? So United Healthcare is facing a class action suit as their AI tool allegedly denied elderly care at a 90% error rate, right? Not a good thing. And this is, okay, by the time the company realized it, it was too late because the AI was allegedly making

Starting point is 00:08:46 decisions and denying people care that should have been given care. Workday faced a nationwide age discrimination suit over its AI hiring screening tool, right? There's literally cases. I could talk about these for days because there's hundreds of them. But this is the importance of government because those instances they didn't require or there was no malicious intent involved, right? Because I think most people assume when it comes to AI governance, well, hey, if our company and department and our people are just.

Starting point is 00:09:29 just acting ethically, you know, and being, you know, good, thoughtful humans, then we don't have anything to worry about when it comes to governance, right? We're not doing anything illegal. And that's the exact opposite, right? When we talk specifically, the difference between, you know, AI being able to talk versus AI being able to act in agentic AI and, you know, autonomous loops of AI, you know, now we have, you know, this open claw, you know, surge that's really been, you know, popularized and legitimized, right, with, you know, Nvidia, the largest company in the world came out with, you know, their more secure version of it, you know, called NemoClaw. It is going to become very common for your company, whether you know it now or not,

Starting point is 00:10:19 to have autonomous agents acting on your behalf. And I think maybe that heightens the need for taking AI governance seriously. Because, yeah, two years ago, you know, it was just like, oh, let's just, you know, put something on our website or, you know, we'll put one little checkbox here. And then we're done. And we don't have to worry about anything. But now what happens when an agent didn't have a proper guardrail in place? What happens when you don't have an expert driven loop and you have a human in the loop, which is terrible, by the way, right? that's when governance gets real and when the the egg lands on your company's face.

Starting point is 00:11:01 And one of the reasons why I think companies haven't yet done anything is, well, everyone's looking around for real rules, right? They're like, all right, well, just give us the law. We'll follow it. Right. I think sometimes, you know, it turns into this top down legislation. Right. And they're like, okay, well, if.

Starting point is 00:11:22 we're not breaking any rules, that means we're doing the right thing. And there are no rules so we can do anything. And that's not the right thing. That's the wrong thing. Right. So right now in the U.S., there's no comprehensive federal law on AI. And I don't think there will be at least not in this administration. And you can argue whether that's a good thing or a bad thing. That's not what I'm here trying to do. And President Trump signed an executive order outlawing state's abilities to legislate AI, right? That didn't stop the states. The states are still, you know, approving things. And ultimately, what's going to happen is there's going to be a showdown because there's states like Colorado and California that have, you know, not saying if they defied Trump's executive order, but they just

Starting point is 00:12:07 went through with their, you know, states laws on AI. And ultimately, you know, nothing's going to happen until a federal judge, you know, strikes, strikes these state laws. down. So until then, we're kind of left with this cloud of uncertainty, but at the same time, right, we have things like the EU AI Act, right, things that are actually going into effect this August as an example. So I think a lot of companies are just kind of sitting on the sidelines and they're in this wait and see scenario, you know, decision makers, which I think is extremely dangerous because a lawsuit is not going to care, you know, that you were waiting to see what the loss are.

Starting point is 00:12:51 Just because there is no true governance over AI doesn't mean that your company shouldn't take it upon itself to create that. Don't worry, I'm going to give it to you with our five rules. But before we go over those five rules, I got to take a break. I got to take a sip of water. Quick word from our partners. Here's a harsh truth. Your company is probably spending thousands or millions of dollars on AI.

Starting point is 00:13:19 tools that are being massively underutilized. Half of companies have AI tools, but only 12% use them for business value. Most employees are still just using AI to summarize meeting notes. If you're the one responsible for AI adoption at your company, you need Section. Section is a platform that helps you manage AI transformation across your entire organization. It coaches employees on real use cases, tracks who's using AI for business impact, and shows you exactly where AI is and isn't creating value. The result? You go from rolling out tools to driving measurable AI value. Your employees move from meeting summaries to solving actual business problems. And you can prove the ROI. Stop guessing if your AI investment is working. Check out section at

Starting point is 00:14:07 sectionaI.com. That's s E-C-T-I-O-N-A-I.com. All right. Got you paying attention to governance now, right. So here are the five rules that every company needs to follow. Period. I don't think there's really any exception to these rules. There's more rules that you can follow. But I think if you follow these five rules to the T, I think that you are in a better place than 99% of the companies in the U.S. All right. Rule number one, know what AI you actually have. My gosh, I don't know if any company. has a hold on this partially because of shadow AI or what I predicted in 2023 would be called second computer AI. Apparently that's not as good as shadow AI. Shadow AI's, you know, it's scarier,

Starting point is 00:15:03 stickier, right? But over half of organizations right now completely lack a systematic inventory of their AI tools. And that's because, well, Shadow AI. So a recent IBM report said that shadow AI was involved in 20% of all data breaches, right, that retracting their report, at least. And those shadow AI breaches cost companies $670,000 more per incident on average than the non-Ai or non-Shadow AI involved breaches. All right. So obviously, there is a huge danger in you not knowing what AI is used across your company. We, We've had a couple really good episodes on everyday AI about Shadow AI. We had one with the CEO of ARIA, which was a really good episode.

Starting point is 00:15:58 But you can't just ban certain AI tools. That doesn't get rid of your Shadow AI or your AI sprawl. Because blocking that doesn't mean anything. That just means employees are going to just do the same thing, switch over their Wi-Fi network, right? tabble off the VPN somehow and still access their files that they sent to themselves in an email. People are always still going to use AI tools. So you might as well do the right thing, do a complete inventory, fast track, green lighting, the correct ones that make sense for your organization and then train the people on them.

Starting point is 00:16:36 Right. One of the reasons why people are using other AI tools, they probably have the capabilities in the access, they just don't know how to use it. So they're like, oh, well, I can do task C with chat GPT and task B with co-pilot, but we only have Gemini. Well, if you learned about Gemini, you probably realize that you could do all those tasks, right? About now, you know, at least when it comes to the harnessing and the tool use, most of the big four, you know, you have about 80% feature overlap, right?

Starting point is 00:17:11 So it's not like, oh, you know, I'm, I'm going to use this because it can read PDFs. No, they can all do that now. It's not 2023. So and also, people think that banning AI eliminates the risk. Wrong. Makes it way worse. All right. There's, there's no way around it.

Starting point is 00:17:30 You have to start implementing AI and an AI operating system across your entire organization. And you need to start moving all of your day-to-day knowledge work tasks in there, all of them. right. AI is becoming collaborative. It is becoming dynamic being able to work now. You can read and write. I mean, depending on when you're listening to this episode, right, if you're listening in March 2026, this will make sense. If you're listening in January 2027, you're like, this is old now, right? But in the past couple of days alone, right, what you can do with your phone has completely changed. Right. Now you can run Claude Co-work on your phone. You have a Browsers on iPhones, right?

Starting point is 00:18:13 Everyone is going to be using these tools. You banning them or your company banning them, right? So if you're listening to this and you're one of those companies that have banned AI, right, unless you're a Fortune 10 company that maybe there's things I don't understand. Otherwise, go ahead. Tell your CEO to talk to me. And I will tell said CEO that they're making an absolutely terrible mistake. Because even if you work in a highly regulated industry working with highly sensitive data,

Starting point is 00:18:40 you can't avoid generative AI in large language models. You absolutely can't, right? Even if you've somehow, if you're in the 0.001% that, you know, doesn't have any internet, no cloud, right? Everything's on-prem lockdown, right? I mean, even the military, the government, everyone is using generative AI. You can't not use it anymore. So you have to map what problems are people are actually solving with the unauthorized tools.

Starting point is 00:19:08 And then you need to teach them. or provide them how to do that in an authorized and approved way, right? That's it. Okay. Rule number two is you need to classify everything by risk level. So first you have to understand what you have, what's being used, what's not being used, what's authorized, what's not. Then you need to fix that part first.

Starting point is 00:19:31 Then you need to classify everything by risk level. And actually, this has already been done for us, right? Just borrow the EU, their AI Act has four tiers. It's unacceptable, high, limited, and minimal risk, right? So you need to assign everything by risk level because you don't have to apply the same level of guard rails to something that is minimal risk versus something that is unacceptable, right? You don't have to have the same approval process, the same guardrails. So a tool drafting, a generic welcome email, you know, that doesn't matter. It's, you know, it's a broom closet.

Starting point is 00:20:09 It's not your highly classified room with all your company secrets, right? So you don't need to put, you know, 10 security guards and in laser beam lights and triple padlocks on the broom closet, right? A tool deciding who gets a mortgage, that's, yeah, that's a little heavier, right? You need heavier controls. So for high risk decisions like hiring credit and health care, human review is always required. So it's going to look different for companies of different sizes. different sectors, right? Like if you have different sanctions, it's going to look different, right?

Starting point is 00:20:48 Those four tiers. But for the most part, most people shouldn't be able to put most of their day-to-day processes under those four tiers, right? So you don't govern everything the same thing. You don't put the, you know, the caution tape and the sirens on every single thing. That's probably only on your, you know, on your unacceptable list. All right. Rule number three, assign clear owner.

Starting point is 00:21:09 ship, don't just kick something to IT. So there's a quick test you can take, right? So let's just say as an example, an AI agent goes off the rails and it's going to, right? Go back and listen to my 2026 AI prediction and romance series. Yeah, a lot of it's already come true. And there is going to be an agent crash coming. All right. So if an agent crash happens at your company, and that's essentially when you have a well-meaning agent, right, that you think is properly set up.

Starting point is 00:21:39 And it goes and does something catastrophically bat. Okay, if that happens, can you with 100% certainty name the person who is accountable in 10 seconds? Most people would say, oh, it's probably, you know, Bill and IT or, you know, Jane and Finance, right? Most people could maybe say, oh, it's one of three. Unless you can definitively say instantly the one person and you know 100% they're responsible, you don't even have the baseline of governance. you need clear ownership. Not only do you need clear ownership, but that person needs the authority to act without hardly any notice, right? That person needs almost full autonomy, right? Maybe aside from, you know, the CEO or, you know, how big the organization is, but whoever that person is,

Starting point is 00:22:32 if they are the person that has direct and end ownership, they need the autonomy to make things happen quickly to change the rules, to hit pause, to hit play, to hit rewind, they need it all. All right. And you also do need as much as I hate buzzwords. You do need a cross-functional committee. You need an executive sponsor. You need someone in legal. You need someone in IT.

Starting point is 00:22:56 You need a domain expert. And then you need a daily AI user. I think those are the five different people minimum that you need or the five different apartments that you need because agents are going to be making decisions. Remember, it's not a human expert talking to a chat bot and then the human expert making the decision. In many cases, this is someone who is unrelated to that domain, who is creating agents. And then that agent is going and making decisions. Sometimes without the actual expert, the actual domain, subject domain expert, even knowing what's happening.

Starting point is 00:23:35 Or they're like, okay, well, hey, whatever, whoever gave. this agent directions on finance, it's completely wrong. We should have ran this by finance, right? So that's who you need. You need the executive sponsor. You need legal. You need IT. You need the domain expert. Then you need the daily AI user. And why do you need the daily AI user in your company? Well, that's your frontline person, right? That's your person that's actually probably using these tools way more than maybe the head of legal or your, you know, your IT director, right? That's the person that's going to say, like, hey, wait. That's not how we're using this agented platform.

Starting point is 00:24:11 We're taking completely different route. All right. So rule four, don't write policies. All right. I can guarantee you the best written policy from 2025 is antiquated. It is holier than Swiss cheese right now. Swiss cheese on a Sunday, right? because policy just says do not do this, right?

Starting point is 00:24:41 Do not input sensitive data. A playbook tells you exactly who reviews what and when, right? If you just have a list of things to not do, right, which is usually what policies are, it's not helpful. Every AI use case needs five answers. It needs a task, access, accuracy measure, reviewer, and an escalation path. All right. Every single AI use case that you deploy within your organization needs those things.

Starting point is 00:25:11 And then outsourcing something to an AI agent does not outsource the responsibility. Actually, the FTC, right, the Federal Trade Commission here in the U.S. They kind of shifted their focus away from, you know, Bitcoin. And it's going full, full all in on AI. You are, your company is ultimately responsible for. any decisions that an AI makes, right? So if you're using an fully autonomous, you know, agentic loop, right? If you're using, right, open claw, any of these things and something goes wrong, you don't get to point the finger at OpenClaw. You don't get to point the finger at,

Starting point is 00:25:52 you know, Open AI, Google, Microsoft, Anthropic, et cetera. No, it is on you. Right. So that's why you have to have those use cases have to be thoroughly vetted and you need playbooks on what to do, just what not to do. And then rule five, you need to treat governance as the scaling engine and not the brick. So here's what I mean by that. Right now, studies show that 75% of companies are stuck in pilot purgatory because they're just running small AI experiments endlessly. They can't get out of them. Right. Number one is because corporate policy moves too slow, agentic AI moves too fast, but companies with mature governance who deploy new AI capabilities, they do it faster, 40% faster than their peers that don't.

Starting point is 00:26:43 Right. So if you do have mature governance, you can get out of pilot purgatory. Because if you took care of steps one through four, it is actually no longer a stoplight that is stuck on green. It is a working stoplight that's just, or sorry, it's no longer a traffic light stuck on red. It is a traffic light that is properly pulling the cars through and keeping them going at a high speed, right? People think, business leaders think, people on, you know, Twitter, LinkedIn, whatever, people who are AI experts, they assume governance slows companies down. And it is the exact opposite.

Starting point is 00:27:32 because without governance, you cannot compete. You cannot keep up. There's going to be too many small roadblocks along the way, too many giant Chicago-sized potholes. Your car's not going to make it out of the lot, y'all. Governance is the scaling engine, not the brakes. All right. So both studies from Align A.I and IBM said that, organizations with strong AI governance actually saved $1.9 million per data breach on average.

Starting point is 00:28:09 A lot of this data just goes back to data breaches because ultimately, like, that's that's where a lot of this is headed. Right. When agentic AI goes off the rails, everyone knows about it. And then you have to start diagnosing and it takes a lot of time and a lot of money. And that's, that's where we are unfortunately learning the good lesson. about what we should do in governance when we learn where things go wrong. And the biggest thing where things go wrong, it's going back.

Starting point is 00:28:40 I'm going to, I'm going to just read these rules here. One more time. All right. I think it starts with not knowing what you actually have and not knowing what the capabilities are. All right. So rule one, you have to know what you actually have. Rule number two, you have to classify everything at risk by risk level. Rule three, you need to assign clear ownership, not just kick it to IT.

Starting point is 00:29:00 Rule four, right? playbooks, not policies. In Rule 5, treat governance as the scaling engine, not the break. All right. So that's not all. You might not like this part. You have to set monthly review cycles. Yes, not yearly, not quarterly, monthly.

Starting point is 00:29:22 All right? Because a government policy that if you think you can set it once and forget it, that's literally like, you know, thinking, you can repurpose a 20, 20, 2006 social media policy, change a couple of words and use it for AI in 2026. Like monthly review is the absolute minimum cadence to keep governance matched to reality. Y'all, I've literally been doing this thing for more than three years every single day. And I'm not exaggerating when I say the last three months in terms of capabilities, what an AI can

Starting point is 00:29:57 output and do have far outpaced the previous three years. Like I said, it is scary in a good and bad way. So you cannot just set something and revisit it once a year. That is a recipe for failure. But a recipe for success is to stick with us through the rest of the start here series. All right? Because we're going to be guiding you along the way, whether you are brand new to AI or you're trying to keep up and double down. Thank you for going with us on this one as we went over AI governance in plain English,

Starting point is 00:30:29 five AI rules every company needs to follow. I hope this was helpful. If so, do me a favor. And I'm not going to keep this open forever, FYI, right? Just free open, unlimited access to our community. So go to start here series.com. If this was at all helpful, all right, that's going to give you free access to our community. And you can go check out every single episode in the Start Here series, all in one easy to find space.

Starting point is 00:30:55 and also connect with thousands of other people in our community right now who are doing the same thing you're doing. So thank you for tuning in. Hope to see you back tomorrow and every day for more Everyday AI. Thanks y'all. Meet Firefly AI assistant. Now live in Adobe Firefly, the Allman One Creative AI Studio. Just describe what you want to create in your own words and the assistant handles the rest,

Starting point is 00:31:22 orchestrating multi-step workflows across Adobe Creative Cloud apps, including Photoshop, Premiere Express, and more in one conversation. interface. You direct the outcome while the assistant accelerates execution. Stand control with the ability to step in and refine at any time. See it today at firefly.adobie.com. And that's a wrap for today's edition of Everyday AI. Thanks for joining us. If you enjoyed this episode, please subscribe and leave us a rating. It helps keep us going. For a little more AI magic, visit Your EverydayAI.com and sign up to our daily newsletter so you don't get left behind. Go break some barriers and we'll see you next time.

Everyday AI Podcast – An AI and ChatGPT Podcast - Ep 737: AI Governance in Plain English: 5 AI Rules Every Company Needs to follow (Start Here Series Vol 14)

There aren't comments yet for this episode. Click on any sentence in the transcript to leave a comment.