The Executive Guide to Ethical AI and Governance

Speaker A: Technology is changing faster than ever. But the most important conversations aren't about the tools. Uh, they're about the ideas and the people shaping what comes next. On the Bridgecast, I sit down with the leaders driving change from AI and cybersecurity to the infrastructure powering modern business. Together we explore how technology moves business forward, what they're seeing, what they're building, and what it means for the rest of us. I'm Scott Kinka and this is the Bridgecast. Presented by bridgepoint Technologies.

Speaker B: Welcome back to the Bridgecast. I'm your host, Scott Kinka. Uh, if you're a business or IT leader, you've probably faced the corporate mandate. Go get us some AI. But as the hype settles, the real questions remain. How do we build AI we can actually trust, audit for bias and drive user adoption without drowning in technical debt? In this special Greatest AI Hits edition, we are bringing you a masterclass in AI execution, governance and ethics, mining our archives for three of our most impactful conversations. First, we sit down with Reggie Townsend from SAS to map out a practical four pillar framework for trustworthy AI. Next, we hear a sharp reality check from Dr. Eva Marie Muller Stuehler on the mathematics of bias and why leaders are taking massive risks by grandfathering in unaudited models. Lets jump right in. First up is Reggie Townsend. Reggie leads the data ethics practice at SAS and he is deeply involved in the global policy conversations surrounding this technology. When we sat down, I wanted to push past the buzzwords. We've all heard the phrase responsible AI, but Reggie argues that the semantics here actually matter. He shifts the conversation from responsible to trustworthy and maps out a practical four pillar framework that mid market businesses can use to govern their AI systems with without slowing down innovation. Let's listen.

Speaker A: I want, kind of want to explore both the do well and do good categories. We focus on do good. I want to stay one more there and I want to, I want to orient it over to the do to the do well portion. Right. Let's just stay categorically in here for a moment. I have, you know, when I engage in responsible AI conversations, you know, you either have somebody who gets it or you have somebody that goes, well, it's just technology. Like I'm not really, I don't have responsible word processing. Like what are we talking about here? Um, and my answer very often is just simple. Like at the end of the day AI is informed, the information is delivered via the Internet and the treatise of human thought, frankly, at the end of the day. And that is based on the People who wrote it. Maybe not based on real history. Like if somebody says to you, I don't get it, why responsible AI and what's the risk? What's your answer?

Speaker C: At sas, we talk in terms of trustworthy AI, okay? Because responsible AI, and I know I am absolutely in the semantic weeds right

Speaker A: now for people who are, let's get semantic, do it.

Speaker C: But because this notion of responsible, um, doesn't have a good counterfactual that people opt into, we have trouble. So as an example, no one is going to say, oh, yeah, I'm going to sign off for irresponsible AI, right? That's not a thing. This is where we have to start talking about politics and the influence of political thinking. And when I talk about politics, I'm talking about influence. Not necessarily Republican, Democrat sort of thing, but the politics of the word and the politics of the term. I should say responsible AI is really, um, steeped in the doomer conversation, the safety conversation, all those sorts of things, and who wants to be unsafe? But Luddite conversation, it gets rooted there. And so it becomes really problematic when you talk responsible AI, because people are coming, some people are coming to the conversation with these predetermined stances vis a vis all this other stuff that it's rooted in. Coincidentally, when you look at a lot of the governmental conversation with respect to AI, a lot of that is trustworthy AI based. So you start to look at stuff that came out of the first Trump administration, the Biden administration, look at the stuff out of the un, you think stuff out of the eu, go to Asia, the same thing. They are all talking about trustworthy AI, because I think they all recognize that this has to be a conversation about whether people invest their trust in so called AI. Uh, now of course we can get into whether you actually trust the technology and that sort of thing. But let me get to the point that you were making, which is this technology, it's completely agnostic. I don't have responsible word processing or I should have responsible AI. Well, AI is network processing AI, you know, again, I'm just going to shorthand it is about automated decision making, right? And we're talking about decisions in the dozens, hundreds to thousands every minute on behalf of Yoda and the rest of the folks who are listening. And so if you understand that AI is, uh, a formulation of data models and decisions, then you have to go and say, okay, what's the source of the data? Whose data is it? How was it derived? What's actually in it? Is that data bias, the Answer is always yes. But the question then becomes a bias in what way? And when we put that data into a model, is that M model going to treat that data in such a way that it creates the expected outcomes? And oh, by the way, what are the expected outcomes? What is the intended purpose? And so that, that is really the life cycle when we talk about AI. So why be responsible or why be trustworthy or why be ethical with that is because if we're going to automate decisions on our behalf, we want to make sure that, that automation is reflective ultimately of the values of the ethics. Right. That we hold dear.

Speaker A: Regularly advising on AI, having conversations every day, you know, we're kind of doing

Speaker B: cloud all over again, right?

Speaker A: Go get some AI and then you know, it's getting driven down to the IT department who's trying to figure out use cases that it may not understand in the rest of the business. And then they go meet with the

Speaker B: consultant and the consultant says we're going

Speaker A: to start before we start turning knobs with governance, which is bound up in everything that we're talking about the uh, business's decision on how to apply everything you just talked about practically in the business. Right. What does that really look like? What does good look like in an AI Governance policy in just a mid market business, you know, is going to do some basic things around AI to perhaps improve process or um, maybe increase productivity out of employees practically.

Speaker B: What's happening there practically?

Speaker C: Governance in an AI context is very much like governance in every other context where we put process around and policy into the organization. Now we're just adding the flavor of the day. We can talk about frameworks, like we've got a framework, we refer to it as a quad, but it's basically, it's four pillars, uh, which says that we're going to start with an understanding of the cultural implications potentially of a, uh, given technology. So a lot of folks underestimate the effect of normative behaviors in the organization. We realize it as this is the way we do it and this is what we've always done and this is what we're going to continue to do it. Well, AI is a significant disruptor and so it necessarily requires us to rethink how we are organizing, um, if we are going to do certain kinds of work, uh, what the workflows will be going forward and oh by the way, what's the psychological impact on the employees that are now having to inherit this capability. So there's a whole stovepipe of conversation to be had there. Uh, and so Then I started to touch on really the next pillar, which is the operational dynamics. And so that's the effect of the workflows. The other piece would be the kind of the regulatory aspect. So what is it that I have to do and what is it that I aspire to do from a regulatory perspective? And that literally is a patchwork around the world right now. And then the final pillar that Scott, is oversight, which is to say, um, given all of these new dynamics going on in the organization, where does accountability sit? Where does monitoring and observation sit? And how are decisions going to get made at the frequency and the pace at which it needs to be made now, given the pace of change, of the technology and, oh, by the way, do we choose to accept that pace of change, or do we want to erect some sorts of filters, uh, or borders or gates that will, um, govern the rate of change? Because there's only so much change that our organization's nervous system can take. Right. Um, and so that is the complex of governance when we talk about governance. And quite honestly, you can start with any of those. But my advice is always to not go and try to use a medical analogy, don't go try to solve for cancer. Let's just kind of find out, bandage and put them on. So we get into all of that. Uh, but I would always advise folks to kind of think about it from those four pillars initially. And there's a ton of work that we've done there, and then others have done there with similar frameworks.

Speaker A: Gotcha.

Speaker B: It's fine. When you get outside of kind of

Speaker A: personal productivity, kind of like model used

Speaker B: by employees, which will. That's going to be.

Speaker A: My next question is going to be around that. When you talk about doing something like codifying something into the business. I love what you just said because we're always saying to people, solve the most boring problem in the business first.

Speaker C: I call them.

Speaker B: I love your point about curing cancer.

Speaker C: Yeah. I call them pearls. Like, what are the things that are proven? So we know we've done them because we've done them a ton of times. They're repeatable, repetitive, and so they're showing up a lot. And they're laborious, which is, man, I don't like to do this stuff, and no one likes to do it. So look for those pearls and go and AI ify that stuff first. Get some early wins. Understand kind of what the motions are inside of your organization to solve for those sorts of things. And then we can start to expand, then we can start to scale. But I think a lot of organizations get in trouble when they want to stand up big committees and make grand proclamations and it's very, very difficult to be successful that way.

Speaker B: I love Reggie's medical analogy there. And don't try to cure cancer on day one. Just find where the band aids are needed. For mid market leaders, that advice is gold. If you want early wins, don't stand up a massive committee to draft grand theoretical proclamations. Instead, look for what Reggie calls the pearls, those repetitive, boring, laborious tasks that nobody in your organization actually wants to do anyway. And AI those First, build your governance muscle on the small things before you scale. That brings us perfectly to our next guest, Dr. Eva Marie Muller Stuehler. Eva Marie is a powerhouse in the world of data science and AI governance and frankly, she delivered one of the most eye opening and let's be honest, slightly terrifying perspectives on AI ethics we've ever had on the show. In this next segment, I ask Eva Marie about the building blocks of a successful deployment. But the conversation quickly pivots to the sheer scale of bias built into modern LLMs and why IT leaders cannot afford to sit back and assume that regulations or big tech compliance officers are going to save them. Here is Dr. Eva Marie Muller Stuehler.

Speaker A: Let's bring it back to just sort of practical tips. If, if I'm a CIO and I'm listening to this and I want to start either fixing AI deployment or starting it and I want to do it in a, not in a quarter, like what are the three things, what are the building blocks?

Speaker D: They should start with really understanding what is it that you want? Do you want to buy something or do you want to build something in house and, and why do you want it? Can you actually buy something that is good enough for you? In the Middle east, for example, fraud detection machines, they are often just bought from the us they don't really work that now because they're not often trained on Middle Eastern information. Same problem with health care. We buy health care solutions from the us I can promise you there was no data set of an emirati women over 65 in there. And so we don't really know how they perform for our demographics. So really make that decision on what is it, classify by risk and saying let's start with something that is easy, that doesn't jeopardize your whole company and something that is feasible, where you have an impact. So these are, I think the starting point. If you only have three weeks, um, make a good plan of um, where to get the Talents from and how to employ them. A big risk that I see in situations like that. They call the consulting companies the consulting companies, like, yes, we're coming, and I was one of them. And we build you proof of concept in six weeks, and that is basically doing the easy part. And then we're leaving and the client is left alone with not knowing what they got, not knowing how to scale, not having the right capabilities inside. And basically they spend a lot of money and probably buying books for their teams would have been a better investment.

Speaker A: Interesting way of thinking about it. Um, I want to turn our attention while we have some time out to, um, ethics and governmental involvement. I mean, you've worked extensively on ethical AI and governance frameworks across global institutions. I'll just ask this question, uh, where do you think we're headed from a regulatory perspective around AI?

Speaker D: I am very worried. We have been talking about AI government for so long, and I recently realized I can exactly, word by word, give the same talks that I gave in 2017 with even the same slides, and maybe sometimes replacing my screenshot from Google with screenshots from ChatGPT. All the systems are so biased. I gave the talk back then about when you go on Google and you say, can you give me a picture of a nurse? It was always women serving men. Um, I tried the same on, um, chatgpt. It was always women serving men. And even when I said, give me an American nurse, give me a Filipino nurse, give me a European nurse, it was always the same. I'm like, why is it always women? And then I said, give me a lawyer, and it was always men. And I was like, why are they? And then I even spent time finding out where places in the world where we have a higher percentage of female than male lawyers and the picture would still be male. And with that, we train stereotypes in people's brains. We take children off of studying the right subject. Um, so all these models are still extremely biased. Unbiased AI is actually not really possible because you always have side demographics that are not fully represented and that you can't really train on. Um, it would get too expensive to train all of these and monitor all of these. Um, so you do have to decide on who are you okay with discriminating. We have amazing laws, but they are so vague. So we have gdpr, but we all know that large language models, um, solutions are not GDPR compliant. But it's not enforced enough. When I ask, um, these models and you can discuss it with them directly because they have a voice to build the Case where they are eu, AI, um, ACT or CCPA compliance, they can't build that case themselves. So you're ending up on saying ChatGPT and Grok were like, oh, we're trying our best to be explainable. I'm like, yeah, we're trying to your best and being explainable are two different things. And. And so I think the problem that I'm worried about is we have good laws that are quite meaningless and are not enforceable because as a technical person, we can't know what accuracy is actually defined at. Um, there's so many ways of defining it, um, unbiased explainability and so on. There are no clear yes and no. Um, in between, the question of, like, how are we going there is varying. I think we are at a very high risk of building a world that is far more unequal, um, than it has been before, especially when we look at the Global South.

Speaker A: Yeah. And so if I read that back, you know, effectively, the point is, hey, we've got good laws around privacy right now that aren't followed. So we could, you know, the EU could put something in place or the US could put something in place, but that's going to be inconsistent globally, which invalidates effectively the usefulness of all the regulation. Really, at the end of the day, it's a scary thought, but I understand the thought. Right. And I get your point. I mean, in a lot of ways these models are meant to be informed. Um, they have to be informed, um, and they learn from what they're provided. And in a lot of ways it's the volume. I mean, they are going to be a reflection of what the media landscape looks like, what the Internet looks like, what the size of populations look like are going to inform these models. It's just what they have to consume. Um, is there anything in your mind, I mean, you're still advising and you're involved with governments and with the global institutions. What are you advising them to do to counteract this?

Speaker D: I still haven't given up hope. So, um, I actually, a lot of the, uh, discussions are rules and regulations slowing down innovations. And I completely disagree. Because if you have clear frameworks to work with, your investment into innovation is actually safer. Nobody would fly on planes that aren't regulated and where everybody could just put something together. I think there needs to be really good and clear frameworks, the more specific they are. Um, and often by industry, having them sign off by industry, more model bodies and so on. Um, I think these are the right steps in the right direction. It has to stop to be the wild west we're facing now.

Speaker A: And if you're an IT leader who is engaging, should you be thinking about it the same way? In other words, are you being cautious because you're not sure if what you're building will ultimately run amok of some regulatory or some law or some framework that's in place, or do you advise just saying, hey, you know, that will affect the AI companies? You just use them responsibly inside your business. Like, how does the IT leader think about a, uh, regulatory environment that they are have no idea where, they have no idea what's going to happen Ultimately,

Speaker D: unfortunately, they don't think about it enough because they should be even stricter than the governments are. Because if you don't know what your model is doing, you're flying blind. And that could go in the right direction, but it could also go in the wrong direction. I was very surprised at a responsible AI summit I was at at recently. They asked us and it was a lot of like compliance officers from big tech companies and so on, or, uh, AI compliance or head of AIs. And they asked the group and we could secretly vote. Um, for example, you realized you have, your company has thousands of AI models running in the background, and most of them were not monitored or audited and signed off. But a lot of them are, um, critical for your organization. What would you do? And I was really shocked by realizing that. Most of the people there said we slowly grandfather them because we don't want to interfere with the business. And for me that is kind of a thought. Like as an airline company, you realize, like, oh, lots of your, um, planes are running on technology that has never been signed off. Let's hope it will all go fine. And when the plane is old, we don't do it in the next one. Or colleagues are committing fraud, tell them not to do it again. Because we don't want to upset a bribery, we don't want to upset the client that doesn't work. Because if it has an impact on your revenue, it could have a negative impact as well. And for example, if you have a fraud engine that seems to be working but it was never audited, you might not realize that until the big hit is gone. Credit, um, application model at the bank who gives works perfectly. And deciding this person should get credit or not, um, you'll only discover it five years later when everything fails and nobody is repaying any loans. So the fact that even in a situation like that, so many of people, uh, who are working on responsible AI were like, oh, but it could drive revenue. But think about the risk. We're not willing to interfere and say, no, stop everything now. We monitor, and once we know what they're doing, we slowly, one by one, start them again. Um, I was very surprised.

Speaker B: If you don't know what your model is doing, you're flying blind. That line from Eva Marie should be pasted on the wall of every IT department in the country. Her aviation analogy is a powerful wake up call. We would never board a plane running on unverified, unaudited technology. Yet organizations are quietly grandfathering in automated decision making M models that determine creditworthiness, fraud detection or hiring simply because they don't want to disrupt the business. If you are an IT leader, her message is do not wait for the government. Audit your models now. And don't be afraid to hit the pause button to ensure your systems are safe. Now let's bring this down to the ground level of execution and human psychology. When a massive enterprise like Nike or American Express rolls out new technology, how do they actually ensure people use it? Our third greatest hit features Elaine Barsoom. Elaine has led major digital transformation and innovation initiatives for some of the world's most recognizable brands. When I spoke with her, she explained how Nike avoided the trap of AI for AI's sake. She shares how they mapped out end to end workflows to find the actual friction points. And how they turned the threat of shadow AI on its head by turning unauthorized users into their biggest champions. Let's listen.

Speaker A: I'm joined by Elaine Barsoom. She's a venture partner at Silicon Foundry and a recognized leader in AI and corporate innovation. She spent 20 years helping businesses marry strategy and next gen technologies. She was most recently global head of tech innovation and partnerships and strategy at Nike. Her resume also includes time and leadership at American Express. She's driven innovation across multiple sectors. Retail, fintech, hospitality. I'm super excited to get into all of that. Today we're going to be diving into innovation, innovation, adoption, where we really are with AI and how all this can ultimately drive growth. All right, now apply that to AI for me.

Speaker C: Right.

Speaker A: I think, I think right. Maybe no time is that more appropriate than right now. We're just kind of running and doing things. Talk to me about kind of governance and planning and corporate edict around, like what we want to accomplish on the AI side. Because, I mean, I think, you know, we meet with CIOs and IT leaders all the time. And I could tell you 9 out of 10 conversations I've got somebody on the other side of the table who's like, I just got told to go do some AI. I don't really know what that means, you know, but I have to go get some because that's what the board wants or that's what the CEO wants. Talk to me about planning and governance in AI.

Speaker E: I would say we're, we're asking wrong questions. Um, before, particularly at Nike, before we started any conversation, we didn't ask how do we use AI, which a lot of CEOs right now are mandating. We asked what problem are we trying to solve? And can AI help? What are the problems? And so when you walk into a room with senior leaders, you need to answer what questions? Where, what problems do we need to solve at a mass scale and for a mid sized organization? So that's the most important question that you got to. And then once you realize like, where are the friction points? What problems are we solving for at a mass scale, then you can apply AI. Uh, then you can actually incorporate. But what are the workflows? Where can we redesign? Where does AI fit into that? Just putting a tool on top of a tool just incurs more technical debt. So I think that's super important as all companies are now have a mandate to where are we going to go incorporate AI? So don't just do AI for AI sake.

Speaker A: I think one of the challenges that we find is, and we talked a bit on the pre show about kind of like the CIO role pre pandemic and the CIO role post pandemic. And what does that mean? I mean, I think, I think in a lot of cases this is like a general contractor job. And I think in a lot of businesses, whether that's the inclination of the CIO or the inclination of the leadership team, the CIO is the plumber. And I mean that in the nicest way possible because these are my friends and I have a history as a technology leader. But we put in a CRM and then when we're the technical person provided everybody can log in, we hand it to the line of business and we walk out. So the visibility on the big problems to solve is usually not sitting in the CIO's bucket, right? Unless the problem is a, uh, connectivity one or a scale one or something along those lines. So what's the best way for a cio? Listening to this right now in your mind there's a corporate edict around AI, but go solve something and you're like, except I don't have this pile of business problems. I'm trying to Solve. I have a technical problem. How do they bridge that gap?

Speaker E: I think the best way to start is. Let me start with an example of how we did it at Nike. And so we started, um, when we started our journey really early on, we actually started really with the business. We mapped where are current state workflows incorporating technology in the CIOs of course, but what's that current end to end state workflow? Where does the friction lie? Where was it actually? And then we actually did an exercise, um, as a team is what could optimal future state look like? If we were looking at redesigning or if we're looking at removing capabilities, what does that look like at an optimal state? And so doing that cross functional exercise, one, you're redesigning around the human side and you're not just bringing on a tool and you want to make sure that adoption is part of it. And two, you're driving, when you're driving with the business early on and the cio, the engineering leader, the CIO is part of the organization, the legal, I mean part of the decision and business is part of the decision. You have much higher success rate of the adoption and actually designing something that's actually going to be used by the organization and be adopted. So that's what I would encourage. Any CIO leader is really without. Before you even look at the tools, before you take on the tool, spend some time just with the business outlining it. And one pure example was when we were even launching within Nike, one of our first use cases was engineering GitHub, um, copilot, uh, we thought it would just, okay, we're going to turn this on. This would be quite easy. But what we found was that adoption was pretty low initially and we had to do a lot of training, a lot of interviewing as to what are the best use cases, a lot of adopting best practices. And then when we launched actually these trainings and business practices and brought in an adoptions program, the Champions program, we had much higher. Um, and so lab was a redesign with the actual engineers who were the business leaders, who were the ones that were using it.

Speaker A: I love the idea of kind of building literacy up, you know what I mean? Before you try to solve chunky problems. Like you mentioned starting around copilot. I think your users are going to fall into three categories. Like, like, of course I was going to go out and do something on my own over the weekend that I wasn't supposed to do, but maybe I'm trying to solve a business problem. On the other end is like I'm not going to do AR until somebody tells me. Right? And then the middle is like that group that you can influence ultimately. But putting that aside for a moment, I mean, every business has users who are going and doing stuff on their own. Did you guys have to contend with that too? And like, I mean, how far back are we this, you know, it's early 26, we're recording this. Like when, you know, you, uh, mentioned copilot, how far back did you guys, you know, bite the bullet and say, okay, you know, we're going to offer up a model for everybody to use?

Speaker E: It didn't start initially across the whole organization. And yes, when you have fear within an organization, hesitation spreads faster than any tool. And what you end up happening is people go and try new things on their own and they try to learn it because it's fear or fear of being disrupted or fear of actually being displaced. So that's, that's a real driver in these organizations. And so you do you have a security problem of people going and using the tools? So yes, every organization had that, including Nike.

Speaker A: So is that first, like go figure out where everybody is and bring them in. I mean, those people could be your champions too, ultimately.

Speaker E: Yes, exactly. That is exactly what we did, is finding those people and getting them to be champions. And so actually you have to do two things, right? It has to come from the top down because this is, this is a mandate. But it also has to build from the bottoms up. Who are the people like hands on keyboard that are actually doing this work?

Speaker A: Doing some things? Yeah, yeah. Figure out how to support them or get them to be the champions and

Speaker E: build community structures that, that have the learning spread.

Speaker B: Elaine's point about shadow AI, uh, is brilliant. When employees are afraid of being disrupted or left behind, hesitation spreads faster than any tool. They go out and start using unauthorized AI tools on their own, creating a massive security headache. But instead of just locking down the network and acting like the IT police, Elaine's strategy is to find those rogue users, bring them into the fold, and turn them into your bottom up champions. Match that bottom up enthusiasm with top down strategic alignment and you have a recipe for successful adoption. What an incredible lineup of insights. Threading these three conversations together gives us a clear roadmap. Reggie Townsend reminds us to build trust around culture, operations, regulations and oversight, starting with the simplest, most boring tasks. First. Dr. Eva Marie Muller Stuehlar warns us to take direct responsibility and audit our algorithms rather than flying blind on unverified systems. And Elaine Barsoom urges us to map out human workflows and turn rogue users into internal champions. Ultimately, the mandate isn't to go get AI. It is to solve real business problems safely, ethically, and with your people at the center. And since this episode was all about artificial intelligence, we thought it was only prudent to use a little AI in the episode itself. You may have noticed that my intros and outros were not actually the real Scott Kinko, but rather my AI avatar. A, uh, huge thanks to Reggie, Eva, Marie and Elaine. You can find their full unedited episodes in our show feed or@the bridgecast.net don't forget to rate, review and subscribe wherever you listen to your podcasts. Until next time, I'm Scott Kinka. Uh, thanks for joining us on the Bridgecast.

Speaker A: Listen, if you made it this far, there must have been some good content or you're just a fan or a relative of mine. In either case, we appreciate you spending your most valuable asset with us, your time. We don't take that lightly. We'd also like to say one more time that we're appreciative of, uh, bridgepoint Technologies and their belief and sponsorship of this show. We hope that if you or someone you know is thinking about your company's digital transformation or simply the next IT project that you may not have the resources, budget or time to get to. I'm sure that bridgepoint will of the country's fastest growing technology advisory and procurement firms can help. Check out bridgepointtechnologies.com don't forget the E on Bridgepoint or simply reach out to me at Skinka uh S K I N k a@BPT3.net also take a minute please, if you would, to give us a five star review on your favorite platform. It helps give us the visibility to reach other people like you. Thanks for listening to this episode Episode of the Bridge. I'm Scott Kinka and until next time. There's a lot of noise out there in business and in life. Do what you can to be the signal. Thanks.