EP276 AI Governance vs. The Hyper-Velocity Agentic Future: A Lawyer's Take

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here as ever, myself, Tim Peacock, the Senior PM for, well, a bunch of fun stuff in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.withgoogle.com/cloudsecurity/podcast. You can also find us on our new YouTube channel, youtube.com/@cloudsecpodcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we are— well, you are, not me. You abandoned me for this recording.

I did.

How could you? I'm so hurt.

But I thought— I felt like maybe sometimes I feel stressed if there are more PMs than me on the show. But this was a case of more lawyers than you on the show.

Yes.

So see, there is that.

Any is more than the number of me on this episode. But this is a lawyer-heavy episode. And I will say I've been uncomfortable when I've been outnumbered by analysts on episodes. So I really— I do wonder how you felt when you were outnumbered by lawyers.

Well, it actually was kind of fun because the topic was really juicy.

Really? Nobody says that.

Nah, nobody says that. Okay.

What was the topic?

The topic, wasn't there some kind of a line from Terminator when he said, I lied? So I should really practice that one.

You should work on your Terminator impression. That wasn't very good.

No, I need to, yeah, I need to try harder. But it was about AI governance. And of course there's enough about AI governance mistakes and ungoverned AI, AKA shadow AI. And the fact that maybe people who misuse— among people who misuse AI, there are some lawyers too. So all this was actually kind of fascinating.

I hear they keep getting caught for that.

There is that, yes.

Well, listeners, if you have ungoverned AI or shadow AI, I feel like you should invest not in Anton and me podcasting, but instead in perhaps Blade Runner. But maybe let's turn things over to today's guest and see what they have to say.

Really happy to be here. Hey, everyone. James, thanks so much for joining us. We're really fortunate to have you here on the podcast today. So, James Scherer, partner at BakerHostello, and works in co-leading the emerging technology team. So, I'm assuming with emerging tech, it's pretty much synonymous with AI these days, and you must be quite busy. How are you doing?

I'm doing well, thanks. There are still other emerging technologies. I want to put that out there. But there is so much interaction and intersection with AI so that A number of the AI projects still find their way to me. And it runs the whole gamut right now with what we're seeing. Some organizations who are still developing or, let's say, refining AI policies, all the way to organizations that are trying to put compliance frameworks in place because that's going to better govern what they do and/or they've made contractual representations where now they have to abide by that. So they're working on that in the back end.

So I want to start— I want to continue, rather, in a somewhat interesting spot. We mentioned AI. We mentioned technologies, and you, of of course, mentioned that there are other technologies that are emerging in sort of semi-adopted state. But if you follow AI hype, say on social media or somewhere else, you'd think that it's not just an emerging technology. It's not just cloud, 5G, OT, AI, quantum. Like, it feels like the vibe is different for AI. So do you treat AI as just an emerging technology, or is there some kind of a wider, bigger societal about it?

I think you have to augment the treatment of it. I'll say that. So it's both emerging technology and everything that comes along with that, plus this idea that we're projecting, and in some cases, a legally recognizable agency onto this technology. We've talked about, I think we'll probably consider here today, this idea of skeuomorphism, where we collectively decided we wanted these technologies that are creating new things to be perceived as human-like or to have those characteristics, we can't be surprised when people are interacting with them in ways that seem human-like. And I think that's, that's a fundamental difference because we're, we're projecting reasoning onto these technologies. We're thinking that there is, there are considered approaches behind it rather than often the probabilistic nature of the technologies that leads to output that we then perceive as having some, some real intent behind it. So we have to look at the technology itself and how it operates, as well as all the backdrop to that, all the tech stock, all the resources, all of the procurement issues, but then also think about how people are interacting with it, which I think it is fundamentally different than a lot of the emerging technologies we've seen before.

Okay. So, before Marina asks the actually deeper question, I want to prod a little bit on that one, even though it's not shallow at all. It sounds like you wanted to answer, maybe it's different, but in the end, you answered yes, essentially that AI is not just an entry on the long list of emerging tech. Because at some point, servers, clients, cloud, mobile devices were emerging tech. And people probably wrote about societal implications of everybody having a computer in their hand or something in 2007.

Yeah.

But can you kind of explain beyond us assuming it has human-like intent, what else is different about it from your perspective?

Well, it's not the human-like intent because there's not that. It's the projection onto it and these intersections. I'm still a behavioral economist at heart as far as how I believe people are going to behave. So the best projections out there. people are interacting with these technologies as though they embody personhood, then that's something different than holding a slab of metal and glass in your hand. I, I fully appreciate that that technology and its dramatic adoption changed a lot of things, maybe not quite everything, but pretty close to it. And so that modifies human behavior, but it wasn't an assumption where we had any kind of hardwired evolutionary path to how we were going to intersect with or interact with a slab of glass and metal.

Mm-hmm.

These technologies now are not only positioned to interact with us that way, we have intentionality for the providers of the technology, which are trying to integrate them in, taking— I wouldn't say taking advantage of, but appreciating that we're attuned to interact with those technologies in that way. And allowing for that to happen. I don't want to say taking advantage of. I'm not trying to project any kind of nefarious means here, but appreciate that that's the path of least resistance to get us to interact with these technologies because of certain design choices that have been made along the way.

Yeah. And I would add, I mean, I think we've initially, maybe not so much now because of the way that the technology's evolved, but Even like a year ago or so, people were saying, like, wow, like this emergence of AI that's like as significant or even more significant than the internet or than SaaS applications that we now have ubiquitous access to that we hadn't in the past. And there are significant differences, exactly as you said, James, where— so AI is still a tool, right? But the way that it functions, that probabilistic nature, for instance, is a significant differentiator. And so I'm wondering, and I think this is something that so many organizations are grappling with, and I'd love to hear your perspective on, is particularly in the way that AI is being used within various industries and enterprises. Folks are trying to like wrap their minds around how to effectively govern and control it so that it's used in the intended way, but still continue to reap the benefits that they see are possible. So wondering if you have any thoughts in terms of like what you've seen organizations do from a governance standpoint that's been effective and where we might need to tweak some of the current approaches to governance to be more adaptable to AI.

That's a long one, Marina.

Sorry. Let's see how James handled it.

Yeah, the lawyer response is always, it depends. But I mean, practically speaking, there's— you've got both individual uses of these technologies and at an enterprise level what expectations might be and where some of those responsibilities are going to exist. I think at I mean, I counsel enterprises and then through the extension of that work, meet individuals where they are. At least that's the intent. We want to be practical. It's like these ideas within information governance generally, and so much of this is data-driven. You don't boil the ocean, you can't do that. So, where can we make an impact? Where are we going to get that Pareto optimality? Where can we get our 80% of the results? I think with organizations, it's trying to build off of what's already there. And for those organizations who have developed some frameworks for privacy and security and evaluating data governance, using those to figure out what is happening because you've got this idea within these technologies that it's operating as or creating results that we would have normally associated with people. with human output. We want to accommodate for that in the first instance. So if you look at that, we say, hey, we don't know objectively where a given output comes from yet. We're going to try to work our way back into that. So how do we figure it out? It'd be the same thing. I don't remember if you— or I don't know if you remember the movie like The Secret of My Success, where Michael J. Fox like took over an office and was pretending to be an executive. and pushing out memos and doing corporate things. And from that corporation's perspective, they didn't know they had a new exec sitting in a corner office, you know, that was a mailroom person pretending to be the exec. Now, I'm not gonna dig too far into this metaphor because I'm gonna lose it, but that's part of the idea here. Suddenly you've got technologies that are creating outputs that mirror what we would expect that we had an approach for assessing or accommodating for. And how has that changed? And do we need to double-check everything, or is it good enough for those outputs? So for organizations that are confronting this, I think we have to distill it down into what can you do. Organizations can work to figure out what they have, what's happening within the 4 corners of their operations. And that can go through DLP programs. You can see—

Mm-hmm.

What your employees are accessing, whether it's through the firewall or existing technologies. But in order to understand the existing technologies, you have to, you have to do your mapping process there. Again, that's why we try to take advantage of it with clients. And again, if you're working with us, chances are you have a certain level of sophistication where you've appraised yourself of what technologies you're paying for, what technologies your employees have access to, and what type of information at least they're inputting into those technologies. We can work there and say, all right, do we have automated processing functions here? Do we have outputs? How do we get our arms wrapped around that? And some organizations then become a little bit more sophisticated in assigning responsibility to those different programs and ultimately their outputs and keeping track of those. You know, I speak too firmly and fondly of actual client experience, but that's where a lot of the stories come from. So working with clients who set off these initiatives And then we'll find out about them later on when we're assessing them for privacy notice requirements or what we might expect to see. And then coming back to the client saying, hey, this program is running, what do you think about that? And the client might say, well, we've deprecated that program, we've wound it down. And then you get to tell the client, you're like, well, maybe you thought that.

Hmm.

But we've interacted with it and here's what we've seen. Now we know 2 things. One, it's still running. 'Cause we interacted with it. And 2, we know that there's a disconnect between what this program is doing and what's happening internally that we need to accommodate for. So we need to deal with the plane in the air, and we have to deal with the process that hasn't yet accommodated for that.

Yeah.

So the companies are still working their way toward that. But in doing so, I think they have to be really, really careful and intentional. So this is one among many bad metaphors that I usually use. If you've ever held Jell-O in your hand, And you know that there's a little bit of give there. And maybe nobody here has, but I appreciate it if you've ever had kids and you had to pick up something.

Yes.

You can squeeze it a little bit, but if you squeeze too hard, it goes everywhere and you cannot recompose it. Now, I'm sure there's some food scientists out there would say, oh no, you just put it back in this and— no, but I mean, for the most part, for those of us, those of us whose day jobs are not food science, that's it. You've lost contain and created a bigger issue than you had before. So how do we navigate this with intention and with some sensitivity, especially because not only are some of the outputs somewhat indistinguishable from what we'd expect from a person, the way in which people are interacting with these programs, I mean, it's different. And we've got another generation that's coming up outta school into the professional world who has been interacting with these tools on a near constant basis.

Yes.

We have to appreciate that. And maybe not within the corporate sphere. My first corporate email address and interaction on those systems was when I really joined a company. But now you've got people using these technologies in ways that are going to mirror or augment the work that they're doing, that have been doing them along the way, and in a way that is somewhat bespoke to them. So you have to accommodate for that too. And so that's what I mean, we're finding an appropriate level and then giving instruction back to employees. Policy development are seen as appropriate controls for things like the NIST AI Risk Management Framework or ISO 42001. And I think those standards are helpful to at least communicate what organizations have done to start to or begin to responsibly address these issues.

So I want to, before Marina goes and asks a question about the agents, because of course agents are kind of a thing, I want to ask for one clarification. I'm specifically kind of maybe not disturbed, but I'm specifically nervous about some companies that are just not dealing with the speed of change in the area. So, we asked you a governance question. I think you addressed the differences and to some extent the speed, but can you speak briefly specifically about the speed? Like something that you— like nothing that happens on a quarterly basis fits. Because the tech changes much faster and you can't pretend it doesn't. And I've met people who did. But ultimately, what's the governance answer to something that's ultra-rapid?

So, how do you put governance in place as something that can scale immediately and can be a surprise?

Yes.

I mean, instruct your employees that there is— you have to have a general enough policy that you've educated employees and given them some direction such that they're not going to unintentionally create a much bigger issue. In the same way that every employee has the potential nuclear bomb of social media in their hands at work. And I think that organizations have done a decent job in helping people adjust to that. We don't see a flameout, or maybe we do see a flameout on social. I don't spend enough time on social media, thankfully, to see a flameout that's work-related every day. I think people even joke about it on LinkedIn that it's to anodyne and that there isn't a real personality behind a lot of it. But I think that speaks to people can handle these technologies responsibly. And maybe that's what we look to do, to both inform individuals, appreciate that, and know that they're not going to get scammed every day stepping out, even though those challenges are there and frankly are available to nearly everybody with A cell phone or access to the internet. And I think the organizations have to be ready to be supportive. Because again, it's that Jell-O metaphor. If you just say, don't do it, and you've got people who have, I mean, really wound it into their approach to professional life, I don't know how successful that's going to be. And we're confronting it for the first place, like seeing pressures on both sides. Don't use it irresponsibly, but you better be using it. And if you don't use this technology, you're going to be left behind. You're going to be the dinosaur. And I've heard that a number of times with different ebbs and flows of technology. I'd be curious about that paper for everybody who said you're going to be a dinosaur if you don't do this thing. I think organizations who aren't online could speak to that if we could hear them, but we can't because they're not online. But there's probably other technologies where maybe you didn't need to immediately get on the blockchain to provide whatever the services are. So, and we're seeing a lot of interesting pressures within. It does remain to be seen what type of education is going to work best, or if other pressures, including if you don't have a job anymore because of your use of this technology, if that's going to stand in and really help most effectively.

I really love that point you made about meeting your clients where they are and having that practical approach. I think that really resonates. And like, we do have— we see so much guidance in terms of the requirements for employees to ramp up, right, and to use and to get proficient, be AI literate, understand how to use it, understand how not to use it, right? Just as important. And I think from what I'm seeing, correct me if I'm wrong, right? Or if you're seeing something different. But from what I've seen thus far, a lot of times the enterprise governance isn't nearly as flexible or as flexible as they're expecting their staff to be in accommodating the changes that the enterprise is requiring, right? And so there's still a lot of like trying to fit this technology into the existing governance process and like somehow making it work.

Mm-hmm.

Because there's a fear, particularly, and rightfully so, but still, particularly in regulated industries where you can't just say, okay, well, we just won't do this anymore. We'll take a completely different approach and it'll be fine because it's more tailored to GenAI or agentic AI as, as we're starting to see that evolve. And I'm curious because of the points that you had made earlier, particularly around the skeuomorphism, is, are you seeing a shift in terms of the governance posture and how we're treating these, at least relatively nascent agentic AI capabilities that are really kind of blurring that line between being tools and even like human teammates? And whether the existing controls that we have currently are sufficient or if we should be looking at changes to those controls that continue to have the technical components but also incorporate some version of human resources type considerations as well.

So this concept of HR for AI is one that did come up in client discussions, but I think that's still a projection for now.

Oh, okay, good. That's actually hugely important. This is like— I want to just stop you for a moment and say, so if you treat AI agents, GenAI, as human/employees, Employees, you're in the wrong.

I think that's still—

Too harsh?

I would have to separate it out into specific use cases. I think where you have an expectation of certain types of interaction, I can see that and have had more active discussions around call centers or instances where people are using chatbots and they're unclear if they're interacting with a bot or a generative platform. Or if they're actually interacting with a person and they might have that expectation, and what will the organization be held to account for those interactions that are fuzzy? And I mean, some of the exceptions make the rule. You know, we've seen some challenges with youth and some dramatic reactions on the sides of the, at least the state legislatures, to say you can't interact with kids in this way because they're even less prepared. for that skeuomorphism and for distinguishing between somebody online and a bot and the type of advice and counsel that they're searching for and getting, especially with technologies whose aim is to capture attention and maintain it. For most organizations, I think it's still— you've got a lot of the established corporate workers at whatever level that have been doing their jobs to this point and have slowly adopted the technologies. It sometimes, it seems like a lot, but at the same time, email does look fundamentally the same. I think people growing used to collaboration platforms, like that's been a little bit of a push or interest in. But you've got individuals who have been using the technologies and where the outputs are indistinguishable from what they might provide, or individuals look at that and say, you know what, this is a better product than what I have. And there may be some very, very realistic instances of that, especially if you've got— you're trying to work in a language that's not your first language or you don't have a lot of familiarity with, but you're generating a better product than you would have. Understanding that maybe better is not quite the right word, but different is, that takes education. Frankly, some of the issues the legal profession has had here Those cautionary tales, and I think we're up to north of 700 different instances where attorneys have been caught using these technologies.

Wait, 700? 700 incidents? Wait, wait, 700. Let me kind of like— I need to process this briefly. 7? That was 7, right?

7.

7-0-0, Anton. What? That's foolish.

First, you got to appreciate just how many lawyers there are in the United States. I feel like it's— is it like north of a million for one for every X people? And this is what I ask often when I'm doing speeches or presentations. Like, why do attorneys keep getting caught? Is it because we're just not good at using these technologies? I don't think that's the case. Clearly, we weren't in those instances. Let me put that out there. I mean, there's 700 pretty clear instances where you wouldn't have been accused of it and put in front of a judge if it wasn't the case. However, attorney work product is triple-checked. It's checked by the other side, by your adversary's counsel, who's paid a lot of money to do so, and it's checked by a judge and then evaluated to see if the norms of objective application are there. Because remember, they're looking and saying, hey, did you cite a case that really exists? Did the case really say what it is that you said? That one's a little bit murkier. It's because someone else is checking. For every attorney that gets in trouble, you might think it's only 700 given there's a million practitioners. And also given that these technologies, in part because of what I understand the economics to be, are very widely available right now, seeking to capture that toehold and become part and parcel of people's everyday lives. I mean, that's why we're seeing a lot of organizations simplifying their platforms because they do not know in what direction this is going to go. They just know that last time around, those organizations that were not nimble got left behind. You can't pick the direction. You just have to be ready to take that direction. I think the legal profession in some ways is a harbinger for where some of these other places go insofar as like, this is a profession that we agree to. We agree it works this way. Medicine, we're following the science. Chemistry, we're following the science. We're not saying, hey, here's a new rule now. We don't go into physics and say, you know what, now we're going to agree that the speed of light is actually this so that we can go faster. We don't get to do that. But within the legal profession, within some of these other professions, we get to make choices and determinations. Is this going to increase access to justice? Is this going to speed up the e-discovery process? We get to make some of those decisions, and as long as we're making them together, I think that's— that's where it's allowable. We have to figure out what our tolerances are going to be. I'm intercepting it on the backend. I've had clients come and say, hey, I've got this thing that was generated from this platform, can you check it?

Uh-huh.

And I had to tell a client last week, I was like, it's quicker for me to start with something that I've done before than to deal with this thing. And I said, it's the equivalent of you coming in And you came in for an oil change, but all of your tires are bald. I can't let you drive out that way. It's a miracle you made it in. So how can I help guide this? And I think that it goes back to this idea. I'm not the house of no one. I'm not here just to say, oh, you can't do that. You should just stop. Let's all go back to pre-fax machines where we could send letters and be civilized. Like, I think that that has— maybe we'll come back around to it. Maybe that's like the big leisure time addition. But as of right now, it really is dealing with these things at scale. And I have to think about how can I help organizations where every individual has essentially created potentially their large action model for all the different technologies they work into their day-to-day operations. How do I accommodate for that on behalf of an organization that's going to have output into the economy? that it's responsible for, regardless of whether that output is communicated by AI or by individuals or by more traditional work product.

I mean, I like that, but I feel like in addition to this, there are also unintended consequences in some of this, in some of the rulemaking. I mean, my mind goes to people who write very stringent policy and then not enforce it at all, or people who, you know, do other things like avoid setting policy because they're afraid they would do something. So, I'm sure you have stories where unintended consequences of rulemaking about AI have caused some fun, okay, however defined. So, maybe can you share some of those before we start getting to a close of the episode?

Well, that's what we're concerned with, which is it's still an emerging technology. It can be an emerging technology plus, but this idea of unintended consequences, when I work with organizations, I want to see the forest for the trees in the first instance. We don't want to redo anything. If we already have a measure by which we can capture the different assets and processing activities within an organization that relate to personal information under the privacy laws, let's please start there because that's going to help me risk adjust and kind of develop risk tolerances for the automated processing instances if they involve personal data because I know I've got 2 sets of laws to think about. Now, again, I'm looking at it from the legal standpoint. I want to let organizations know if they can't do something or if it's going to raise incredible risk, or if they can and it's relatively allowable. Not, not everything is off limits. And we've got US policy at a federal level during this administration that's trying to push for less guardrails so that the US doesn't fall behind in its development of these technologies. That's an interesting place to be with organizations. I take umbrage, Anton, with the idea that if you put a policy in place and then you're not dogmatic about it, that you've in some way increased risk. No, no.

If you don't do anything about it, if it's a purely paper policy, that's— somebody scared me with that story a good number of years ago, and I occasionally repeat it, but hopefully not in the presence of 2 lawyers here. It's basically the policy that exists, like, we monitor access, but you don't deploy any controls, you don't buy any tools, you don't actually monitor. It's your policy is just a straight-up lie, but it sounds stringent.

There are some controls under audit frameworks that speak to the documentation piece, the contemporaneous business documentation. And I'm going to assert that that's part of it. And saying, well, if we don't have it, then we're not out of compliance with it, is going to help us on an audit? No. The first thing regulators ask for is a copy of it. And frankly, You don't know if it's made available. And I work— one of the things I have to ask organizations when I start working with them on these bigger projects, I'm like, how do you get your policies approved? Are you a, we meet quarterly and present them to the board, so we have to work backwards from that? Or are you, we updated the PDF and put it on the intranet, so guess what? We have a new policy now.

Yeah.

Regardless of the approach there, you have individuals who are looking for guidance. If you have that there as a reference document, that is helpful. Same thing for data governance. Same thing for records. Like building that knowledge base out, especially now where people are self-help. Yeah, we want to have training for them. Yes, it would be great to audit on the back end. But a, we've got individuals who are used to finding their own things and being very self-directed. Make it available. At least you have the hope and you can make the assertion. So I do a lot of litigation on these topics too, with like auditors. And I will tell you, at the end of the day, when this is really being evaluated in that deposition, when people are under oath and on camera and really paying attention, I want to be able to point to things and say, hey, is this the expectation on behalf of the organization that people would behave in that way? Because if I don't have that, then everybody's a cowboy. God bless them. Based on that, I think it's still a great place to start, and then it's always incremental improvement after that. Because even digging into the controls and policy frames within the organization, we go and we unearth everything because we have to. I want to find out what's already there so I don't screw up something that's already in place. I don't turn something off. I don't suddenly create contradictions. Even if I'm trying to follow NIST or ISO or trying to embed something there, I want to be very, very cognizant of that. And frankly, if I integrate it in more, then it's helpful to those programs. Also, going back to this idea of like putting things in process or making them available, guess what some of our AI agents are trying to do, right? If you want, you want to fine-tune or you want to create some kind of like RAG framework, that's what's going to be available. So if you're worried that Oh, it's been so difficult to get people to pay attention to these policies and abide by them. Maybe we're going to solve for that by using some of these technologies that we can direct the work based on what our expectations would have been. And within, within the IAAP, within some of the governing bodies, there's absolutely been this idea that as these tools and technologies scale exponentially, it's just not the way that we think. You're going to have to fight fire with fire. You're going to have to use some of these automated technologies to do what we're saying you need to do with automated technologies vis-à-vis governance and audit and evaluation and keeping track of outputs.

I think it's also important to kind of keep in mind that perfection isn't typically expected, right? So usually we're trying to take a risk-based approach. We're trying to find a practical, defensible position, something reasonable. not perfect. I haven't seen regulations or laws that say, you know, perfect outcomes are expected each time, otherwise you'll get in trouble. So, I think, you know, as unfortunately we have to close, I'd much rather keep going with this conversation. But from like a lightning round perspective, if you had to name like a couple, like what are the critical, you know, non-negotiables? Like what types of things should organizations be looking to put in place now to have that type of defensible position?

Policy. Start with the policy. I've done north of 80 for clients, still working on a new one today for a client that had rolled something out. I have to question—

Wait, you can't just ask Gemini what?

So, well, all, right? They're looking at what they have integrated into their technologies. I'm gonna have to work with that client on distinctions between and among generative platforms and others. Depends on what they do. A lot of companies sell an idea, right?

Yep.

Banking products, insurance, contract, whatever it is. So it's a fascinating place to be when you think about output finally, but a policy to start, which will lead you down the path of evaluating what's happening. At least you can start with that expectation. I think that starts to give you the questions. It's almost like that's part of the initial checkup you have on that annual basis to see if you're healthy or if there's things you need to improve. It's one thing to say, well, if I go to that checkup each year and I don't do what they say, you audit me on that, well, then it didn't do any good. And that's not the case. That's not the case. It gets you out and does it. So I'll leave you with this. All right. I'm trying to remember if we had a chance to speak before, if I'd shared this. But you think about who the healthiest people are, and they are people with daughters who make them go and see the doctors. And even in divorce cases, if you've got men with daughters, they force them to go to the doctor. These are clearly people that weren't doing these things on their own. And I appreciate like the gendered implications here and more of this burden of work. But ultimately, objectively, doing some of that work gets you that momentum in stepping into the next point. And it's— I feel like it's within the govern framework. It's govern 1.4 into the NIST AIRMF, which I have open and flagged and everything because I'm referring back to it for We're saying we don't have the law yet, or we've got the law, but the Texas TRIGA didn't push so much through, or Colorado AI Act's not in effect yet. It's like, yeah, but you've got the frameworks and you know where they're going to go. So when we look at this, what can we do today? What can I do today to position you so that 6 months from now, if there's a challenge, you can say, well, we started doing this, we had reasonable expectations, this is available for people and for guidance. This behavior, this instance, tragic as it is, is an exception to our rule, and we have to address it as such, rather than this is what we can expect when there are no rules.

That's a perfect, perfect closing remark. I don't know, sorry, I shouldn't use the word closing remark again in the company of 2 lawyers, but this was just like, somehow it struck a chord with me. So thank you very much for being on the show. Marina, do you have anything fun to say to close it?

No, I was gonna say absolutely fantastic talk. It's always such a pleasure, James. I really hope that we'll have you back.

Yeah, I'd love to contribute, and I hope it resonates.

And now we are out of time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.

Security. Security.