AI that Advances Human Rights | Dreamforce 2026

Please welcome Vice President of Ethical and Humane Use of Technology at Salesforce, Rachel Gillam, co-chair of UNESCO's Women for Ethical AI and president of Women in AI, Alessandra Sala, and C-suite and leadership editor Ruth Umoh.

Thank you.

Good morning, everyone. Thank you so much for joining. Delighted to be here today with Dreamforce. Let's jump right into what is a very prescient conversation. As AI becomes more capable and more embedded in decisions and experiences that shape people's lives, the conversation around responsible AI is increasingly a conversation about human rights. Many of the underlying concerns are not new, as you all know, and certainly the both of you know. Privacy, discrimination, safety, and certainly human agency all predate generative AI. What AI changes is the speed and the scale at which those risks can travel and increasingly the kinds of decisions technology can make or influence. So the question here today is how do companies move from broad commitments around human rights to actually designing, deploying, and certainly governing AI in ways that protect them. To explore that, I'm joined by 2 experts, Dr. Alessandra Sala, board member of the AI Office of Ireland, global president of Women in AI, and co-chair of UNESCO's Women for Ethical AI. Her work spans AI research, responsible and inclusive AI, and the real-world deployment of these technologies. Welcome. Thank you so much for joining us.

Thank you.

Alongside her is Dr. Dr. Rachel Gillum, Vice President of Ethical and Humane Use at Salesforce, hugely crucial role where she leads work at the intersection of technology policy, human rights, and responsible AI, helping translate principles into governance and safeguards for how technology is designed and used. Alessandra, Rachel, welcome to the both of you. Thank you so much for joining us.

Thank you.

Thank you.

Let's start with what AI actually changes. As I said in the intro, Things like discrimination, privacy, access, safety. Companies have been grappling with all of these facets well before generative AI. What does AI fundamentally change about the nature and certainly the scale of those risks? Perhaps we kick off with you.

Thank you, Ruth, and thank you for this beautiful introduction. So some of those problems, we have been dealing with them for quite a long time. So privacy, discrimination, nothing new in the physical world, in the digital, in the enterprise space. But if we think about how they were manifesting in the past and when they were appearing, the impact that they had was kind of limited to few people. That we are receiving that discrimination. What AI has changed is the scale, moving from a few hundred people to millions in a click or in a second. You deploy an app and you can have a blast impact that is cross-geography, across the world. So the fundamental question haven't changed, the impact that this technology has and the reach that it has has grown exponentially. And therefore, we need to be more careful in understanding that this technology travels very fast and has impact on many people, different geography, different language. And how do we mitigate at design Yeah, same question for you.

Yeah, I mean, I would echo exactly what Alessandra said, and I would just add that it also adds complexity to understanding. It makes the harms more opaque sometimes as finding the root cause or sort of what led to a harm, you know, at the scale of, you know, an AI system impacting millions at once. It can take time to recognize that harm pattern and unpack that and address that. So I think that's the other challenge. And, you know, to your point, the technology continues to change so rapidly, like sitting inside a company every quarter, every month, new features. It's so important that we keep human rights at the center because that gives us those fundamental rights to make sure we're consistently addressing and seeking to protect no matter how the technology continues to transform.

You talk about the mitigation of said real-world impact. You're just talking about the compounding effects, same side of different coins. How do you then identify a human rights risk before it becomes a true real-world harm? What does that process look like in practice if you want to make it really tangible for those here in the room?

Yeah, yeah, I can, I can share sort of our approach at Salesforce. I would describe it in sort of 3 layers. First, at the enterprise layer, really our governance approach. Our team helps run our human rights committee that reports up to the board and As part of that governance process, we occasionally look at what are the most salient risks, you know, presented within our company, and that helps us prioritize. And then my team is really focused on those product and customer use risks. And so the second layer then is different processes we do, like our product ethics reviews. We implement our human rights work into those very reviews anytime a product's being developed and shipped out the door. So we're asking questions like, who can be impacted, how could individuals be impacted differently, what is the severity of the potential harm, right? And so then we're working with our product teams to then implement and develop safeguards and mitigations before it goes out the door. And then after it goes out the door, it doesn't stop there, right? So we're— we can't anticipate every, you know, use case. And so we're monitoring our systems, we are able to receive reports of abuse and harm, and then we're position to address those if and when it occurs. So it's really a full cycle on how we implement that governance.

Anything to add?

Yes, I'd like to add one thing because Salesforce has an amazing team of experts on the ground. There are many companies out there that are rushing to get this technology into their product portfolio, but they don't have the time the skills, the money to invest and do all the due diligence that big companies actually can. And therefore, I'm less worried from the big players that are putting a lot of time and effort, and they have years of experience on the ground on how to build robust and resilient products, but more the rest of of the world that is trying to understand how to adopt this technology fast, be relevant, and be competitive in the market. So therefore, my call is to those experts from the big companies to continue to have those discussions and share concrete playbooks and tools and metrics that will help every company out there to actually think about, question how they are using and who is impacting without redesigning the whole process and due diligence that big company can afford.

I'd love to double-click on this, perhaps with some real-world examples. When you're a tech company who's hugely customer-centric, as most companies are, certainly Salesforce is as well, there are many times where you have a technology that is filling a customer need, it's filling a hole or a gap, but there's some side effects, if you will. Can you share an example of when you've had traditional measures of whether a product is technically working, but it fails to capture its impact on the people using it or even society at large? Anything that immediately comes to mind for either of you?

Yeah, I mean, I think the The issue top of mind is, you know, a product leader might say, let me test and assess the accuracy of my AI system, for example. And on average, it maybe is performing at 95% accuracy. That seems okay. But a big question that we tend to ask is, is this working equally well for everyone?

Yeah.

Right? And so depending on the context and circumstance, we may need to test and assess different subgroups of the population, different demographic groups. And we can often find that sometimes these systems that seem to perform well overall are not performing well at all for certain groups of people.

Give me a for instance if you can.

Let's say for instance, women. You know, sometimes like, you know, the performance for men, and that could be based on the training data, that could be based on a variety of factors of why that could be. But again, we might look across different groups and make that assessment. Again, work with those product teams to understand why and then work to address that. And from a human rights perspective, the reason that's important, again, it is just a core performance issue for a big portion of the population. But the important piece is that when people are relying on that system, especially for critical goods and services and access, that performance gap can result in unequal treatment, right? Unequal access, unequal opportunities. And so that's why it's so important to get ahead of those and be looking and testing for those type of differences.

Yeah, I have something to add, a very concrete example. Large language models, your favorite ChatGPT, Gemini, are general-purpose technologies. So they are built to give you generally good answers in the majority of cases. So now all of us are in industry, I guess, and at the end of the year we do performance reviews. I've been in tech for 15 years, and a few years ago we said, okay, let's see how this works. to help me do performance review. No one really wants to spend so many hours. So I did a prompt to test if I was getting some good suggestions. So software engineer Jane working on project X, and then the other prompt, software engineer John working on project X. Same prompt, Same project. Jane, John, very similar name, right? So Jane was really good. She was a team player. She did everything you asked her, an amazing communicator. John was outperforming. His code, his test, the delivery quality of his product. Product was amazing. So same prompt: Jane was an okay software developer; John was an excellent one. So now going back to the point, when we use those tool, we bring those tool to application, to specific application, and in that moment you can see. How those discrimination and bias that are building the model start to manifest. It's taking those general tools and adapting to a specific use case. And if we, employee and user of this technology, are not trained or aware to question and to think, am I discriminating or is it what I really meant and wanted? from this interaction to be. So it starts having the structure that Rachel described so beautifully in the big company, but it also requires our participation as employer, as user of this technology, to be trained, to lean in, to question, to use our critical thinking.

Perfect segue into my next question. I'll turn to you yet again, Alessandra. I mean, at Fortune, we're constantly interviewing and speaking to leaders at the forefront of these premier AI labs, I'd say more often than not, these companies, these executives have every intention of building inclusive AI. But increasingly, especially for tech companies, they're building on models that are developed, quite frankly, by someone else. So my question for you is, how do you evaluate the impact of a system when you may not have full visibility into how the underlying model was built, how it was trained, or or even how it was tested?

Exactly. This is the most important question. Before, there were 2 big differences in software development before AI and after AI. It was deterministic. Products were built and tested for a specific purpose. So I was building a product that was intended to do specific things, and it's deterministic, the answer. And I know how it's going to be used, and it's optimized for that use. So you have transparency, visibility, and an ability to understand how it was tested for that specific use case. With AI are those big models that we don't know how they have been trained. And after the OpenAI Hugging Face incident, now we are hearing them to say, oh, in those data that we used to train, there were things that we shouldn't have used. So the due diligence is still a question mark. And then we bring it into product or we give those tools to our software engineer, to our product manager, to our legal team and marketing team to build other things on top of that. Those people, most of them, I would say, say 20% of them are non-technical. So they take those models and build on top with zero understanding on how those models have been built and what kind of consequences or inconsistency they could manifest when they are used. And therefore we lose that ability to question to validate and bring the transparency forward. So I think it's come back to us, to the Department of Responsible AI. When we do procurement, we need to procure tools that we understand how have been trained, where are they supposed to be used, which kind of performance do we expect. So every employee that will use those tools needs be trained and understand the limitation of the technology that they have in hand.

Similar question for you, Rachel. Certainly, you know, from the inside and from the governance side, how do you account for that, for potential blind spots before a product reaches the very people who could be affected by it?

Yeah, yeah. And it's so important to take that diligence and that responsibility for what you can control and have leverage over. So doing that additional testing, But, you know, looking at it from like a higher-level governance perspective, it is so important that we're intentional about premeditating, again, those harms or different voices we need to be considering. And so, you know, we try to really make sure we have diverse teams from different backgrounds. But even so, we need to make sure we can never, you know, represent every voice. And so part of our process is making sure we're bringing in intentionally outside voices. And part of the way that we do that—

Mm-hmm.

We have an Ethical Use Advisory Council. So this is made up of, internal frontline employees who are building the product closest to the customer, as well as top-level executives across the company. But we also bring in human rights experts externally, tech ethicists, different academics from around the world to make sure we're getting that global perspective. And their job is to really, you know, question our assumptions, right? Surface risks that we might have missed and also nudge us to go engage with different experts or communities that we should be working with directly, right? And in certain circumstances, we'll even work with independent human rights organizations to conduct that stakeholder engagement. So it's really about being intentional about that. But then also, what do we do with those learnings?

Mm-hmm.

Those learnings go right back directly into our policies that we are making, into the product reviews and the questions and the tests that we're looking at. So it's really a cycle and making sure that we're being really intentional about Bringing in those perspectives so we really know what to look for, what harms, how to stay ahead of that.

How receptive is the product team to this feedback?

Say that one more time?

How receptive is the product team to this feedback?

Well, to your earlier point, one thing we've done is we've intentionally put this as part of a routine product review. So it's not like a separate step.

Very much enmeshed.

Right. Because we do want to make it easy. Our product teams are moving fast. They are trying to ship products. So we need to work where they're working and get in front of that process. So it's not like a tacked-on thing, but it's really by design. We're thinking about these questions.

Yeah, I'm going to circle back to that very question. First, I want to turn back to you, Alessandra. I mean, what should companies be demanding from model providers in terms of transparency or evidence of accountability and testing?

So Please repeat me the question. The model so that the user of the—

Yeah, but I mean, because again, we're looking at a bunch of these, like we're looking at Anthropic, we're looking at Gemini, we're looking at OpenAI. Like what should you be demanding before you're leveraging these various technologies? What should you want to see from your various data providers?

Yes, sorry, I missed from which perspective. Let's go back to what we were saying before. Today we know nothing. So we are working out of assumption. And the reality is there is not a good standard on, or an accepted industry standard on what we should know before we use specific systems. So there is a little bit of a call for action of us being in this industry thinking about the responsible use of this technology to also question one step before, what do you— do we need to know from those systems before we actually leverage those systems or decide to procure this system over the other one? Today we are at an early stage. There is the rush to get those models into your hands and run with it because you don't wanna lose the opportunity to be competitive in the market. But as the market matures, the ability to question those systems and to understand how they have been built, which were the ethical principles not just written on a paper but used in the development of the model, may actually differentiate the decision, I'm buying this system or the other system. For example, just a concrete example to be very practical. Last 6 years of my 15 years in industry, I have been working at Shutterstock. So a very big library of digital content. And we use their library to build generative AI. But we implemented our ethical principle that we're saying, let's source data ethically. What does that mean? Paying the artist a share of the revenue that we were making on those data used to build the model. So we can write ethical principle on a piece of paper or on a website, side and say, oh, my company is ethical, we are doing all those things, or really do it in practice. So sourcing data ethically, do the due diligence of what should be in the data and what should not be in the data. I wrote 3 patents on how to train those systems to debias not only the data but the way you train, because As we said, sometimes we don't have enough data to represent the variety of the world that we want to represent. But how do we leverage the small signal into our data and tell the model, remember this, this is important, remember this, this is important. And as you keep training, instead of forgetting those small examples, you remind the model to keep remembering them. So you increment the probability at the end to actually create outputs that are more equitable. So there are many techniques that you can demonstrate that you have actually implemented in building this technology that can help a company to say, I prefer this model over the other model. Certainly.

Let's take a slight pivot and talk about where responsibility lies and who bears that responsibility. As we've already discussed, an AI system, it can involve one company building a model, another deploying it, and the user at the front end determining how it's ultimately used. Let's start with you, Rachel. How should responsibility be distributed across that chain? I mean, if something goes wrong, if there's real-world harm, who does it fall to? The person closest to it? How are you thinking about that?

Yeah, I mean, human rights gives us a great way to think about that shared responsibility. I know this has been a really big topic in the industry, but As you said, there's many players in the stack.

Yeah.

And you need to take responsibility for the areas that you control or that you can influence. And sometimes those overlap, but that doesn't mean you diffuse or give responsibility to someone else just 'cause it touches their work. So for example, for us, as we sort of were talking about, even though we're building on top of third-party foundation models or integrating those into our system, we're not going to just say, well, they should have put in the guardrails That's not our problem. No, we're going to do additional testing, additional assessments for our context, for the, you know, the use cases that we're looking at and making sure that we're comfortable with that performance. And then same with the downstream. We're not just going to just build something and send it out into the world. When we can reasonably foresee harm or a way it could be used in a harmful way, we're building in those safeguards. We're implementing policies that put guardrails around those known harmful uses, and we're enforcing those policies. So again, every player is going to have a different level of authority and influence on a different piece, but everyone needs to play their part in the stack.

Absolutely.

And maybe I'll just very quickly add one thing. We haven't seen a very serious accident yet.

Yet.

That's the operative word.

Yeah. And let's finger cross. But as those things will happen, then we'll see that the discussion will quickly change. When things go seriously wrong, people are very quickly able to go and blame who was the person that didn't do the due diligence. And as we are getting to the point where those machines are more intelligent, more used, so this is actually the liability aspect of those products start to become a very important product question. So the companies that are building on top of these foundational layer product that touch real human, real consumer, are asking the liability question. If something goes wrong, am I the responsible or can I blame the previous step who sourced the foundational technology?

Yeah.

And I think it's a legal question.

Yeah.

And I don't know if It will really matter in the future. I think the most important thing is what do we do to limit the liability that we carry as players in the chain?

Absolutely. I want to go back over to you and the discussion we were just having about the wide swath of experts and ethicists you have weighing in throughout the entire process. I think most major tech companies, as Salesforce, they now have responsible AI principles. What has to be true inside an organization for those principles to actually change a product decision, particularly when it could come at the cost of speed, of revenue, of competitive advantage? How do you align all of those incentives?

Yeah, no. And we care a lot about principles. And so just like other players, we have maintained a set of responsible AI and now agentic principles that really help align our team of what we're prioritizing, what we're focused on in this work. But to your point, principles are principles until they're actually implemented throughout the process and, you know, occur where people work and make decisions. And so I mentioned our product reviews, right? Those principles really shape the type of questions we're asking, what we're assessing. It also affects how and what other features we build.

Mm-hmm.

The Responsible AI team helps develop different design features that can help enhance, for example, transparency for the end user, auditability of the system, right? Where those are some of our core principles that we're actually building them in.

Yeah.

And then same with the governance, right? Making sure we have accountable decision makers, visibility up and down all the way to the board of these type of decisions. And so we're taking those principles and actioning them throughout the process. where people work and make decisions daily.

Yeah, let's double-click on that because one thing I've certainly seen in covering the tech space, we often talk about governance almost as a constraint on innovation, even a barrier to innovation. What are your thoughts on that? And when is governance actually an accelerant, in fact?

Yeah, well, and Alexandra, feel free to jump in. I'll just say very quickly, for us as a company, the trust piece. It's our number one company value for a reason. If our customers don't trust the system, if we haven't done our job well, they're not going to use it. And so for us, it's actually a business imperative. And like, we need to do this work. Our customers expect it. And so in that sense, it's not a hindrance in that way.

Yeah.

But yes, we do want to move and, you know, again, work with our teams that we're integrating with throughout the company. It's not just sitting in one centralized group where we're working across the company. in implementing these principles and practices throughout the process.

Yeah. Alessandra, what are your thoughts on that?

Yeah, very quickly. I've seen different shades of real investment in responsible principle and action. Some leaders see more as an additional cost, like due diligence, like an audit, those things that you have to do, but you're just spending money instead of just driving value for your company. Other leaders that actually see as fundamental building block to create value for your customer. And naturally, and with the work that I'm doing with UNESCO, we believe that we are much more on the side of those principles actually bring value to your customer because your customer can trust your product better. And I will say There is a great network effect when great CEOs, like from important companies, lean in and showcase how they are doing things, which metrics are they monitoring to demonstrate that they're really doing it in practice. It's not just on their website. Then it creates an industry standard. You don't need to wait for the standard organization to write the standard. You can create industry standard by demonstrating the leadership. And once those influential CEOs start to do that and start to showcase a real metric of implementation, everyone will start to see the value. and will follow because no one wants to see themselves behind the curve. So there is a very good attitude and behavior that can drive industry in the right path.

Absolutely. Well, we are running on time, but I think this discussion in particular becomes all the more critical as AI moves from generating information to actually taking action, moving from an advisor to an actor. So I wanna close by bringing this back to the leaders in this room. and the decisions they're making now as we move into this next era of AI. What questions should they immediately be asking themselves when they return back to their respective organizations next week, Monday, before deploying or building AI systems? What should they be able to answer?

Maybe let's start with you. I think it comes down to asking, like, you know, a lot of company leaders say, oh, I'm so excited about this use case, this positive thing, taking that time to stop and ask, What could go wrong?

Yeah.

And for whom? And really bringing your team together to ideate that and think through that because you will develop a better product if you can really think about that and address those obvious harms in advance and really drive some positive change.

About being proactive rather than reactive.

And one more thing. When those agents take action automatically, you want to have control over those automated decisions. Because you can encode an automated path, just replicate an average or mediocre practice. Or if you question, you say, wait, we should do these things better. So having those people that were doing this job, that now many steps can be automated, is an amazing idea. But having them to question, and instead of maintaining those systems, them into this stable execution path, start to understand how do we add value, which outcome do we want to drive, how do we drive revenue, how do we drive cost reduction instead of just automating all those steps and keeping the status quo constant.

I think it's a solid place to end. I know we're right at time. I think what's become clear through this conversation is that while AI maybe changed the technology, certainly tech companies and what they can do. The questions we've discussed today are ultimately and almost ironically about people. Who is protected? Who is affected? And ultimately, who is accountable? Doctors Alexandra Sala and Rachel Gillum, thank you both for a terrific conversation. Really such a pleasure.