#344 Governing Pandora's Box: Managing AI Risks with Andrea Bonime-Blanc, CEO at GEC Risk Advisory

Generative AI is transforming industries at an unprecedented pace. But as AI changes how you or your team work, one thing is clear. Your skills also need to evolve. At datacamp, we offer everything you or your team need to adapt and thrive with AI, whether it's business users looking to get the Most out of ChatGPT and Copilot, or developers and data scientists looking to fine tune models. You can learn the entire AI skills spectrum on Datacamp. Power your AI transformation today. Start learning@datacamp.com. We also have people leaving companies like OpenAI because they felt that the safety and the guardrails weren't very strong. So they've gone to other organizations to create their own companies to put safety first. And so we have not seen that safety disaster yet, but we're going to see something. And the moment we see that if it's big enough, there'll be a rush to creating better governance and better risk management and better auditing and better red teaming and all this stuff that we talk about, but that we don't always do, but you have to be discerning. And I think that's really, really important right now is there's so much garbage out there and so much slop and more and more of it being created every day by AI. So we need to be discerning, selective, not being overwhelmed, but also be open to understanding some of the other forces that are taking place in our society. And.

Welcome to Data Framed. This is Richie. The rapid advances in AI are world changing. The technology is mostly improving the world, but it also introduces new risks. Today we're looking at techniques for governing technological moving targets. The focus is naturally on AI, but I'd also like to know how AI fits into the broader suite of exponential technologies like quantum physics and biotech. Our guest is Andrea Bonin Blanc, the CEO and founder at GEC Risk Advisory. She's got 30 years of experience in technology, ethics and compliance, including since as an executive at Bertelsmann and a professorship at New York University. Andrea has just written Governing Pandora, a book that forms the basis for today's show. Let's find out how to govern AI and other exponential technologies. Hi Andrea, welcome to the show.

Thank you so much for having me, Richie. I'm looking forward to our conversation.

Yeah. Great to have you here. So I think over the last few years, AI has been advancing incredibly rapidly. How do you. Well, I guess first of all, what's the biggest risk you've seen from the rapid advances in AI?

I think the biggest risk is that we're not keeping up with both the upside and the downside. So if people are not looking at the AI and tech risks in a holistic way, keeping up with it both in terms of advances and also downsides, and making sure to protect and maintain sort of an equilibrium of sorts, that to me is a very big risk. And unfortunately we have, you know, the very bleeding edge of tech change on the one hand, which doesn't really care about the risks as much. And then we have the overly cautious, risk averse crowd that is trying to drag them down, in the words of the accelerationists, let's call them. And so we have that tension between different kinds of functions in the pursuit of new technology. And I think we have to have a more holistic and more balanced approach in general.

Yeah, I suppose both extremes are kind of problematic. So if you just like gung ho, we will adopt the latest technology, we'll build the latest thing and not really worry about risks. That's a terrible idea because something bad's going to happen. But also if you're like, okay, we must do nothing because it could be dangerous, then you're overly cautious and you're not going to get those upsides from the, from the technology.

That's right.

So somewhere in the happy middle, there's a state where you are creating new technology but governing it. And again, it seems like when technology is moving fast, governance becomes a problem. How do you deal with that?

I think governance has to be, has to adapt as well to the, the, the, the speed of change that we have. And I like to call it the governance of change. And in the work that I do and, and in the book that I wrote, we'll talk about it later. But the governance of change means that we all have to have an attitude change. We all have to adapt ourselves to the fact that change is going to happen and it's going to happen fast and it's going to happen in a multifaceted way. And so if we as individuals, professionals, experts and our teams don't try to adapt to that, we're going to lose. And it goes back also to the leadership of organizations, companies, NGOs, government agencies, et cetera, to really take this seriously and see it as something that will slip out of their hands if they don't create a proper adaptive structure to deal with it.

Okay, so I like the idea that everyone kind of has a role in this, from individuals right through to sort of NGOs and government and I guess business leagues as well. You said like, if we don't take this seriously, it might slip out of our hands. So what happens then? Tell me, give me a disaster story.

Well, we haven't seen a major disaster yet, but we're hearing a lot of, I would say, small stories or stories that are sort of hidden beneath the surface that come out through whistleblowers maybe and others who are concerned about how some of the advancements that are being made with LLMs and gen AI are actually potentially very dangerous. And so we have the red alerts that we sometimes hear about from the likes of OpenAI. We also have people leaving companies like OpenAI because they felt that the safety and the guardrails weren't very strong. So they've gone to other organizations to create their own companies to put safety first. And so we have not seen that safety disaster yet, but we're going to see something. And the moment we see that if it's big enough, there'll be a rush to creating better governance and better risk management and better auditing and better red teaming and all this stuff that, that we talk about, but that we don't always do. And so we're in the rah, rah, rah phase of doing anything and everything and asking for forgiveness later. And sadly, I think the forgiveness piece will cost and it could be lives, it could be money, it could be, you know, safety of people. And so we don't really know. And I think that's why we need to have a holistic, integrated approach to governance from the top down, from the middle out and from the bottom up. And people who are on the front lines of, of doing the it, the technology, the testing, the development, they're on the cutting bleeding edge of all of this and they need to have help now, not later, when something bad goes wrong.

Yeah, so it just seems like a common thing is that you wait until something goes wrong and then that's the point where you start fixing things. But obviously better do things before things go wrong. And actually your OpenAI example seems pretty pertinent. Like it seems fairly well documented at this point. The company has like to like a very divided culture. So they've got all the people trying to ship stuff and they're doing that as fast as possible. Then you've got a separate safety team and they're like, no, no, no, no, no. And occasionally someone from the safety team gets annoyed and leaves. And I guess that's how Anthropic was formed as a company, was people leaving the safety team and starting again. Governance kind of sometimes like it doesn't have the cool image. So it's hard to see, like, oh, it's like, is the team that says no, so talk me through. Like what does a good, what does good governance look like? Like what's the point of it? Like, what happens when governance took those.

Right, Yeah. I think it really is a whole of organization effort. It isn't just the board of directors or you know, the tech governance around a specific technology. It's a fully integrated, holistic approach to governance. And I mentioned before the top down, the middle out and the bottom up. And I talk about that in my book Governing Pandora in the sense that there's a ch I call leadership. And it's about the 360 governance basically. And by 360 I mean everybody has a piece of this, but it takes the governance from the top to make it happen. So if the board of directors or the CEO or the management team aren't really on this issue because they haven't had their disaster yet or their big risk come to fruition or anything like that, then you're, you're going to have more of a lackadaisical attitude on the part of the top. And it'll only happen if there is that incident or that regulatory requirement that comes along, you know, something from the outside. But it really, I think it starts with leadership from the top and the board of directors really getting that tech governance is a 360 effort and that you have to incentivize the rest of the organization to work in concert with each other to make sure that at the very fruition of the new algorithms or of bringing in data and looking at its shape and content and so on, and how it then becomes part of your own algorithm software program, what have you, that at that very, very granular level. We have not only the technology software developers and all that, but some ethics folks who can sort of ask the what ifs, they can test some of this stuff before it goes into the next stage. And so it's kind of a life cycle approach to governance. 360 is what I like to think about it. It's everybody taking part of it. It has to come from the top in the first place because otherwise it won't happen. It'll happen in sporadic parts of an organization and then it has to be for the life cycle of the products and services that you're creating. So from inception to termination or you know, decommissioning of a product and having those people who are involved with the development, implementation, sale, troubleshooting, et cetera, those people include some form of ethical experts, governance experts, that can help troubleshoot some of the downsides of what's potentially going to happen.

Okay, well, I think you named like a lot of different teams enrolled in the company. Like, basically everyone's got to do something.

So I like that.

So maybe, maybe let's start with the top then. Because you mentioned like this would come from leadership originally. So what's the role here? Like, how do you go about setting like a governor's vision or creating governance culture?

I, you know, I, I think the frontline, top frontline responsibility is always with the CEO or the president, the leader of the organization, to be tech and governance savvy enough to understand that the vision, mission, values of the organization have to include some of this integrated tech governance. And again, you know, every company's a little different. If you're a pure technology company, like a Microsoft or an anthropic, that's one thing. If you are in the auto business or food business or banking business, it's another. But I would say that we're all technology companies now. There isn't a single company out there that isn't a technology company. So the degrees of how much technology you have to govern are going to be a little different perhaps. But everybody's using AI, everybody's using Genai, multiple other technologies that might be interconnected with the AI and with other, you know, robotics, automation, advanced materials, biotech. All this stuff is interconnected at the end of the day. So I go back to the CEO and the leader of the management piece of the organization to really set the right tone from a values and a mission and a vision standpoint. And then that has to trickle down into how human capital organizes the incentives around these things. How it's not just about getting the software and the algorithms created and then deployed and sold. It's about how you're doing it. And so incentivizing the how, doing it ethically, responsibly, accountably, doing it in a way where you will test your products multiple different ways before you actually release them into the wild and to your customers. So it starts with the CEO and the management team, but there's that layer of the board of directors. And I kind of, I specialize in the governance piece at that level. But also how does it interlace with the rest of the organization? The board of directors usually lag behind what is necessary at the management frontline piece. That's changing slowly but surely. But the point here is that the board of directors needs to have savvy people in it that Understand the technology, the change, are ready for that. Governance of change. And not just governance, the old fashioned way, the traditional sit back, I sit on a board versus I serve on a board. You know that those are things that are very important right now. You have to serve proactively on a board in order to get what's going on with technology and then adapt to what your company needs and be more visionary, more scenario oriented than you've ever been. So that's a responsibility at the board level. Although the direct responsibility, in my opinion is a CEO.

This is interesting. Boards of directors, slightly above my pay grade, so I don't interact with a lot of them. So yeah, okay, this is interesting that the board needs to be actively educated then in order to have some kind of impact. Can you talk me through how that impact works then? Like yeah, what do they do?

You know, the board of directors is supposed to supervise, oversee, you know, the whole, the full strategy of the company, the management of the company. Hold the CEO and the top team accountable through performance metrics and incentives. Make sure that the reputation of the organization is being protected and that, you know, that also there is a forward looking where's the business going. I like to think of them as the strategic and culture guiders, right. For the organization. And if something's going wrong at the CEO level or at the management level, they're the ones who have to intervene. And the chairperson of the board is usually the person that's most directly involved with the CEO. Leave aside the fact that in some companies we have the dual role of chairman of the board and CEO in one person. And that is not good governance, in my opinion, because it means that there isn't a check and balance between the chair and the, and the CEO. But so the, the, the governance at that level has to be. You need to select the right people to be on the board. Not just the cronies, the friends and family of either the CEO or the chairperson, but people who are actually qualified to be overseeing a business of whatever tenor it is, right. If it's automotive, if it's robotics, if it's biotech, it doesn't really matter. But do you have the right people who understand the business, who understand the financial wherewithal and implications of the business and then these other things like technology, like, you know, sustainability issues, issues that have to do with the long term strategy of the business and also crisis and risk management? Because we are living in what someone else termed a poly crisis world, which I think is a very good way to describe the world we're living in. And I've added a little, a little nuance to that. I call it a poly risk world too, because our risks are so complex right now with sort of the infusion of technology and other different things. Like for example, a cyber risk in the Ukraine right now would be a geopolitical issue, a cyber or tech issue. It could also involve automated machines like drones, you know, those kinds. So it's kind of a complex multifaceted risk. So the people at the board have to understand these things and have to be continuous learners. This to me is the most important thing. We all have to be continuous learners. But the people who are the guiders of the organization and the people who hold supposedly the CEO accountable, those people have more responsibility than anyone to be continuous learners and to be ahead of the curve, understanding, benchmarking their own industry, but also the competitors beyond their own industry that might come into the fray.

Okay, yeah, certainly, I mean, lots to take in. And I like the idea of a poly risk world. Yeah. I don't know whether it's just like there's more news and there's more awareness of like all the different things going on, but it does seem like, yeah, at any given moment there's always like some kind of crisis somewhere or something about to happen. So, yeah, certainly lots of uncertainty. Okay, so we talked about the board, the C suite. You also mentioned, like, a lot of different teams need to be involved in AI governance. So how do, how do you implement that? I guess tactically within an organization. Like do you need a committee or is there another way of doing this?

Yeah, great, great question. And I'll use an example that I implemented in a company where I was a senior executive. I was in charge of risk audit, corporate responsibility and cyber. For the risk piece, we had sort of an interdisciplinary enterprise risk management team. We were publicly traded companies, so we had to report quarterly and annually and those. Those kinds of things. So we kept a very a fulsome risk register and did surveys every year and collected information to inform our enterprise risk management posture, which then would go up to the management and the board. This team of people would meet every six weeks or so. And this team was about 14 people from all walks of life within the organization. It was a technology company, so we had very senior people like the general counsel and the chief financial officer, but we also had more sort of specialized junior people who were in charge of one risk, for example, export controls. So we had these people around the table every six weeks reviewing the latest information coming out of the Enterprise risk management exercise, anything new that came up. So it was this coming together of multiple different minds and lenses around the risk profile of the organization. So to me that's always been a great model to say, hey, and one other thing that we did actually is if we identified a new high impact, high likelihood, risk, we would put what, what we called at that point rapid deployment forces. Doesn't sound very kosher at this point but you know, two or three people who actually understood or needed to understand that particular risk better. So if it was, you know, if it was cyber, you would have an IT person there, you would have a risk person there and you would have a financial person there. Just to pull that out of a hat. And so those rapid deployment forces would then go and really study the issue, get to the bottom of the information that we had as a company and then come back and report back to the larger cross disciplinary team. So to me that is a really good model of how you a learn about your risks and stay on top of it to the best. And you need all kinds of tools and information flow coming in of course, but then identify the risks. And so the similar model can be used for AI risk which is, you know, we have a multitude of AI risks out there. There's this wonderful repository that MIT keeps for anybody who's interested. It's the AI Risk repository. It's free, it's online, it's constantly updated and it has just a vast wealth of resources, maybe too much, but for those of us who are in the risk space or in the audit space, even in the technology space, it's a very useful place to go and see what the latest is. So someone who would be on a either rapid deployment team or interdisciplinary team looking at AI would want to make use of those kinds of resources. Also other resources that benchmark the industry, perhaps on AI risk. And of course looking at your own information that's perfect percolating up through whether it's reporting, audits, whistleblower reports. I mean we go back to OpenAI. Whistleblowing was not working well at OpenAI. And so there was a lot of no speak up because there was fear of retaliation. And so you need to have a robust speak up structure in your organization that allows you to speak up about these kinds of issues without fear of retaliation. And so that's all part of what I would say is you have to find the right structure for your organization. Every organization is a little different. The right people to populate a structure and make it a very agile, adaptable group. Of people who are really interested and can really find the resources they need to be able to inform the organization. So that's kind of what I would say is a great way to operationalize some of this, is to have those structures and people in place.

Okay. So yeah, certainly if you keep shooting the messenger with me, there's bad news. You're gonna run out of messages pretty quickly. So I like the idea that you need, do need that culture of being able to talk about risks in a sensible way. Now you mentioned that you typically can have like a very cross team initiative. It's typically like four, was it 14 people or something from different groups or whatever. Like as a example, sort of size for within individual teams, like particularly technical teams. Like if you're a data team or you're like a product team or something like that. Are there any particular roles around governance that you think people should be aware of? Like as you're building stuff?

Absolutely. And you know, we're all, I'm sure, familiar with the wealth of new AI related roles that are rising. Right. And so one of the things that I encourage, certainly some of the younger people coming into the workforce and people who are, who traditionally were interested and have served in roles of ethics and compliance, regulatory affairs, those kinds of things, those people traditionally have been working in silos over here while the technical people are over here doing their thing. Right. And what I'm saying, people have to do at the IT frontline, technical teams that are dealing with the data that's coming in or looking at the quality of the data or building the algorithms and the software. You need to have someone come in with a different set of lenses. And those lenses are more of ethics. You know, the ethics of what you're doing, questioning where the data is coming from, if it's quality, you know, helping the technical team look at issues from more of an ethics, compliance, regulatory and risk standpoint. So you want to have a few people like that peppered into the teams that are on the front lines at the very, very early inception of things so that that lens can come in at an early stage and you don't end up with Google Gemini putting out, you know, visuals of, of black presidents from, from the 19th century and things. And much worse, of course, is much worse that's happened, but you don't want that sort of thing to happen. Maybe you can't prevent it entirely, but you have to make an important effort to, to think about those things early on so they don't spin out of control later.

Absolutely. I do like the idea of embedding these skills and capabilities around governance in sort of frontline teams. Otherwise you end up that tricky situation where you've got separate governance team. The governance team is then like the team that says no because the other team's done something silly that could have been avoided.

And this is one of the biggest problems, I think, in any kind of organization is jurisdictional battles. I spent 18 years as a senior executive at four companies and the jurisdictional battles, if I'm general counsel, I have control over this, if I'm risk, I'm controlling that, if I'm cfo. And those kinds of jurisdictional battles are as natural as human nature issues are. Right. But we have to try to overcome some of this. And again, that's why I keep going back to the CEO and to the board. They have to set the tone for a culture that incentivizes the, you know, the top managers and mid level managers and others to work together. Because we're not going to solve these problems if we don't work together and cross functionally and cross disciplinarily. Because these, these questions and these issues and these technologies are so complicated and the implications of them are so unknown that we really need to come together to help find the way to a safe future. And you know, not everybody lives, lives in that world.

I do, yeah. I mean, certainly, I think particularly on a legal level, I mean, within companies as well, there's always like people arguing about, well, whose responsibility is this? And yeah, I guess either trying to pass the book or, or, or take ownership for something where maybe you should belong to someone else. Okay, so I guess maybe on this note, like, what do you think, like a responsible technology culture looks like within organization?

Well, I think it goes back to what I was saying a little earlier about, you know, the CEO and the management team typically set the vision, the mission, the values. And then those things hopefully are not just paper on a wall or, you know, zeros and ones on a screen, but actual things that matter to that organization and that have operationalization through performance management, performance incentives. How do we do the work? Not just get the work done, but how are we going to get it done ethically versus unethically or, you know, those kinds of things. So it always goes back to me to how the CEO and the management team characterize the use, the deployment, the integration of technology into the products and services of their company. And I mentioned earlier too that there is no company now that isn't a technology company. We all use all kinds of technology every day. Whether it's compute computing, whether it's automation, all kinds of software and gen AI and bots and communications tools. So all of us are using these things and all of us are sort of integrated with each other and using them. And so it's all based on technology. And if something really goes bad, you know, a data center goes down, a cloud is cyber attacked, whatever we feel the impact, even if we're manufacturing needles or something, you know. So at the end of the day, how technology intersects with your products and services and how you're going to deal with that intersection has to come from the values of the company, from how the company does business. And the, the way it translates directly is through performance management. And you know, the CEO and the board have to set the tone about the culture that. And to me, the most important crux of the matter, and it always has been this way, but it's even more now with technology moving so fast, is you have to have a safe to speak up culture and a structured one so that it's not someone feeling like they have to hide and talk to somebody about something that they're really concerned about because you know, there's a, there's a out of control AI in your software or something. You want to have process where you can go to someone where there's people identified as helpers, as resources. You also need to have an anonymous route to, to report some of these things. If you're a bigger company or organization and you have to feel that you're not going to be retaliated against because you did that, because sometimes that information comes out and so people will leave like they left OpenAI, for example. I keep picking on OpenAI, but they're, they're like a very good poster child for a lot of these issues. You know, you look at some of these others anthropic started from day one saying we're going to be a B corp. We're going to have all the structures in place, we're going to cater to stakeholders, not just shareholders or owners. There, there is a different attitude that's reflected in each of these companies and it's showing and we'll see who ends up more successful in the longer run. I, I'm betting more on topic than I am on OpenAI, to be very frank, but that's my personal opinion.

Interesting. A spicy take. Yeah, well, I mean, we'll see how it plays out. Okay, so I guess for organizations who are wanting to get better at this, it's kind of a big nebulous thing. Doing governance better. What's like a practical first step?

Yeah, you know, I think it always goes back to being well informed and having good sources for your information, which is a whole other topic that we could be talking about in this age of disinformation, misinformation, weaponized information, etc. So I think we have to pick and choose, but also be open to learning things that we maybe don't necessarily always go to. Right. So be more open to reading, you know, reliable sources on technology issues, on ethics issues, on business issues. Go to. My go tos, for example are the Financial Times, the Economist and then there's a couple of really great newsletters that, that are free from Axios and Semaphore on technology, on AI, there's a rundown AI which is another great resource. These are things that each of us can easily subscribe to if you know, if you don't want to pay money. There's a lot of available newsletters from, like I said, Axios and Semaphore and Rundown. But you have to be discerning and I think that's really, really important right now is, don't we. There's so much garbage out there and so much slop and more and more of it being created every day by AI. So we need to be discerning, selective, not be overwhelmed, but also be open to understanding some of the other forces that are taking place in our society. And I'm a big student of and someone who's followed geopolitical and political issues very closely. In addition to being a lawyer in my earlier career, I have a PhD in political science. So I'm very interested in geopolitics and international relationships. Democracy versus autocracy. These things help inform you what's going on if you're interested enough. And you know, I'm an old fogey, but I was like this when I was a young fogey. So I think you have to be curious. And that's one of the most important things for this, to do well in this world is to be curious. Continuous education, be open to, you know, understanding some other forces that are not necessarily part of your day to day job. And that's why I said the Economist is a great resource or Financial Times, which, you know, it's a business newspaper but it has better political reporting and international relations reporting than in my opinion, almost anybody else. So that's, that's what I would say.

No, that is interesting that when you start thinking about risks, it's not just pure technology risks. You do need to think about like business racing, like what's going on in the world and just, you know, pay attention to trends and pay attention to the news a little bit.

You know, the, the IT personnel that are on the front lines of cyber security issues. Hopefully they understand the larger picture of cyber insecurity worldwide. Right. So they're busy every day battling, you know, the phishing scams and the ransomware and the this and the that, but they need to pan out every now and then. And why are we being attacked and who is attacking us and where is it coming from and why is it happening like this? And it may be criminal gangs, it may be national security, it may be something else. But knowing, having that perspective, I think is really important to doing a job. Well.

Absolutely, yeah, I suppose. I mean, yes, cybersecurity is obviously very, very closely related to geopolitics, like all this kind of nation state gang, like hacking gangs or whatever. Yeah, yeah. I'm trying to think of whether that also applies to AI things as well. I'm not sure whether there's a similar sort of.

Well, it does in a very direct way in that now we have AI turbocharged cyber and security, so we have agents out there and others deploying AI and then agentic AI really raising the scope and impact of cyber attacks. And there's also the reverse, which is the defense part of the cyber attacks is also arming up with more agents to defend and that kind of thing. But it is warfare and it is, you know, an escalating attack and defense kind of matrix, I guess is one way to put it. Those who are in that world really need to understand not only the technology piece of that, but also the, the larger context of geopolitics and international relations.

Yeah, certainly for all the cool stuff that AI brings us is like having automated cybersecurity attacks is not great. Yeah. Some different downsides as well, so certainly worth bearing in mind. Okay, so I think it's worth touching on the relationship with governance and compliance because it seems like complying with regulations is an important part of this, but. But maybe it's not everything. Do you want to talk us through, like, what, what your approach should be here?

Sure. You know, in my day I, I was in charge at the companies where I was an executive for the ethics and compliance program, which was a combination of ethics on the one hand, is more values driven and, you know, culture and that sort of thing. And the compliance piece is what are the laws that you need to comply with. And let's make that the, the Bottom line, fundamental thing that we do. And then depending on the industry that you're in, you are more or less regulated. And of course banking, for example, healthcare, some of these industries are way more regulated than others. And so each company, each organization has to have an integrated approach under governance to risk compliance and ethics. You know, different companies organize it differently. It doesn't really matter how you organize it, as long as you actually organize it, I said. So a lot of that comes under the jurisdiction of the general counsel, but it sometimes is organized in a different way depending on the company. To me, it doesn't really matter how you organize it as long as it works for your type of company, your footprint, the personnel that you have, your geographic scope. Are you all over the world or are you just in a couple of places? All those different criteria determine how your governance, risk and compliance program has to look like. Now there's grc, which people talk about a lot, which is sort of the rubric that's existed for many years to describe not the top level but the next level of governance within an organization. And you usually would have a compliance head or general counsel into which compliance reports, again depending on the footprint of the organization. And so the important thing is having the right people in the right places and having the right coordination. I don't care what you call it if it's grc, enc, regulatory affairs, but it does have a very major legal component. So you want to have your GC or your legal department very much involved with that, whether they actually control it or someone else does because there's a chief compliance officer as well. So again, it's about the topic and how you organize to satisfy the needs of regulators and legal compliance, etc.

Okay, yeah, that's fascinating. Like the structure there. So I guess, yeah, you mentioned like risks and, and governance and compliance as being sort of three separate but related things.

Yeah, and, and, and just to put a little extra nuance on that, the risk piece is often a separate piece that is enterprise risk management. And you have a chief risk officer who doesn't report to the general counsel is an independent or part of the, of the, you know, of the, of the panorama of functions, but hopefully is coordinating closely with the GC and his or her team. And you know, again, depending on how things are organized, you might have a chief risk officer and an enterprise risk management program or you might not, which is a problem for bigger companies and even complex medium sized companies. You'll always want to have some form of risk management that is independent from compliance and governance, but actually integrated somehow in terms of informing them for purposes of governance and compliance issues.

Chief risk officer sounds like a cool job. It's like the kind of person who parachutes into the office or something.

Sexy version of the chief risk officer. There's a very unsexy version too, where you're plowing through information and trying to find the right nuggets that will inform your superiors and management and the board. So there's a.

It's nice, not, not quite as James Bond that much. All right, so for anyone who's sort of interested in governance, like, are there any particular skills you think are important to learn?

Some fundamental building blocks for governance is being expert in one of several different areas. It could be technology, it could be ethics and compliance, it could be risk. And so I think, you know, having, having the, the sort of the rigor and the discipline that comes with being an expert in one of those areas or multiple areas is always a good foundation for governance. Now governance, you know, at the end of the day, it's how you define it and what are you talking about? It's always context driven. So governance, risk and compliance is a functional group. Sometimes governance on its own is usually references the board of directors. And so there you have either the general counsel or a corporate secretary that helps with the governance agenda, caters to the board of directors, organizes the meetings, yada yada yada. So that's governance in a different sense. And then there's sort of the 360governance that I reference in my work, which is integrating all those different things in a way that you have pieces of governance at the front lines that the IT and technology people understand and deploy with the help of other experts, for example, maybe an ethical AI expert. And then you have management in the middle, integrating that into how they manage, how they do the performance, management incentives, and then the top of the house really thinking through the big strategic picture and then helping to create the tactical pieces that go into the rest of the organization.

Okay, I should probably guess before I ask that, like the stuff you need to learn depends a lot on what your role is, but just kind of like there's a big mix then. So there's some technical skills, there are some legal skills, there are some management skills. And it's about being able to like communicate and plan things and make sure it sort of gets implemented within your organization. Now I'd love to go back to this idea of poly risk. And one of my favorite things about your book was you put AI as being just one new Technology, among sort of several that are having big impacts on the world. Do you want to talk us through about all the other bits that weren't AI?

Sure. So when I started writing, so I'll give you a little bit of the genesis of why I wrote the book. I wrote an article. I'm always writing because writing to me is learning. And then once I learn something, I can help educate others. So that's kind of the method to my madness. So. So I wrote a piece about two years ago for NACD Directorship magazine called the Governance of Exponential Technology, something along those lines. And it was basically looking at the phenomenon of Gen AI, which was about a year old in terms of the public, you know, of all of us learning about ChatGPT and so on that. But also looking at how the Genai phenomenon was also interconnecting with a bunch of other technologies. I'm thinking of biotechnology, synthetic bio, automation, robotics, all these things. Advanced materials, of course, because the more powerful the GPUs and the Silicon that's being created for compute, the more we can do. So I was fascinated by the fact that this isn't just about Gen AI, it's about everything else that's happening in the ecosystem of technology and one is affecting the other and interacting with the other, and new things are being created, et cetera, et cetera. So I was fascinated by that. I got an invitation to put a proposal together for a book based on that article, and that was ended up being Governing Pandora with Georgetown University Press. And so when I started strategizing the book, I felt that I first had to start with context. So I talk about that geopolitical context in which, you know, the technology is flourishing. But in the second part of the book is where I, I wanted to do what I call a whirlwind tour of exponential technologies. And I, I spend a lot of time figuring out what are those technologies I want to talk about, because I'm not a technologist, I'm not an engineer, I'm not a mathematician, so I can't really explain them from a pure scientific standpoint. And I, I've chose these five. So Gen was one, biotech, Synthetic bio was another, Automation, robotics, you know, anything from killer robots to smart cities, all that kind of stuff. Then of course I looked at frontier computing, including quantum and a bunch of others. Those are the five categories that I figured, okay, this is not exhaustive. There's other things out there. There's energy, there's communications, but I can't do everything what I'm Trying to do is create a mindset for people to start thinking about. This is all part of our lives, our individual, personal, professional, community, national, international lives. And we need to get informed, at least at a certain level. So I try to do like a, you know, a primer on each so that we all get sensitized to what's going on. And then I go on to other things in the book. But that's. Those are the five categories of technology I felt are exponential in the sense that they're moving really fast, they're becoming cheaper to acquire, they're dangerous, they're fantastic. You know, they're everything.

Absolutely, yeah. I mean, I have to say, there's so many, like, cool technologies sort of in progress at the moment. So actually, of those, is there something you're really excited about? Like, what do you think is going to be really impactful or very cool in the next couple of years?

Well, this, this is kind of a mixed message, but climate tech is moving great guns forward in all kinds of ways. And the solar piece of it is already very well known. And there was a piece actually in the Economist last year talking about how solar. It was a cover story. Solar is the exponential technology that is going to be the most impactful of all because it's getting cheaper, it's getting easier to do and so on. And we have sun, you know, so sun and batteries and all these things that allow it to happen. But then politics interferes with that, right? Geopolitics, international relations interferes with that. But to me, climate tech continues to move forward apace, even with a change of administration in the US where climate tech or sustainability or ESG no longer is part of the dialogue, although it is under the surface in a big way, in my opinion. And technologists and inventors and innovators are going to continue to innovate. And so a lot of innovation is taking place in the climate tech piece, which I think could have an amazing impact if we get rid of some of the political noise, you know, the geopolitical noise. Meanwhile, China is doing fantastically with all of these technologies. And, you know, first of all, they control solar, but they are making incredible progress with a whole variety of things. Batteries, you know, electric vehicles. And they will own the climate tech world at some point, although there'll be others in other parts of the world too. But that will help save, I hope, the planet from too much heating. That then leads to all kinds of dire and terrible consequences for humanity, for biodiversity and so on. So I'm the most excited about Seeing that come to fruition over time. It's not going to be today or tomorrow, but that would be it.

Yeah, I mean, that's a very exciting thing. I mean, like. Well, first of all, like not burning the planet, brilliant outcome, but in general it's a happy story. And I suppose maybe the common theme is like the technology is maybe the easy part and it's the people and processes that are always the challenge.

I actually wrote a piece about that recently about how. What did I call it? Climate tech is alive and well. Planetary governance, not so much. That's the title of the piece that I wrote a couple of months ago for Diploma Run a Career. And it's about this idea that people are inventing, innovating, doing fantastic things all over the world, frankly. But it's the politics of no, of. Of maybe of not making a decision of the COP30, for example. Got nothing done, basically. You know, that's an oversimplification. But if you don't have the. The most powerful countries in the world and then many others talking together about how to do things, we end up with atrophy, arthrosclerosis, whatever you want to call it. But I think that might hopefully shake out over time with different administrations and political will. I don't know.

My hope in this is that, I mean, you mentioned solar technology and climate technology is getting a lot cheaper. The economics generally provide a persuasive argument, so hopefully one.

Right, exactly. That's what I keep saying is people are in business to make money, but in order to make money, sometimes not sometimes, most of the time you need good data, information. You know, the heating of the earth we now have, I believe 2025 is the second hottest year on record after 2023. And 2024 wasn't so good either. The last 12 years have been the hottest years in terms of the heating of the earth on record. And the record started in 1850, I believe. So, you know, Data speaks, right?

Absolutely. That should be the slogan for the show, really.

Exactly. Data speaks. And burning woods and boiling oceans and rising, you know, flood, flooding, flooding and fires. We're all feeling it one way or another. Some. Some parts of the world much worse than. Than some others, but we're all feeling it wonderful.

Yeah. So, I mean, some challenges, but I'm above it until the happy we're going to stay positive that the problems will be solved. All right, super. So just to finish with, I always want you people to follow. So whose work are you most excited about at the moment?

Yes. So I'm going to pick a couple of different organizations that I think are doing anthropic. First of all, I think is doing really good work in combining good governance and ethics with innovation. And they've announced that they're going to do a public offering at some point. I always look at the leaders who are the leaders and are they setting the right tone. And Darius Amodei there is, has been setting the right tone and he's been speaking up when others don't and others are fearful or others are just, you know, playing to the current administration. So I really like the tone that he's setting, combining the safety, the governance with the innovation. So he's someone I would be following and their company as well. Mustafa Suleiman, who's the head of AI for Microsoft and previously co founder of DeepMind and an AI, basically an AI genius. He's heading up Microsoft and he put out a blog just a week or two ago about how AI at Microsoft is going to be focusing more and more on health care outcomes and things like that. And so I think there again and Microsoft has a history of thinking about the governance and the ethics of AI. Nobody's perfect. So I don't want to say, oh, you know, let's go pray at their temple. But I think they've set the right tone compared to some other companies. You know, I would put Meta in the other category of not setting the right tone in terms of ethics and responsibility. So I would follow Mustafa Suleiman, what he's doing at Microsoft. And then there are several other players. I call them the Tech Guardians of the Universe, as opposed to the Tech Masters of the universe in my book. And the Tech Guardians are organizations all over the world. Sometimes international organizations like UNESCO or the UN, other times independent NGOs or international kinds of organizations like the Africa AI Observatory, for example, and center for Humane Technology. There's a whole bunch of future of life. These people are really focused on the safety, the ethics, the responsibility, the accountability. And I would say people should follow one or more of those organizations and see what they have to say about the issues that are coming before us in a tsunami of information.

No, I do love that idea of just following some of these organizations who are involved in responsible AI, AI accountability. Because yeah, that's another signal that doesn't get quite as much noise as maybe some of these tech leaders. Like you're a CEO of an AI company, you get a lot of attention. But some of these other organizations maybe a little more in the background, but definitely me worth great wonderful. Thank you so much for your time, Andrea.

Oh, thank you, Richie, for the great conversation. I really appreciate it.