Implementing AI Responsibly | What Leaders Need to Know in 2024

Brilliant. So let's kick off the discussion. I'd like to start with a bit of background context. So can you give me an overview of the major concerns that organizations face when they're trying to make use of AI? Esther, do you want to go first?

Yeah, sure. So my work is predominantly consultancy work in the US and Europe, even though I'm based in Latin America, in Colombia, to be precise. And what I see in my everyday work is a lot of concerns on data privacy and of course, more and more on ethics and governance. However, unfortunately, I don't necessarily see enough attention yet for the ethical side when it comes to biases, discrimination, and also the negative impact on the workforce for specific groups. So we have come a long way when it comes to the concerns within organizations. They're very real. There's finally awareness, but there's still a couple of topics that I think could be highlighted more.

Okay. So privacy is kind of the number one concern, but there are also issues around discrimination and employment which are maybe not getting enough attention at the moment.

Yes.

Richard, do you have anything to add to that? Have you seen any concerns from businesses around using AI?

Well, I think most businesses are predominantly concerned about how to create business with AI. Yeah. And today they are mostly concerned about gen AI, generative AI. How can I use that in my business? Because it's so good, but how can I do that in. In the right way? Yeah. And it is true, like Esther said, some worry about the ethical impact. Some companies worry about the responsible use, but it's still some. Yeah. So Telefonica was very advanced. Other companies like Microsoft, also very advanced. But in general, what if you speak about ethical AI and responsible AI, companies also worry about, wouldn't it stifle innovation? So, and they worry really when it becomes regulation because then there is no option they have to do so. It is a very powerful technology. It has some, also some negative impact. And there are some companies and organizations that worry about the ethics and responsibility, but by large, they are still worrying about how to turn this into profit. Okay.

Yeah. So the business, like big money, always seems to be topmined. But then this is something you have to kind of make sure that people understand, like why it's going to be beneficial. It seems like. All right, so maybe just to motivate this, can you give me some examples of when AI has been misused and it's caused a problem? Richard, do you want to go first this time?

Well, so the most famous one, and actually there are many ones, there is actually a database with AI incidents with over 8,000 so people is from the OECD if you're interested. It's very interesting to read it. Very well known the influence in democratic elections in 2016 in the U.S. in the U.S. elections, the Brexit vote also influenced using deep fake and AI recommendations. Very recently, the porno defects of Taylor Shift. Those are things that can. This is all about misuse. Yeah. It's not unintended misuse, it's really doing wrong and then some unintentional one. The impact of adolescence. Yeah. In terms of Instagram, tech addiction, anorexia, suicide. So this is also negative impact of this technology with a legitimate purpose. But so those are very high level. Yeah. That you see it everywhere in the press and of course gender discrimination in hiring practices using AI.

Okay. So some quite wide ranging things and some of those have impacted millions of people. So it's pretty. Well, pretty impactful stuff. And it's interesting that you distinguish deliberate misuse from unintentional misuse. So sometimes people are doing bad things because they, you know, they have a motive for doing bad things. And sometimes it just happens by accident. All right, so Esther, can you add to that? Have you got any more examples of cases where AI has gone wrong?

Well, like Richard said there, there's so many recently, of course, the case of Robert Williams being arrested due to falsely being recognized by an AI. Horrible, horrible story on Portia Woodruff, who was eight months pregnant when that happened to her, jailed based on a false facial recognition. We've seen multiple cases in Richard and mine, home country of the Netherlands, with a Social Security system that went off whack and discriminated everybody from certain postal codes, which is called the Siri case. Nothing to do with the Apple Ciri. And of course we've seen other major incidents where it could actually, whether it was intentional or not intentional, lead to people killing suicide, people getting into heavy depressions, people getting into serious financial issues. So I understand the distinction. And on the other hand, the outcome of the output and the wrongfulness of that output can have major impacts, whether it was intentional or not.

Okay. Yeah. So in, in both of these cases, it's like it's causing mental health problems or financial problems or physical health problems. So lots of like pretty serious impacts. All right, so let's go into some, into detail on some of the specific issues around responsibility. So Esther, previously was the thing you mentioned was top of mind, so maybe we'll start with that. So it's something that a lot of executives worry about. How legitimate is this Fear around using AI is going to cause privacy issues. All right, Esther?

Yeah, well. Well, again, whether we're talking data breaches or leakages or whether we're talking about proxies, where you think you have your system all in shape to make sure that data in general is anonymized enough to make sure that you can't figure out who's who and what's people's backgrounds and that kind of stuff, just a combination of different elements of information can lead to you still figuring that out. That's what we call proxies. And so whether you look at the more technical side, so the data breaches and that kind of stuff, or whether you look more at the impact on the privacy side, I think, and Richard actually probably has taken a look at the 8000 example list, I haven't, but I think at least 50% of the issues concern privacy breaches or privacy issues. So it's a very real concern. Thank God. In Europe we have gdpr. In California, they have their own legislation to try to protect. But more and more different nations are considering either copying gdpr, which we call the Brussels effect nowadays, or we see nations drafting their own legislation in order to protect their citizens.

That's interesting that a lot of the data protection regulations are being reused for AI there. So I'm wondering, are all the issues the same with data protection and protection from AI, or are there some issues that are unique to AI? Richard, do you want to take this?

Yeah, Well, I actually would slightly disagree with this line of thinking. I think privacy is an issue in any digital system, regardless of whether it uses AI or not. So there can be a data breach in a system without any AI. And most of the data breaches are in such systems. And a lot of AI is happening with non personal data. So if you think about impactful AI, what they call predictive policing, that is just statistics about neighborhoods where there is a higher crime rate, so there is higher surveillance in that area based on statistical information, which is not personal data. And then people, because there's more surveillance, people get often more often detained and that increases the statistics. And then it's a loop. So there's a huge negative impact. But it has nothing to do with personal data. It's not about looking at one specific person, the attributes, and then predicting whether, as in Minority Report, this person is going to commit a crime. As you asked, there are specific things that have to do with privacy and AI. Now, if you look at facial recognition, that's biometric data, it's very sensitive data. And is specifically used in a use case for AI. But if you have just an inactive database with faces of people, there is no AI. But you have a privacy issue as well. I think it's important to not put them in the same concept. They're very much related. Because a lot of AI is on personal data. If you do recommendation, some of the recommendations are based on profiles. But not everything that AI is doing has to do with personal information. And there are other impacts. Like if you speak about potential discrimination based on data. That is not a privacy issue. There might also be a privacy issue related if you have personal data. But that's for a different reason than for the AI.

That's really interesting, the idea that it doesn't have to be personal data to have an impact on the people. Like as you say, it can just be slightly dubious. Interpretation of statistics can cause societal problems like in their predictive policing example. All right, so let's go back talking about regulations. I think that was pretty interesting. So Esther, you mentioned things like GDPR and there's the California New Equipment. I can never know what the acronym is, cae, something like that. So there's a lot of these new regulations coming out. Can you talk me through, like what are the most important regulations that people need to know about?

Yeah. So the California law is called ccpa, just for anyone who's interested in that. Yeah. So there we what what Richard described as a bit of the fear of missing out that companies have when it comes to AI. You also kind of tend to see that now when it comes to legislation. So a lot of different nations, different regions are trying to draft different frameworks. Of course, the most well known one is the European AI act, which hopefully, I think the voting is now scheduled for 13 March. It was pulled up a month. And that's of course going to be another major breakthrough when it comes to having some sort of a framework. However, there's a lot of criticism also regarding this specific act. In the us, of course, we saw the Executive Order pretty recently there was an AI Bill of Rights initiative. And in China already a lot of legislation has been implemented. The uk, the Bleachly Accord or Declaration, I think it was called. So we have all these different initiatives, if I may call them, to get somewhat of a legislation specifically for AI. Whereas of course gdpr, DSA already exist in Europe and also in other nations, there's also already a lot of legislation that is in place specifically on technology and data and privacy. But moreover, when it comes to discussions around the impact of AI on the workforce are on health care. Existing laws on health care and social laws do still apply. So it's not like, oh, just because it's an AI, we use an AI for something, all of a sudden we don't have to consider workforce laws or anything. So yeah, there's a lot of initiatives specifically for AI regulation and on the other hand on technology, but more specifically, existing labor loss already applies.

So yeah, okay, Just to expand this, it seems like there's lots and lots of different laws. And I like the point that existing laws still count. So if you're looking at medical data, it's like it's AI laws plus the hippo stuff as well. Not instead of. But because there's so many different laws around. Particularly if you're a global business and you're dealing different jurisdictions, different countries. How do you navigate all these? Like, where do you begin in terms of trying to deal with all these different regulations?

Well, for instance, you mentioned hipaa. HIPAA is an American law. It's specifically on healthcare. And so you first take a look at what kind of company are we dealing with, what is their jurisdiction? Then you look at the sector that they're active in. Then you have to look at do any laws outside of my jurisdiction also for some reason apply? Because if you look, for instance at the proposal for the European AI act, it doesn't not just apply to companies with a European headquarter, for instance. So you really have to double check all of this. This is why we're under scrutiny. Sounds very negative, but. No, but that's why we have a constant system of permanent education. Most of all of are CIPP certified or certified in any other matter. And you, you're, you're constantly studying. Like to be honest, my, my day starts at 4am with two hours of studying first to make sure that I'm up to speed with all the liberty literature that came in in the last 24 hours. So that, that's, that's, that's what we're dealing with right now. And I love it. I went to law school for a reason. I can really put my teeth into this stuff, but it is a lot and it's hard to keep up for anyone else. So that's what we're trying to do every day is make sure that the people that we work for don't have to do what we do, but that we give very concise answers to the questions that they have on how this affects their business.

Okay, Two hours of studying every morning. That's, that's Very dedicated. I like that. Yeah. Some of our Data Camp users need to do that as well. Two hours of Data Camp every day, but yeah. Okay, I like that. So think about the sector. Think about, like, which things are applicable and then.

Yeah.

It's just. The lawyers have to figure it out.

Yeah. It's not just jurisdiction. You know, when you're a lawyer, you always, you know, you're trained to think within your jurisdiction, but it's way wider than that and way broader than that. That. So, yeah, yeah.

Let me say something about global things. Yeah. Because. Yeah. Telefonica is a global country. A company is in Europe, is in South America, and of course, it doesn't make sense to do AI locally. Yeah. Where everybody has to find out how do I comply with my regulation. And. And we. It's the same with privacy. We have a global privacy. Yeah. And in some. And. And it complies with all the jurisdictions, and usually it complies with the most. The most strict ones so that you comply automatically with the rest. Yeah. But of course, then you have a global policy, and then there may be some tweaks depending on local regulations in the country. We've done the same with the. Our internal regulation for AI, which we approved in December last year, two years ahead of the AI act, including all the aspects of the iac, but also including more things. Yeah. Because we are operating also outside Europe. So I think the best way is to have a kind of reference model from headquarters and then you roll it out in a flexible way, but in a sensible way. Not inventing the wheel all the time, having one tool that registers all the AI systems that. Where people evaluate the AI systems in one system. So there's one registry of all the systems. For instance, we have over 600 systems working every day in AI across the globe. So it's not something you have, not one or two or 10. So it's a huge amount of systems. Some systems are from. Are already 10 years old. They're simply machine learning, decision trees, random forest, et cetera. But still it's analyzing data, it's generating and learning patterns, and it's then recommending things or taking decisions on the fly, depending on the impact it has. So companies have to adapt to that. I think there was one regulation that is also, I think, very well known, even though it's very local, is The New York, New York Local Act 140, which is about AI in the labor, in the workspace. It's about hiring and firing and promoting and demoting. And I think that's one of this. This is also under the ua, under the AI act of Europe is also there as a high risk case, but here it's already enforced since the beginning of these years. Now, I just read three days ago, actually came from New York, I'm on London now on a trip from New York back home to Spain, where I'm an ethics advisor on an HR startup. So they're very interested in using AI for in this, in this field. But there is this regulation and there was this, let's say the local regulator was at this event at the conference and he also said, yeah, this is high risk. We want equal rights for everybody. We cannot discriminate. So there needs to be audits every year on the data. If you use this for hiring, and this is an external data, but then also in the press appear that only 18 companies from the hundreds of companies that could do it have done it. So enforcing is not only coming up with regulation, but also enforcing the regulation in the right way. And I think this is all a journey where we are all on as companies and organizations. And that's also when always the discussion comes up about hindering innovation or not. I personally have an opinion on that, but maybe we speak about it later as well.

Okay, sure. Yeah. So I think my takeaway from what you just said, there is probably better to do this right before you get audited rather than the auditor comes knocking on your door saying, what have you been doing with this? All right, so I'd like to talk a bit about what goes wrong when AI makes bad predictions. It's not going to get the answer right all the time. So I think, yeah, some of the most common issues are like, well, something goes wrong and then there's a bad consequence. So can you talk me through when you need to care about the accuracy of predictions and maybe when it doesn't matter as much. All right, Richard, do you want to go first this time?

I think you make a very important point, and that is artificial intelligence are never 100%. So people think, okay, we can automate everything and we solve all problems, but there are always mistakes. And those can be generally false positives or false negatives. So if you're hiring a false positive, you hire somebody who you shouldn't. And the false negative is you don't hire somebody you should have hired. Now that happens, of course, in real life all the time. People make so recruiters all the time have false positives and false negatives. But I also has it now whether that's a problem or not, Depends a lot on the use case. So it's not the same if I want to predict churn what customers are leaving me. If I'm good at 80%, I'm very good because, well, I have a mistake with 20% but. So I tried to retain them while they were not leaving. Well, that's not a problem because I have made contact with them or well, they left anyway and I didn't touch them. Well, I mean, it's part of the business. You have improved. But if you go to facial recognition or if you go to medical diagnosis, then you have to be in the 90s. So it depends. And if you, if you have an ad on the website in a banner, who cares if it is? If it's wrong, maybe 40% is good enough. That's why we're flooded with so much email, because you think, well, it's not 100%, it's maybe 40% but still it's better than nothing. So it generates revenue. And if you recommend a movie, well, it's also, it's not so big deal. Yeah. So the use case is very important and the application, if you decide what accuracy is important or not, so you cannot say it's not accurate enough. It always depends on the, on the type of use. And then it's very important if you understand what the error is and what is the error rate that you can accept for a certain case that you still make an assessment of if it still goes wrong. In a high level use case like medical diagnosis, have 90.99% still 1%, if I apply it on 3 million people is still a lot of people. So what is the impact on their human rights? What's the impact on their health? And many organizations don't make that. They don't make that thinking. They think, okay, it's very good, it's 99%, but if you don't think about the 1% and something goes wrong, it can have a huge impact on everything, on the person first or even on climate, on property, on reputation. Can be a big scandal on your stock market. So therefore it's important to think in advance. And we call it by design before you launch. Because if you can, if you find it out in advance, you actually can prevent it or mitigate it. And it's much cheaper than mitigated once you are in the market and it has gone run.

That's really interesting. I like the idea that the consequences of getting a bad movie recommendation are very different from something where it involves, for example, people losing a job or something.

With big finances. And then there's one more very important thing. Even if a machine makes a mistake, and actually the mistake is very tough, maybe it's still better than people. Maybe people make still more mistakes in medical diagnosis with all the same kind of consequences. So we tend to require much more from a machine than we require from ourselves. But it's always important to keep in mind, what's the baseline? Are we improving on that? Yes or no? And then you still have to have the social and the ethical questions.

Okay, so this sort of leads me to another thought, that you need some way of categorizing what the risks are going to be like. Is this a low risk institution? Is this high risk? Esther, do you have any advice on how managers might think about categorizing different risks here?

Yeah. So basically we use three large tools and we have different varieties for that, but we have a risk assessment. We have specifically an impact assessment, which is different than just risks because impact also looks at what's. What happens next. And then more specifically, we have a reputational impact assessment.

So just want to clarify the difference between risk and impact there just for everyone in the audience who.

Yeah, so risk is basically what can be the negative outcome of my deployment of an AI. That's basically it. Impact can also be very positive. Like Richard just said, you know, even though it might not be very accurate, it might still be more accurate than human beings. There's all kind of different varieties where you don't want to just assess the negative risks, but also the positive risks. Since we deal with governmental and political stakeholders on a daily basis, we also need to know the positive impact of different AIs. Maybe we found a solution for a societal problem or our clients. This did. And that gives us the opportunity to reach out to external stakeholders and discuss this positive impact. So risk is negative. Impact can be both positive and negative. And Richard also already tapped into that. The most important thing is, of course, in the end, how does this affect my business when it comes to my brand and my name and my reputation? And specifically for that, you want to do a reputational assessment. So there's also, you know, in Denmark, they've designed a really beautiful human rights impact assessment, hera, which does really amazing work when it comes to assessing the impact on a human rights level. There's multiple impact assessments out there, but these are predominantly the ones that we use.

Okay, so it seems like there are some frameworks in place then. So you're not going to have to invent stuff from scratch for your company. It's like, okay, take one of these standard assessment tools, run it through your use case and hopefully that's going to give you some guidance on.

Yeah.

The most well known one is of course drawn by nist. It's a risk assessment framework from an American institution that most people in this call will know, but the Danish RIA one is very interesting, but not as known. So again, it's important to make sure that you educate yourself on what's already out there, because it's really a waste nowadays to build your own frameworks or guidelines or assessments from scratch. There's so much out there. And just for what Telefonica did, if I listen to Richard on their policies, they really just choose what was best for their organization and closest to their DNA in order to make sure that they were on track on this.

Okay, yeah. So, Richard, do you want to tell us a bit more about how you've made use of these sort of assessments at Telefonica or otherwise?

Yeah, so we basically have, we actually experimented with a lot of ways of assessing risks and we, we run it through the businesses many different times. We had huge amount of interviews because this is all about questionnaires. Yeah, Asking questions and asking different questions than usually is asked about, about the business. But one thing that came out, and I think that's also in the background of what is, for instance, called high risk in the European Commissions and proposal. So it's about impact and probability. If you speak about risk and we, we split it even out, so we speak first about severity. So if something goes wrong, how severe is it? Again, it's not the same if you recommend the wrong mobile device versus the medical diagnosis or accepting a customer for a loan. So they have different severity. And basically this severity appeals to human rights. It's not about something else, it's all about human rights. It's not having equal opportunities, not being discriminated, being left with dignity, et cetera. The second one is scale. You can have a use case that applies to a certain target group of 500 people. Well, it's not the same if you use Instagram, which is 5 billion people. So scale is very important in assessing risk. The larger the scale, of course, low severity as a very high scale might still be very risky. And the last one is probability. Now, probability is a very broad concept, but if you take it a bit in a tactical way, if your accuracy is 80%, then you have a probability of 20% that something might go wrong. Now, there are more aspects in probability because sometimes simply the fact of Doing something is already a very high probability that going something wrong. For instance, in the case of Siri, this Dutch system, I mean, it's just an overkill of what they wanted to do, whether it was correct or not. And there are more examples of that. But so those are three things, ways of thinking. If you have to say, oh, is this a risky application? And if you can't find it in a list of the European Union or you can't find it in the list of NIST or then you can think about those things. Yeah, those categories because they're very general and of course people disagree, agree on scale, they disagree on severity. But still. Yeah, sometimes it's more important the think process and the process itself than the, than the outcome. And it's very important that you take decisions in an explicit way. So we've estimated the risk, we think it is this and we document it now, if later something goes wrong, at least you have a trace, that you thought about it thoughtfully, that you documented it, you had a discussion and it took a decision, can still be wrong or can be right. And then what we do is also all the, the AI principles that are out there.

Yeah.

And there are many, there's oecd, there's UNESCO, there's NIST there as well. They all come down to the same things. Yeah, there are some tweaks and differences, but they are not so very different. So then what you can do, you can check whether your application is, has an impact on this risk if things are not, not treated in the right way. Yeah. And the tricky thing is how are you asking those things to your business users in such a way that they are able to answer that? But we've experimented a lot with it and now we've come to a conclusion that the businesses need to register this AI systems according to some objective criteria. So what's the purpose? What kind of AI technology is it used? Is it generative AI, is it machine learning, deep learning, rule based systems, whatever? Then what kind of data does it use? Is it text, is it structured data, is it audio, is it, does it have personal data? Or yes or no, does it have sensitive data? So these are objective things that people can do. Yeah. And then we have experts that take into account all these aspects. Okay, now what is the risk factor of this application? And then you have to select several things which are related to human rights with ethical AI principles. And if there is a risk that generates requirements, you have to do something. For instance, if you have sensitive variables, take them out. If you take them out, see if there are proxy variables, take them out and then use them again so that risk create requirements and requirements need to be implemented and if they are implemented and validated, then you can launch. So that's, that's the process. And if you do that by design from the beginning, then it's not such a horrible, horrible burden to do it. And actually it makes people think in a new way about business, about a more responsible way. And what you create is a culture of responsible innovation rather than innovation as fast as you can. Okay.

I like the idea of just having, write down the facts about it, like what type of AI using, what are you using for? And then you've got, at least everyone's going to agree on the facts before you start getting into opinions on things. The other idea about breaking things down into scale and severity and probability seems quite useful because it's like how bad is it? How many people does it affect? What's the chance of something going wrong? That seems like a fairly simple thing that a lot of people could get their head around. All right, so I'd like to talk a bit about discrimination and both of you talked about something called the Siri case. So I think you, you said this was about discrimination. So maybe we'll, we'll do a little case study, we'll go through like what is this thing and what was the discrimination and how it have been mitigated. So Esther, do you want to start like just talking about like the background of what went wrong here?

Yeah. So it's, it's spelled S Y R I so not S I R I in case anyone wants to Google this. And basically it's about the Social Security system that they have in the Netherlands and how they were going to assess whether people met the criteria for, for getting some form of Social Security. And the system basically, and I'm summarizing it quickly, but the system basically targeted, so gave, gave a negative on people with certain incomes, certain postal codes, certain educational backgrounds. So that was something that went to the Dutch courts and of course the government was forced to pull the plug on this. And you know, we've seen multiple cases where courts understand and try to protect. But for instance, the Apple Goldman Sachs bank card case, I don't know if you remember that one, but women weren't provided Apple Goldman Sachs cards at the same rate as men. They're actually, the New York court said ruled. We don't see the bias here of course, thanks to the reputational damage it did to Apple. It pulled the plug by, on their Own card. But so Siri is a horrible example of where a lot of information based on historical data is misinterpreted. Basically it's the same thing as if a university that had an 80% professor rate being male, starts recruiting using historical data of the university on what the best professors were, what their profiles were, who were most successful, who were not. If you use that data to recruit a new professor, of course you will end up with a male professor. So it's the same thing. For instance, now in LLMs we see that if you put in your resume and a job description and ask it to fit the LLM will be able to determine whether you're a man or a woman based on your resume, and then will write a female motivation letter or a male motivation letter, which leads to using very different, what we call soft terminology for the women, hard terminology for the men. And then on the other hand, you have the AI of the company, the HR department, interpreting that motivation letter and picking up on those soft words and their AI again saying, we don't want someone with the soft skills, we want someone that has those hard skills. And so then you come into to this vicious loop, whether you explicitly mention what your sex is or not.

That's interesting that like, certainly once you bring AI into it, it's kind of exacerbating the. Because it's an intermediary in between two humans, it's exacerbating some of the issues there. All right, so going back to the Siri idea, was there anything that could have been done earlier on, do you think, to mitigate this? Like what point should the problem have been noticed? Richard, do you want to.

Well, the Siri case was a huge case because it actually, I understand it caused a fall of the Dutch, of the Dutch government and it still not solved the problem. Yeah, and of course the system was part of a much bigger thing. But so one of the reasons they forbid it because it was completely black box, nobody understood how it worked, there was definitely no consent. But very important, the purpose is very legitimate. It's against fraud. And for fraud reasons you can access a lot of information. Even companies can do that for fraud reasons, financial companies, whatever, they can cross all kinds of data. So it's very legitimate. And I sometimes give a course on ethics and AI and I bring up this case and I just explained what happens. It's a lot of data that is combined and they want to find source of fraud. And then the fact is this a good purpose. And most people say yes, why not? Now then, if it turns out that it was also very stigmatizing because I also understood it took basically people with double nationalities, Dutch and East European. And that is a very stigmatizing thing that can then live its own life. And also is very important, the importance of this. As soon as you are on the list of fraud candidate, then your social service is stopped. And as a result of this, hundreds of families have had their kids taken away because they couldn't take care of them. So this was for bringing children to. How do you say that? Play Garden Kindergarten. And that's about €1200amonth in the Netherlands. So it's very expensive. And so there is a subsidy for that. And this was finding fraud in the subsidies. So there were hundreds of people of thousands of families who have been completely ripped apart. And of course, how can you do, how can you repair the damage? It's impossible. Even not with a huge amount of money. And they're still in the afternoon. In the aftermath of solving this problem, it's still unsolved. So how could they have avoided this? Well, if they had thought how. What is the accuracy of the system? How important is it to have a false positive? Because this is all about false positive. A false negative is something you have missed. They're still doing fraud, but you didn't spot it. Now that is bad for government, but it's not bad for people. A false positive is very, is very serious here. So maybe they should have optimized on minimizing false positive and allowing some false negatives instead of trying to get all the false negatives down at the risk of having a lot of people who actually didn't commit fraud, but were accused of fraud. So. And in the end this has nothing to do with technology, this has nothing to do with AI. Even if a normal person, a normal process, you have the same things. And it's about making an estimation of the impact of human rights. If you take decisions that are impactful, if you do it automatically, of course the scale is much bigger. And here, even if there were many statements made by civil servants and we cannot do this, this is not fair, this is not ethic. The system continued. They'd never stopped it.

Okay, yeah. So a couple of interesting things there, I think. Yeah, maybe for anyone who doesn't realize there's going to be a trade off between the false finding false negatives accurately. So this is going to be people who have committed fraud, which where it is. Yeah, people who have committed fraud. But you don't detect in the false positives when people didn't commit fraud, but. But you accused them of it anyway, so, yeah, there's always gonna be a trade off there. All right, so it seems like we should talk a little bit about. Oh, well, how long we've got left. We've got about 10 minutes talking time left for anyone in the audience. If you do have questions for Esther or Richard, please do ask them in the chat. Before we get to that, I think we should talk a little bit about some of the processes and sort of procedures within organizations to help around this. So I'm curious as to who needs to be involved in this, like which members of the C suite or which other managers or other members of staff need to be involved in responsible AI. Esther, do you want to go first?

Well, basically everybody, because if I look at every organization right now is everybody's trying to use large language models and other generative AIs to make themselves more productive. So first of all, it's very important that leadership gives out guidelines on how to use these models in the best way for the particular organization. If we look at the examples of, for instance, Samsung, where highly sensitive business information was put into one of these generative AIs, and then, you know, the implications of that were humongous. That's the kind of thing you want to make sure that you don't make these mistakes anymore. So you want to make sure that for everyone within the organization, it's clear how they can and can't use AI. This is a leadership thing, first of all. So that means top down, but it's also bottom up. Because first of all, a lot of organizations don't understand how many of their people are already using this. It's not just marketing that's using midjourney to get some nice pictures out without using Getty or something else, any other stock image. It's multiple departments, multiple businesses within an organization already using it. Also what we used to see is that this was either a CTO thing or CIO thing, depending on what you would call it. The DPO was responsible and then you had legal and compliance that had to have a say on this. But nowadays HR needs to know, you know, how we can use it, how we could use it, how we shouldn't use it. But that basically counts for procurement, corporate affairs, communications, anything. So every business unit needs to understand what is allowed, what is expected. And the focus within a lot of companies right now is to focus on the risks. But the opportunities for a business are. There's a myriad of opportunities for any company right now. So if you make sure that you train everybody in the organization to understand these new technologies. They can not only make sure that you don't go into the world of reputational risks, but also make sure that they help think about how to make your people more productive, to streamline your processes, look at the structures that you already have. So it's a combined effort, in my opinion, that should be both top down and bottom up and should include everybody. We talked about biases and all these processes that you have to have in place. The more diverse the input is on, you know, developing and deploying an AI within an organization. And I'm talking diversity when it comes to different business units, but also different backgrounds of people. The more diverse the input is on the plans and ideas that you have for developing and deploying an AI, the better the AI will be and the least reputational risks you will have. So my idea is not just to have an ethical board, not just have a couple of policies in place, but really make this something part of the entire organization now. But Richard wrote a whole book on this, so. And he introduced champions and squats, and I don't know what. So maybe, maybe you can give some good examples from Telefonica. But, you know, yes, I would absolutely.

Like to hear more about the how. How this worked at Telefonica, but I do like the idea that everyone in the organization needs to have some kind of understanding of AI ethics and responsibility before you actually start developing these things. All right, Richard. Yeah, take it away. Let's hear about how you did this at Telefonica.

So we started with defining our AI principles. So it should be fair, transparent, explainable when the application requires it. Privacy, security, human rights, etc. In order to make the wording of each of these principles, we involved, I think, 10 different areas. Of course, it's very difficult to involve the whole company, but you have to involve some key areas. Like, we involve procurement, we involve partnerships, esg, privacy, security, AI, engineering, business, many business areas. And we came to a kind of consensus rather quickly. I must say, it only took us a few months. And then when you land that in the organization, then you need this government model, you need training. And we build a course where thousands of employees have done the course on AI ethics.

We.

But then in order to scale, you have to leave the responsibility of being ethical with AI in the business. Yeah. Otherwise you can't have a police running around checking everything all the time. So it is the business that has to register the system. They have to discuss what we have. This Role a responsible AI champion. It's like a data process protection officer for privacy. This is for ethical AI. So it's to go, go to person in the business unit that is knowledgeable about ethically, I think so they have to register the system. If they have doubts on how to do that, they can talk to this person. And then there is a group of experts that evaluates the risk. If there is a, if there is an issue, it's escalated to an AI ethics committee. Yeah, it's not a permission based committee. You don't ask permission to do something, but if you have a problem and if a problem is detected or there is too high risk detected, then it goes there. And then there's debate on the ethical impact of this. And it's an only an ethical debate. There is no business argument whatsoever involved. We explored with that. But if you bring them together, it becomes a very awkward discussion. You need to have a pure discussion on ethics. And then if there is a disagreement still you elevate it up to an ad hoc, a senior manager committee where they have to take a decision and document, document the decision. So it's a combination of central and distribution and that makes it workable where you have some certain processes in place that are followed. But on the other hand, it's so distributed that it's a relative little effort for everybody because otherwise it's going to be a huge amount of work.

It just seemed like it's quite important to have people who are close to actually the problem they're trying to solve to be able to be involved in discussing this stuff. And I thought it was very interesting you saying like you need to keep the ethical stuff separate from the business stuff a bit, otherwise this get confusing. Okay. All right, we are, we're about to run over time. So with that I'm gonna stop asking you questions. We've got several questions from the audience. Audience, it's been so fascinating. I just want to carry on chatting for another hour, but we can't do that. Okay, so before we get to audience questions, I just need to let everyone know about the upcoming event. So next week we've got two sessions on working with Azure. So if you're interested in cloud computing, then please do come along. To those that's Tuesday, Wednesday, then Thursday got a session on getting return on investment from your data literacy program. So I think that also works with AI literacy as well. If you want to teach everyone about data or AI in your organization, you're gonna have to work out how to get some return on your investment there. So please do sign up for that. There is a QR code in the top left in order to sign up for future webinars. All right, with that, thank you for answering all my questions. But we're gonna do some audience questions now. So this first question comes from one. So one asks, if AI violates a security or privacy policy or laws, who is going to be responsible for the investigation? Who will be acquitted? I'm not sure whether they're actually going to get acquitted if they've broken some laws, but is it going to be the developer who gets accused of the problem or has to do with it, or is it going to be the. The company they work for?

Sounds like a legal question.

Yeah. Esther, do you want to take this one then?

Yeah. Well, it depends. And. And that's a horrible question, a horrible answer, but it seriously does. First of all, you can't ever say that's just a simple rule, and it's not set in stone. It was not thought of by the Romans like most of our legislation is based on. But you can't say the AI did wasn't me. So let's get that out of the way. First of all, the responsibility for using AI can never be shifted to the AI. There's been different court cases recently, and in every court ruling that was like the first rule that was set in the ruling, you can't just say it wasn't me. I don't know if you remember the Mata Avianca case, where basically the, the. The plea by Avianca lawyers was Written by. By ChatGPT and all the, the. The. The jurisprudence used was made up by a large language model. We have examples, of course, from Canadian Air on the Chatbot, which was recently ruled that Canadian Air can say, hey, it wasn't us, it was Chatbot. Well, also in that particular case, the court was very clear. When you use an AI, you're responsible for that AI. Then when it comes to the layer underneath it besides the organization, who within an organization. Organization is responsible? That, of course, depends on a lot of things. When you're on a board, you have way more different responsibilities and accountabilities and therefore different liabilities than when you're just an employee of an organization. So it depends. But the main rule is don't hide behind the AI it's not going to work.

That sounds like good vibes.

Yeah.

So I think the Air Canada thing, they Chatbot made up some fake insurance policy or something and the company had to own it.

You mean in the Canadian Air case. Yeah, yeah, yeah. So it was about the general terms and conditions about the refundability of tickets. And the chatbot answered incorrectly. And based on that, this particular person made a choice to go for a non refundable option. And in the end it wasn't a lot of money that had to be paid back by Canadian heir to this particular person. But the court case dragged for quite some time and it was just, it was a great example of what we've seen for centuries now in law is that these things set precedents. So people really, really, really, really want to make sure that they win this particular court case. Not so much because they don't want to pay this guy, they don't want to refund his. I think it was something like 1500 bucks. It was ridiculous. But they were so scared of this setting a precedent if they would not go to court. So that's, that's, that's the mechanic, the mechanism that you see here in place, like make sure that we don't have court rulings that actually make clear what people's rights are and not when using an AI kind of backfired, gave a lot of reputational damage. Also in the Avianca case.

Yeah. So in this case, using generative AI chatbots where they hallucinate, this could be a big problem. So there's a data frame podcast episode on this coming out very soon. Excellent. All right, so next question comes from Elizaveta saying how can I assess the impact on the audience in. Oh, I think it's for users like what happens to your customers in a B2C business if we implement AI? It's a pretty broad question. Just want to go over the keys of like the impact frameworks again. Maybe.

Yeah, I think if you have in, in a certain sector, B2C, if you use AI, think about who are the stakeholders, who, what's the target audience? Aren't you leaving anybody out? Who, who you should be there and think about things if the system doesn't work. Right. So what's the impact? Yeah, if it's the chatbot, of course it's not so much about false positives or false negatives, but it's about saying things that can harm people. And I think if we speak about responsible AI, there is a difference between a negative impact for business. What we just heard about the chatbot of the Canadian is a business impact, but that's not so much about human rights. So if you have chatbot doesn't work well and you lose business, that's not responsible AI thing as A business thing. Normal as always.

Yeah.

We speak here about if it has an impact on human rights, then it has an ethical impact. So make sure that if you are interested in that, that you. That you do not mix up business analysis analysis with ethical analysis analysis.

Okay? Yeah, so it's maybe a gray area. If, like you're annoying your customers or doing something bad to them, then it's kind of a bad impact, Bad business impact and a bad ethical impact. All right, we're going to run over just a couple of minutes. There's two questions asked from the audience which are pretty interesting. So hopefully we can get through those quickly. If you do have to jump, then please do check out the recording later on. Got to register and then it will be emailed to you. Okay, so another one from Elizaveta saying what resources do you have about like updates, changes, where do you find your information? Esther, you say you're reading two hours every day. So have you got some good links you can tell us about?

Yeah, sure. So first of all, I'm with iapp. IAPP is the organization that gives out the ISO certifications for privacy professionals and per April, also for a governance professionals, they have a very elaborate data bank and so that helps a lot. Oliver Patel is an instructor there. And for the people that don't know Oliver yet, He works at AstraZeneca, which is a pharmaceutical company, but actually has the best cheat sheets in the world. So if you want to know, uk, China, Gulf countries, whatever, he has a cheat sheet on that. It's on LinkedIn. He makes everything available for everybody. We have the center of Artificial Artificial Intelligence and Digital Policy, say CI poo, C I D, So it's spelled C A I D P. And just, just Follow them on LinkedIn if you want to really be constantly updated about European AI Act. And of course the 13th of March is very close, but if you want to understand also the trajectory that we've seen so far and what is good about the ACT and what is missing, that kind of stuff. Kai Zinner, sorry, has a whole website on this. He's the assistant to one of the MPs in the European Parliament. But he's everywhere. So there's a lot of stuff out there. Richard already mentioned UNESCO, un I love the Ellen Turing workshops that are available. And LinkedIn just released three free online courses and not just one or two, but 250. So those are really nice. But the best quality, of course is when you do a data camp.

Very good, yes, Data ethics course. Come here to Data Camp.

Do those. Brilliant.

Nice. Thank you for the plug for Data Camp there, Richard. Have you got any resources or links you want to tell people about?

I think if you are interested about what can go Wrong, study the OECD incidents. Monitor 8,000, and it's automatically updated every day. So what we discussed here, it's all there and much more. And instead of taking your information from headlines in the newspapers, here you can see what. What really is the problem. Yeah. So these are 8,000 incidents from 2013, of course, is. In the beginning, it was very little. Now there is a lot, most of it in the last two years, but 8,000 is not so much. If you. If you look at how many mass shootings are in the US every year, it's about 600. So it is. It is a lot of incidents, but it's neither catastrophic that everything is disappearing, but it gives you a lot of insights in what is really going on.

8,000 things go wrong. That's a lot of fun. Well, not fun. Maybe that's not the right word, but a lot of, like, things to give you some advice.

Okay.

All right. With that, I think we're well past time now, so we're gonna call it a day. Thank you, Esther. Thank you, Richard. So much insight there. That's really informative. Brilliant. Thank you very much for coming along and chatting with me.

Okay.

It's a pleasure.

Excellent. Thank you, Reese, for moderating. Thank you to everyone asked a question. Thank you to everyone who showed up today. If you have not registered for the radar conference on March 25, first please do so now. QR code in the top left. That's your next task for today, if you haven't done it already. I hope to see you again in future webinars. I hope to see you at the conference. All right, see you all again.