MSP Dumpster Fire Season 1 Episode 7 - AI for MSPs: Friend or Foe?

Welcome to the MSP Dumpster Fire series. This is season 1, the impact AI will have on your MSP. Welcome back, everybody, to episode 7 of the MSP Dumpster Fire series. The impact that AI will have on your MSP. I'm joined once again by my dear friend and colleague Alex Farling. And today we'll be talking about AI concerns over privacy, confidentiality, risk, and FUD factors, things like that. So, Alex.

Rob, great to see you again, man. I'm super excited for this episode. And we've got a special guest going to join you for an interview in a little bit, right?

That's right. Mark Kirkstein is going to be joining me a little later. I'll be asking him some specific questions and hope to get a little bit deeper insights than, you know, from an industry expert who is living and breathing this stuff on a day-to-day basis.

It's cool to see Mark kind of taking a, taking an industry-leading approach, right? He's dove all the way into this. He's going to make sure that MSPs understand what policy around this ought to be. What the best ways are to treat this. And he's actually building a business around it. So it'll be great to hear his take.

That's totally fantastic. I mean, I just love, you know, some of these positive impacts that it's making on people's lives here, right? Creating new industries. Part of a little, little side presentation I did for my clients on AI, as I open up with, you know, the fear of AI, you destroying jobs or taking things away. And, you know, I cite the auto industry, like what did that do to the wagon business or the buggy whip business, right? And it, you know, look at everything that the auto industry has created, just the entire ecosystem, not just the manufacturer of automobiles. So it's nice to see how somebody like Mark has seized an opportunity and is building a practice around this.

And I think, you know, at least for those of us who are awake and paying attention, we understand that this isn't going to gut an industry. It's not going to destroy an industry, but it will change an industry, right? There will be different jobs. For a lot of folks, different impacts for a lot of folks.

Yeah, and we've touched on that a little bit in a prior episode, especially around prompting, prompt engineers, or prompting skills, uh, that being one of them. So sure, I mean, you know, this is what we're seeing, and I think now we're seeing a different one, right? Somebody who's, um, acting as either a sherpa or a guru around AI and helping MSPs with privacy, confidentiality, and, uh, all the— maybe I'll say the legal or compliance side of AI.

Yeah, the policy and procedure side, right? Those should be 4-letter words somehow. They're not, but my goodness, they should be.

Yeah.

And look at my AI's misbehaving as my Apple's giving me a thumbs down when my hands are folded here. So you can't take this AI anywhere.

No, you can't take it anywhere. It's going to rear its ugly head.

And yet we're going to take it everywhere.

Yeah. So let's jump in. Quite literally.

Oh, what were you saying?

I was going to say it literally has a mind of its own.

Oh, we need a sound effect there. Yeah, when we have sponsors, we'll have sound effects.

Okay.

All right, let's dive in though. You know, we've kind of figured out that AI is in all of our tools. It's just showing up everywhere, right? I opened LinkedIn the other day and there's talk of a beta AI on LinkedIn. It's in Canva, it's in Microsoft, it's in Google. It's on our, it's on our desktop in 47 places already. So we have to accept that it's here. There's no blocking it, locking it out, pretending like it doesn't exist. Um, the fact that it's already everywhere, how do we deal with it? How do we have that conversation with our teams? What do we need to worry about as far as making sure we're protected? Like, that's kind of what we want to get into in this episode, right?

Yeah, you know, that was a concern of mine in 2023. Somewhere in the middle of the year, somewhere around late summer, I came to this realization and it— and I shouldn't say I came to it on my own. It was really inspired by a conversation I heard at a conference where somebody was talking about privacy and confidentiality of AI. And that's when it didn't dawn on me until then that we've got to be ultra careful about how we're using these tools. And what I discovered in my learning process, which— or my learning journey, which I have talked about on, on this series in a few different places, is that I discovered there's a vocabulary or an understanding of AI, I think, that we all need in order to be able to navigate this safely. Right. And I think one of the first things that was surprising to me. Maybe, maybe in 2024, maybe a lot more people know or understand the difference between open and closed AI. But that was one of the first things that it dawned on me, like, wow, like, there's a big difference here. And I need to understand when I'm using a product, whether this is open or closed AI and what the implications of that are as a user.

So let's go back and define those terms because I've heard them enough times having these conversations with you, but I'm not sure everyone our audience really understands the difference. So let's unpack open versus closed real quick. I think we've talked about this before, but let's, let's dive in one more time.

Yeah. So I think it's always worthwhile to rinse and repeat on subjects, especially if you think you know it. But I'll try to be brief here and give a high-level summary. Essentially, an OpenAI system is going to use any of the prompts or data that you feed it and consume that information as part of its learning dataset, right? So it's going to learn from the information that you feed into it and put that in its database so that when other users come along, they may potentially be exposed to the same outputs or the inputs that you've provided it as well as the outputs. So why is that important, right? If you're an attorney, the last thing I would want to do is upload a legal briefing or anything that contains client data up into an OpenAI system because OpenAI may cite that case or that briefing or whatever those documents are in a response to somebody else in a later query to that OpenAI system, right? So the beauty of the OpenAI though is, so it's not all dark because an OpenAI system can, or widely, more widely considered to be better simply because it's a collaborative worldwide endeavor, meaning if more and more people use it, then the more it learns and the faster it learns, right? So that's the pro and con of using an open AI system.

So as we kind of flip on that, closed is exactly the opposite, right? This is a system that doesn't learn from the general public, right?

It is, right? So if you look at something like Microsoft Copilot, And if you're a Microsoft 365 subscriber and you're using Copilot, the queries that you put into that stay within your organization, right? So now if I'm an attorney doing the same thing and I still might be a little hesitant to do this, so please don't take this as an endorsement to load client data into any AI. I mean, I'm a bit cautious about doing that in any system.

Yeah, well, any system could, could be breached, right? And then all the data that you've loaded into it.

Of course, right? I mean, I'm paranoid enough about putting it in the databases that, you know, we really need to use. You know, that alone is a risk. Now to put it in some other place where it's not super visible or controllable. But the theory holds that a closed architecture or a closed AI system keeps all the inputs and all the outputs within that system. Alex, you cited actually a pretty interesting case earlier about a school Uh, what was the product?

Uh, Nectar, Nectar, N-E-C-T-I-R.io, if anybody wants to go check it out. But, uh, they're doing something really cool. And as we're building Empath, you know, we're paying attention to more and more education platforms. So, um, Nectar bubbled up on a podcast that I listened to, and what they're doing is putting chat in a classroom. So imagine these big lecture hall classrooms that have 300 students in them and a, and a, you know, a lecturer, um, and how daunting that would be for some students to raise their hand and ask a question. And the goal of this product is to say, well, now you can ask the classroom a question, the community a question in chat, and maybe a TA answers it. You know, a teacher's assistant can answer the question without it having to be public in, in the, in the, in the room. Maybe the rest of the community answers it. But one of the features that they've rolled out just in the last month or so since I first heard about them, uh, was the ability for them, for the teacher to load lesson materials into a super closed AI, an AI that has no learning beyond just the materials that were dragged into it. And now it can answer those questions. So every AI probably knows, or we would think that every AI knows what color the sky is, right? It's just basic learning material. An AI should know that. But this course, this AI, if you're in a humanities course, it's not even going to be able to answer for you what color is the sky. It's not going to be able to answer for you what color is grass., it's going to say that's not in the learning material that I was presented, but it can very reliably and without some of the, you know, some of the fog of, of AI here, not misrepresent data because it's only trained on a really, really finite amount of data. And that's kind of the goal there. It's the second place I've seen this methodology used in closed AI. If you go look at what Google's doing with their NotebookLM product, it's very similar. You can take your own documents, drag them into NotebookLM and they stay right there. And you can query an AI that only knows about the things that you put in the box. And I think it's just a really interesting use case for AI and a way to get a very sculpted, very produced outcome from what otherwise can be kind of an unrealistic or I guess uncertain tool.

So those are the, you know, open versus closed here. And if I can kind of go back to my journey last summer in summer of 2023, I recognized, or I heard from that lecture that I was sitting in about privacy, specifically privacy confidentiality policies, right? And it made me think about our own acceptable use policy, and then I needed to extend that to cover artificial intelligence tools. Now, my brain went in two places simultaneously. Number one is, I gotta have a policy. Right? You know, the, you know, fake lawyer Robert kicked in and said, oh, we're going to, you know, adjust our policy and, you know, put in all these rules and, you know, conditions and make people adhere to them. And yes, that's very important, I think, for any organization to do is to update their policies to reflect changes in the technology like artificial intelligence, because it's not no longer, hey, you can't use Google, you know, your browser for personal shopping and things like that. You can only do it during lunchtime or whatever, but it's even the use of particular tools like AI and the open versus closed verification of data. We had talked about hallucination and bias, meaning like, you know, if you're going to put data into it or use outputs, it's up to you to validate the the data to make sure that it is accurate and representative of your organization. So all of these, like, you know, kind of policy, HR, legal kind of stuff, I felt like that's— yes, I need that. But the second place that my brain went to was, hey, I mean, aside from like the letter of the law that I'm trying to lay down, I have to have a conversation. I have to educate, right? I have to be a human with the other humans that work around here. And explain to them like why this is important, why this is here, and exactly what we're doing here, right? Hopefully people are learning things like, for example, open versus closed. So I started to bring my team together in a room and started to share some of these. This is why, right? Like, why is always a very important question for me to ask and answer. In any context like this.

So, if I'm hearing all this correctly, what I'm hearing is number one, we have to have this conversation with our team internally and with our customers, those who we're supporting. But also, we've got to have an understanding of what type of AI we're dealing with and what our company policy is because we want to make sure that nobody is pasting the formula for Coke or Pepsi or the, you know, some confidential client information into an AI that might learn from that and either regurgitate it somewhere else or just ultimately an AI that might be less secure and gets breached down the road and puts all that data at risk.

So by the way, I have an example and I'm gonna ask Mark to see if he can expand on some more examples or this particular example later on when I get a chance to interview him. But Samsung in the early days of OpenAI had engineers put code into like proprietary, like, what's the word I'm looking for here? The intellectual property, right? Like secret, like software development code into AI to do things like, hey, can you optimize this? That was what one engineer did. Another one asked to look for bugs, right? Well, that became that software code that they had uploaded. I don't know how many lines of code it was, but it wasn't like a short little procedure of like 10 or 20 lines. It was like a lot of code. Is now part of the OpenAI public domain. Wow. Right. So, you know, they kind of put themselves in a little bit of a precarious situation there. You know, now that, you know, there's like for those who are skeptical, I guess, you know, saying like, hey, I haven't heard of any examples. Well, you can look that one up and read all about what happened to Samsung there. And there are others.

Yeah.

And an OpenAI or an AI database data breach It is a real concern. It's a real problem. And we don't necessarily think of these things as databases when we go to look at them. But I think that's the way we have to frame it to our customer. Like, this thing answers you because it has a large dataset and you need to treat it just like any other large dataset, not putting content out there that might— that you might not want to see. My old, my old mentor at my MSP used to say it's got to pass the billboard test. Like, are you okay putting this information on a billboard on the side of the road on the busiest highway in town? That's the billboard test. And if your answer is no, if it's the client donor database for a nonprofit or if it's medical information for a medical office or if it's Samsung's proprietary code, those are things we probably don't want on a billboard. That's how— that's kind of the early litmus test for should I be doing what I'm doing?

I think you hit the nail on the head with sort of the next thing that I wanted to bring up. But you've covered parts of it. What we need to be careful too is our obligations, both from a compliance perspective and a legal perspective, right? I mentioned client-attorney privilege earlier, right? But think about like GDPR, right? Where someone may request their information, a European citizen may request their information to be removed from data that you control. Well, if you're putting that And I'll even argue, even if you're putting it into a closed AI system, how do you get that data out?

Right?

And I don't think anyone has really dug deep enough on that question right now. I wouldn't know how to ask Copilot to remove some information about, let's say, European citizen information, client data that contains European citizens in there. I wouldn't know how to do it right now.

Is, is, is please forget a proper prompt for an AI engineer?

It is.

It could be.

Like, and I don't know. I know, and like, I'm speaking from ignorance, right? And maybe somebody—

I think we all are. This is one of those things we just haven't solved.

Right. And I think that's the beauty of these conversations, Alex, is that we're asking a lot of questions and we're putting a lot of information out there in the hopes that everyone will just pick up on this conversation and continue to learn from it and share in the community what we've learned and what we know. Yeah.

Yeah. I think, I think it's really important to understand that we're on the, in the early days of this, like, We talk all the time about how the MSP industry is still an immature industry by compared to accounting that's been around for 1,000 years. You know, AI is a super immature industry. You know, it is a day-old infant in the eyes of technology. So we have to continue to treat it like that. We don't know what it's going to be when it grows up, and we need to continue to ask questions about that.

Hey, you brought up something earlier too I want to kind of touch on, and maybe as an encouragement to our listeners and viewers is that I think it is, you know, one of the things that I struggled with last year and coming into '24 was what's our place as an MSP in the world of AI when it comes to services and client conversations. So my mind was like in a million different places. I'm going to need to like train people on AI technologies and build things. And I'm like, you know, wait, what am I doing here? Right. I think I was going a little too far, a a little too fast without even understanding what the market was looking for. So my, my, my head landed on exactly what we're doing with this podcast, Alex. And that is, I felt like the way we felt like we needed to talk about this amongst MSPs and just educate ourselves. I think that would be good advice for most MSPs is figure out a way to take all the concepts that we're talking about throughout this entire series distill it down into something that you can share with your customers and walk them through the journey of, listen, I'm just going to provide you education on terms to know, you know, the dark side of AI, the upside of AI, how it can transform a business. We don't have to be like AI and super, super AI engineers, if you would. But I think our place, at least right now, is to be a guide. Or even a bit of a teacher in this respect until we kind of figure out what sort of tools and other things, other services that we can figure out how to deliver AI-based services, if we even ever at all.

Yeah, no, I think there's a big question there, right? Are we, are we just the guide or is there a business model where MSPs help their, their end customer deploy AI models? Like, is there, is there a world where you help them go deploy their internal closed AI tools and get paid for it. I think there's a revenue opportunity here for the right organizations, but it's— we've already touched on how delicate this is. You have to be an organization who decides to adopt this and really wrap your arms around it and understand it and keep up with the ever-changing landscape of it if this is going to be part of your business model. At the very least, this is a great conversation for those quarterly business reviews or those regular touchpoints you have with your customer. Hey, let's educate a little and then let's just ask some questions. What are you hearing in your industry? Are you hearing a lot of chatter about this being baked into your core line of business apps? Does that make you nervous? Have you thought about how that might impact the way you enter data into these apps? Have you thought about the way— the risk that might get exposed based on the way that you enter data into these apps? So there's just a bigger conversation here, and I think the point is it's not a one-and-done. We don't know yet what the right answer for this is, right? A standard 2016 acceptable use policy for a workstation for an end user, something we can pretty much just stamp out of a notebook and, hey, here you go, here's an acceptable use policy, you know, make sure it aligns with how you run your business. These AI policies and the usage of AI, the benefits of AI, the way that it impacts our business, we're not there yet. And so I think it's one of those things that ought to be on your agenda for quarters and quarters to come as you go to meet with your customers.

Yep, 100%, Alex. And I think, you know, I will say that it has been a lot of work for us to do that here at Progressive Computing. But we're on, you know, we've made an investment in that journey and it took a while for us to get there. I mean, this is about 9 months in the works for us. I've personally put together a presentate, a narrated presentation that my customers can consume via just, you know, watching a 35-minute YouTube on all of these topics, right? And I would encourage other people to sort of do the same. You know, I have a friend that runs an MSP quite large. They're about 4 times our size, and they have a whole classroom, you know, and they bring end users into their office in a classroom-type style seating. And I can see this as a wonderful topic to educate your customers, right? So whether it's a lunch and learn or, you know, an after-hours sort of wine event or take the path that we're doing with, you know, some video-based training, or all of the above, I would encourage MSPs to, like you said, just ask questions and also just put some information out there.

Yeah.

AI and whiskey tasting, guys. Here it is. Like, this is time to set it up for your customers.

You may need whiskey to kind of get through this topic.

Yeah. Yeah. It can be a tough one. But I think we've done a pretty good job of setting this up, right? We've got an interview coming up with Mark. Is there anything you want to touch on before we cut to the interview?

No, I think, I think Mark is going to bring some additional expertise and help sharpen some of the, you know, a lot of the rough edges that we've left around here around policy and, you know, the legal implications. I mean, you and I are not lawyers or policy experts. We're business owners. So, you know, we know, we know that much, but really looking forward to the upcoming interview with Mark so that he can provide us some greater clarity on these topics.

Well, let's throw that interview up right now and we'll cut to that.

All right, thanks for joining me again today, Alex. Well, it's my pleasure now to interview Mark Kurstein from Codebook AI. Mark, would you please introduce yourself and tell us a little bit about your new venture?

Yep, so I'm Mark Kurstein with Codebook AI and the new venture is focused on bridging the gap between cybersecurity, but also bridging it into privacy and artificial intelligence. So all three of those are now intersecting with each other, and they all have some overlap in terms of common areas, but also some distinct elements, often distinct in the sense of more regulation, more, you know, geographic disparity in terms of different regulations in different parts of the world. But as professionals in the IT market, we need to see how all of those are coming together, and that's the role that I'm looking at, is how to bring governance and risk and compliance into the AI space as well as the privacy space and make sure that the things that are unique to this AI development world that is exploding, literally, are considered and that people are doing it deliberately and carefully and not just kind of willy-nilly run down the path.

Well, I think right there is exactly where my headspace is, right? I'm a bit nervous, right? Not in necessarily a negative way, but, you know, that healthy paranoia about we're going down this road of AI, customers are asking us more and more questions. Many MSPs, while we can sort of follow along, right, we're not— we don't know what we don't know. And that's kind of what makes me nervous is that we're making sure that we've got things like privacy and confidentiality, regulations, compliance, all those scary, risky buzzwords that We just want to make sure that we're approaching this correctly. So Mark, specifically, Alex and I were just talking about acceptable use policies and how maybe in the past it was very easy to kind of have just a boilerplate acceptable use for people within an organization. But now AI may have complicated that a bit. Can you, can you talk to that at all?

Yeah, absolutely. I mean, I love that you guys start with the acceptable use policy because that's the mindset that I like to start with regardless of whether a company is developing AI products, whether your clients are or whether you are. The place to start is really with the acceptable use policy. And it's because right now we've got a disparity where the excitement and, you know, activity around ChatGPT that brought everybody's attention to it and is pretty readily available You know, somewhere in the neighborhood of about 60 to 70% of employees report that they use AI actively in their work every day, all the time. 60 to 70% of us, according to some of the recent surveys, 70% people using AI. Only about 30 to 40% of companies have policies about AI. So think back to a term that you— that we're all familiar with in the MSP community, shadow IT. This is a massive case of shadow AI. People are using this technology and they don't know necessarily what the risks and barriers are. And if they do something that is not right, if they make a mistake or they do some— they expose intellectual property, they use hallucinations from the AI in some of their work product, all of those type of things, ultimately at the moment that becomes the employer's responsibility. Why? Because you didn't tell them what the rules are. You know, if you don't tell what your employees, what the rules are, rules of the road, then you as the employer are responsible for them, you know, making mistakes or misusing the technology. And, you know, so there's some risk there. Things that have already made it into the public domain. Samsung engineers put code into ChatGPT and exposed a fairly large volume of intellectual property into the public domain. And much more recently, I think this was just in the last week or two, uh, Amazon. And you'd think Amazon's a pretty sophisticated company and they're, and they're on the leading edge of developing AI. Amazon just provided guidance to their employees to say, hey, stop putting our proprietary information into the public domain because we've noticed that ChatGPT is trained on Amazon contracts and trained on Amazon information that again inadvertently— So now dial it back to us and our customers. First thing you need to look at is simply say, hey, we know that people are using, you know, these AI agents in all kinds of variations because there's all kinds of tools about. What do you want your employees to be doing or not doing? And it's really quite impractical to tell them, You are not allowed to use ChatGPT. You're not allowed to use these AI tools. You can't, you simply can't do it. A lot of companies did that in response to ChatGPT gaining ground, but it's really impractical because ultimately the better stance is to say, I want you to use these tools. I want you to gain the 20 to 30% productivity improvement, and I want you to be more effective in your job, but I want you to understand Number 1, don't put proprietary information. Don't put sensitive information into it. Don't put anything that could harm the company into these tools. If you do, make sure that the model that you're using is either proprietary to your company or that you have the training turned off, which a lot of people don't know that ChatGPT, if you have the paid subscription, you can turn off training and it won't train on the data that you put into it.

Ah, so it won't add the data to its learning, right? You know, its database to learn based on your inputs is what you're saying.

Right.

Ah, that's an interesting little factoid that I don't think Alex and I fully were— well, maybe we kind of in the background understood it, but not fully cognizant of. It's interesting how you said about like, you know, banning the use of internally. If memory serves me correct, it was around this time last year, or maybe it was maybe like March of '23, when Italy banned, and I don't know if it was OpenAI or ChatGPT, for like a full month because of GDPR, um, uh, concerns. Uh, is that, is that, is that an accurate recollection of the facts?

Yeah, Italy, you know, kind of was reactionary in terms of their, of their response to AI, and they're in a little bit of a feud with, with OpenAI relative to what's going to happen going forward. But EU as a whole is looking at it more comprehensively. They're, they're probably leading the way with the EU AI Act, uh, that actually has passed but still has about a year or two before it really starts to have teeth and starts to be enforced. Oh, before we move away from policies real quick though, another one, almost, almost the second most important policy that I would say that people need to put in place is the third-party vendor management. Because remember, just like we think of supply chain attacks in the cybersecurity realm, If whether you or your customers are using active AI in your own proprietary or own development phase, the vendors, the software vendors are. There's no, there's no question. I mean, most of us in, in the IT industry, for example, you know, we hear every day about this is an AI-enabled cybersecurity tool, this is AI, everything's AI-enabled, right? So we need to start thinking about, well, okay, if our vendors are using AI, what are the terms and conditions that are in place for that use of AI? Are they using my data to train their model? Do they have rights to the data that they've used? Yeah. And do I have some potential risk attached to, you know, because intellectual property rights happen on both ends of an AI model. The data that you use to train the model, what intellectual property rights, what privacy rights do you have to that data? And the output of the AI model, what intellectual property rights and what rights do you have to use that data? And for the most part, people haven't updated their vendor licenses or haven't updated their vetting of a new software app to say, wait a minute, these guys are using AI.

How?

How are they using it? What are they doing?

It's, you know, if we didn't have enough to do in this industry when we're especially when we're vetting vendors and having a look over agreements and now we have to start asking, I mean, listen, and I don't mean to make it sound negative because, you know, it's that's this is a golden nugget right here is asking the question of your vendors, how are you using our data or and/or our customer data? Right. How am I maybe even potentially on the on the hook for something because I use your software and I put my client data in your software and that becomes part of your learning dataset. I think that's kind of what you're saying is that, you know, there's some potential exposure and danger there.

Yeah, yeah, absolutely. You just, you just need to be deliberate. And that's what ultimately what AI governance is and privacy governance is. I'm going to deliberately look and what are the terms? Have I considered AI in the context of these terms? How is this going to move forward? But at the same time, while we can look back and go, okay, this is some scary things, it's happening at an unbelievable pace, we can also look at it. I often look at it from the context of I feel like we're in 1997 right before the dot-com boom or maybe right in the middle of it. So the only scary piece of that is the dot-com boom had a dot-com bust. And we may see one of those, but ultimately, even with the dot-com bust, the internet is still profound and changed everything about our lives. AI is at that, you know, hey, we're 2 or 3 or 4 years before the significant impact. And we all, or at least many of us, like you and I who've been around for a little while, we get the benefit of having experienced that.

Last time.

So now we're not completely flying blind. We're like, okay, yeah, I saw how significant and how profound the change was. It's a little different this time though. It's happening much, much faster, much quicker.

I totally agree. And it's funny that you said that because it was last year in 2023 when I felt like my Spidey sense went off and said, you've seen this before, Robert, like do something now, right? Because when the internet, you know, craze hit, the hype, I felt like we, like we just kind of watched it pass us right now. Obviously, we've caught up since, and that was 20-plus years ago. But I felt like that there were some potential business opportunities that we missed out on here. We didn't necessarily capitalize on, and maybe even thankfully so because of the bust. Right. And then we rode that slope of enlightenment into the plateau of productivity, as Gartner says. But I felt like I needed to get ahead of this conversation around AI as early as last year. So it's, it's really great that I think we're having this conversation and that people like you have started to maybe even carve out a niche for yourself in the MSP space to help those of us that need that help. So kudos to you for that. I have a question or two around compliance. Like, I mean, I think this might be fairly obvious, but I don't want to overlook the nuance of things like GDPR or HIPAA or attorney-client privilege or really, you know, everything between what we're legislated to do all the way to like, hey, what we should be doing ethically and morally. So like, do you have any advice for MSPs on our AI journey, what we should be looking out for and through that lens of compliance and regulation?

Yeah, I guess the first thing that I would do is put it in context of us as MSPs and our clients, because there really is two contexts that we need to look at. One is how do we manage this in our own business? How do we apply AI? Where do we apply? Where are we applicable? Where does the regulations hit us directly? But the other one that's equally as interesting is how does it impact and how do we help our clients? Navigate through it. Because I believe it's very likely, if you haven't seen it already, in many instances, the clients that are thinking about developing AI and integrating it are going to come to you and your— you as the MSP and say, hey, I'm looking at this, I'm thinking about this, what should I do? Right? So that's great because that is you as a trusted advisor helping them navigate their business, helping them know where they need to go. On the regulation front, most of the active regulations for AI sit in privacy laws. So GDPR, you mentioned, right? So are you— do you have any connection with Europe or do your clients have connections with Europe? If you have European citizens in your dataset, if you're servicing Europe, you know, in your dataset, then GDPR is going to apply to you. You need to think about how to manage that. Oh, in the US it's becoming a little bit more, uh, applicable to more companies across the board simply because there's been 15 states now that have passed privacy laws in the last 18 months. California being the first with CCPA, but there's been a cascade one after the other, after another. So there, the count is up to about 15 that have passed privacy laws, and most of the privacy laws cross into AI in the sense of what am I doing with your data? You being the private, you know, the individual consumer, what am I doing with it? So if you're applying AI to your customer's data, then those privacy laws start to impact you. And that also applies to the FTC, which has authority over unfair and deceptive practices. Now, also more or less privacy, but that's a little broader context, but that's the authority that they use to enforce restrictions on AI and those type of things. So I guess what I would be looking at is, you know, what is that regulatory environment and what laws apply to me or don't apply to me? And it depends on which state you're at and which, not just the state that you service but your client service. Because again, it was just an example, CCPA, you don't have to actually operate in California to be subject to CCPA. You simply have to have a volume of California consumers that are in your database. If your customers have, and I think the number is 25,000, 35,000, I don't remember the specific number of California residents that need to be in your database, but then you're suddenly, you know, subject to CCPA. You need to do all of the privacy regulations, including anything that would cross over into what your plans are for artificial intelligence. So that's the regulatory side. Wow. The ethical side is a little more broad-based than simply— and there's a lot of, you know, third-party frameworks. There's some coming out of Europe, there's one out of Singapore that's really robust, but also the NIST risk management framework for AI. So there's some in the US as well, and they're really focused around transparency, around ethical use, around considering the human element in what is happening with AI and not doing bad things with it, which Obviously, the adversaries, if you cross over into cybersecurity, you know, there's going to be people doing bad things with it. But those of us on the right side of that equation want to deploy it ethically and responsibly. And ultimately, if you follow a lot of those guidelines, you're going to hit most of the regulatory requirements anyways.

Right, right. Okay. So, you know, if things weren't complicated enough, now we've got to worry about 15 different states with different laws, especially for those of us that might be working in different states and not just within a local geography. But, you know, in this adversity, I'll call it adversity, lies, I think, opportunity, Mark. And I'm just curious on your thoughts on this. Alex and I were chatting earlier and he mentioned, hey, this is a great conversation to bring into your QBRs or whatever, you know, frequent touchpoints you have with customers just to bring up some of the things that you mentioned earlier, like the Acceptable Use Policy and some of the privacy concerns and now all of this great information around regulation, just, I think, even just framing up a conversation just to drive awareness. Would you, do you have any kind of advice about how MSPs might approach that? Is there a place that they can learn? Are there resources that they can arm themselves with good information so that we're just not talking out of both sides of our mouths?

Yes. Yeah, absolutely. And I think, Overall, this is very similar to what many MSPs have already tried to be doing on a regular basis, because it is interesting where cybersecurity and the emergence of that being important to the MSP and starting to integrate some CISO services or cybersecurity operations, MSSP services into the MSP, that's where cybersecurity brought us into basically a CISO relationship. MSPs in a sense were already trying to have a CIO type relationship. What I see most of the time in these companies that are considering it and what they do, it's not coming from the CISO, it comes from the CIO. These are— and sometimes the CTO, depending on whether it's internally facing or externally facing what they're trying to accomplish. But, you know, this is a strategic business initiative on behalf of the company as to how do we use it, how do we gain, you know, effectiveness of our employees, how do we use it internally to be more effective, how do we use it externally to service our employees. These are business objectives, and that's a great conversation to integrate into your QBR and ultimately pull it back into your business in the sense of anything that you implement attached to AI is going to have implications for the MSP. On the cybersecurity front, there's specific threats and vulnerabilities that are only associated with artificial intelligence. It changes what your threat matrix and, and the things that you need to look at. So you need to start thinking, all right, what do I need to do relative to that? On the awareness training, you know, add AI awareness training to your security awareness training. It needs, it needs to happen because it's changing even faster. And employees don't know what to do. I mean, look at the deepfakes that are coming up. Like, if you're not well trained on these things, there's mistakes to be made. And again, even elements of the stack that you offer to your customers, whether it's privacy elements of, you know, cookie consent management or data subject access requests or these type of things that are mandated with some of the privacy regulations, those fall into areas that you as the MSP can help your customers with. Or data management, because ultimately AI is all about the data.

Yeah, I love that picture you painted where, you know, you brought up cybersecurity, right? Like that was like the last phenomenon that we all tried to get our arms around. I remember, you know, 5, 6 years ago going, you know, like, hey, like we got to do something about this, right? And I feel like, like I felt like when I was in that dot-com bubble and I felt like I missed the boat, right? With cybersecurity, maybe we're a little late to the game here, but, you know, we're fully embraced in that. And, you know, so should everybody else be. But I think AI is now that new thing in that if we're not having— if we're not leading conversations with our customers over all of these subjects, right, and beyond just the privacy and confidentiality and the legalities and compliance and regulations surrounding this, but just to talk to it as subject matter experts. People, clients are going to look at MSPs and say, you know, why aren't you telling us about this? They're going to find another MSP that would provide that. Almost like if we said as an MSP, like, no, we just, you know, maintain the network and fix stuff and worry about connectivity, but we don't do anything about cybersecurity.

You're on your own. That's the recipe for obsolescence. Especially in a world of AI that's moving quick. One other thing to your question you asked about resources, one of the resources I love is IBM offers a lot of free training classes on this. You don't have to love IBM in order to sign up for their training. Love them, hate them, doesn't matter. They've got some really good material and it's free, right? Online video courses, sign up. It'll give you the basics without a lot of time and effort.

Yeah, I'm actually glad you brought them up because, you know, I think as those of us who kind of grew up in the last few decades in the MSP space, I started my business in '93, felt like IBM was becoming like sort of obsolete, like, you know, they're, they're, they're has-been or whatever, but they've actually been doing some very innovative things over the last several decades, maybe that we don't necessarily see directly in the MSP space. But AI, you know, their investment in Deep Blue and Watson and some of the other stuff that I've been reading up on. And I'm glad you mentioned the free training that they offer because they really— they're like, you know, they're a company to watch when it comes to this stuff. Are there other resources that you would advise us to, you know, either watch out for or look out for?

Yeah, well, I mean, around— especially around risk and governance, there's a tremendous amount of material. There's the NIST RFCs. AI framework. Uh, so NIST has a lot of publications, ISO has a lot of publications, the European Union has a lot of publications. You know, it's, it's, to me, it reminds me very much of, uh, cybersecurity in the sense that there is tons of resources out there. It's just very disparate, and so it's kind of not all that well organized because it's coming from so many different sources.

Right. So, Mark, you know, I wish I could talk to you all day long. I may do that at a conference if I catch you or especially at lunch or something. But, you know, we only have limited time. So any just final thoughts before we close out this conversation around privacy, confidentiality and the world of government?

Well, the one I would say, I would volunteer as a resource for the audience, you know, I've been more in the cybersecurity realm, part of this community of MSPs. AI is moving so quickly that we all benefit from sharing information with each other and just having conversations. So, you know, if anybody reaches out to me, you can find me pretty easily on LinkedIn. Happy to have conversations and provide guidance. My biggest objective, especially with a new venture, just form relationships, build trust, Good things will happen for everybody.

Yep, Mark, I love that about you. I love that about this community because there's so many of us who share that opinion about the value of community and just, you know, share information and help lift each other up. So thank you for joining me again today, Mark. Just one more time, how can people reach you?

Yeah, mark@codebookai.com is the email address. And of course, I'm easily found on LinkedIn as well.

All right, Mark, thank you so much. Really appreciate your time and your expertise today. Perfect.

Thank you. See you, Robert.

So, Alex, what did you think of Mark's interview?

Absolutely fantastic. I love that we get the opportunity here. You know, one of the coolest things about our space is that we are super close to people who are expertise in their— are experts in their little niche, right? They get to niche down into something become really, really an expert at it, and, uh, and then they come share it with the world. So, and we're so close to these people in this industry, and Mark's just another example of that. So if you want to follow up with Mark, um, we'll share his LinkedIn really quickly. It's linkedin.com/in/markkirckstein, K-I-R-K-S-T-E-I-N. So linkedin.com/in/markkirckstein. So, if you want to follow up with him, I highly recommend it. He's absolutely becoming the MSP space's foremost expert in AI policy, as he proved in that interview with you, Rob.

Totally. So, Alex, you want to close this out now?

Yeah, I think if we had a takeaway from this one, it would be things are changing fast and things are going to be changing for a while. So, we've got to keep our clients up to date. We've got to keep our policies up to date. We've got to keep our procedures up to date, and we've just got to follow the bouncing ball. Like, this is not something that we can close the book on today. It's something that's going to require MSPs to circle back internally and with our customers maybe once a quarter and just make sure that, uh, that things haven't moved too far on us. Is that a, is that a good summary for today?

I think you once again hit the nail on the head. Uh, it is a journey, not a destination. So let's just keep moving forward together.

Well, that's a wrap, guys. Thanks for, thanks for joining us for this episode, and we'll be back next week with one more. This podcast was created by me, Alex Farling, and my good friend Robert Jaffe. This podcast is produced by Francis Belland. The music and artwork for this series were produced by artificial intelligence and edited by Francis Belland.