Felicia Ellsworth: Welcome to In the Public Interest, a podcast from WilmerHale. My name is Felicia Ellsworth.

Jekkie Kim: And I’m Jekkie Kim. Felicia and I are partners at WilmerHale, an international law firm that works at the intersection of government, innovation, and business.

Felicia Ellsworth: Today, we are joined by Miriam Vogel, the president and CEO of EqualAI. Miriam Vogel is a sought-after strategic advisor on AI issues, host of the podcast In AI We Trust, and author of Governing the Machine: How to Navigate the Risks of AI and Unlock Its True Potential. Ms. Vogel was previously chair of the National AI Advisory Committee for the White House. She has also served in several senior positions at the Department of Justice, WestExec Advisors, and the Dana-Farber Cancer Institute. Today, she continues to serve on the Board of Visitors at the Georgetown University Law Center, as a senior advisor to the Center for Democracy and Technology, and as a member of the Council on Foreign Relations, all alongside her leadership role at EqualAI.

EqualAI is a nonprofit organization focusing on bringing education on AI governance to leaders and organizations at the forefront of AI adoption. To help lead today’s discussion, we are also joined by WilmerHale Partners Jessica Lewis and Josh Geltzer, each of whom served as an advisor to EqualAI in its development of the AI Governance Playbook.

Ms. Lewis is a leading securities litigator located in Silicon Valley, sought after for her defense of complex class actions and extensive knowledge of Delaware law. Mr. Geltzer is a widely acknowledged security expert, counseling clients through crises and pivotal moments involving issues like artificial intelligence, cybersecurity and CFIUS, as well as providing forward-looking strategies for emerging companies working in highly regulated industries. We’re delighted to have each of them here today to join in our conversation with EqualAI’s Miriam Vogel and to share their expertise and experience with you.

First of all, thank you, Miriam, for joining us on this episode of In the Public Interest. We’re excited to discuss your leadership and EqualAI’s work in this very interesting and dynamic time, and of course, to hear about the recently published AI playbook.

Felicia Ellsworth: Artificial intelligence, of course, is a common theme across many industries and stakeholders, and one we’ve discussed on the podcast before. We’re particularly excited to continue our AI discussions with our guests today. Miriam, maybe you can set the stage for us. From the EqualAI perspective, what shifts are you seeing pushing AI governance onto board agendas?

Miriam Vogel: Increasingly, smart companies are understanding this needs to be a governance conversation, both the opportunity and the perils of not managing this effectively. Board oversight has increased more than 84%. Since 2022, it’s been 150% increase across all industries on board agendas. And I think we can look at a few market shifts that are putting it there. First of all, we have to realize that AI is being used. And if you don’t think it is, ask your HR team, ask your marketing team, ask customer service, ask cybersecurity. It’s being used. And so, you really have to be thinking about, how does that translate into legal risk, how could it impact brand reputation, fiduciary oversight, all the items that belong squarely in board considerations. There’s still a huge gap in between where it is actually being used and making sure that all the appropriate board oversight is happening. A McKinsey survey found that 66% of boards have limited to no knowledge or experience of AI. One in three have said it does not appear on their agenda. We’re seeing this increasingly show up on agendas because investors and shareholders are asking about it. A Harvard Law School forum on corporate governance said AI-related shareholder proposals at S&P 500 companies have more than quadrupled from the year prior. Investors are wanting to talk about it. They’re thinking about it in terms of innovation. We need to be thinking about benefits, as well as the risks. We need to be considering the opportunities of how it can up-level companies, but you don’t want to be doing that without maintaining trust, and the only way to maintain trust is to make sure that you are driving in a car with functional speed controls, an odometer, seatbelts, and that’s AI governance.

Felicia Ellsworth: That’s really helpful context, Miriam. Thank you so much. With that in mind, Jessica, why does AI matter to boards today? Why is this now a governance-level issue?

Jessica Lewis: So that’s a really great question, Felicia, because as we all know, everything is all AI all the time. Investors want companies to be deploying AI, offering AI. Customers want AI. All anybody wants to do is talk about AI. But as much as it presents a great opportunity, it is a tremendous risk when it comes to how quickly AI can scale. So how are boards going to govern an opportunity like this, but also something that can be such a significant risk? The Delaware courts have not yet addressed any oversight claims when it comes to board governance of AI. We have seen, from my perspective as a securities litigator, two cases coming out of Delaware recently that aren’t specific to AI, but do evaluate a board’s governance policies and procedures when it comes to oversight and when it comes to risk. And those two decisions have recently let what are called “Caremark claims” go through on a motion to dismiss. For somebody who’s interested in corporate governance, for somebody who’s watching the Delaware courts, we don’t typically see these kinds of claims proceed past a motion to dismiss stage. What’s of most interest to me is a tendency now, or at least some movement in the Delaware courts, to really apply the oversight standards. So, for all those reasons, AI corporate governance is something that all boards have to be really mindful of right now.

Felicia Ellsworth: That’s a great segue to Josh, because I’d love to hear from Josh’s perspective some of the regulatory and enforcement trends that boards should be keeping in mind as they think about AI risk.

Josh Geltzer: Regulators, as well as courts, are grappling with what it means to be responsible with this fascinating, fast-evolving and powerful technology. What does it mean for a model developer to decide that it’s appropriate to release the newest iteration of its model, and moving from the developer to the model augmenter? What does it mean to have an interesting data set one uses to enrich a model and adapt it for a particular purpose? Then there’s actual deployment of it. Increasingly, we see AI tools embedded in all sorts of things: software, hardware, more. What does it mean to make it available in a particular setting for a particular use? And then finally, actual use of it. What does it mean to rely on this technology for decisions big and small? The reason I say they’re grappling with it is, even though it feels omnipresent, it is the dawn of this technology. We’re only a few years in, and regulators, maybe especially courts, take time to make clear what those standards of care are, even to understand the technology themselves. For now, a lot of what we see regulators and others turning to are not actually binding law, but it’s instead guidance put out, not in the binding way, but by governments in the form of the Commerce Department and NIST, AI Safety Institute, now the Center for AI Standards and Technology, or put out by nonprofit. And that’s why I think the guidance that EqualAI has offered to boards holds particular weight in this space, where you don’t have clear case law or clear statutory direction. So, you’re looking for other ways, if you’re a board or another part of a company’s ecosystem, to comfort yourself that you’re being reasonable in how you’re approaching this technology.

Felicia Ellsworth: So that sounds like a pretty complex, emerging and ever-changing regulatory landscape. Miriam, in light of that uncertainty, what issues are you hearing create the most practical challenges for boards trying to build responsible AI programs?

Miriam Vogel: Yeah, there’s a few consistent issues we are hearing with almost every board that we talk to. It’s an evolving landscape. I agree with Josh. I think we’re early days, first inning, in how this plays out, but that should not stop us because, while we don’t have certainty, we do have guideposts as to what the questions will be. Enterprise-wide, where is AI being used? That is often a hard question to answer right now. As a result, boards want to make sure they have visibility. Companies have not done an enterprise-wide survey, so it can be a great reminder that this is a best practice to start with. I think another common challenge is translating technical risk into governance language. AI introduced new concepts that can make people feel that it’s not a language they speak. We’re talking about model drift or training data quality and third-party model reliance. Each of those are very much related to common governance conversations. So what we need to be doing is bridging the gap between the technical terms and the boardroom conversations and fluency. The third issue we’re seeing with AI specifically is ownership and accountability. It’s hard to pinpoint who is responsible for its use enterprise-wide. It can and probably will impact every team. If they have not decided who in the C-suite is ultimately accountable, they are putting themselves at risk. So, you have this real opportunity to ask who’s in charge as a board member, because that is doing the enterprise a real favor. Finally, with AI, what we’re dealing with here is new levels of speed. When we had seismic shifts and innovation in the past, we had a century, perhaps, with the Industrial Revolution. We had decades with internet adoption. We had time to see how the courts handled it, we had time for new laws as necessary. We don’t have that luxury with AI, and so we’re needing companies and boards to adapt at a pace that they haven’t had to before.

Felicia Ellsworth: Well, picking up on that point from Miriam on adapting to AI risks, and maybe Jessica, this is a good one for you to address in the first instance. What are some of the features of AI risk that make it different from the traditional levels of risk that boards are accustomed to handling—technology, compliance, et cetera?

Jessica Lewis: So that’s a really key question that I think is going to be integral to any board thinking about their oversight mechanisms to make sure it’s accounting for what is unique about AI risk versus some other types of risk. I think of essentially four things that distinguish AI risk. The first is that AI can be a black box in terms of exactly why AI does what it does. And that can make it harder when AI makes a mistake to explain the mistake and to provide reassurance to regulators, to stakeholders, to customers, about what happened and why it won’t happen again. So that’s one key difference. The second is that AI changes post-deployment. It can change over time as models update. It can drift a bit. This is critical from a risk management perspective, from an oversight perspective. You have to make sure oversight mechanisms take into account the fact that the risk can evolve post-deployment. That’s pretty unique about AI risk. The third point is scale. When AI makes a mistake, it doesn’t just make one mistake. AI mistakes sort of pervade the systems in which AI is being deployed. It’s not one rogue employee somewhere. It’s your entire model. So, things can scale incredibly quickly and lead to what Delaware courts call “a corporate trauma” when something goes essentially really, really bad, really, really quickly. And then the fourth point is just vendor dependence. A lot of companies are building on third-party models. If the vendor updates the model, changes its terms, has an outage, shifts how it’s managing the data that’s input, your enterprise can just inherit all the consequences of that. Boards are very familiar with third-party vendor oversight, but it’s very rare for a vendor to be as integrated into a company as AI is.

Josh Geltzer: I think it’s the perfect encapsulation, and maybe one way to describe it in the board context is technical boards may have related to cybersecurity roughly a decade and a half ago maybe. It could have been seen as technical, something to be dealt with in some specialized way, rather than something needing to be thoroughly understood, overseen carefully. It took some, what was that phrase I just heard from you, Jessica, corporate trauma? It took some real corporate trauma to recognize that unfortunately, while the opportunity is absolutely there, we all live in a cyber world, the risk is really there too. Hence, some incidents drove home that. And so, I think we’re in a moment where AI needs to make that turn for boards from something left to the specialist. Boards are not often yet aware because they don’t realize all the ways a company relies on AI, let alone its partners, its vendors, its supply chain.

Felicia Ellsworth: Let’s talk in detail about that for a minute. What are some of the features that might be overlooked in AI that boards might not be as aware of, but might present risks?

Josh Geltzer: In a simple sense, maybe you could divide it into external and internal. There are customer-facing chatbots, there are interfaces that are AI-powered, and those carry tremendous efficiency potential. But if they mislead your customers or make guarantees—or what the customers perceive to be guarantees—the company’s going to be on the hook for that. Then there’s internal phase, informing employees about their rights and responsibilities, interacting with each other. And then beyond those categories, there are the partners and vendors that I alluded to before. Then there’s also this one more category, which I hear about increasingly, which is employees are just using this. Whatever their formal guidance from their lawyers, their IT professionals, they’re just using it. That’s maybe the scariest category of all because it’s the one escaping the visibility of company leadership, potentially board leadership. This is part of why the very first step of the playbook EqualAI issued recently is just for boards to understand the full surface area of AI exposure.

Felicia Ellsworth: Okay, so let’s talk about something we talk about a lot in connection with boards, which is fiduciary duty. How should boards be thinking about their fiduciary duties in the context of AI?

Jessica Lewis: Yeah, this is an easier one. So boards should be thinking about their fiduciary duty with respect to AI in the exact same way they generally think about their fiduciary duties of oversight. While AI risk itself is unique, the board’s oversight responsibilities with respect to AI risk are the same as their oversight responsibilities with respect to any other risk that is mission critical or essential to the company. The best practices that you see with respect to systems, paying attention, diligence, escalation, response, apply to AI risk as well. Those oversight mechanisms, though, lead to account for what makes AI risk unique.

Felicia Ellsworth: And Miriam, how are you seeing boards shift their oversight structures to manage AI risk?

Miriam Vogel: The data shows that it is increasingly an agenda item. Smart boards are putting this on a more routine cadence and formalizing their oversight mechanisms and expectations. That means putting this on the remit of the audit or risk committee. There can be cross-committee coordination; for instance, cybersecurity, data governance, compliance, given the way it’ll touch those committees’ remit as well. In the same way that your governance has overlap and insight into current policies, you want to make sure that your board oversight has an overview of the relevant policies. You’re going to want to see more regular reporting to management. It’s important that boards are asking for AI inventories, risk frameworks, and points of accountability in the company. They are saving themselves a lot of liability. They’re doing a lot to build trust within their organization by making sure that they are asking for clarity on those answers so that the company themselves have clarity on those answers. You want to make sure that you know what the AI use is and that it’s been clearly communicated. And you want to be thinking about another risk, and that’s AI literacy. How do you make sure that the workforce is ready for the AI that you’re asking them to use? The board wants to make sure that they’re having their own AI literacy education programs. Are they bringing in experts? Do they have a board person who has this expertise? Smart boards are making sure that they have sustainable, planned, consistent ways to bring their own AI literacy as well as making sure that’s happening across enterprise.

Felicia Ellsworth: I want to talk now about different types of AI use and break it down into uses that are core to a business versus uses that are more peripheral. So, Jessica, turning to you, how would a board go about categorizing AI-related risks for its particular institution?

Jessica Lewis: So, it’s a great consideration for boards to be thinking about. And I’ll go back to the Caremark doctrine, which is the Delaware doctrine that sets forth the standard for board oversight. The way Delaware courts think about it is if the board fails in oversight of a mission critical risk. I think you’re right, Felicia. There’s a lot of ways that AI can be added or integrated to a company that are not going to rise to that level of being mission critical. Maybe there’s a chatbot that employees can use to access HR documents or forms, but it’s not external. Something like that might carry very little risk. Caremark looks at whether or not a risk is central or core to the company. In the two cases that I mentioned where these Caremark claims passed a motion to dismiss, in one of them, the risk was FDA compliance. The company was a pharmaceutical company. It was regulated by the FDA. There was a question about whether or not it was compliant with FDA regs. That was deemed to be a central or mission-critical risk to a company. So, if you see AI being folded into something that’s going to touch on regulation, you could readily see that becoming a mission-critical or core risk. The other case was a banking case where the court said the order in which deposits were processed led to overdraft fees. And because it was a bank, those overdraft fees were central to what the bank does. And, therefore, the oversight mechanisms that kept an eye on that were mission critical. If you’re in a regulated industry, if it’s customer facing and it’s going to a core product or offering, you could really see a Delaware court saying that was mission critical.

Felicia Ellsworth: Let’s look at the other end of the spectrum. What are some of the peripheral risks? Maybe they don’t fall within the mission critical risks in the Caremark doctrine that Jessica just described, but they are things that boards should still be thinking about. What are some examples, Miriam, that you’ve seen in your work in this area?

Miriam Vogel: Yeah, I think everyday general purpose AI tools for productivity, drafting emails, summarizing documents, preparing presentations, analyzing spreadsheets, it may seem low stakes, but given that these are public tools, that is private information that could be spilling out. Certainly not that boards need to manage the tools directly, but that there are clear policies in place, training programs, guardrails to monitor and guide employees as to what is and is not expected. The other part is there are often risks that are keeping people from wanting to adopt AI. So, for instance, if you’re not talking about your privacy controls, your guardrails, there are many people in your organization who will not use the AI tool.

Felicia Ellsworth: What about some of the really mission-critical AI risks in practice, Josh? What have you seen that boards are thinking of as not the peripheral, but the core risks to the institution?

Josh Geltzer: I do a lot of work in the defense and national security space, and that’s a space where the opportunities are high, but maybe the risks are as well. You see an appetite, an interest, even stopping short of weaponry. In general, it’s quite remarkable in what it can do. And if it is either not properly tailored to the mission at hand or being mis-deployed, misused, it becomes mission critical. And I think we’re going to see a real race, maybe we’re already seeing a race within the defense and national security space, to plug this technology in, to have it embedded in the latest vehicles, weapons, a whole range of cutting-edge technology, which really is life and death ultimately. This tech is really good, but it’s also being embedded in product so quickly that I think for boards to have understanding of what the testing looks like, how comfortable they are going to market with that, that strikes me as an area that really calls for particularly involved, maybe even intrusive board oversight.

Felicia Ellsworth: Let’s talk about some practical governance options that boards should be thinking about, or probably are thinking about. Jessica, we’ve talked about subcommittees, audit committees. What are some practical tips that boards should have in mind as they think about AI?

Jessica Lewis: The playbook here by EqualAI, I think, is really thoughtful and helpful in this respect. And step one is always to take stock of how AI is being used within the organization, how it’s being offered, and then tailoring an oversight program to the level of risk as it’s manifesting within the organization. So doing an assessment in the first instance to help the board understand the magnitude of the risk. On the other hand, maybe you’re allowing your employees to use AI chatbots on their computer, and there your oversight is going to be very different. And in fact, you don’t want to overdo the oversight mechanisms for a risk that’s pretty peripheral. We often see in litigation things like charters used as the standard of care for what the company should have been doing with respect to the risk. So if the risk is pretty peripheral, you want to make sure that you don’t set up an AI committee with this very lofty charter, because if something does go wrong down the road, that charter is going to be exhibit one in a court filing saying the board said they were going to do this and they didn’t do it. So, it really is taking stock of what the risk is and then calibrating the oversight mechanisms accordingly. Whether or not it’s allocated, as Miriam said, to the audit committee or risk committee, an enterprise risk management committee, that’s all going to be very customized based on the level of risk.

Felicia Ellsworth: Miriam, what are you seeing in terms of how boards are really digging in on AI risk, such as getting additional reporting from leadership, et cetera? What are some of the trends that you’ve seen?

Miriam Vogel: Better reporting frameworks are translating AI risk into the language boards already speak, operational risk, the reputational exposure, regulatory liability, financial impact, and that is getting better over time. We’re seeing more of that. Also, an increased demand for exception-based reporting, which is different than the status updates, but an escalation trigger when there’s a need for board to be aware as what we call AI incidents are happening more and more. Another trend that deserves attention is the growing expectation. A lot of this risk comes from third parties and supply chain AI. And so, making sure that there’s real certainty on what the expectations are in how vendors’ products play into your governance system is another smart trend that we’re seeing. Finally, as we’ve talked about, regulators are beginning to shape this conversation in addition to courts. So, in certain sectors, financial services, healthcare, critical infrastructure, there is an increasing regulatory expectation that boards can demonstrate informed oversight.

Felicia Ellsworth: And Josh, over to you. What are some of the incident response escalation processes, et cetera, that you see working well when AI is part of the picture?

Josh Geltzer: Companies have increasingly gotten used to preparing for that moment you’re asking about, Felicia, doing tabletop exercises, practicing escalation, linking up the lawyers with the IT professionals, the comms folks, those who will need to interface with regulators, so that when that bad day arrives, they’ve practiced, they’ve got some muscle memory there. We’ve started doing that for folks on the AI side. Now, the number of AI bad days, or maybe I should say the range of AI bad days, is probably wider than a classic cybersecurity breach, whether it’s the AI itself is the source of the incident, especially for a company where AI is central, or whether it’s peripheral AI. But for those who kind of tabletop that out, far better to have gamed that out and then have the pain of working through it, but at least working through it with a plan than trying to figure it out in real time.

Felicia Ellsworth: Let me give Miriam the final word here. What are some thoughts you might leave our listeners with about this very interesting conversation as we think through not just AI, but really how it intersects with boards and board governance and regulations in this ever-changing landscape.

Miriam Vogel: I think an important point to really underscore here is as we talk about governance is that we actually all have a role in making sure that our AI is safe and that we’re reducing liabilities. Today, I’m thrilled to be talking with you about the boards because they have an outsized role, as does the C-suite, in making sure that governance is in place. Governance can’t happen bottom up. It has to have this oversight structure to make sure that there’s the budget needed, that there is the accountability, that there is the messaging that is not only safe, but it is invited for people to be raising those issues. It requires employees, once they have been given agency, once they know what the process is, to make sure that they’re staying current on the policies, to make sure that they’re on the lookout for these risks. It’s also looking out for opportunities as AI evolves. It’s going to have new use cases. There’s new potential consumers who could benefit from it. So, it’s making sure that people understand there’s risks and opportunities in this work of governance. The main takeaway here is if we’re talking about governance, the answer is not which of these parties play a role. It’s each of these parties will make sure that our AI is safe, make sure that it deserves our trust, and make sure that all of us can benefit from it.

Felicia Ellsworth: Well, so much we could continue to talk about. I think this has been a really fascinating discussion, and I’m sure we could go on for hours. Hearing about this from each of your perspectives has been really interesting. So, thank you so much for your time, Josh, Jessica, Miriam. It’s been great to have you on the podcast.

Jessica Lewis: Thank you so much.

Miriam Vogel: Thank you.

Josh Geltzer: Thanks for the chance to be part of the conversation.

Felicia Ellsworth: And thank you to our listeners. If you enjoyed this podcast, please take a minute to share with a friend and subscribe, rate, and review us wherever you listen to your podcasts. If you have any questions regarding this episode, please email them to us at [email protected].

Jekkie Kim: For our WilmerHale alumni in the audience, if you haven’t already, please join our Alumni Center at alumni.wilmerhale.com so we can stay better connected. Special thank you to the producers of this episode, Ben Gardiner and Sara Gardner. Sound engineering and editing by Bryan Benenati, marketing by Allison Khan and Alexandra Thimble, all under the leadership of executive producers Jake Brownell, Kaylene Khosla, and Arpi Youssoufian. Thank you for listening.

Felicia Ellsworth: See you next time on In the Public Interest.