InsightsLeading Change Around AI

What Should Be Included in an AI Policy?

From the Scaling with AI podcast by Alex Bacon, founder of BrightKeel · with Dr Ben Thompson, AI governance expert

Short answer

An AI policy should start with your business objectives and how AI will help you meet them. Speaking to BrightKeel founder Alex Bacon on the Scaling with AI podcast, AI governance expert Dr Ben Thompson named five things every policy needs: approved and prohibited AI tools, clear data handling rules, expectations for human oversight, clear ways to escalate and report issues inside a no-blame culture, and alignment with applicable laws and regulations. It doesn't have to be complicated. In fact, "the shorter the better."

Key Points

  • Start with "what are the business objectives?" and how AI will help you meet them.
  • Ben's top five: approved and prohibited tools, data handling rules, human oversight, escalation in a no-blame culture, and alignment with laws and regulations.
  • You can have a one-page policy. "The shorter the better."
  • Put the policy in place right at the beginning, before shadow AI takes hold.
  • Don't be too punitive, or "you're probably gonna get people using shadow AI."

"Whilst we're all rushing in to using AI, we have to do it safely." That's how Alex Bacon, founder of BrightKeel, opened this episode of the Scaling with AI podcast with Dr Ben Thompson, an AI governance expert. The conversation covered how businesses can keep scaling with AI while balancing pace and innovation with data security, and what a good AI policy actually needs to say.

What Should an AI Policy Start With?

Ben is clear on this. "The starting point has got to be what are the business objectives? What is the point of this business?" From there, the question is how you're going to use AI to achieve those objectives, because "it's got to be a rationale for using AI."

As he puts it, "You don't want to just be running around using AI because it's cool to use AI or it's the latest trend." If it's a sales-orientated business, using AI to automate mundane tasks and give people more time for their core role, which is selling, is a valid use. Saving time will be a big part of it for most organisations, but you still link it back to the business objective. Why do you want to save time? So your specialists can go and do their specialist jobs.

Then come the next two questions: what AI tools can we use to meet those objectives, and how can we make those tools safe?

What Are the Five Things Every AI Policy Should Include?

When Alex asked Ben to sum up what small and medium-sized businesses should put into their policies and governance, this was his top five:

  1. Approved and prohibited AI tools. "You've got to spell out what we can and can't use." Expect this to be an iterative process as tools change and develop.
  2. Clear data handling rules. How are you handling the data you put into AI? Are you anonymising it first? Are you only putting certain categories of data in?
  3. Expectations for human oversight. How will you keep a human in the loop and check "is the AI doing what it's supposed to be doing?"
  4. Clear mechanisms for escalating and reporting risks. This "really needs to be inside a no blame culture." If something goes wrong, you need to know about it, and people need to escalate things without fear of repercussions.
  5. Alignment with applicable laws and regulations, and making sure AI is used ethically.

Underpinning all of that has got to be training and awareness. "A lot of people still use AI like a glorified search engine," Ben says. People need to understand things like the implications of using the free version of ChatGPT, and the lack of control they have over the data they put into it.

How Long Should an AI Policy Be?

Shorter than most people think. Ben often meets resistance built on the idea that "policies and governance is this really big, complicated thing and it really isn't."

"You can have a one page policy, which is sort of just outlining, this is our business, this is what we do, and this is how we're going to use AI to meet our business objectives."

"It doesn't have to be complicated," he says. "In fact, the shorter the better in terms of AI policies." There's also a sense that governance will slow things down, be expensive or be complicated. In his view, it's none of those things.

When Should a Business Put an AI Policy in Place?

"I'm really old school and I'm right at the beginning." When Ben goes into an organisation, his first question is, "do you have an AI policy? And if the answer's no, it's stop what you're doing. Let's put an AI policy in place." If the answer's yes, the next step is to review it.

The reason is that "the longer that we go on without putting governance structures in place, the harder it is to put them into place," because you end up trying to fit them around how people are already using AI. Too often, governance "seems to be a bit of an afterthought" as businesses get swept along in "this combination of enthusiasm and race to be able to deploy and use AI tools."

What Is Shadow AI?

"Shadow AI is when staff or individuals in an organisation use AI tools outside those that are officially approved." It might be ChatGPT on your phone to help write a report, AI note takers "popping up on Zoom calls and Teams calls", or browser plugins. People use them because they're helpful and easy.

But if a tool isn't on the approved list or within the scope of the AI policy, "the risk for the organisation is that there's no visibility of these tools. There's no audit trail, and there's no control over any data or outputs that are coming from them." Ben calls it "kind of like a blind spot."

It can catch people out with no ill intent at all. Recording a meeting for your own purposes is fine. "If I then uploaded that recording into ChatGPT and asked it to give a transcript of the discussion, then I'm in breach of GDPR," because you've processed someone else's personal information in an unapproved tool.

Who Is Responsible for Shadow AI?

Alex shared the example of a friend whose AI note taker saves him hours every week, but who is too scared to tell his organisation in case they turn it off. Ben's answer: "Ultimately, the responsibility lies with the organisation and with the leaders in the organisation because it comes back to governance."

The AI policy "needs to state what we can and what we can't use, and if there's something we can't use and we wanna use it, what are the processes we go through for seeking permission." Only once robust governance is in place does it become the responsibility of individuals who ignore it. Without that, uncertainty leads people to think, "well, I'm just gonna use this and I'm not gonna say anything."

Should an AI Policy Only Allow Copilot?

Locking everything down can backfire. "If you're too punitive and say, the only tool we can use is Copilot because we've got all the safety mechanisms in place with our 365 subscription, then you're probably gonna get people using shadow AI." AI tools are relatively cheap, so people will simply use a different model on their phone or at home.

Ben's approach is to audit the tools you're already using and look at how safe, reliable and cost-effective they are, alongside what you want to achieve. He encourages leaders and managers to ask people how they're using AI and how it's making their working life smoother, then bring the good ideas into the governance structure. He also suggests creating AI champions who keep their finger on the pulse and bring suggestions forward, and trialling new tools in a sandbox or with a few users first.

Alex has had similar conversations with businesses: use Copilot for some tasks and something like ChatGPT for others, so people have the flexibility of the right tool for the right task.

Does the EU AI Act Apply to UK Businesses?

It's easy to think it won't, because the UK isn't in the EU. But Ben says "it's so far reaching that I think most businesses in one form or another are gonna be touched by it," through supply chains, direct customers, or a chatbot that someone in Belgium uses.

At its heart it's "a risk based approach." Know what AI systems and tools you're using, assess the risk, and be able to justify it. "GDPR focuses on data, whereas the AI Act focuses on decisions and outcomes and harm." Ben describes it as "a bit like GDPR with teeth", with enforcement likely to be more punitive. His advice: "make sure that you are compliant with the EU AI Act and then you're in safe territory."

Is Rolling Out AI the Same as Rolling Out Software?

No, and this is where Ben and Alex strongly agree. With software, you buy the tool, train the staff and move on. "AI is not a software rollout, and AI is bigger than that. Because it's not a single entity that's gonna do a single job." It brings unpredictable outputs and risks like data leakage, bias and legal exposure, so organisations that treat it like a software rollout risk losing control before it's even in place.

Alex put it this way: "It is just a lot less binary and actually it won't work first time... it's a whole organisation thing. Everyone has their part to play in that." That's the thinking behind how BrightKeel works with leadership teams. AI adoption is a change for the whole business, and governance is part of getting it right from the start, not something added at the end.

About Dr Ben Thompson

Dr Ben Thompson

Ben is an AI governance expert. He began his career in secondary education, where he became a head teacher and set up a brand new school, with governance and compliance a big part of the role. Dealing with a cyber attack around the time GDPR came in led him into data privacy and cybersecurity. After completing his doctorate, he moved into AI governance, where he now advises organisations and teaches courses.

Listen to the Full Episode

Full Transcript

Read the full transcript

Alex: Welcome to the Scaling with AI podcast. I'm Alex Bacon and I'm on a journey to cut through the vendor hype and learn the real life use cases of how AI can help grow your business. Every episode I chat with scaling businesses just like yours who are leveraging AI to do more, go faster and grow bigger.

Let's dive in.

Alex: Whilst we're all rushing in to using AI, we have to do it safely. This week I'm joined by Dr. Ben Thompson, who's an AI governance expert. Ben's gonna be talking to us about how businesses can still scale with AI, but how they can balance pace and innovation with data security.

Okay. Ben, do you want to start off, just tell us a little bit about yourself and, and how you came about becoming an AI governance expert.

Ben: Yeah, so my background was originally in secondary education. Most of that was in leadership and management, including being a head teacher and setting up a brand new school and.

Was based around governance and compliance. And you know, education's a really regulated sector and I sort of had to learn on the job and at the same time. It was when GDPR came in with a victim of a cyber attack. So I had to learn all about data privacy, data protection, and then I took a career break to do my doctorate.

And I dunno, sort of, I just seemed to, without realising it moved across into the. Data privacy, cybersecurity, and then AI world off the back of the done around compliance and governance and audits.

Alex: Brilliant. Thank you. So we've had quite a lengthy chat around this already, but just tell me, what are you seeing as the biggest challenges when businesses roll out AI and where they're considering governance in that process?

Ben: Yes. I think quite often governance seems to be a bit of an afterthought, or it's something that's fair, but it gets kind of put to one side as we swept along in this combination of enthusiasm and race to be able to deploy and use AI tools. I think. There's a lot of pressure for businesses to think about AI to use AI.

It's all around us. The sorts of, we're hearing messages that if you don't adopt AI, you're gonna be left behind. When I talk to business leaders quite often, they say, I feel like we should be adopting AI, but I'm not really sure how we should do it or what we should be doing. And I think sometimes in the midst of all that.

AI noise governance gets either forgotten about or it's just priorities or elsewhere.

Alex: And what's the challenge with that? 'cause there's that balance between innovation and speed, keeping up with the market as you've said, but there's obviously a lot of risks that come with it as well. So for a lot of SMB businesses, just just bring that to life a little bit around some of those risks and considerations.

Ben: Yes. I think one of the biggest considerations is making sure that you are aware of what AI and where AI is being used within your organisation. And by that I mean we're all accessing AI everywhere. Um, it's quite easy, for example, for someone to have ChatGPT on their phone and want some help with a project or a task that we're doing at work and just tap it into ChatGPT, but then that's outside of that.

Organisational framework, it's outside of, if there is any governance measures in place, it's outside of that. So I think that's one of the biggest challenges in that AI is very, very readily available. A lot of it's readily available and it's evolving all the time and people want to use it, and rightly so.

People wanna use it, but trying to keep track of what people are using and how is. A real challenge and members, obviously the inherent risks that come with that.

Alex: And when you're looking at a project, at what stage should governance be considered?

Ben: Oh, I'm really old school and I'm right at the beginning.

And if I go into organisations, my first question is, do you have an AI policy? And if the answer's no, it's stop what you're doing. Let's put an AI policy in place. And if the answer's yes, then it's like let's review the AI policy. And I think governance needs to come right at the beginning because the longer that we go on without putting governance structures in place, the harder it's to put them into place because you try to fit them around what people are.

How people are already incorporating things into practice and what people are telling us about what tools and what they're using.

Alex: And do you find much resistance to that or are most people on board with addressing that straight away?

Ben: A bit of both. I think sometimes there's a bit of resistance around this idea that policies.

And governance is this really big, complicated thing and it really isn't. And actually, you know, you can have a one page policy, which is sort of just outlining, this is our business. This is what we do, and this is how we're going to use AI to train, meet our business objectives, and then take it from there.

It doesn't have to be complicated. It doesn't have to be, in fact, the shorter the better in terms of AI policies. But there's also a sense sometimes that governance is gonna slow things down, or governance is gonna be expensive, or governance is gonna be complicated. Is none of those things quite.

Alex: And then what about external regulations?

So obviously every business is gonna have different industry regulations. Maybe they've got some ISO accreditations that they need to fit in with, but there's also the EU AI Act. So just tell us a little bit about some of those external regulations that the business needs to be aware of.

Ben: Yeah, so for me, the most important thing is the EU AI Act, and it's a bit difficult.

UK businesses because we're not in the eu, so you think, well, it's not gonna apply to us. But it's so far reaching that I think the most businesses in one form or another are gonna be touched by it. And that can range from supply chains, that can range from direct customers, right down to, if you've got chat.

And someone in Belgium is using it. Then you've got a user that's based in the eu, so it falls under the EU AI Act. And on one hand it's complicated bit of legislation, but that's because it's quite big. Um. Uncertainty about what's being rolled out and bits get rolled out and we believe coming into, on the other hand, it's quite simplistic, it's just let's take a risk based approach to the use of AI and my personal feeling and what I advise businesses is make sure that you are compliant with EU AI Act and then you're in safe territory.

And it's a good starting point. There was a report recently, which was really interesting, which looked at AI adoption across businesses across the world, and the largest number of businesses that were adopting AI were in the eu. And the likelihood is that it's because of the EU AI Act. So businesses aren't avoiding.

Or rolling out AI because of the act, we're actually finding that having that legislation in place and that supporting guidelines is encouraging them, and I think it's a really good benchmark by which businesses can, you know, develop very AI governance strategies.

Alex: That's really interesting 'cause it shows that actually it's giving businesses the confidence to do things in the right way.

So for those who don't wanna sit down and, and read the full EU AI Act, can you just summarize what the main elements of it are that, that businesses need to be aware of?

Ben: Yeah, so I like to say it's, it's a risk based approach and what it's looking at, it's mainly dealing with high risk AI. Or AI systems and they're ones which can, you know, potentially cause harm to people and by harm that could be if it's handling sensitive data, for example.

And one of the things that businesses need to do is to be able to basically rate AI systems and then, you know, that call as risk. They've got able justify that and they've got to be able to publicize what AI tools they're using and what the risk level is. And that's almost fit in a nutshell. And it's about having a risk-based approach to your AI systems and your AI tools.

A good approach for businesses to take. So I always say there's nothing controversial in there. It's just number one, make sure that you know what AI systems you're using or AI tools you are building, and then assess the risk.

And then, you know, borrowing from ISO 42001 and do impact assessment on how is this potentially gonna impact people. And then you've got your evidence and then you've got So benchmark.

Alex: And how does that compare to GDPR? 'cause it sounds like there is a similar stance in that. What they're looking for is for you to take action and to go through the process of acknowledging the different risks.

Is it similar in terms of the approach?

Ben: Yeah, I think the approach is very similar and the sort of the need to be aware of the legislation is very similar. The difference is GDPR focuses on data, whereas the AI Act focuses on decisions and outcomes and harm. So it doesn't just ask. You know, was the data lawful, which GDPR would ask.

It asks, is the system safe, explainable, and appropriately governed and know? A lot of this comes back to when we think about ethics and the ethical use of AI. When I teach on some of my courses, the time we run, the two key words I say are fairness and transparency. And within transparency comes the explainability.

So if you are using an AI system or you are giving your information that's been put into an AI tool, is that system or tool safe and is it being explained to you how your information's being used and is very for governance and guardrails around it? Like I said, it's very similar to GDPR. It's got much broader scope than,

Alex: and how are they monitoring and enforcing it?

Ben: So this is where I say it's a bit like. GDPR with teeth because one of the things about GDPR was it was monitored by the information commissioner's office and when GDPR first came in, there was a lot of talk about fines and there was a lot of talk about, you know, there was a lot of scaremongering about what's gonna happen if you are fall foul of GDPR.

And actually for most organisations. You know, you get some guidance from the ICO and you know, you get told, please change practices and, you know, it tends to be pretty major breaches. Um, big organisations which get fined the EU AI Act is gonna be enforceable by, you know, obviously different EU countries.

And the understanding is, is that they're gonna be a lot more punitive in terms of. In terms of holding organisations to account, and again, it's sort of where we think this is going, but some countries, so Germany for example, is going to be even more strict. So there's more of a risk. While this has still gotta play out, we've gotta see what happens as it gets implemented.

There's potentially more of a risk than I would say was posed from the information commissioner's offices.

Alex: And you can see how as you are looking at that risk-based approach, shadow AI is gonna cause a real problem with being able to identify what tools are gonna be used.

Can you just explain to us what Shadow AI is and what are those risks?

Ben: Yes. So Shadow AI is when staff or individuals in an organisation use AI tools outside those to be officially approved. So it's a bit like my example I gave earlier, which is you're doing a piece of work and you've got ChatGPT on your phone and you put in some questions to help you to write a report or something.

And that's shadow AI. If it could be things like unauthorized natural language processes like chat, GBT or Gemini note takers. Which we see a lot popping up on Zoom calls and team calls, some browser plugins and people use them because they're helpful and they're easy. And I've got a plethora of tools open on my various screens and various desktops, and it's so easy just to fall into using them.

But if it's not on that officially approved list. If it's not under the scope of the AI policy or the governance framework, then it's shadow AI. And then the risk for the organisation is that there's no visibility of these tools. There's no audit trail, and there's no control over any data or outputs that are coming from them.

So it's kind of like a blind spot. And from a governance perspective, that's that's not great.

Alex: And where does the responsibility lie around that? So I've got a friend who uses a note taker in work. It's transformed. His working week, saves him hours every week, but he's too scared to tell the organisation that he's using it 'cause he's worried they're gonna turn it off.

So where does the responsibility lie?

Ben: Ultimately, the responsibility lies with the organisation and with the leaders in the organisation because it comes back to governance. Governance ultimately sits at the top of an organisation. You need to have an AI policy. Your AI policy needs to state what we can and what we can't use, and if there's something we can't use and we wanna use it, what are the processes we go through for seeking permission to use them?

If you've got robust governance in place and then people are still using shadow AI, then it becomes a responsibility of individuals who are using it because they're in breach of the AI of governance framework. You can't start to look at it and deal with it unless you've got the governance systems in place.

And that example you give is quite a common one, I think. And I would suspect that in that organisation there aren't rigorous governance mechanisms in place. So for your friend, it's probably unclear. What they are and what they're not allowed to use or how they go about getting approval to use things.

And that uncertainty leads people to think, well, I'm just gonna use this and I'm not gonna say anything. You know, because it's not clear. So it's gotta rest with the organisation and the leaders and managers in the organisation to set up the frameworks around which AI can be safely used.

Alex: So can you just bring that to life a little bit?

If you're looking at working with an SMB organisation around their AI policies, what sort of questions should they be asking? What should they be including in, in that final document that they're working on?

Ben: So the starting point has got to be what are the business objectives? What is the point of this business?

And then it's how are we going to use AI to achieve those business objectives? Because it's got to be a rationale for using AI. You don't want to just be running around using AI because it's cool to use AI or it's the latest trend. If, for example, it's a sales orientated business, then using AI to free up people's time to automate mundane tasks, to give people more time to get on with their core role, which is selling.

A valid use of AI to meet those objectives of business. So you've gotta start with that umbrella picture. You know, I'll caveat that with, in most organisations, using AI to save time is going to be a big fit. But you still link it back to business object. Why do we want save time? Well, if we say time, we're gonna allow our specialists to go and do their specialist jobs, for example.

And then it's gotta be, well. What AI tools can we use to enable us to meet the objectives? And then how can we make those AI tools safe? Or if it's an organisation which is developing AI and developing these AI models, how's that align to our business objectives? And again, comes back to those ideas of looking at the decisions and the outcomes and the potential harm from AI.

And then underpinning all of that has got to be training and awareness about what AI is and how AI can be safely used in line with the policies. A lot of people still use AI, like a glorified search engine, and so there's two things off that. One is you've gotta have that understanding in order to have that governance, that you've gotta be really careful what you're gonna put into AI and what guardrails you've got set up.

So for example, people need to understand the implications of using the free version of ChatGPT, and the lack of control and provenance they have over the data they're then putting into it. There's also about using AI properly, and this isn't necessarily a governance thing, but this is more a, are we getting the best use of AI?

Are people using it properly? Or we utilising these tools that we've got. So I think there's a big raft of training and awareness, which sits I policy. It's not.

Allow it to be put into practice.

Alex: Yeah. So you have that education and awareness both at the management level and at the teams who are using the tools, and then they're using that essentially to make their own decisions of what should be included in the policy and what they're comfortable with. What are the gotchas within that?

What are the things that are kind of people stumbling over or not considering?

Ben: So. I think part of it is not necessarily considering what data is being put in and how data is being put in. So an example being is if you are using an AI audio tool. So we're having a meeting and the audio tool is recording this meeting.

There's no legislation which says, I have to tell you that I'm recording it. I record it for my own purposes. That's fine, and there's some good tools out there that if you are having a discussion like we're having, that you could record it and then play back afterwards. If I then uploaded that recording into ChatGPT and asked it to give a transcript every discussion, then I'm in breach of GDPR.

Because I've then processed your personal information that's come from the meeting and which I've put into an AI tool, and it's those sort of things which can catch people out because there'd be no malice in that. There'd be no ill intent in that. On the surface it seems like, well, actually that's a good way of, you know, instead of me trying to write minutes during the meeting, I can do a recording, put it into chat, g pt, get a summary, send those meeting notes out or something.

But you can see how someone can be easily caught out with that and.

GT is the free version. It's not been authorized. It's not got the guard rail for. Suddenly you're falling into a trap of using AI and being in breach of GDPR and potentially other other regulations.

Alex: And, and some people will hear that and immediately panic and say, right, we have to stop using note takers.

How do businesses overcome that? How do they kind of balance that desire to do things with remaining compliant?

Ben: So I think it goes back to when I work with businesses, I always talk about pain points. And it goes back to what said, establishing how and why you are using AI and how it aligns with the business objectives.

Now, if you look at pain points, pain points, for example, quite often in businesses are the amount of documents we have to read, the amount of summaries of meetings, the amount of notes from meetings is a pain point. So. You kind of need to get that outta the open. Now, one of the solutions strategy using note takers, so let's identify that as this is something that as a organisation, we wanna use AI to help us because it make us more productive.

And then let's decide the best and safest way of utilising this technology. And then let's give people training on how to use it and support on how to use it. Rather than just sort of allowing people to go off and find their best use of AI. And I don't think people should be scared about it. And I think if people are in organisations, go back to your colleague and your friend.

I think there needs to be mechanisms within organisations where leaders and managers are saying, tell me how you using AI and tell me how it's. Better how it's making your working life smoother. And then let's see how we can incorporate that into our governance structure and into our, you know, overall corporate use of AI.

So one of the things I would, I encourage leaders managed to do, if they're starting down this road. Putting governance framework is to have conversations and find out how and where people are using AI. Because what you don't wanna do, individual a. From marketing has found two or three great AI tools, which is making them more productive and is also, you know, allowing them to meet their KPIs quicker and more successfully.

Well, you want to be listening to that and taking that on board and look, they can roll that out. So I think again, it comes down to the culture of the organisation and being led from the top to not have a sort of punitive system in place. Come on, tell us what are you experimenting with? What are you using AI, and then how can we make that safe?

Alex: And there's two elements to that. So there's the how are you using it, which you've touched on. You touched on briefly their tools as well. So would you say choose the tool that you want and think is best, and then. Build the guidelines around that, or would you use the guidelines to choose the right tool in the first place, and would you dismiss certain tools because you don't think they're as secure or as strict?

Ben: Yeah, that's a good question, and I think it's a combination of both to a certain next step. What I would normally do is I'd do an audit of what tools we're using and then examine them to look at how safe they're, how reliable they are, how cost effective they are. And in parallel with that, I'd be looking at around what we want to achieve in our frameworks.

What tools can we suggest? Because. If you go too far, either way, you're gonna end up with problems because if you're too punitive and say, the only tool we can use is Copilot because we've got all the safety mechanisms in place with our 365 subscription, then you're probably gonna get people using shadow AI.

And one of the problems with some of the AI tools is they're relatively cheap. So, you know, I'm working for an organisation. They say, you can only use Copilot. I might not think Copilot is the best tool for what I want use, but I can to. A different model which I can then use like say on my phone or on my computer at home. And so I think if we're too punitive, there's the real danger of that. But on the other hand, we don't want to just give free reign and say, go and use whatever tools there. So I think there's got to be that sort of middle ground, but also there's got to be a constant dialogue because AI tools were evolving so quickly.

And you know, it's almost like some sort of arms race. You know, we think that maybe 12 months ago it was chat, GPT and ChatGPT was the future and that's what everyone was using. And now it's, you know, Claude seems to be the thing which is streaking ahead. And then, you know, Gemini. So, and there's got to be some sort of flexibility.

I understand why a lot of organisations, for example, insist on using Copilot, but I would be devil's advocates and say to them, yes, I can understand why you are using Copilot in terms of safety features, et cetera, et cetera, and the fact that are you being. As productive as you can. Is it the best I tool for your organisation at the moment? And if it isn't, then you look at your governance systems and say, well, actually Claude is going to make our business run better and faster, more efficiently. So let's use Claude and let's go back to governance.

Let's see how we can use Claude safely and in a way that's managed properly.

Alex: Yeah, and I've had similar conversations and actually then broken it down and said, well use Copilot for these tasks and these elements, and then you want to use something else, ChatGPT for these elements, and you, and you allow to kind of have that flexibility for using the right tool for the right task.

As you say, the challenges, they're just continually evolving and suddenly you might say, well, those are our two, and then. As you say, Claude is kind of the, the darling of the moment and uh, everyone starts wanting to use that and it's almost whack-a-mole when you look at that, that shadow it element of it.

Yeah.

Ben: My advice to companies is to create some AI champions and have your AI champions for wands who might be using AI outside of work who are keeping their finger on the pulse of AI news and. New developments and new rollouts and have that dialogue where they can bring forward suggestions. I hate saying committees because I don't try to encourage people to have committees, but having an AI committee where you've got your AI champions where you can come and keep abreast of what's happening and how it could possibly be used, and then using it in a way.

Like you would if you are rolling out new applications or new software, you know, you can have a sandbox where you can maybe use it or you have it limited to a few users while you trial it and then build out your governance systems. I am going to add a caveat to that, and I did sort of almost hesitate before I said roll out of apps and software because one of the problems I've encountered quite a lot is some organisations treating AI like.

Roll. And quite often that's 'cause AI kind of looks like software. It feels like software often sits within the realm of your IT department or you know, something like that. And there's a mind shift there. And I'm sure you've come across this that. Software. That's quite straightforward really, isn't it, in the sense that a software tool becomes available.

Leadership and management either are convinced or decide they're leading, that they want to use this and adopt this. You buy in the tools, you train the staff, and then it gets used and you move on to next thing. AI is not a software rollout, and AI is bigger than that. Because it's not a single entity that's gonna do a single job.

And you've got, with AI introducing, you know, unpredictability, you've got unpredictable outputs, you've got risk of data, leakage bias, legal exposure, all those things linking back to things like the EU AI Act, or if you've got a management system, you are operating under the ISO standards. Noncompliance up.

So there's a danger that if organisations treat AI rollout in the same way that they do software rollouts, that they're gonna lose control before is even in place and implemented. So some of the mechanisms are similar. For how do you bring to the table the idea of using this new i I tool or in a similar way that you might bring to the table a new software product, but it's very, very different and it's much bigger.

There's bigger governance issues and it's a bigger whole organisational thing I would say.

Alex: Yeah, I'm glad you brought that up. You could see me smiling the whole way through. I talk around that quite a lot and I think you've covered it well from the, the governance perspective. 'cause it is just a lot less binary and actually it won't work first time.

Typically. It's a lot more unpredictable and a lot more refinement that needs to go on. And as you say, it's, it's a whole organisation thing. Everyone has their part to play in that. That's not just one team who's responsible for rolling it out or training people on the software.

Ben: And I think it's interesting, just to come back to something you mentioned earlier was using specific AI tools for specific tasks makes governance easier potentially.

And this, I think, highlights the difference between the AI and software rollouts because typically you'll have software which will do a task or a series of tasks which are related. So you might be using software. To do with something with sales, or you might be using software to do with something with marketing or, you know, AI is so multifunctional, has so many multiple uses, and you might be implementing a new CRM, which pretty much is only gonna do the CRM, so.

People in the organisation aren't necessarily gonna use that, or you know, you're not gonna necessarily use it for something else, but you might be using an AI tool, something, say your social media, your organisation, social media and monitoring and writing posts and respondents posts, for example. But tool will be able to do lots of different things as well.

And you might have it for one thing, but suddenly it's like, well, let's do this. But we can also use it to write our reports so we can use it to do our tracking spreadsheets or whatever. And I have seen some fairly big organisations. One of the Big Four actually, I've done some training on their apprenticeship program.

They're very clear. They have inbuilt AI tools, and this is for their accounting or. And it's very, very clear what you can and can't use these specific tools for. So. You know, there's one tool which is used for historical information, historical records, searching through it, finding things, which you're allowed to use that, but you're not allowed to use it to write proposals for clients.

And they're very, very clear that they've got different tools for different purposes, and they have robust policies where it becomes a disciplinary matter. They are misused.

Alex: Yeah, that makes sense. And I guess that ultimately probably starts with looking at it by departments and you might say, well actually we're comfortable with marketing using this because it's all stuff that's gonna be in the public domain anyway.

But we're not happy with HR or finance using this tool, for example.

Ben: I find sometimes it's more challenging when you've got smaller organisations and you've not necessarily got clearly defined departments or you know, you've got smaller departments that cross over more so in large organisations where you've got a HR departments or HR function and a finance department, finance function is sometimes easier.

Your finance team will be looking at finance and maybe tools which are just using finance, and same with hr, et cetera. But if you've got a smaller organisation where you've got, maybe HR is also covering some of finance and maybe some of the marketing as well, who knows? And then you haven't got those same clear defining lines, and so it can be trickier.

Alex: So we've covered a lot of ground here. I'm gonna ask you to try and sort of summarize, if you're talking to those small and medium sized businesses, what are the top five things that they should be really considering and and putting into their policies and their governance?

Ben: Yeah, so I think my top five would be one approved and prohibited AI tools.

You know, and that's likely to be an iterative process. As things change and develop, like we said, but you've got to spell out what we can and can't use. Clear data handling rules, you know, how we're handling the data that we're putting into AI. Are we. Anonymizing it first. Are we ensuring that we only put certain categories of data in?

What are the expectations for human oversight and how are we going to have that human in the loop and look at is the AI doing what it's supposed to be doing? How do we deal with issues that might arise? I'd say having clear mechanisms for escalating risks and reporting risks or reporting issues, and that really needs to be inside a no blame culture is something I've talked a lot about for years in work with privacy is something goes wrong, we need to know about.

And escalate things without fear of repercussions. And finally making sure that there's an alignment with applicable laws and regulations and we're using things ethically.

Alex: Perfect. That's great. Great summary. Thank you. I'm gonna move to the quickfire questions now.

What's one thing you do regularly that helps protect your mental health?

Ben: Okay, so this is a bit geeky. And I wouldn't expect everyone to do this, but I build model airplanes, and the reason I'm saying that is it's something that I can do that allows me to sort of switch off. So I wouldn't say to everyone go build model airplanes, but I'd say do something which just lets you switch off and I don't.

Build fanatically, but maybe 10, 15 minutes. At the end of the day, I'll have a model on the go. I'll do a little bit with it. It just lets me switch off, focus on that, and then I'll put it away so I have something which allows you to switch off

Alex: away from the screen as well. Nice.

Ben: Yeah. Yeah.

Alex: What's the most unexpected way that you've found AI has helped you?

Ben: I think using AI as a kind of critical friend, and if you set up a natural language process like ChatGPT or Claude, and you put a couple of prompts and settings into it where basically you don't want it to. You don't want it to try and please you, and you actually explicitly say, I want you to be critical.

I want you to challenge, I want you to explore ideas in depth with me. Then it can actually be quite a good way of sort of testing ideas and being that sort of critical. You do bear, remind me. It is only an AI, it's only a tool. It's only a machine, but it does pose and ask questions, which have made me think and have made me reflect and made me refine my way of thinking.

So yeah, it surprised me that I could use it as successfully in that way

Alex: and in the grand scheme of things. AI. AI excite you or scare you?

Ben: Oh, it me, I think there's a lot about, I have a belief. I don't think. Achieve full AGI. And I've said this a lot because one of the things I used to teaching, I'd teach some of my courses on an evening, and especially in the summer, and we've got quite a nice summer house in our garden. So I'd finish teaching maybe about eight o'clock, and I'd like to go and sit outside and catch the last sort of hour of sunshine and I'd walk up the garden path and inevitably I'd smell the flowers that we've got in the hanging baskets.

I'd hear birds singing. It makes me happy and it makes me happy without me realising. It makes me happy. It makes me happy on a subconscious level 'cause it's appealing to my senses. I'm able to smell the flowers, I'm able to, you have the sun shining, the birds singing. It's all about sense and it's all about how that affects us.

And artificial intelligence will never be able to have that. And I think that is what is gonna define us. We can have things which clever. If machines can be clever, we can have things that can solve problems. We can have things which can do logical arguments and big computational problems, but it's never gonna be able to have that.

This is what a flower smells like. This is what a bird sounds like. And I think that's what sets us apart and that's why I think we'll never be able to get agi. And then on a more really practical level, we can just pull a plug. It goes off. So I think it's something which, it's a tool. It's gonna change the world.

It's changing the world. It's gonna change how we do things. It's gonna pose lots of challenges. It's gonna pose some threats. But as with everything, you know, there's always negative sides and positive sides. And I think positive are gonna vastly out negatives much.

Alex: Brilliant. Thank you, Ben. That's been a really fantastic episode.

Thank you.

Ben: Thank you very much.

Want AI in Your Business Without the Risk?

BrightKeel helps leadership teams adopt AI safely, with the right policy, training and guardrails from day one.

Explore AI Adoption Strategy for Leaders