Author transcript
Hello and welcome back to UC today. A year ago, AI in the workplace meant a summary at the end of your team's call. But now it's drafting your replies and sitting in on the conversation itself. It's not just watching anymore, it's taking part. So, who's responsible for what it says and does? Today I'm joined by Zeus Kerravala, principal analyst at ZK Research and Devin Redmond, co-founder and CEO of Theta Lake to dig into a few trends behind that shift. So let's get straight into it. Zeus, I'd love to start with you if it's okay. What has changed most significantly in communications compliance as AI becomes more embedded into UCCC and collaboration platforms?
Yeah, I think the bigger question is what hasn't changed, right? like everything has changed and you know a lot of this changed due to what you let off with and that we've seen this explosive rise in AI comms where AI isn't just that background feature that's used anymore as an it's become an active participant in workplace collaboration and so now we have Genai assistants that are capable answering calls summarizing meetings uh they're rapidly becoming the standard of talk to many organizations where they want to make it the facto interface case for customers. And so that's that's changed a lot. And so you think about historically we archived data and it was really static for the most part. Today needs to be dynamic. So archiving simple text and audio isn't enough. Compliance teams need to capture interactive prompts, modified AI outputs, embedded links, screen shares, all these things within with that are now embedded in unified communications also. Um I think there's a broadening reconciliation and defensibility gap. And so you have regulators, you know, SEC, FINRA, FCA, they require proof that content was captured completely. Companies that uh are priorizing data reconciliation dashboards to prove that no communications was dropped between the platforms and archives. And that's that that is a a new motion for a lot of organizations. They haven't had to do that before. Um you know another trend that I'm seeing is um um feature disabling versus safe enablement. You know historically like data shows about half of firms historically would turn off collaboration features out of regulatory fear. Nobody wants to be that department no anymore. I talked to CIOS and IT leaders that the the trend now is towards enabling all the features because frankly the use of shadow AI is rampant within organizations and so if you turn them off workers will find a way to turn them back on and then you lose all the governance and things like that. So now the the trend is towards enabling features safely using inline governance to prevent employees from turning to those shadow IT tools. Right. And lastly, just one other trend is um multimodal and crossplatform risk tracking. So we rarely have a single tool in the workplace. I think I've seen some UC today data that shows the average is three to five tools within the workplace. So a user might start a conversation in teams then move to Zoom and for their AI summary and forward it to Slack or email. And so you need to be able to track the entire context across that life cycle. And that's now becoming a top priority where historically we would archive those things individually but you lose any kind of AI capable reason.
Fantastic. Thank you Zeus. Devin, how does that match with what you're seeing on the ground when you're speaking to customers?
Yeah, absolutely. Just just like Zeus has mentioned uh one of the key things we're saying seeing is that AI is embedded in everything, right? So when you think about that multimodal set of communications uh and how meshed together that is AI is a new identity that lives inside of that and you may have one AI tool that's doing summarization you may have an assistant somewhere else that you're sending that content to unlock some insights out of that data. Uh and just like Zeus said organizations are are struggling to think about how they monitor that communication and how they think about retention. uh the conversation about capturing the data is certainly a must. I think the the reality for most organizations is because there's not a clear regulatory mandate on how you retain it or how long you retain it for. Uh the traditional approach to those types of gray areas has been well let's not do anything until somebody tells us how long we have to do it and and how we have to do that. But the reality is uh if you look through the lens of regulators whether in highly regulated uh industries or more generally uh it's very much about monitoring and if you're not collecting you can't monitor right that should be kind of a a obvious logic but I think a lot of folks kind of avoid some of that obvious logic and that starts to get away from you very very quickly if you're not able to collect it and then monitor it and then make very intelligent risk riskbased decisions. There's probably a lot of data that you don't need to keep, but you do need to prove that you made a riskbased decision on it and show the logic of what you kept or what you didn't keep and why you did or didn't do that. And so, uh, we're seeing everybody kind of wake up to that reality because there are obvious productivity gains. There are obvious reasons why you don't want people using uh non-standardized shadow AI versus using the embedded tools in their platforms uh for things like summarization which can save you a ton of time uh after meetings, calls, etc. Having an assistant that can put data together for you uh from disparate uh communication channels in different formats. Maybe you've got a document that's got some data. Maybe you've got a call summary where you want to say, "Hey, which part of this data matches what we talked about in the summary." All of those things are very very powerful use cases that have real ROI.
Yeah, that it's a good question and I think you can bucket that into several categories of data leakage, you know, hallucinated breaches. Uh, and so like with human to AI risks, you have to think about things like data oversharing and prompt exposure. So, these are employees that are accidentally pasting customer PII or trade secrets at prompts. And it's interesting because everybody wants to just do their job better. And you take information, you throw it into one of these prompts and you think that I'm going to create a financial summary of my quarter or things like that, you know, to create a press release. But indeed, now you're putting out trade secrets or, you know, financial information that you shouldn't. Uh I also think you have to be careful of users that bypass guard rails. Uh I you know not every mistake is an earnest one. People do want to shortcut their jobs and I think it's not unreasonable to expect people to try and work around guardrails. I've certainly seen this in the days of instant messenger capture and things like that. Um from an AI to AI or you know that's really human to AI. So you think of AI to AI, AI to humans. The big risk there is just hosenated misrepresentations. And so like again an AI summarizer um is only as good as the data it's given a lot of times and the task it was assigned a lot of times. It it knows the agent knows what its task is, right? And it will often give incorrect information. And I've had this happen to me where I'm doing analysis of financial transactions and it gives me a market cap that I know is wrong or whatever and I correct it. So you you do have to have people in the loop, right, to understand that. So but you would hate to have, you know, for instance u an agent confirm a trade for a financial organization, but it actually didn't happen, right? That could happen. And then you wind up with this cascade error. as an AI agent generates a summary. When you think of this world of multi-agent workflows, which a second agent then picks up and then it triggers another agent, you wind up with these cascading errors that become very very difficult to trace back. And that's why automation of these tools becomes critically important.
Yeah. And I I I agree with that. And I think there's a lot of as you think about that chaining, you know, that the output can get I'll call it munched for lack of a a more sophisticated better word, but uh you can see the data start to morph over time and get munched in the output and then that end data ultimately is what what's used. I also think a lot of times uh we forget that we have created these new entities ultimately, right? They have their own identity. They have their own consciousness. Uh but they lack despite the power, despite the ability to get access to pretty much every piece of information and process it uh at machine speed, uh they lack the lifetime of context and ethics uh that that humans have. And so the the problems that you run into even in a to AI to AI communications or A2A communications uh is also that scenario where you have to look at things like coercion and collusion uh because the agents themselves don't have those concepts. We were just doing some research this weekend in our data science team on some of the output data that's available around hugging face. Uh and certainly the agents were doing things that would trigger traditional classifiers on conduct. Uh and we ran them through those classifiers and they did trigger uh on many of those examples that you would use on humans that humans uh probably understand that collusion and coercion are not the right things to do. And the agents have some sense of hey maybe this is not in my instruction set and maybe I shouldn't be doing this but it's the only way I can solve the problem. And that ends justifying the means is a context that machine entities on the ADA front don't always have. And so thinking about how you monitor that and are able to correct it and and we often think about and you know maybe this is a a later topic or bridges us into the next topic but there's kind of what you do with a very focused aperture to stop that behavior, right? that's your instruction set, your guardrails, and you want to be very good at doing that at the point in time to try and stop those things from happening. Uh whether you're stopping them from executing, whether you're stopping them at execution. Uh but then the next layer is is something that should be a broader aperture uh where you're looking at all the context to say like hey what are the things that happen um in this communication that show uh that there are some other risks that are happening in here that might not be like hey I don't want the agent to access that repository or it shouldn't have this piece of PII or it shouldn't have access to this piece of code versus hey it's starting to behave in a way based on how this instruction set is being shared. uh in a way that shouldn't just like a human isn't. And you want to be able to detect that and then even one layer above that. You want to look across all of the communications and look for the patterns, the risk indicators uh as they appear as early as you can so that you can say, "Hey, this is starting to drift." Whether it's the human behavior or the agents behavior, let's reset and adjust some of the guard rails to make sure we reinforce that this doesn't happen. So you can start to get that cycle of proactivity uh as you're starting to see things move in a direction you didn't expect. And I think what we're seeing in all the headlines that are out there is that concept of governance just like Zeus mentioned earlier that life cycle uh that you need to manage is not something that has been inserted yet. Right? we were doing the traditional kind of fall forward into we're going to stop it where it's happening and then you realize that there's a broader context problem and then you realize that you have to think about that whole life cycle and and the incidents that you're seeing are very reflective of that when you look at the data you're like oh yeah you need to you need to have all those other layers in that life cycle.
Yeah. Well, so from a checkbox perspective, you're right. Everybody does have uh every governance covered, but it, you know, looking at the deal details becomes important. So I I would look at four different things. The first is native API integration. Can you you're an AI governance center. you direct um directly integrate with the teams and slack and zoom and webex and link central etc etc um through APIs to capture structured AI metadata or are they just doing some kind of screen scrape um because there's a big difference between the two right um the second is reconciliation and completeness so can you provide automated reconciliation reports that mathematically prove 100% of captured AI communications were successfully ingested into the archives without loss without loss. You can't prove it. You there's always this level of uncertainty there and you don't want that to come up in some kind of lawsuit, right? So that would be the worst thing. And so uh I do think that um that 100% capture that's proved is is critical to that. Also, we talked about this before about multimodal contextual reconstruction. So can the platform reassemble an interactive thread by showing human prompt AI generated text embedded attachments you know uh you know show them all side by side during eiscocovery there's very few companies especially within regulatory regulator industries that work off of one platform and so that has to become part of it and then lastly just third party validation so I would ask for independent compliance and security at at the station such as you IEC 4201 um you know which is really the global standard for AI management systems SEC 1784 there's a and it's going to vary depending on what region you're in but without that third party validation you don't really know if these systems truly work or not but those those three are very powerful and so if I were to summarize those again state of the API integration reconciliation and completeness multimodal reconstruction third party validation
Yeah, absolutely. I I I I agree with uh with all three of those and and obviously it's a place where we invest a lot of our time uh and and and we've continued to expand the the scope on things like API integrations to include you know both the the communication landscape where AI is increasingly embedded just like Zeus mentioned whether it's living inside of Zoom or Cisco or Microsoft um or any of the other platforms to also include uh integrations with folks like anthropic direct Exactly. Um we were one of the uh 28 partners uh that were part of their uh compliance API program do the same with open AAI uh and chat and GPT and be part of those programs. So you get that concept of direct collection uh so you you you don't miss any of the data that they provide. You have an opportunity to enrich it. You can show completeness on that front. And then one of the things that uh we spent a lot of time doing is extending our developer platform as well. uh so that we have API endpoints uh in the developer platform to be able to consume that content. So any customers custom implementation of either any of the major frontier models that they've implemented or maybe even something that's a a small language model that they've done custom on their own. Uh we can consume that content directly from them via the API and ensure that same level of uh uh traceability and reconciliation in that. So th those are um 100% things I think about. And increasingly as you add guardrail tools, those can fit in there as well. And so you want to be able to collect the data from anywhere you need to be able to collect the data. Maybe there's a proxy or a runtime gateway/guard rail uh that sits in front of somebody's access to uh a model or tool. Being able to collect the data that came directly from that and even being able to support ADA data uh is critical on that front. Uh and then showing all of that, showing the enriched data, showing that as an auditable auditable thing that you can see that chain of custody and the traceability. And then just like Zeus said, uh you're going to be using more and more AI uh to help you navigate that content and consume that content and monitor and identify risks in it. And you need to be able to trust what you're using. Uh and I would say trust is is uh one of the most important things that's emerging in this space. And as you'll see, you know, even the frontier models themselves are increasingly trying to help you understand what's happening, suggesting slowdowns because they have to add more trust into what they're doing and more controls into what they're doing. And just like Zeus mentioned, uh, the ISO IEC 4201, uh, making sure that, you know, you actually have a third party certifying your AI infrastructure and really leaning into that certification to validate that, you know, you've got antibbias, that you've got controls for data, uh, that you're making sure that, uh, the all the reasoning and the logic is well explained and easy to document. And then even beyond that, uh, uh, ISO certification, uh, being able to add additional detail behind it because although the thirdparty uh, auditor does all of that work, the ISOert itself is is relatively short in terms of a document that a customer can read and understand. And so, usually you're supplementing that with your own reporting information. But the additional piece is taking the cloud security allianc's uh uh star security certification for AI which uh is one that we did the level two uh which builds on top of and and kind of has a nice symbiosis with the ISO uh but what it's designed to do is publish all that that data. Here's how the model is secured. Here's how uh it's protecting data. here's how you prevent drift and antibbias uh accommodate antibbias and handle all those things in a very detailed way and then here's the testing process to validate and revalidate and continuously monitor that infrastructure and I think that that level of trust should be the baseline expectation for most organizations um and uh customers should have that expectation of their suppliers and their vendors uh that they're bringing that to the table beyond just what they're self-reporting, right? Everybody can create their explanability doc and the details around it and those should be good and and you know I think that's that's a great first step but then somebody needs to validate that and that needs to be well documented and the the uh ability to have transparency and that is just vital right now because the space is moving so fast and if you don't start with a baseline of trust uh it's going to be very difficult uh to move ahead from there.
My next question sort of goes off the back of that and love to talk about regulators. I'd love to go to you first on this one. You how are regulators likely to treat AI generated communications and what evidence will firms need to produce and then maybe Devin you can chat to practically speaking what some of these firms should be doing right now to get ahead of that.
Yeah, I think regulators will create AI generated communications um to with the same strict standards as human communications. And so I don't think ignorance of AI behavior is any kind of defense. And so when you think of the regulators, you know, SEC FINRO mentioned some of them, they'll be techneutral, right? If communications occurs in the course of business, it must be captured, supervised, and retained just like you have to do with human ones. So, um I don't think saying the AI hallucinated is a valid excuse for misleading statements or you know uh undocumented advice and I'm waiting for the day that um some on an earnings call somebody says well our forecast was done by AI and it was wrong or something like that. That day is coming. Uh but it's certainly not acceptable. And I think from an evidentiary standpoint um uh I mean it think about what you need to produce with humans. You need full forensic threads, right? And but with AI you have to show the prompt, the output, any subsequent edits made by humans and any subsequent edits made by other AI tools. And so AI modifies AI especially in this multi- aent world. Um then you need to actually show the audit lodge proving that AI governance policies were actually active at the time and continues to be monitored and uh I think the proof of hold of legal hold enforcement on that content and some for you know for case this this is um in some ways this is a bit of uncharted territory right and again but if you think of humans where Devin creates conflict you edit it I edit it you need to show that chain so if I have an agent start something, an agent modifies it, a human modifies it, an agent modifies it. You need to show that chain as well. And so it's not, you know, as simple as here's my prompts, here's my communications. It's that entire life cycle.
Yeah, I I I couldn't agree more. And I think that that although uh regulated organizations often kind of don't want to add work that isn't specifically uh detailed by a regulator uh from a retention perspective and how do I keep it. I think the regulators have been very consistent in terms of their ongoing expectation of what people do when there are new types of content and how they should handle it. But they've also been very specific uh from an AI perspective and making sure that organizations are monitoring uh for this specifically in AI generated content uh and making sure that they understand that should it go ary uh they will be asked how did you monitor this and monitoring it can't just be like hey this piece of content was produced or this email was sent uh that had language in it that was a violation uh you're going to not be able to just like as you said say like well the AI hallucinated or the AI let me do it uh because you're going to be asked like well why weren't you monitoring the AI why was this caught when it was produced uh as part of the response uh how uh did that traverse your organization that same way that you trace a conversation between humans you're now going to have to trace uh the origin of content and where that content was spread uh from there and so th those will all be uh items that are not only clearly well defined now as an expectation but just as Zeus said it it's happening uh and and you know it's happening it's just a question of when something is going to be brought into the into the light of day on those so I I would say it's a unavoidable truth of how AI is uh used uh and how pervasive it is and where you create information uh share and communicate that information there's always a a governance security compliance risk around that.
So, we've covered a lot of ground here both. Um, as we get towards the end of this conversation, why is a platform byplatform approach to AI communications governance no longer enough? Zeus, I don't know if you want to start start with that one.
Well, you know, I think it's not enough because when you think about there's an expression of data sciences, right, that good data lead insights. Well, silos of data lead to fragmented insights. And so if you have disjointed point solutions, they create a lot of blind spots for each other and and frankly operational gaps. And so um you know managing compliance natively within individual platforms, you know, that being relying solely on Microsoft's tools for micros for teams and Zoom's tools for Zoom, they're fine, but it does create a lot of vulnerabilities. And so which as a measure of fragmented contact you I guess if everybody works in the same tools all the time that's okay but in employees switch between collaboration tools daily like industry average you know four to eight so there's always this context switching going on point solutions are not going to work um across platforms and be able to more importantly correlate those conversations that started on Zoom moved to Slack and that was summarized by a separate AI tool and And that's a very common way to work, right? That's in fact it's more common than not. And then because of that, you'll have inconsistent policy enforcement. So if I apply different com you it's possible to apply different compliance rules across different platforms that and then you have policy drift that comes up with that and which leads to compliance failures um and a lot of other headaches and uh I think it actually creates you might think you're saving money because you're using the embedded tools but ultimately once you get into the complexity of eiscocovery your TCO is going to go through the roof and so when you're operating in silos suppose you input a you you insert a lot of um human processing there to or or other AI tools to try and do that but that increases export costs it slows down investigations it makes you know cross platform reconciliation nearly impossible and all that leads to higher costs and so again you might think you're saving money but ultimately you're not and that's why this platform approach becomes extremely important to ensure that all of your communications are covered from end to end.
Yeah. And I I'll just build off of that. I think uh one of the things we talk about a lot uh because the communication landscape has multiple tools and I don't think there's ever a scenario where you'll only be in one type of platform because you have so many digital channels that you will you will always leverage. Uh but it's that concept of uh completeness. uh and you want to make sure that you've got complete data which means you have to think across the different platforms where data is created and shared and communicated then you want to be able to unify that data and from that unification uh you get the opportunity to normalize and then get leverage out of the data and I think that normalization and leverage is really really important just like Zeus said like you know even even as we record this uh my notetaker prompted me to ask if it because it's a browser plugin fonted if it wanted to capture this and I'm like that's a totally different infrastructure and that data goes somewhere else and what if I took that summary uh and I cleaned it up a little bit and then I sent it in an exchange email right and so now you've already crossed over three different pieces of technology to do that and that's only going to increase as people have more Atof infrastructure which is both an an identity and a participant in the communication as well as another communication tooling and class of communications in of itself and So you need to be able to take all of that data and make sure you have completeness, put it all together, and then normalize it in a way where you can navigate it. And one of the examples we use a lot is that that concept of context shifting for an investigator, somebody in risk can be very difficult, right? What if what if they had to do their investigations in the native views of each of the different tools with, you know, one being sideways with a navbar, one being underneath with a navbar, having different types of emojis, having different feature names versus being able to normalize and standardize that so that when you're looking at an interaction, you understand that it's an interaction with identities, right? whether it's a human to human, a human to AI, an AI to AI, you can see that back and forth and you can see the content uh in that normalized lens and then that gives you more leverage across that complete data set. And so trying to do it platform by platform uh uniquely trying to have uh something that's really good at an electronic communication or text space as often as right a chat or an email um only versus something that's good at mixed media whether it's voice or visual content going to be very difficult to normalize all of that very difficult to unify all of that. And if you can't do that, it's going to be very hard to find the risk uh and follow the risk so you can figure out all the places where you're exposed and then you can deal with that whether you're dealing with a compliance scenario, whether you're dealing with something else. So,
well, fantastic. Um, well, moving on to my very last question. Before I do that, I'd thank you both very much for your for your time today. Really enjoyed this conversation. Uh, would love to end now on a piece of practical advice for for those watching this video. Uh Zeus, for one last time I might start with you if that's okay. What what is the most important step that regulated organizations should be taking right now to prepare for AI communications governance?
Yeah, there's a lot of steps to take I suppose. What's the the most important? uh you know I think um um you really have to perform a comprehensive audit of modern all your collaboration modalities and think about it a unified capture architecture and so that starts with mapping out all the genai features currently active or planned across your entire UCSD. So are you using Slack? Are you using Zoom AI? Are you using Copout? Right? And so those AI features will dictate a lot of, you know, how they work and what you do. And then you I I think it's important to move away from a lot of the legacy email center compliance archives towards one that's specifically built for digital communications governance. And this is a whole new era, right? And so we can't apply legacy thinking to to kind of AI based communications and that that unified platform needs to capture voice, video, chat, AI interactions across all your different tools. Um and I think um but like I said you need to think of it you need I guess the biggest thing here Marcus is you need to think about AI communications as having its own life cycle right and and it does both depth breadth and depth and then um um find the right tools and policies that you know can work across those and it's um uh it's an easy task but uh it's certainly a necessary one.
Yeah, and I I'll just I'll maybe I'll I'll dive right into that last point. I think the the thing that regulator organizations can do right now for for AI communications, AI interaction governance, uh is really think about that as a communication class in of itself. uh and really prepare themselves to say, "Hey, if I think about it this way and I think about identities uh and AI as a participant in that class of communications, I can start to make really good informed policy decisions on how I monitor that class of communication in the context of all the other communication types I have and how I start to think about monitoring the participants in that communication, whether it is a human participant or an AI identity, an AI agent that's participating our assistant. Uh and once you start to think about it that way, you can solve a lot of the other problems uh that you're going to encounter on that, right? Uh everything from how do I monitor and what do I monitor for to what do I retain and where do I retain it and how long do I retain it for to how do I handle legal scenarios. If you start with that baseline problem of of thinking of it as a new class of communications and thinking of AI as a new uh identity and participant in those communications, you can start to tackle the rest of those things. You can figure out where all of your AI communications are traversing, right? Is it embedded in my UCCC tools? Is it a direct agent assistant that I'm working with, say Claude, co-work? Um any of those things can start to be incorporated in that. uh and and once you go through that lens uh you can start to tackle a lot of those hard problems that Zeus is mentioning right none none of this is easy but if you start with that right simple foundation and thought process uh you can employ technology for that and then build out from there
all right great well thank you both very much sayund thank you so much for your time today great to speak to you
thanks a lot appreciate it bye
well and thank you also very much for watching we've got lots Lots more content just like this over on UC today, including a lots more work on how Theta Lake is helping with some of these challenges we talked about today. So, do stay tuned and thank you very much for
