In this episode of the Future Proof HR podcast, Jim sits down with Lindsay Castro, General Counsel and Vice President of Human Resources at HCM Unlocked, to talk about how organizations can build AI governance that employees can understand and use in practice.

Lindsay explains why AI tools will continue moving faster than policies, regulations, and legal precedent. Instead of freezing or banning every new tool, she recommends starting with an inventory of how AI is already being used, assessing the data and platform risks, and giving employees clear examples of what is and is not allowed.

The conversation covers confidential information, human review, discoverability, vendor contracts, embedded AI features, biometric data, and the risks of allowing AI-generated recommendations to influence people's decisions without proper oversight. Lindsay also shares how HCM Unlocked uses cross-functional ownership, tiered risk assessments, approved-platform controls, and employee feedback to govern new AI tools.

The central takeaway is that a policy alone is not governance. Organizations need clear ownership, a repeatable approval process, employee education, and a living playbook that can change as technology, business needs, and legal requirements evolve.

Topics Discussed:

• Why AI tools are moving faster than policy and legal precedent
• How to inventory the AI tools employees and clients are already using
• Why leaders should learn the tools before setting employee rules
• The baseline rule for keeping confidential and client data out of public AI systems
• How human review prevents confident but inaccurate AI output from becoming a business decision
• What to evaluate when approving AI platforms and recording tools
• How retention, discoverability, privacy, and vendor contracts affect AI risk
• Why embedded AI features can create new exposure inside existing HR systems
• How legal, HR, technology, and employees can share responsibility for AI governance
• How tiered risk assessments and approval workflows control new AI tools
• What organizations should do when AI adoption starts from the bottom up
• Why an AI playbook must remain a living document

If you are an HR, legal, compliance, or technology leader trying to support responsible AI use without stopping experimentation, this episode offers a practical framework for creating guardrails people can actually follow.

Additional Resources:

• Cleary's AI-powered HR Chatbot
• Future Proof HR Community
• Connect with Lindsay Castro on LinkedIn

It's still a computer right?

2

00:00:01,849 --> 00:00:05,159

So it may give you an answer that

sounds authoritative but it could

3

00:00:05,159 --> 00:00:07,459

be the wrong information isn't it?

4

00:00:07,469 --> 00:00:09,009

It could be outdated, right?

5

00:00:09,519 --> 00:00:12,379

The tools don't wait

for the policy, right?

6

00:00:12,389 --> 00:00:15,049

The tools are not waiting for

the precedent or the case law

7

00:00:15,399 --> 00:00:19,229

if it shouldn't be shared publicly,

it shouldn't go into AI, right?

8

00:00:19,709 --> 00:00:23,049

Speaker 3: The pace of change

when it comes to AI is at a level

9

00:00:23,049 --> 00:00:26,019

where it's very difficult for a

lot of organizations to keep up.

10

00:00:26,639 --> 00:00:31,409

And When you're looking at the pace

of change being at that level, it's

11

00:00:31,409 --> 00:00:35,509

gonna be even more challenging to

establish guardrails and establish a

12

00:00:35,509 --> 00:00:37,359

foundation that you can operate from.

13

00:00:37,919 --> 00:00:39,459

So how do you actually tackle that?

14

00:00:39,469 --> 00:00:44,739

How do you build a compliance

environment when the technology

15

00:00:44,739 --> 00:00:48,949

is new, the pace is fast, and

there are a lot of open questions?

16

00:00:49,269 --> 00:00:52,569

That's what we're gonna actually

tackle in today's conversation.

17

00:00:52,929 --> 00:00:56,609

We're gonna examine what you need to

consider when you're thinking about

18

00:00:56,609 --> 00:01:01,699

your AI initiatives from a platform

perspective, from a legal perspective,

19

00:01:01,709 --> 00:01:06,179

from a compliance perspective, and from

an ownership and governance perspective.

20

00:01:06,179 --> 00:01:11,039

And we're gonna dig into all of it

and share some best practices on how

21

00:01:11,039 --> 00:01:17,030

you can set your organization up for

success even in the face of rapid change.

22

00:01:17,350 --> 00:01:19,149

So who's gonna guide us

through that conversation?

23

00:01:19,149 --> 00:01:20,660

Today we have Lindsey Castro,

24

00:01:20,710 --> 00:01:25,360

who is the General Counsel and the

VP of Human Resources at HCM Unlockd.

25

00:01:26,789 --> 00:01:31,440

Lindsey holds the dual executive role,

and she oversees both the legal and people

26

00:01:31,440 --> 00:01:35,660

functions of a high-growth consulting

firm with over 170 remote employees

27

00:01:35,660 --> 00:01:37,360

across the US and internationally.

28

00:01:37,710 --> 00:01:40,770

She's a Buffalo native and

earned her JD from the University

29

00:01:40,770 --> 00:01:41,950

of Buffalo School of Law,

30

00:01:42,190 --> 00:01:46,701

where she was recognized for academic

excellence She's built her career advising

31

00:01:46,701 --> 00:01:52,031

C-suite leaders on everything from

corporate governance and M&A transactions

32

00:01:52,031 --> 00:01:53,951

to employment law and SEC filings.

33

00:01:54,281 --> 00:01:59,321

She's a member of the GC Collective, an

invitation-only peer community elevating

34

00:01:59,321 --> 00:02:02,091

general counsels, as executive leaders.

35

00:02:02,461 --> 00:02:06,831

And outside of her day job, Lindsay gives

back to her community that she calls home,

36

00:02:07,071 --> 00:02:12,271

Serving on the boards of Literacy Buffalo

Niagara, the Canisius University Alumni

37

00:02:12,271 --> 00:02:15,961

Board, and the UB Law Alumni Gold Group.

38

00:02:21,028 --> 00:02:22,218

Jim: Lindsay, welcome to the show

39

00:02:22,532 --> 00:02:23,612

Lindsay Castro: Thank you for having me

40

00:02:24,300 --> 00:02:27,930

Jim: So this is gonna be a pretty fun

conversation and, depending on who

41

00:02:27,930 --> 00:02:31,930

you are, it may or may not be fun,

but you're an attorney and a CHRO,

42

00:02:31,940 --> 00:02:34,220

so you have two hats that you wear.

43

00:02:34,530 --> 00:02:38,530

So I'm looking forward to a really

interesting conversation, both from a

44

00:02:38,530 --> 00:02:43,820

people lens and also a compliance lens,

which your JD background falls into.

45

00:02:44,200 --> 00:02:47,710

So I think one of the key things

that we'll be talking about is

46

00:02:48,540 --> 00:02:54,390

you set up, a strong foundation of

compliance, as you think through

47

00:02:54,390 --> 00:02:56,829

your AI launches and AI initiatives.

48

00:02:57,110 --> 00:03:00,210

But before we get into all of that,

I think it's important for you to

49

00:03:00,250 --> 00:03:03,350

set the stage and tell us a little

bit about the landscape of the

50

00:03:03,350 --> 00:03:06,270

organization and your background and

how all of those things fit together

51

00:03:07,174 --> 00:03:07,574

Lindsay Castro: Yeah.

52

00:03:07,574 --> 00:03:07,954

Okay.

53

00:03:07,954 --> 00:03:08,474

let's see.

54

00:03:08,484 --> 00:03:12,534

So HCM Unlocked is the organization

that I am lucky enough to work with

55

00:03:12,584 --> 00:03:15,414

as their GC and their VP of HR.

56

00:03:15,414 --> 00:03:22,284

we are a managed services and consulting

firm, so we handle payroll, HR, benefits,

57

00:03:22,304 --> 00:03:24,654

compliance, data governance, all of it.

58

00:03:25,103 --> 00:03:29,024

we sit inside of our clients' payroll,

their HR, their benefits, and their

59

00:03:29,024 --> 00:03:34,204

compliance environments, and we run those

operations for them or alongside them.

60

00:03:34,644 --> 00:03:37,744

So in addition to having our

own proprietary kind of data

61

00:03:37,744 --> 00:03:41,853

validation processes, we clean

data, we do system migrations.

62

00:03:42,174 --> 00:03:45,853

we're very engaged when it comes

to not only our own systems,

63

00:03:45,853 --> 00:03:46,894

but those of our clients.

64

00:03:47,293 --> 00:03:50,404

it's a very unique and interesting

space in which to operate, right?

65

00:03:50,444 --> 00:03:51,714

In both of those roles.

66

00:03:51,774 --> 00:03:57,164

And what's really interesting is that

in managing the HR operations, for

67

00:03:57,634 --> 00:04:02,534

this company and assisting others who

are navigating outside entities' HR

68

00:04:02,534 --> 00:04:06,354

operations, we really have to make sure

that our policies, including those for

69

00:04:06,494 --> 00:04:10,574

AI, will work across every organization

for every client that we support.

70

00:04:10,944 --> 00:04:15,574

So that's really the basis of a lot

of what we do and how we frame it

71

00:04:16,224 --> 00:04:19,964

Jim: So it's interesting, the spaces

that you occupy in managed services

72

00:04:19,964 --> 00:04:24,204

and consulting, and you have to balance

not only your internal compliance

73

00:04:24,224 --> 00:04:27,064

and policies, but you also have

to do that for external clients.

74

00:04:27,414 --> 00:04:32,924

the thing that I'm curious about is what

happens when you encounter conflict,

75

00:04:33,284 --> 00:04:37,754

between your internal policy and a

client's internal policy and you're

76

00:04:37,754 --> 00:04:42,774

trying to set up the common ground,

for moving forward on an engagement

77

00:04:43,424 --> 00:04:44,814

Lindsay Castro: That's

an interesting question.

78

00:04:44,874 --> 00:04:49,704

So it's tricky because while I can

provide direct guidance internally

79

00:04:49,704 --> 00:04:53,534

to our employees and the consultants

navigating our client relationships,

80

00:04:53,834 --> 00:04:57,784

we have to be respectful to a degree

of the client's own policies and the

81

00:04:57,784 --> 00:05:01,534

way that they are navigating, all sorts

of compliance matters in their world.

82

00:05:01,864 --> 00:05:04,524

So we offer up enough training.

83

00:05:04,524 --> 00:05:07,554

We really work diligently to,

to offer up training to our

84

00:05:07,554 --> 00:05:09,394

internal employees to equip them.

85

00:05:09,784 --> 00:05:13,154

but we also, as a part of that

training, help them understand that

86

00:05:13,154 --> 00:05:16,804

sometimes the answer will be, "Here

is what we would recommend," right?

87

00:05:16,804 --> 00:05:18,584

Or, "Here is how we have seen this occur."

88

00:05:18,944 --> 00:05:21,704

but not necessarily to demand it, right?

89

00:05:21,744 --> 00:05:25,564

And certainly never to step into,

providing financial or legal

90

00:05:25,564 --> 00:05:29,114

advice that, would be perceived

as giving them that direction.

91

00:05:29,114 --> 00:05:32,854

So a lot of times it's giving them

the option of best practices, giving

92

00:05:32,854 --> 00:05:36,683

them information, and allowing the

client to decide how best to proceed

93

00:05:37,334 --> 00:05:40,433

Jim: So I like what you said in

terms of not offering legal advice,

94

00:05:40,433 --> 00:05:44,144

but giving best practices or sharing

best practices and recommendations.

95

00:05:44,144 --> 00:05:45,624

that's a good frame of reference.

96

00:05:45,914 --> 00:05:49,334

I guess the area that I'm thinking

about, especially with our show being,

97

00:05:49,384 --> 00:05:58,188

an AI and HR show, is everything about

AI is new, so best practices haven't

98

00:05:58,248 --> 00:06:02,528

necessarily been defined well enough

for you to offer those recommendations.

99

00:06:02,948 --> 00:06:08,478

And when you're thinking about advising

clients or even thinking about your

100

00:06:08,478 --> 00:06:14,428

own internal HR, and AI policies,

what are some of the considerations

101

00:06:14,458 --> 00:06:18,457

that you have high on your list that

other HR leaders should be thinking

102

00:06:18,468 --> 00:06:23,178

about when-- before they even start

launching a formal AI initiative?

103

00:06:23,828 --> 00:06:27,098

Lindsay Castro: It's a very layered

question, and I completely agree with you.

104

00:06:27,188 --> 00:06:31,148

the tools-- what we've come to find is,

to your point, with everything developing

105

00:06:31,148 --> 00:06:37,138

in real time, on both the legal side

and the HR side when it comes to AI, the

106

00:06:37,138 --> 00:06:39,848

tools don't wait for the policy, right?

107

00:06:39,858 --> 00:06:42,518

The tools are not waiting for

the precedent or the case law.

108

00:06:42,868 --> 00:06:46,168

So it requires a formal inventory, right?

109

00:06:46,198 --> 00:06:47,998

Of going in and saying,

"What are we using?

110

00:06:47,998 --> 00:06:49,138

What do we want to use?"

111

00:06:49,558 --> 00:06:52,548

the regulatory pace is

getting a little bit faster.

112

00:06:52,548 --> 00:06:55,408

It's picking up steam, but

we're still learning as we go.

113

00:06:55,728 --> 00:06:58,898

So I think not only did we

have to ask internally, "Are

114

00:06:58,898 --> 00:07:00,928

we using AI in our processes?

115

00:07:01,148 --> 00:07:03,928

Where are we using them, and

what protections are in place?"

116

00:07:03,958 --> 00:07:08,128

But because we operate inside those

client environments I'd mentioned,

117

00:07:08,388 --> 00:07:12,948

it, it became also looking at, how

are they using that as well, right?

118

00:07:12,948 --> 00:07:15,808

And how can we ensure that

they are also protected.

119

00:07:15,818 --> 00:07:21,548

So I think it's based upon knowing

the AI, platforms and software that

120

00:07:21,548 --> 00:07:24,638

are out there that you're potentially

navigating, trying to gain a pretty

121

00:07:24,638 --> 00:07:28,888

solid understanding of which, in some

cases is easy, in some it's not, right?

122

00:07:28,888 --> 00:07:31,748

You wanna understand how they're

using that data, if they're using

123

00:07:31,748 --> 00:07:35,038

that data to train their systems,

if it's private, if it's encrypted.

124

00:07:35,457 --> 00:07:38,148

and then, if we really wanted to take

a deep dive, you have to start paying

125

00:07:38,148 --> 00:07:41,457

attention not only to the federal,

regs that are coming out related to

126

00:07:41,488 --> 00:07:44,318

AI, but also state-specific, right?

127

00:07:44,568 --> 00:07:47,238

So there's no real map, there's

no real playbook, but it's a

128

00:07:47,248 --> 00:07:48,918

matter of kind of understanding.

129

00:07:48,928 --> 00:07:52,338

And I think it's exciting in this

way, that you have the opportunity to

130

00:07:52,338 --> 00:07:55,858

look at things as they're developing

and to develop, those best practices

131

00:07:55,858 --> 00:07:59,818

that we mentioned and offer "Here

is how we see the safest way to

132

00:07:59,818 --> 00:08:01,848

operate in this space," right?

133

00:08:01,868 --> 00:08:06,208

Or the most compliant way to operate in

this space based on what we know, right?

134

00:08:06,538 --> 00:08:09,778

So that's the approach that we took

was starting with that inventory, which

135

00:08:09,778 --> 00:08:13,348

is what I would always recommend no

matter the business, and looking at,

136

00:08:13,758 --> 00:08:18,298

who is using AI, how it's being used,

and the protections that are in place.

137

00:08:18,673 --> 00:08:21,633

Jim: One of the things that I really

liked about what you answer is that you

138

00:08:21,633 --> 00:08:26,593

mentioned that the tools are moving faster

than organizations and individuals can

139

00:08:26,593 --> 00:08:28,813

adjust, from a compliance perspective.

140

00:08:29,523 --> 00:08:35,732

you look at the pace of change, it's

pretty easy for internal stakeholders

141

00:08:35,732 --> 00:08:40,783

and also external clients to, to freeze

up because they're overloaded with all

142

00:08:40,783 --> 00:08:42,352

the different paths that they can go.

143

00:08:42,413 --> 00:08:47,463

whether we're talking about platforms

or use cases or just simply where

144

00:08:47,463 --> 00:08:49,833

do we start, a lot to take in.

145

00:08:50,303 --> 00:08:54,983

So when you're looking at that environment

where you have high pace of change,

146

00:08:55,243 --> 00:09:01,433

emerging technology, so much that can be

done, what are the things that you have

147

00:09:01,433 --> 00:09:07,323

suggested or recommended to help people

get unstuck from that overload paralysis?

148

00:09:07,973 --> 00:09:08,783

Lindsay Castro: It's a great question.

149

00:09:08,783 --> 00:09:11,983

So I think that, yeah, I completely agree.

150

00:09:11,983 --> 00:09:16,493

I've seen in many instances, and

even in professionally, right?

151

00:09:16,713 --> 00:09:21,063

That people not only freeze, they

just completely write it off.

152

00:09:21,613 --> 00:09:22,873

AI, it's too overwhelming.

153

00:09:22,883 --> 00:09:23,243

Forget it.

154

00:09:23,263 --> 00:09:24,433

We're not gonna incorporate it.

155

00:09:24,453 --> 00:09:25,423

We're not even gonna look at it.

156

00:09:25,443 --> 00:09:26,573

No one's allowed to use it.

157

00:09:27,213 --> 00:09:31,293

And I get it from the place of

wanting to be as cautious as possible,

158

00:09:31,403 --> 00:09:36,653

especially in certain industries,

but I also believe it's so invaluable

159

00:09:36,673 --> 00:09:38,673

if you use it the right way, right?

160

00:09:38,953 --> 00:09:43,293

So I think it's looking at your business,

what it's doing, the goals that you

161

00:09:43,293 --> 00:09:47,403

have, the way in which you would want

to use that tool to empower your people

162

00:09:47,463 --> 00:09:52,203

to be more productive, to be more

knowledgeable, and then to offer…

163

00:09:52,593 --> 00:09:54,283

step into it yourself first, right?

164

00:09:54,323 --> 00:09:59,793

you can't, demonstrate or provide guidance

on a platform or a system or, a use case

165

00:09:59,833 --> 00:10:01,383

if you're not familiar with it, right?

166

00:10:01,383 --> 00:10:05,003

So I think it's really important that

leadership becomes familiar with it first,

167

00:10:05,403 --> 00:10:10,133

and then roll it out in a way where, and

this is what we made a point to do, where

168

00:10:10,133 --> 00:10:14,373

you are, not just saying "Hey, this is

what this is, and this is how it works."

169

00:10:14,393 --> 00:10:18,873

You're saying, "Let me support you

by offering case-specific scenarios

170

00:10:19,043 --> 00:10:22,073

that you might find yourself in,

and what you can and cannot do, what

171

00:10:22,123 --> 00:10:23,643

the yes and the no would be here.

172

00:10:23,653 --> 00:10:26,133

And not only that, but let

me tell you why," right?

173

00:10:26,193 --> 00:10:29,413

And then I think when people understand,

like when our employees, we had

174

00:10:29,413 --> 00:10:33,493

a very, lovely like interactive

meeting with them to walk through

175

00:10:33,493 --> 00:10:35,993

slides and say, "Here is what it is.

176

00:10:36,023 --> 00:10:37,443

Here is how it can be used.

177

00:10:37,443 --> 00:10:38,823

Here's how it cannot be used.

178

00:10:39,383 --> 00:10:42,093

Let us walk through some

scenarios together, give you the

179

00:10:42,093 --> 00:10:43,583

opportunity to ask questions."

180

00:10:43,873 --> 00:10:47,243

But what we really stressed was,

this isn't scary, and we don't wanna

181

00:10:47,243 --> 00:10:48,603

tell you, no, you can't use it.

182

00:10:48,623 --> 00:10:52,233

We need to just tell you the parameters

within which you can use it, right?

183

00:10:52,463 --> 00:10:56,113

No confidential information, no

client information, nothing that

184

00:10:56,113 --> 00:10:59,433

you wouldn't, you wouldn't wanna

leave out on your desk, right?

185

00:10:59,453 --> 00:11:02,663

If you were in an office or that

you wouldn't w- you know, want

186

00:11:02,683 --> 00:11:04,653

someone else to have easy access to.

187

00:11:04,683 --> 00:11:07,373

So I think we tried to make

it as friendly as possible.

188

00:11:07,373 --> 00:11:10,873

And when you do that, it

takes away from the freeze.

189

00:11:10,933 --> 00:11:15,043

People understand, oh, like this could

actually be a really helpful tool.

190

00:11:15,373 --> 00:11:20,163

And honestly, as a lawyer, it can

also give you real insight into how

191

00:11:20,193 --> 00:11:25,073

people are navigating things like

revisions on contracts or, policies

192

00:11:25,073 --> 00:11:26,243

that they're sending back and forth.

193

00:11:26,293 --> 00:11:32,193

and sometimes you'll witness occasions in

which people may not be utilizing it in a

194

00:11:32,193 --> 00:11:36,083

way that's beneficial to them, but could

be using it in a way that's detrimental.

195

00:11:36,083 --> 00:11:36,983

They're not paying attention.

196

00:11:36,983 --> 00:11:38,073

They're letting things go.

197

00:11:38,533 --> 00:11:43,143

And, I think, again, I hate to say

that, but it can also be advantageous

198

00:11:43,183 --> 00:11:46,693

to, then understand who's paying

attention and who's not, right?

199

00:11:47,093 --> 00:11:49,983

so yeah, I just see it as being

so beneficial, but there are a

200

00:11:49,983 --> 00:11:52,963

lot of organizations and business

structures afraid to use it.

201

00:11:53,303 --> 00:11:57,593

If you approach it from a space of

providing boundaries and education,

202

00:11:57,853 --> 00:11:59,523

I think it's incredibly useful

203

00:12:00,173 --> 00:12:04,333

Jim: So I wanna dig in, a little

bit more on some of the rules of the

204

00:12:04,333 --> 00:12:07,773

road stuff that you were referencing,

when we're talking about guidelines

205

00:12:07,773 --> 00:12:09,503

or, what you can and can't do.

206

00:12:09,783 --> 00:12:11,713

I think that's an important

discussion to have.

207

00:12:12,113 --> 00:12:15,653

And when we're talking about

parameters, let's look at it from,

208

00:12:15,713 --> 00:12:17,973

a platform-agnostic perspective.

209

00:12:18,423 --> 00:12:24,423

When you think about establishing a

baseline level of do's and don'ts from

210

00:12:24,423 --> 00:12:28,463

an AI strategy or execution perspective

within an organization, what are

211

00:12:28,463 --> 00:12:33,403

those baseline considerations that

people should have in front of their

212

00:12:33,403 --> 00:12:38,483

minds that's consistent with whatever

state, local, federal privacy policy

213

00:12:38,483 --> 00:12:40,333

that they might be a- adhering to?

214

00:12:41,043 --> 00:12:45,813

For example, if you're a SOC 2

compliant company, should that type

215

00:12:45,813 --> 00:12:50,833

of organization be looking at their

AI strategy as they implement whatever

216

00:12:51,223 --> 00:12:54,133

strategy initiative platform that

they're thinking about implementing?

217

00:12:54,783 --> 00:12:57,663

Lindsay Castro: Think you have to work

very closely with your IT and technology

218

00:12:57,663 --> 00:12:59,753

team to accomplish that properly.

219

00:13:00,103 --> 00:13:04,023

I think at a very basic rudimentary

level, if it shouldn't be shared

220

00:13:04,023 --> 00:13:06,723

publicly, it shouldn't go into AI, right?

221

00:13:07,153 --> 00:13:09,863

That's the baseline, expectation.

222

00:13:10,003 --> 00:13:15,403

So the way that we had framed it is,

if you need to outline a project plan,

223

00:13:15,553 --> 00:13:21,373

if you, need to draft an email and kind

of get past a blank page, that's okay.

224

00:13:21,423 --> 00:13:22,853

Use it to structure those things.

225

00:13:22,863 --> 00:13:25,433

Give it a hypothetical, "Hey,

what if I'm dealing with this?"

226

00:13:25,743 --> 00:13:32,043

But don't feed it the confidential

information from internal resources

227

00:13:32,073 --> 00:13:33,813

or on behalf of our clients, right?

228

00:13:34,163 --> 00:13:39,253

That would then jeopardize,

the confidentiality of those

229

00:13:39,393 --> 00:13:41,723

materials or of that information.

230

00:13:42,203 --> 00:13:46,508

I think that's incredibly important

and, again, I think there's a way

231

00:13:46,508 --> 00:13:49,168

to approach it in a friendly manner

that doesn't scare people off.

232

00:13:49,598 --> 00:13:52,318

But you're also allowed to say to

them, at least in our business,

233

00:13:52,328 --> 00:13:55,468

we're an HDM business, so the

clients trust us to get this right.

234

00:13:55,988 --> 00:14:01,328

And AI doesn't necessarily

understand multiple employment

235

00:14:01,438 --> 00:14:04,888

laws at a time, or maybe a leave

policy or a termination risk.

236

00:14:04,908 --> 00:14:06,548

it's still a computer, right?

237

00:14:06,758 --> 00:14:10,288

So it, it may give you an answer that

sounds authoritative, but it could

238

00:14:10,288 --> 00:14:12,588

be the wrong information, isn't it?

239

00:14:12,598 --> 00:14:14,138

It could be outdated, right?

240

00:14:14,148 --> 00:14:17,568

It still requires human review

and ensuring that you're providing

241

00:14:17,618 --> 00:14:19,928

the proper information, right?

242

00:14:19,928 --> 00:14:24,598

So use it where it can help you work

faster and think more clearly or create

243

00:14:24,628 --> 00:14:29,058

a better draft, maybe give you some

insights, but don't use it as a default.

244

00:14:29,448 --> 00:14:34,748

And I think with our technology team,

where I am personally, they're incredible.

245

00:14:34,818 --> 00:14:38,918

They're very good at, looking at kind of

the activity that's happening internally

246

00:14:39,088 --> 00:14:43,058

at a generic level, understanding

how high the usage is, and then

247

00:14:43,058 --> 00:14:48,508

supporting legal and HR and really the

organization at large in saying, "Here

248

00:14:48,508 --> 00:14:52,868

are the platforms we've approved,"

because we are SOC 2 compliant, right?

249

00:14:52,878 --> 00:14:55,148

So we have to make sure

that we can attest to that.

250

00:14:55,378 --> 00:15:00,048

and here are the ones that we cannot have

you use, and we're gonna specify those.

251

00:15:00,048 --> 00:15:01,118

We're gonna make it clear.

252

00:15:01,158 --> 00:15:04,538

We'll facilitate the use of those

we've approved, and here's a policy.

253

00:15:04,698 --> 00:15:08,308

Please sign this policy acknowledging

that you understand the parameters

254

00:15:08,318 --> 00:15:09,718

within which we're working.

255

00:15:10,043 --> 00:15:11,213

Jim: that's a good foundation.

256

00:15:11,213 --> 00:15:14,803

So let's dig in a little bit deeper

and talk about some of the things

257

00:15:14,813 --> 00:15:18,893

that you have to consider, from a

compliance perspective, when we're

258

00:15:18,893 --> 00:15:23,153

looking at all the different dimensions

of how an initiative gets rolled out.

259

00:15:23,463 --> 00:15:27,973

So if an organization is rolling out an

AI initiative, and part of that initiative

260

00:15:27,973 --> 00:15:32,623

involves implementing a piece of

technology, what are those platform-level

261

00:15:32,623 --> 00:15:38,083

considerations from a compliance

perspective that an organization needs

262

00:15:38,083 --> 00:15:43,883

to into place before, put into place that

informs how they select the appropriate

263

00:15:43,883 --> 00:15:45,803

platform for their environment?

264

00:15:46,453 --> 00:15:50,923

Lindsay Castro: So I think that

may be industry-specific at times.

265

00:15:51,023 --> 00:15:54,013

and again, the AI kind of

compliance space is moving so fast.

266

00:15:54,353 --> 00:15:59,213

So I would say if you're going to

be rolling out an AI initiative

267

00:15:59,253 --> 00:16:02,353

and you have to look at how each

platform would be utilizing the

268

00:16:02,353 --> 00:16:03,513

data that you're putting into it.

269

00:16:03,523 --> 00:16:05,763

for example, there's ChatGPT.

270

00:16:05,773 --> 00:16:07,943

Everyone's fairly familiar with ChatGPT.

271

00:16:07,993 --> 00:16:10,563

That's gonna be something you're

copying and pasting, right?

272

00:16:10,573 --> 00:16:13,823

So that's where the guidelines

really come into place, and you say

273

00:16:13,823 --> 00:16:14,823

"Okay, here are the do's and don'ts."

274

00:16:15,513 --> 00:16:20,273

There are other AI platforms like

Fathom or recording platforms, right?

275

00:16:20,583 --> 00:16:24,223

And in sales or in a lot of industries,

you'll see that people are using

276

00:16:24,223 --> 00:16:26,973

those to record the phone calls

and the conversations happening

277

00:16:26,973 --> 00:16:29,363

between them and clients or others.

278

00:16:29,773 --> 00:16:33,383

You have to look at, who has

access to those conversations,

279

00:16:33,393 --> 00:16:34,863

where are they stored, right?

280

00:16:34,893 --> 00:16:36,043

How long are they stored, right?

281

00:16:36,063 --> 00:16:39,733

then it bleeds into kind of a doc-- or

a, I'm sorry, a retention policy, right?

282

00:16:39,733 --> 00:16:42,843

Making sure your retention policy does

or doesn't reflect that accurately.

283

00:16:43,263 --> 00:16:47,463

I think you also have to consider, since

we've talked a little bit about the

284

00:16:47,473 --> 00:16:51,783

sensitive kind of employee data, you

have to look at if I'm having that-- if

285

00:16:51,783 --> 00:16:55,613

I'm entering that into a platform that

I'm copying and pasting into, or if I'm

286

00:16:55,613 --> 00:16:59,733

having a discussion on the phone with

someone or, in our case, with a client

287

00:16:59,763 --> 00:17:04,463

who has employees and we're discussing

sensitive information, again, that kind

288

00:17:04,463 --> 00:17:08,453

of reclassifies the material that comes

out of that recorded conversation.

289

00:17:09,223 --> 00:17:12,963

So I, I think it's, I think it's

really dependent on the type

290

00:17:12,963 --> 00:17:15,873

of organization and what the

purpose of the materials would be.

291

00:17:16,203 --> 00:17:17,583

So I think that's step one.

292

00:17:17,883 --> 00:17:23,532

And then I think, for us, we had to make

sure that there was a governance framework

293

00:17:23,653 --> 00:17:25,853

and, an accountability framework as well.

294

00:17:26,113 --> 00:17:29,463

we had to make sure that the

vendors and the third parties

295

00:17:29,463 --> 00:17:33,853

that we work with were also being

protected alongside us internally.

296

00:17:34,123 --> 00:17:36,693

so it, it's really-- it's tiered.

297

00:17:36,753 --> 00:17:38,343

there's many levels to that.

298

00:17:38,673 --> 00:17:42,443

and again, what's interesting too is as

you make those decisions, excuse me, as

299

00:17:42,443 --> 00:17:49,563

an organization, you have to look at rules

that, might be specific to individuals

300

00:17:49,573 --> 00:17:52,193

or entities in a specific state, right?

301

00:17:52,493 --> 00:17:57,803

So things you might not even think about,

like biometric data is being defined

302

00:17:57,823 --> 00:18:03,773

in really unique ways across various

states Using a platform, you might think,

303

00:18:03,773 --> 00:18:08,403

yeah, we navigated what, whether this

platform was safe for our industry,

304

00:18:08,413 --> 00:18:09,763

how we want our people to use it.

305

00:18:09,773 --> 00:18:11,083

We gave them instructions."

306

00:18:11,943 --> 00:18:13,483

N- to your point, there's a new law.

307

00:18:13,483 --> 00:18:17,063

The new law comes out and says, "Okay,

if you enter someone's image into

308

00:18:17,063 --> 00:18:19,373

this platform, that's biometric data.

309

00:18:19,383 --> 00:18:22,783

You've now got a whole new list of items

that you need to comply with," right?

310

00:18:23,193 --> 00:18:26,753

So it's just, it's so tiered and

layered, and we're all learning.

311

00:18:27,143 --> 00:18:31,703

but I think even if you map out which

platforms you want to use and your

312

00:18:31,703 --> 00:18:35,503

compliance process for them, you

still have to remain incredibly aware

313

00:18:35,533 --> 00:18:41,003

of the laws, precedents, regulations

that apply, because that might shift.

314

00:18:41,013 --> 00:18:44,493

You might be using something today that

you realize you, you don't have the

315

00:18:44,493 --> 00:18:45,973

controls around and you wanna shift

316

00:18:46,688 --> 00:18:48,818

Thomas Kunjappu: This has been

a fantastic conversation so far.

317

00:18:49,058 --> 00:18:51,848

If you haven't already done so,

make sure to join our community.

318

00:18:52,088 --> 00:18:54,758

We are building a network of the

most forward-thinking, HR and

319

00:18:54,758 --> 00:18:57,938

people, operational professionals

who are defining the future.

320

00:18:58,418 --> 00:19:01,028

I will personally be sharing

news and ideas around how we

321

00:19:01,028 --> 00:19:03,038

can all thrive in the age of AI.

322

00:19:03,398 --> 00:19:06,383

You can find it at go cleary.com/cleary

323

00:19:06,813 --> 00:19:07,423

community.

324

00:19:08,048 --> 00:19:08,888

Now back to the show.

325

00:19:09,679 --> 00:19:12,929

Jim: So I'm not, an attorney, nor do

I play one on TV, but a lot of what

326

00:19:12,929 --> 00:19:16,699

you just, talked about strikes me

as a discoverability conversation,

327

00:19:16,709 --> 00:19:20,509

especially when you were talking about,

call recordings and things like that,

328

00:19:20,509 --> 00:19:21,849

tools that do that sort of stuff.

329

00:19:22,279 --> 00:19:26,139

So when we're t- when we're thinking

about discoverability, th- this

330

00:19:26,149 --> 00:19:31,479

combines both your, general counsel

hat and your chief people officer hat.

331

00:19:32,349 --> 00:19:36,069

are the discoverability considerations

that people need to have, top of

332

00:19:36,069 --> 00:19:42,499

mind, when it comes to implementing

tools or products that consume data?

333

00:19:42,779 --> 00:19:46,339

because theoretically everything

is discoverable depending on what

334

00:19:46,339 --> 00:19:47,579

the situation you're dealing with.

335

00:19:47,579 --> 00:19:50,614

So what are those considerations

that people need to be thinking

336

00:19:50,614 --> 00:19:53,974

about when, they're setting

up the guardrails for usage?

337

00:19:54,624 --> 00:19:58,484

Lindsay Castro: So this is an area

that is currently a really hot topic,

338

00:19:58,514 --> 00:20:03,354

and it's very fascinating for lawyer

nerds like myself, to see the cases

339

00:20:03,354 --> 00:20:04,754

coming out, the precedent coming out.

340

00:20:05,104 --> 00:20:09,194

What's most interesting is

that some of the determinations

341

00:20:09,214 --> 00:20:11,554

thus far, contradict, right?

342

00:20:11,564 --> 00:20:15,134

So some of the states have made decisions

that are different from one another.

343

00:20:15,434 --> 00:20:20,354

what the overall or, the overarching

finding is if there is a system

344

00:20:20,364 --> 00:20:24,884

being utilized that, such as,

again, like a ChatGPT, right?

345

00:20:25,294 --> 00:20:29,704

You can, you can utilize your own account,

you can pay for an account that's gonna

346

00:20:29,704 --> 00:20:34,434

afford you some privacy that maybe you

wouldn't have if you were not a member.

347

00:20:34,444 --> 00:20:37,514

However, it's not necessarily encrypted.

348

00:20:37,824 --> 00:20:41,944

it may be using what you enter

to train its platform, right?

349

00:20:41,984 --> 00:20:43,224

And so it…

350

00:20:43,884 --> 00:20:45,234

there's a concern there, right?

351

00:20:45,234 --> 00:20:47,164

To your point that this

is gonna be discoverable.

352

00:20:47,214 --> 00:20:52,264

In cases like that where there is a

legal matter at play or someone is

353

00:20:52,264 --> 00:20:56,214

digging into a matter that ultimately

becomes ripe for litigation, that's

354

00:20:56,224 --> 00:20:57,704

d- that is, that's discoverable.

355

00:20:57,714 --> 00:21:01,054

you may have an opposing party who says, I

would like to get in there and see what it

356

00:21:01,054 --> 00:21:02,964

was you were searching relative to this."

357

00:21:03,849 --> 00:21:07,129

there, there has been case law

that said, Claude or ChatGPT,

358

00:21:07,129 --> 00:21:08,709

it's not an attorney, right?

359

00:21:09,009 --> 00:21:10,899

So it's not privileged.

360

00:21:10,909 --> 00:21:14,739

You're not able to say, "Oh, this is

attorney-client privilege," right?

361

00:21:14,859 --> 00:21:17,849

And because you're not an attorney,

if someone's not an attorney doing

362

00:21:17,849 --> 00:21:19,659

this, this isn't work product either.

363

00:21:19,669 --> 00:21:22,079

It's not covered by that privilege

either because they're not an attorney

364

00:21:22,079 --> 00:21:23,429

doing research for this purpose.

365

00:21:23,779 --> 00:21:26,369

so it does become

discoverable in some cases.

366

00:21:26,919 --> 00:21:29,919

But there have been other

cases, so there's three key

367

00:21:29,919 --> 00:21:31,219

cases out there right now.

368

00:21:31,479 --> 00:21:35,969

there-- One of them had an opposite

result where there was a pro se person

369

00:21:35,969 --> 00:21:39,289

who did decide to use ChatGPT to

prepare their litigation materials,

370

00:21:39,289 --> 00:21:42,529

but they were considered to be a

lawyer because they were pro se, right?

371

00:21:42,529 --> 00:21:45,959

So their materials were covered

as protected work product.

372

00:21:46,459 --> 00:21:50,379

So it's really interesting to see

how the analysis comes into play.

373

00:21:50,599 --> 00:21:54,789

in the most recent, decision, there

was a distinction between the two,

374

00:21:54,789 --> 00:22:00,059

where it was that a pro se litigant's

AI, strategies and work product

375

00:22:00,409 --> 00:22:02,589

were protected work product, right?

376

00:22:02,999 --> 00:22:06,079

and just because they were

using a system that maybe wasn't

377

00:22:06,089 --> 00:22:09,819

protected, like it didn't forfeit

their expectation of privacy.

378

00:22:10,079 --> 00:22:13,229

However, the court in that

case said, "Hey, we'll give you

379

00:22:13,229 --> 00:22:15,929

that, but you also have to let

us know which systems you use."

380

00:22:15,969 --> 00:22:18,099

That is certainly discoverable, right?

381

00:22:18,279 --> 00:22:22,419

And it also, I think in that case, they

ended up, issuing, like a protective

382

00:22:22,419 --> 00:22:25,869

order, basically saying, you cannot

upload confidential material."

383

00:22:26,139 --> 00:22:30,749

So I think each state is navigating

this in a different manner.

384

00:22:30,829 --> 00:22:34,369

they're doing it organically, but

then as more precedent comes out and

385

00:22:34,369 --> 00:22:39,209

these cases become more frequent, I

think we're gonna learn a lot more.

386

00:22:39,409 --> 00:22:42,379

I'm sure you've seen, a lit- a little

bit different, but there are also

387

00:22:42,379 --> 00:22:46,029

those cases where, there have been,

pleadings submitted to the court

388

00:22:46,069 --> 00:22:48,849

with hallucinated cases, right?

389

00:22:48,849 --> 00:22:51,799

That didn't even exist, and then you've

got attorneys or law firms that are

390

00:22:51,799 --> 00:22:55,591

being, you know- fined or there are

penalties that exist for that too.

391

00:22:55,601 --> 00:22:56,831

That's an area that's developing.

392

00:22:56,831 --> 00:23:01,731

But to go back to how that would apply

or impact a business like ours or

393

00:23:01,751 --> 00:23:05,781

others, that is again, the importance

of the education piece, is letting

394

00:23:05,781 --> 00:23:11,101

people know part of the reason this

is so significant is because we

395

00:23:11,101 --> 00:23:12,401

work in a high-stakes environment.

396

00:23:12,441 --> 00:23:14,461

We're protecting our

information, but our clients'.

397

00:23:14,991 --> 00:23:19,351

And if something goes askew, which it

always could, this is something that the

398

00:23:19,351 --> 00:23:21,221

court may have in front of them, right?

399

00:23:21,231 --> 00:23:27,701

So if you're comfortable with your search

terms being read, in a court, okay.

400

00:23:27,801 --> 00:23:31,281

But if you wouldn't be, let's

not input it, into the system

401

00:23:32,443 --> 00:23:35,293

Jim: So I like this, lawyer nerd

conversation we're having, so I'm

402

00:23:35,293 --> 00:23:39,513

gonna, I'm gonna throw another bit

out there that I think, it'd be

403

00:23:39,513 --> 00:23:40,813

interesting to get your take on.

404

00:23:41,138 --> 00:23:48,298

a-a-as, as a executive level leader in

HR, you're probably seeing all sorts of

405

00:23:48,298 --> 00:23:54,158

platforms from an HR tech perspective

that have AI branding all over the place.

406

00:23:54,258 --> 00:23:57,788

in fact, every tech platform out

there has some sort of AI wrapper

407

00:23:57,788 --> 00:23:59,618

that they've included in there.

408

00:23:59,928 --> 00:24:05,068

What I'm curious about is when we're

thinking about HR tech platforms, and

409

00:24:05,068 --> 00:24:09,008

particularly those platforms in the

employee engagement space, the performance

410

00:24:09,008 --> 00:24:15,328

management space, it's consuming

employee data that's designed to do some

411

00:24:15,328 --> 00:24:20,598

analysis and then help managers make some

coaching or evaluation decisions on it.

412

00:24:21,508 --> 00:24:26,308

Sticking with that discoverability

conversation and the tendency for some AI

413

00:24:26,318 --> 00:24:33,658

to hallucinate, what's your take on how

those sorts of tools should be used from

414

00:24:33,718 --> 00:24:40,268

a people management perspective, and how

can organizations be conservative in their

415

00:24:40,268 --> 00:24:45,288

usage policies so that they don't end up

in a situation where some employee gets

416

00:24:45,498 --> 00:24:52,298

fired or reprimanded, due to an error in

the AI platform making the wrong analysis?

417

00:24:52,598 --> 00:24:56,658

That's probably an edge case example, but

it's something that we have to consider if

418

00:24:56,968 --> 00:25:04,038

mass amounts of data is being, processed

and a recommendation is being spit out

419

00:25:04,078 --> 00:25:06,028

about an employee or an employee group.

420

00:25:06,678 --> 00:25:07,528

Lindsay Castro: It's tricky.

421

00:25:07,648 --> 00:25:09,898

It's a very tricky area.

422

00:25:10,253 --> 00:25:13,443

And I don't think it's explicitly

been addressed yet, right?

423

00:25:13,443 --> 00:25:15,143

In those cases that we

discussed previously.

424

00:25:15,143 --> 00:25:18,783

so as you mentioned, the vendors are

adding these AI features to their

425

00:25:18,783 --> 00:25:23,243

existing platforms, and yes, to your

point, they can exist in a payroll

426

00:25:23,243 --> 00:25:27,153

system, they could e- exist in a

benefits administration system, leave of

427

00:25:27,153 --> 00:25:32,053

absence, And they're updated oftentimes

through, a routine product update.

428

00:25:32,423 --> 00:25:38,523

So it's very difficult to keep up

with where there may be an update that

429

00:25:38,523 --> 00:25:42,043

does allow for there to be sharing

of people information that you maybe

430

00:25:42,043 --> 00:25:43,253

would not have shared otherwise.

431

00:25:43,763 --> 00:25:47,363

so we again try to choose and limit…

432

00:25:48,153 --> 00:25:50,603

You can't even say that because

sometimes you're dealing, at least in

433

00:25:50,603 --> 00:25:53,963

our line of work, sometimes you are

working with systems that a client

434

00:25:53,963 --> 00:25:55,763

has chosen for themselves, right?

435

00:25:56,093 --> 00:26:02,338

So I think it's, I think to be honest

with you, and not to take it away from

436

00:26:02,338 --> 00:26:06,728

the people piece, because I don't know

that you can avoid necessarily those

437

00:26:06,748 --> 00:26:11,128

pieces being included and considered

enhancements to those tools you're using.

438

00:26:11,418 --> 00:26:16,308

I think it really lends itself to the

contract side, which without meaning to

439

00:26:16,308 --> 00:26:21,528

take it, you know, back to that area,

what you're seeing is that contracts

440

00:26:21,528 --> 00:26:28,538

are now very explicit when it comes

to you may or may not use data within

441

00:26:28,538 --> 00:26:33,468

an AI platform, what type of data can

be utilized, what can be audited, as

442

00:26:33,468 --> 00:26:37,778

well as, what the liability or the

indemnification provisions are, right?

443

00:26:37,778 --> 00:26:43,678

So that's how I see people or

companies navigating this right

444

00:26:43,688 --> 00:26:48,203

now, is we-- it's a we recognize we

don't have control over all of these

445

00:26:48,203 --> 00:26:52,273

platforms and their capabilities,

no matter how cautious we are.

446

00:26:52,793 --> 00:26:56,363

and so that's how there's

the protection right now.

447

00:26:56,603 --> 00:27:01,083

But as that continues, I

think you'll see more, right?

448

00:27:01,243 --> 00:27:04,923

I think there will be more information

made available to us about best

449

00:27:04,933 --> 00:27:09,533

practices, and I'm sure that there

will be, preferred platforms, right?

450

00:27:09,563 --> 00:27:13,763

That can guarantee you encryption

or privacy or, the things that

451

00:27:13,763 --> 00:27:17,553

matter most in, in sensitive cases.

452

00:27:17,928 --> 00:27:20,528

Jim: I wanna expand on something that

you mentioned, a little bit earlier,

453

00:27:20,528 --> 00:27:25,298

and that's in the space of ownership

and governance, but particularly, when

454

00:27:25,308 --> 00:27:28,788

we're talking about building fail-safes,

into the process so that you're not

455

00:27:28,798 --> 00:27:32,988

getting, off-the-wall recommendations

or hallucinated recommendations.

456

00:27:33,368 --> 00:27:37,518

So when an organization is thinking

about their AI strategy, whether it's

457

00:27:37,518 --> 00:27:42,938

talking about rolling out a process,

piece of technology, whatever, what

458

00:27:42,938 --> 00:27:50,208

should the ownership, governance, and

review mechanisms look like to, to…

459

00:27:50,858 --> 00:27:51,558

That's the question.

460

00:27:51,668 --> 00:27:55,208

what should the ownership, governance,

and review process look like so

461

00:27:55,208 --> 00:27:58,838

that you can feel reasonably secure

that you're on a solid foundation?

462

00:27:59,488 --> 00:28:03,818

Lindsay Castro: So I think that you

have to, again, kind of work with

463

00:28:03,818 --> 00:28:08,498

your leadership and your tech teams

to understand where the AI risk

464

00:28:08,498 --> 00:28:12,308

assessments need to be conducted,

where the controls need to be in place,

465

00:28:12,848 --> 00:28:15,918

which policies make the most sense,

and who's going to own them, right?

466

00:28:15,918 --> 00:28:18,108

Which is going to mean

updating them along the way.

467

00:28:18,658 --> 00:28:24,238

The data governance obligations I think

it's about being honest with yourself

468

00:28:24,238 --> 00:28:28,178

as an organization and saying, "Here's

the capacity that we have right now.

469

00:28:28,178 --> 00:28:31,808

Here's the bandwidth we have

to navigate and manage this as

470

00:28:31,808 --> 00:28:33,068

something that we are embracing."

471

00:28:33,698 --> 00:28:34,888

and I think it plays…

472

00:28:35,658 --> 00:28:39,288

So a playbook, without

ownership is just a document.

473

00:28:39,618 --> 00:28:44,418

So you can say, "We really want to adopt

this," but unless we have that governance

474

00:28:44,418 --> 00:28:49,468

process in place and we know exactly who's

doing what and how the decisions will be

475

00:28:49,468 --> 00:28:51,898

made going forward, it won't work, right?

476

00:28:51,898 --> 00:28:56,688

So I think what I have found effective

at HCM is that cross-functional

477

00:28:56,858 --> 00:28:58,298

accountability that I was mentioning.

478

00:28:58,298 --> 00:29:03,908

So for us, like legal, I mapped

regulatory requirements, and then

479

00:29:04,168 --> 00:29:07,498

our technology team, they inventoried

the tools and the workflows.

480

00:29:08,058 --> 00:29:11,538

And we actually engaged with, a

lot of our employees, including

481

00:29:11,538 --> 00:29:15,938

consultants, to flag where they were

experiencing kind of client-facing

482

00:29:16,278 --> 00:29:19,978

processes that we needed to be aware

of that kind of intersected with AI.

483

00:29:20,518 --> 00:29:24,398

so each function, had its own piece,

and again, has to remain current.

484

00:29:24,668 --> 00:29:26,038

But it was that shared ownership.

485

00:29:26,138 --> 00:29:27,278

That worked well for us.

486

00:29:27,628 --> 00:29:32,278

And in addition to, once we

established that, I think it

487

00:29:32,278 --> 00:29:35,948

became a gating process naturally,

especially with our policy in place.

488

00:29:36,228 --> 00:29:39,948

So no new AI tool can go live, right?

489

00:29:39,948 --> 00:29:43,288

Whe-whether it's standalone or if

it's embedded, and we have rules

490

00:29:43,288 --> 00:29:46,258

outlining, what we're willing to

accept, at least right now, in

491

00:29:46,258 --> 00:29:50,268

terms of the embedded, without

going through a pretty well-defined

492

00:29:50,308 --> 00:29:53,988

review and approval workflow across

those teams that I mentioned, right?

493

00:29:54,268 --> 00:29:55,538

And we did tier them, too.

494

00:29:55,538 --> 00:30:01,358

We tiered like one through three, w-

how each item would be evaluated based

495

00:30:01,358 --> 00:30:03,678

on the potential risk that it posed.

496

00:30:03,998 --> 00:30:09,138

So that, I have found in my experience,

is a great way to approach it, because

497

00:30:09,368 --> 00:30:12,858

you can't take it on unless you're ready

to really tackle it and be consistent.

498

00:30:12,878 --> 00:30:15,688

But you also can't tackle

it in one department alone.

499

00:30:16,188 --> 00:30:20,288

Because of all of the areas it impacts,

you really have to bring in leadership,

500

00:30:20,318 --> 00:30:25,108

and also, your employees are invaluable

in letting you know what they're seeing

501

00:30:25,238 --> 00:30:27,538

in real time and where they see the risks.

502

00:30:27,918 --> 00:30:30,378

So we really made it a group

effort, and I would recommend

503

00:30:30,378 --> 00:30:31,918

that for a lot of organizations.

504

00:30:31,928 --> 00:30:35,238

I know it's tougher in really big

ones, but to the degree you're able.

505

00:30:35,888 --> 00:30:39,448

Jim: So one of the things that, that's

interesting about what you just said

506

00:30:39,458 --> 00:30:45,808

is, defining who's gonna own what and

establishing shared ownership and those

507

00:30:45,828 --> 00:30:50,628

cross-functional relationships that allow

all of that, to, to work well together.

508

00:30:50,918 --> 00:30:51,628

I'm paraphrasing.

509

00:30:52,378 --> 00:30:58,338

when I hear that, my mind goes to,

that makes sense if these things are

510

00:30:58,338 --> 00:31:03,138

rolled out in a top-down fashion, if you

have, leadership driving the process.

511

00:31:03,718 --> 00:31:08,428

What I'm curious about is what happens

or what would your, how would your

512

00:31:08,428 --> 00:31:13,998

recommendations change in those

organizations where their initiatives are

513

00:31:13,998 --> 00:31:18,448

happening more in a bottom-up fashion,

and maybe even at a business unit level

514

00:31:18,448 --> 00:31:23,458

where one function within a business

unit is taking on one AI initiative

515

00:31:23,458 --> 00:31:26,388

and rolling that out, and then you

have something completely different

516

00:31:26,398 --> 00:31:29,598

going on in IT and sales and so on.

517

00:31:29,958 --> 00:31:33,908

How would you adjust for that

sort of environment where it's

518

00:31:33,918 --> 00:31:37,928

more of a bottom-up, initiative

rollout versus a top-down rollout?

519

00:31:38,578 --> 00:31:41,268

Lindsay Castro: So I know

that it's inevitable that

520

00:31:41,268 --> 00:31:43,158

those situations arise, right?

521

00:31:43,188 --> 00:31:44,498

Everyone deals with them.

522

00:31:45,458 --> 00:31:50,738

I think that it's just a little

dangerous to not account for that

523

00:31:50,738 --> 00:31:56,258

possibility by creating a process

at some level, whether it's top or

524

00:31:56,598 --> 00:31:58,658

middle or having a gatekeeper again.

525

00:31:59,618 --> 00:32:04,758

And typically, I think technology is a

great place for that to fall because you

526

00:32:04,758 --> 00:32:11,718

can have different units adopting their

own preferred use of AI or platforms

527

00:32:11,718 --> 00:32:13,338

or software, whatever the case may be.

528

00:32:13,858 --> 00:32:19,238

The problem is, unless there

are parameters, it just allows

529

00:32:19,238 --> 00:32:21,128

for so much unknown, right?

530

00:32:21,128 --> 00:32:23,508

So there are organizations that

are comfortable with that, and I

531

00:32:23,518 --> 00:32:24,838

think it becomes a question of risk.

532

00:32:25,478 --> 00:32:28,968

How much risk are you comfortable

absorbing when it comes to AI?

533

00:32:29,928 --> 00:32:31,728

Some may say, "Ah, I'm good with it.

534

00:32:31,728 --> 00:32:32,108

Like it's…

535

00:32:32,158 --> 00:32:33,828

we're making money," right?

536

00:32:33,848 --> 00:32:34,898

"Things are moving faster.

537

00:32:34,898 --> 00:32:36,928

Like we, we can let go of

some people we don't…"

538

00:32:36,948 --> 00:32:40,438

I think then you'll have other

entities that are like, "Nope," like

539

00:32:40,438 --> 00:32:41,688

I said, we don't wanna touch this.

540

00:32:41,688 --> 00:32:42,378

This is terrifying."

541

00:32:43,338 --> 00:32:47,238

But I do think either way, you

have to have a process in place

542

00:32:47,238 --> 00:32:50,538

because the reality is, no matter

what, your employees are going to

543

00:32:50,538 --> 00:32:53,048

be using it in some fashion, right?

544

00:32:53,698 --> 00:32:59,138

So I think as soon as you become aware

of that, if it is a bottom-up process,

545

00:32:59,638 --> 00:33:04,648

it becomes incumbent on whomever is made

aware to raise that to a level of, hey,

546

00:33:04,768 --> 00:33:06,088

we need to get our hands around this.

547

00:33:06,098 --> 00:33:08,918

we need to understand how

we want to navigate this.

548

00:33:09,608 --> 00:33:13,788

And I think it's perfectly okay to say

"Oh, hey, you're using this system?

549

00:33:13,788 --> 00:33:14,468

Okay, awesome.

550

00:33:14,468 --> 00:33:16,598

I'm just gonna need to take a

look at how that works and make

551

00:33:16,598 --> 00:33:20,838

sure that is acceptable for our

business model or for our clients.

552

00:33:21,108 --> 00:33:23,588

And if it's not, we'll find an

alternative that is," right?

553

00:33:23,588 --> 00:33:30,048

So it's not shutting anyone down or

discouraging the growth that clearly that

554

00:33:30,048 --> 00:33:34,548

employee or that division is striving to

achieve, by utilizing these resources.

555

00:33:34,908 --> 00:33:38,078

It's just working with them to

find the right one, and then to the

556

00:33:38,078 --> 00:33:42,428

degree that you're able, putting

a process in place that gives

557

00:33:42,428 --> 00:33:44,148

you some level of comfort, right?

558

00:33:44,188 --> 00:33:48,528

Based on the level of risk you're

comfortable with, that you can, have

559

00:33:48,528 --> 00:33:50,148

some guardrails and controls around it

560

00:33:50,798 --> 00:33:54,568

Jim: One of the interesting things

that I'll be, observing is the

561

00:33:54,568 --> 00:33:58,388

parallel between what happens with

AI and how it's implemented within

562

00:33:58,388 --> 00:34:00,278

organizations and what was happening…

563

00:34:00,638 --> 00:34:02,088

I came out of the recruiting space.

564

00:34:02,458 --> 00:34:06,108

So one of the things in recruiting,

especially if you're in technology

565

00:34:06,108 --> 00:34:09,938

recruiting, which is where the world

that I came out of, is that you had

566

00:34:10,237 --> 00:34:13,788

standard enterprise IT architecture and

technology policies, and then you had

567

00:34:13,788 --> 00:34:18,947

shadow IT, where each function or each

division within was running their own

568

00:34:18,947 --> 00:34:23,098

tech stack, and that created a lot of

technology bloat, as well as additional

569

00:34:23,098 --> 00:34:25,228

costs and more policy considerations.

570

00:34:25,568 --> 00:34:29,638

I'll be curious to see if we see

something similar, on the AI front,

571

00:34:29,648 --> 00:34:33,058

because you'll have a corporate AI

policy and then you just talked about,

572

00:34:33,108 --> 00:34:38,068

a business unit or a functional group

might have a use case for AI that isn't

573

00:34:38,668 --> 00:34:43,188

inbounds from the enterprise level,

so they go rogue and build their own.

574

00:34:43,237 --> 00:34:46,608

We've talked a lot of compliance

and compliance adjacent stuff.

575

00:34:47,338 --> 00:34:51,018

What I'm curious about is when you

think about all the stuff that we've

576

00:34:51,027 --> 00:34:55,527

talked about, and I'm gonna reference

what you mentioned earlier, which is a

577

00:34:55,527 --> 00:34:59,928

playbook, and you're thinking about an

AI playbook or an initiative playbook.

578

00:35:00,788 --> 00:35:04,058

all the things that we've talked about

so far, what should that playbook

579

00:35:04,228 --> 00:35:09,338

contain for it to be useful as a

starting point for the rollout of an

580

00:35:09,348 --> 00:35:11,038

AI initiative within an organization?

581

00:35:11,688 --> 00:35:16,128

Lindsay Castro: So I think the playbook

has to contain, what we've discussed

582

00:35:16,138 --> 00:35:18,448

already, which is clear ownership, right?

583

00:35:18,488 --> 00:35:20,148

Knowing who is gonna be navigating that.

584

00:35:20,808 --> 00:35:25,758

I think it's helpful to include some

information in that playbook as to

585

00:35:25,768 --> 00:35:29,148

why the rules are important, including

in that playbook matters, right?

586

00:35:29,178 --> 00:35:31,008

Real-life examples.

587

00:35:31,418 --> 00:35:36,313

and then I think providing the employees

the situations in which it can and cannot

588

00:35:36,313 --> 00:35:38,783

be used, creating knowledge, right?

589

00:35:38,783 --> 00:35:40,273

Knowledge is power, I always say.

590

00:35:40,503 --> 00:35:43,483

So it's making sure that they

understand exactly what is

591

00:35:43,483 --> 00:35:44,813

allowed and what isn't and why.

592

00:35:45,173 --> 00:35:47,768

I also think it's, understanding how…

593

00:35:47,808 --> 00:35:50,938

I think it's important to include in

that playbook how employees should

594

00:35:50,948 --> 00:35:54,748

be expected to handle situations in

which perhaps they notice the rules

595

00:35:54,748 --> 00:35:57,638

are not being followed by a colleague,

and that needs to be addressed.

596

00:35:57,738 --> 00:36:01,968

Or, including information on the fact that

there will be audits conducted, right?

597

00:36:02,008 --> 00:36:06,218

As an employer, you're able to conduct

audits of the actual activity happening

598

00:36:06,218 --> 00:36:08,228

across the organization at any given time.

599

00:36:08,228 --> 00:36:09,818

So letting them know that.

600

00:36:10,108 --> 00:36:13,078

giving them a sense of how long

the images or the data that they're

601

00:36:13,078 --> 00:36:14,958

utilizing will exist on the system.

602

00:36:15,258 --> 00:36:16,218

I think there's…

603

00:36:16,998 --> 00:36:19,748

All of those pieces are really crucial.

604

00:36:20,098 --> 00:36:24,478

I also think giving employees,

because this is so new, right?

605

00:36:24,658 --> 00:36:28,298

Giving employees an opportunity and an

arena to actually have the conversation

606

00:36:28,298 --> 00:36:32,898

which, with whomever is going to be

owning or leading that process is

607

00:36:32,898 --> 00:36:37,728

really crucial to understand where

they, where the gaps lie, right?

608

00:36:37,728 --> 00:36:39,288

Because we can only see what we see.

609

00:36:39,628 --> 00:36:46,508

But that gives you the ability to provide

a playbook, but to also update it as

610

00:36:46,508 --> 00:36:48,558

needed with that feedback loop, right?

611

00:36:48,828 --> 00:36:52,918

So that what you're seeing feeds back

into the policy itself as needed.

612

00:36:53,398 --> 00:36:55,603

so I think those are the key pieces.

613

00:36:55,603 --> 00:36:56,943

That was what we had included.

614

00:36:57,593 --> 00:37:01,883

But, having a firm policy in place

as a part of that playbook is key.

615

00:37:02,433 --> 00:37:03,353

it's tough to say, right?

616

00:37:03,353 --> 00:37:05,473

Because each industry is going

to do a little bit differently.

617

00:37:05,523 --> 00:37:10,633

but one of the things and my, my CFO

al- always laughs at me for this one,

618

00:37:10,633 --> 00:37:13,243

but I always say clear is kind, right?

619

00:37:13,503 --> 00:37:18,643

So a playbook is meant to provide

clarity, and that is the kindest thing

620

00:37:18,643 --> 00:37:22,323

you can do for your employees because

it gives them the room to operate

621

00:37:22,643 --> 00:37:26,023

and to understand where the rules lie

and to have the flexibility to come

622

00:37:26,023 --> 00:37:27,753

to you with questions, without fear.

623

00:37:28,403 --> 00:37:32,093

so y- you can define it to some ability,

but I think a playbook has to be a living,

624

00:37:32,093 --> 00:37:33,953

breathing document so that it can be…

625

00:37:34,603 --> 00:37:37,093

It can give the guardrails, but

it can be updated as needed to

626

00:37:37,153 --> 00:37:38,833

align with things as they develop

627

00:37:39,483 --> 00:37:42,573

Jim: Yeah, I like the last part of

what you mentioned that clear is kind.

628

00:37:42,623 --> 00:37:44,203

Clarity also builds momentum.

629

00:37:44,203 --> 00:37:47,533

So if we're taking the concept of

a living document into it, you need

630

00:37:47,553 --> 00:37:51,158

to have forward momentum, to be

able to iterate from where you are.

631

00:37:51,158 --> 00:37:55,328

I think the important thing, what I gather

from what you just mentioned, think of

632

00:37:55,328 --> 00:37:59,218

this as a framework and a foundation,

not something that's absolutely static.

633

00:37:59,218 --> 00:38:03,458

Because if you're building a static

document, the pace of change is gonna

634

00:38:03,458 --> 00:38:08,128

make it such that it's not relevant six

months or 12 months from, down the road.

635

00:38:08,478 --> 00:38:12,118

I guess one of the things that, that

I'm curious about, especially given the

636

00:38:12,118 --> 00:38:16,848

space that you're in, you have these

dual hats inside your organization, but

637

00:38:16,848 --> 00:38:22,298

you're also in, a consulting organization

that works with other firms externally.

638

00:38:22,748 --> 00:38:27,278

And when we think about the dynamics

of that, and especially with something

639

00:38:27,278 --> 00:38:33,868

that's so new in, from the perspective of

AI, when something is this new, there's

640

00:38:33,868 --> 00:38:38,718

gonna be some rough lessons learned

when people go the wrong direction.

641

00:38:38,848 --> 00:38:45,148

Are there any painful lessons learned

that you've seen, that I, that you feel is

642

00:38:45,148 --> 00:38:47,588

worth mentioning that, hey, don't do this?

643

00:38:47,628 --> 00:38:50,768

This should be a clear red line

that you need to watch out for,

644

00:38:50,768 --> 00:38:53,718

no matter how attractive it,

it might appear on the surface.

645

00:38:54,093 --> 00:38:57,653

Lindsay Castro: I see where

missteps become possible.

646

00:38:57,753 --> 00:39:03,333

I think that kind of going a little

bit backwards, y- I see AI and

647

00:39:03,363 --> 00:39:06,433

other items like it that we're

lucky enough to be in the midst of

648

00:39:06,433 --> 00:39:10,553

watching develop, as an opportunity

for connection in an organization.

649

00:39:11,013 --> 00:39:16,243

And, there's so many established archaic,

rules and regs, and you just know, okay,

650

00:39:16,243 --> 00:39:17,673

we have a document retention policy.

651

00:39:17,683 --> 00:39:18,303

of course we do.

652

00:39:18,323 --> 00:39:18,863

Everyone does.

653

00:39:19,373 --> 00:39:22,943

This is something so new

that I think you're able to

654

00:39:23,753 --> 00:39:25,553

bring people into it, right?

655

00:39:25,553 --> 00:39:26,563

You're able to say…

656

00:39:26,573 --> 00:39:29,343

You're able to use it as a space

to say, "I don't know everything.

657

00:39:29,343 --> 00:39:30,083

You don't know everything.

658

00:39:30,083 --> 00:39:30,973

We're gonna learn together."

659

00:39:31,573 --> 00:39:38,563

So when I started to see situations

where maybe someone didn't understand

660

00:39:38,563 --> 00:39:42,583

what was okay or what was not okay

to use as an input, the goal was

661

00:39:42,583 --> 00:39:45,903

to quickly get in front of it and

say, "Let's have this meeting.

662

00:39:45,903 --> 00:39:50,483

Let's provide these materials so we can

actually walk through what we know today."

663

00:39:51,233 --> 00:39:57,623

And because of that, there is no fear

on the part of any of the employees,

664

00:39:57,633 --> 00:40:01,093

to my knowledge, I should say, that

if there is a question for them that

665

00:40:01,093 --> 00:40:02,933

relates to, "Hey, can I use this way?"

666

00:40:02,933 --> 00:40:05,793

Or, "Is it okay to

enter this information?"

667

00:40:05,803 --> 00:40:10,153

Or, or maybe if they had questions on how

they were doing something previously and

668

00:40:10,153 --> 00:40:15,283

wanted to know how to change it, those--

It created an opening, for us to have

669

00:40:15,283 --> 00:40:19,763

that connection and for them to be able

to come in and say, "I have a question."

670

00:40:19,793 --> 00:40:22,093

And it was totally okay

to have a question, right?

671

00:40:22,423 --> 00:40:27,453

And it, it also opens the door to, again,

that feedback, that follow-up conversation

672

00:40:27,453 --> 00:40:30,933

where it becomes a, hey, maybe we

should have a deep dive internally,

673

00:40:30,933 --> 00:40:32,123

which we try to do once a month.

674

00:40:32,133 --> 00:40:34,703

Maybe we should have our next

deep dive on this topic, right?

675

00:40:35,083 --> 00:40:37,533

So you start to see…

676

00:40:37,823 --> 00:40:40,023

I wouldn't say missteps or, horrible.

677

00:40:40,143 --> 00:40:42,263

I haven't seen anything crazy.

678

00:40:42,563 --> 00:40:44,513

I've just seen uncertainty.

679

00:40:44,883 --> 00:40:47,893

and then, on the legal

side, the same thing.

680

00:40:48,183 --> 00:40:52,073

It's become an open door where they

can say, "Hey, this client has an

681

00:40:52,073 --> 00:40:53,873

employee in such and such a space.

682

00:40:53,903 --> 00:40:55,583

This is the question they're asking.

683

00:40:55,893 --> 00:40:58,183

Does this fall in the

legal realm, do you think?"

684

00:40:58,233 --> 00:41:00,623

and sometimes we've had to say,

"Yeah, we can't answer that question.

685

00:41:00,663 --> 00:41:01,643

That would be legal advice."

686

00:41:01,713 --> 00:41:04,293

And, we'll just let them know they

should speak to their counsel.

687

00:41:04,343 --> 00:41:07,333

and again, I'm glad they're asking

me versus inputting that even

688

00:41:07,333 --> 00:41:08,703

as a generic question into AI.

689

00:41:09,813 --> 00:41:11,983

What would you do if this

employee wanted to come back to…

690

00:41:12,013 --> 00:41:12,673

who knows?

691

00:41:13,103 --> 00:41:17,088

So it's really opened the door for kind

of connection and conversation, and I

692

00:41:17,098 --> 00:41:22,908

think that is so important to preventing

huge missteps within an organization

693

00:41:23,558 --> 00:41:24,348

Jim: Great stuff, Lindsay.

694

00:41:24,348 --> 00:41:26,928

If people wanna continue the

conversation, what's the best way

695

00:41:26,928 --> 00:41:28,038

for them to get in touch with you?

696

00:41:28,504 --> 00:41:29,170

Lindsay Castro: Oh gosh.

697

00:41:29,250 --> 00:41:32,450

I'm happy to connect

via LinkedIn, via email.

698

00:41:32,450 --> 00:41:33,590

I can provide that as well.

699

00:41:33,590 --> 00:41:37,010

But in any which way, I love having

these conversations, so I'm so grateful

700

00:41:37,010 --> 00:41:39,200

that you were, open to our doing so

701

00:41:39,850 --> 00:41:43,120

Jim: So we'll make sure that we include

your LinkedIn profile in the show

702

00:41:43,120 --> 00:41:44,560

notes, and people can reach out there.

703

00:41:44,870 --> 00:41:46,310

Speaker 3: Thanks for

hanging out with us, Lindsay.

704

00:41:46,320 --> 00:41:49,020

It was a lot of fun chatting with

you, And I think there was a lot of

705

00:41:49,020 --> 00:41:52,940

opportunity for us to dig even deeper

in certain areas, but we only have,

706

00:41:52,940 --> 00:41:55,910

an hour-long show, so I wanted to

make sure that we keep things tight.

707

00:41:56,200 --> 00:42:01,380

One of the big things that stood out

to me was your recommendation that the

708

00:42:01,720 --> 00:42:06,510

compliance guidelines or foundation

needs to be something that's more of a

709

00:42:06,520 --> 00:42:12,690

living document than a static playbook,

and I think that's pretty important

710

00:42:12,690 --> 00:42:17,480

to keep in mind, especially when we

consider that everything in the AI space

711

00:42:17,480 --> 00:42:22,180

is moving so fast, and you referenced

it yourself, that the tools and the

712

00:42:22,180 --> 00:42:26,000

capabilities are moving faster than

the policies can be put into place.

713

00:42:26,340 --> 00:42:31,270

And when we look at that pace of change,

it's important to keep in mind that

714

00:42:31,280 --> 00:42:35,030

whatever policies and guidelines and

compliance outlines that you put into

715

00:42:35,030 --> 00:42:40,780

place, you need to have wiggle room

established so that you can iterate

716

00:42:41,140 --> 00:42:45,810

and expand those policies and adjust

those policies as the technology changes

717

00:42:46,060 --> 00:42:48,110

and as the business need changes.

718

00:42:48,970 --> 00:42:52,110

The other important thing that you

mentioned in this conversation that

719

00:42:52,110 --> 00:42:55,540

stood out to me that I think is gonna be

important for other leaders to keep in

720

00:42:55,540 --> 00:43:01,030

mind is that when there is so much stuff,

from an AI perspective that's out in the

721

00:43:01,030 --> 00:43:07,030

wild, it becomes really easy to freeze and

just ignore it all and do something else.

722

00:43:07,580 --> 00:43:13,860

And your point about how it can be

overwhelming is well taken, and I think

723

00:43:13,860 --> 00:43:20,840

the solution that you gave is that if

you want to build forward momentum,

724

00:43:21,370 --> 00:43:26,400

leadership has got to take the initiative

and put things into place that allow

725

00:43:26,500 --> 00:43:30,630

people to take small experiments and

small chunks and move forward with those.

726

00:43:31,020 --> 00:43:36,210

So having leadership set the tone,

especially in an environment where

727

00:43:36,240 --> 00:43:39,320

it can seem overwhelming, is an

important lesson that everybody

728

00:43:39,320 --> 00:43:45,080

should take away and be eager to

implement in their own environments.

729

00:43:45,470 --> 00:43:48,370

So for those of you who've been listening

to this conversation, we appreciate

730

00:43:48,370 --> 00:43:51,460

you hanging out and and taking it in.

731

00:43:51,800 --> 00:43:55,330

If you like the discussion, make sure

you leave us a five-star review on your

732

00:43:55,330 --> 00:43:58,980

favorite podcast player, and then tune

in next time where we'll have another

733

00:43:58,980 --> 00:44:04,250

leader sharing their insights on how

they're using AI to future-proof HR.