AI & Your Business: 5 Questions You MUST Ask Now!

We kind of use a framework internally that's a super simplified framework of five questions that I want our teams constantly thinking about when they're thinking about bringing new technology into space. Um, and it's simplified because it's meant to be able to like give to anybody in the business um, because sometimes we have tools that our teams want to use and there's a sales person or somebody else that has to be the advocate for that tool. So, they may not be a security professional by trade or a lawyer, but they need to be able to interface with the vendor and say, "Hey, this is what my team is going to expect for you to be able to answer. So, can you give me some basic answers around it?" Um, we touched on one of them already

which is, you know, do you use my trade data to train AI? And they should be able to answer that question really clearly and specifically the same way that I did. Um, the second is, you know, is is my

data secure? And that was true before AI. It matters now even after AI. Can they articulate to you how they secure data? And what this typically looks like is usually on a website they will have some area that is a trust center or documentation where they have some explanation of not only how do they secure their products, but what standard, because there's, you know, sort of globally accepted standards, what standard they use to abide by that. Um, you can look for words like ISO 27001, SOC 2. Those are good indicators that not only is the company engaged in those practices, but they have an auditor that they bring in to recertify them on a rolling basis and say, "Yep, this these this company is abiding by that standard." Um, so that's that's around security. Um, the third is who can

access my data. So, you should have some uh understanding of where does the data go and this should be on their website and in documentation. Um, but also um, who in the company actually has access to the data. So, is it just the product teams? Do the support teams get access? You know, can they articulate the answer to that question? Um, the fourth uh area is are you going

to help me comply with laws and regulations? And the easy one to look for here is if they don't have a good answer to do you comply with GDPR, run. So, that's like an easy test case where, you know, the EU sets a pretty high bar. GDPR actually has a quite a few regulations around how to handle data, and they should have some really good explanation of here's how we do it and here's our sub-processor agreements, etc. Um, last but not least is, uh,

do you delete my data? So, when I ask for specific data to be deleted or when I actually leave, what is your process for that? And what we're typically looking for there is some reasonable explanation of how do they actually delete data? Can they articulate the mechanism that they do that? Words like, uh, cryptographic hashing or, um, rolling data stores. And then, you know, they may have something in backups, but there should be some period of time that they can say, "At this point in time, we've we've deleted all your data." Those are good indicators of good

hygiene practices. And those are things that we even give that talk track to our, um, business associates and and people in the company that are trying to run ahead of the backlog of law legal and security and whoever else that it's like, if you can get reasonable answers to these questions just from their website, that's a good indicator that you're dealing with a mature company.