Richard, thank you so much for being a part of the podcast.
Yeah, thank you very much, Kevin.
It's a pleasure to be here.
Tell me how you first got into the area of, well, AI more generally initially, and
then responsible AI.
Well, AI more generally, I did my studies and my PhD already in artificial
intelligence in the eighties, in the nineties.
So that's a long time ago when nobody knew what artificial intelligence was.
And then of course, since 2016, when this came back into society and later in
business, that's what I focused on.
So long history in artificial intelligence and in the responsible use of AI, I came
across when in 2000...
17, I was working at a large insurance company.
And in my team, there was a small group who looked at bias and explainability.
And I thought, before that, I just had a business look at it.
Yeah.
So how can you use this for businesses?
But then I said, wow, this is actually important.
And if you if you take this into account, and if this is going be applied
everywhere.
So when I moved back to Telefonica, I took that on board and I brought it into the
company and said, well, if we want to be serious on AI, we should not only look at
business opportunities, but we should also look at responsibility.
And that's how I came in the field.
What was the response in the company?
Because obviously there's some effort that's required and there may be
trade-offs in terms of designing responsible systems, dealing with issues
like fairness and bias.
So what was the response you got?
Well, the response was surprisingly positive.
Yeah.
So for instance, when in 2000, we started this, this effort in 2018 in the
beginning.
And basically because the company was very vocal on big data and artificial
intelligence and the opportunities.
Uh, and at that time there were a lot of those scandals about discrimination, the
compass things, uh, this company's hiring people and only hiring a male gender.
So, um,
I thought, well, it's important to make a statement as well.
So we brought together a very, uh, a set of departments, yeah.
Which you have to put together because this what about, it was an aspirational
statement that we wanted to make.
So we wanted to publish our ethical AI principles.
Uh, and it took us a month of four months or five months to agree on the set of
principles and then how do you formulate them?
Because of course, many
commercial people think, well, if we do this, then we will lose speed, we will
lose revenues, but it was surprisingly fast.
So I think we published them in October 2018.
And a very important lesson, because I've also spoken to many other companies, and
there are two approaches to...
make these statements, publish your ethical principles.
The one is, is a kind of aspirational one.
So this is what we want to do.
And we acknowledge that we're not yet there, but we're gonna work hard to be
there.
And then there are companies that before publishing anything, they want to be
absolutely sure that they are already complying with what they're saying.
Those companies, they are still discussing their ethical principles, because
obviously it's not so...
easy to make sure that you comply with all of them in all aspects.
So we are on a journey as a sector, private sector, public sector, as a
society, and this is going to be incorporated increasingly more, but
gradually.
Absolutely.
Well, this is an important point, though.
How does an organization ensure if they actually get principles out the door, that
they are more than just aspirational, that they can actually influence the
development that goes on?
Yeah, so now you are alluding to ethics washing.
And so any company, any organization that starts on this journey will first start
with principles and there is really nothing behind it.
So you can, you can accuse them as being ethics washing.
But in the end, this is the way how you start.
And then the next year they have to, you have to do something more.
And the next year you have to do something more.
So.
It's a journey.
So we started in, let's say 2018, we published into end of 2018.
And we only approved a formal internal regulation last December.
So it took us like, uh, like, like five years to do that.
And that's not because, uh, we had to convince everybody because there is no
experience whatsoever in the world, how to do that.
So you have to find it out.
yourself and then talk to some other companies who do the same, but there are
very few, especially in the beginning.
So what we did is actually the first step was we did a training course where we
explain our employees and most people most affected.
So we're not speaking about only developing artificial intelligence, but
also about procuring it on the market and also about using it internally and also
about selling it.
So all those people.
And that's a big, that's a, that are thousands of people in our company.
And they need to understand something about this.
Yeah.
So that's what we started with.
Then next step we started about a kind of thinking about the governance.
So these are the principles, but so who is responsible for it?
What are the functions?
Do we need a new role in the organization to be able to deal with this?
We, of course, like everybody, we started to make a questionnaire where we do this
ethics impact assessment.
And I think we went through like 15 different versions based on experiences
with people.
Then we, we brought it out in the wild and we tested it with real, uh, real use cases
and people who are not so involved.
And then finally we decided to run some pilots with a governance model.
So do we need an AI ethics committee or do we need.
a special role, like we call it the responsible AI champion.
And how do you organize this completely distributed, decentralized?
And what are the things?
How, what is the workflow?
How is compliance involved?
How is ESG involved?
So we did really a pilot, uh, in four different business units.
And based on that experience, we, we thought we were ready to write really
something up that can be then, uh, complied with, and that is what is
currently the case.
So it's a journey that took us many years.
Of course, today, if you start a journey, there is much more experience.
So it will take you maybe three years.
And anyway, if you're in Europe, you have to do something anyway, because of the
upcoming AI Act, which will be, which will enter in force in, in two years from now.
So in that journey, how do you evaluate what's success?
You talked about a number of choices, a number of options.
How does the organization decide what the right things are to implement?
Well, I think success is that you move forward in a possible way.
And most of my experience is sometimes the process is more important than the result.
So of course, the result is that all the systems that you launch and actually, so
we have more than 500 systems every day running in our in our corporation
globally.
So it's not like 10 systems or 15 or 40.
It's really a huge amount of systems.
So you really have to do something seriously in order to understand that.
Of course, what we now have to do, we start with the new systems, where by
design we take this into account, but then slowly we have to do retrospective work on
looking at all the systems that we have.
But if you have a question like, for example, do we have a centralized AI
review board for ethics issues versus do we decentralize it out?
How do you get to answer some of those questions at an organization?
Yeah, that's a good point.
It depends of course, whether I think one of the first things that is important is,
are you a provider of artificial intelligence, mainly, or are you a user of
artificial intelligence?
A company like Telefonica or energy companies or financial companies, they are
all users, pharmaceuticals, and companies like Microsoft or Google, et cetera, they
are providers.
of this technology.
So I think that makes a very different thing.
If you are a provider, and you're a big tech serving thousands or millions of
customers across the globe, I think you have to be very centralized.
You can't leave this locally because then many things will happen.
If you are a user of this technology, it depends a bit on how
unified you are as a corporation.
I mean, if you have acquired, if you exist because of an emerging acquisition of 30
different companies, it's not so easy to do centralized.
But if you are a centralized company to some extent, then it's always good to have
a mixed approach.
Yeah.
So for instance, we have a, let's say at the corporation at headquarters where we
run several of our global businesses and our support functions.
We have a central model where we have an AI ethics committee, and we have certain
persons in the central business units, because there are also central business
units.
There is, of course, finance, there is HR, but there is also digital transformation,
let's say all our networks from a global perspective.
We have all that centralized.
And then, of course, we have operations in 15 companies across the world.
And then what we tell them.
is here you have a role model which you can use.
And if you want to use it, we can help you.
But given your situation locally, you are free to set up an alternative way of doing
this as long as this is approved globally.
So it's a kind of you cannot impose everything from the top because it's not
one size fits all.
But there are certain principles that you have to follow.
that you have a figure called, actually a role, it's a function of another job
called responsible AI champion.
That is in every business unit that uses, develops, buys, or sells artificial
intelligence needs to have such a function.
And this person is the go-to person for AI ethical responsibility questions across
that unit.
Now, if you don't use any AI in a certain area, of course you don't need such a
person.
If you use a lot, maybe you need three and it's not even full-time.
So it's just assignment of a new real refunction to an existing job position.
And so that is completely distributed because it sits in the businesses.
And then of course you need some...
obstruct you to organize, to bring those people together, to train them.
You need an AI ethics committee.
And then of course you can have the same, you can have for each big area of
business, you can have a separate AI ethics committee, or you can have one
centralized for the company.
What is the best situation?
So actually there are two factors.
One is, do you have enough experts to make such statements?
Because it's not an easy.
Of course, it sounds like anybody has an opinion about ethics and about AI, but
that's not what you want.
You want people with a mix of profiles, of backgrounds, but you also want to have
some expertise in the area.
So you don't have always the luxury to have like five committees in the different
business because simply it's not yet there over time.
Yeah.
There will be much more experts, but today that's a difficult question.
And, and the other part is.
whether how much AI there is.
Yeah.
So if there is a hundred systems, maybe with one committee, because it's
sufficient, because it's not a, so you have also two ways of using an AI, AI
ethics committee.
One is permission-based and the other is problem-based.
So permission-based means anything that will be done by the company first goes to
the committee.
There is a discussion, yes, we can do that.
No, we cannot do it or whatever.
And that's permission based.
And problem based is, look, we're working with this AI product.
We are discussing about the impact, and we see there are some doubts.
Should we use gender as a variable in the model?
Yes or no?
Now, that's a problem.
And then you bring it to the AI ethics committee, and they discuss.
Only about ethics, never about business.
And then they highlight, and they give recommendations.
And then they go back to the team.
Now, if the team agrees, then they
they go forward, if they don't agree, is escalated to an ad hoc committee where you
bring together ethics and business.
And in the end, the company takes a decision.
The important thing is an informed decision, it's an explicit decision, and
it's a documented decision.
So that's the difference by just doing things.
So that works quite well from the ethics perspective.
Now, if you are a technology provider,
where you have billions of customers, maybe is more a permission-based.
So we want to build an AI system that analyzes all electronic communications in
enterprises.
And then we can find hubs of knowledge and isolated hubs of departments that are not
in contact.
So that is a product that has, well.
potentially serious implications for workers and some ethical questions.
So then it's good actually, so if you provide this product to billions of
people, then it's good to have a permission base because the impact is
huge.
So it's again, it's not the same if you're mostly a user of this technology where
you're a big tech provider.
Startups is a different world because they are smaller.
And they, of course, they have so many resources, but still, if it's high risk,
it's important to think those things in advance.
Does the fact that telephonica is in telecommunications, which is a regulated
industry, make it easier to adopt these kinds of practices?
Well, of course, but there are many regulated industries, yeah, and
telecommunications is regulated, but finance and insurance is even more
regulated and healthcare is enormously regulated.
So, of course, the culture of compliance, yeah, of having to having processes and
systems in place that check things, that is...
already in place.
So you can a lot of piggyback on that.
If you are a company that is not affected by any regulation, of course, then it
probably is harder to start with.
But take into account that we started from the business.
We didn't start from compliance because at that moment, this was not on the radar of
compliance.
Today, companies who are aware of upcoming regulation
Of course, they will start from compliance.
How does generative AI change the landscape for responsible AI practices in
your view?
Technically speaking, not too much.
I mean, ethical AI, responsible use of AI is about estimating the ethical and social
impact on human rights by design.
I don't know if that is machine learning with structured data or whether that is
generative AI with unstructured data.
You still have to evaluate the impact on human rights.
Now the difference is that, let's say traditional AI is narrow AI.
Yeah.
So you have a use case and you evaluate the use case.
Now, generative AI is kind of general purpose to some extent.
Yeah.
You can use it for different tasks.
You can use it for very innocent tasks and also for very serious tasks.
And that means that.
Um, it is different because for narrow AI, it makes sense to evaluate use cases and
not the technology.
You don't, uh, you don't evaluate a recommendation algorithm or a random
forest algorithm in terms of ethical impact.
Once you apply it to a situation, then you, uh, evaluate the impact.
And with, with generator to vie is this, this border is not so clear cut.
Because I can bring to the market, and this is what the companies do, they have
the big tech do, a general purpose AI that I can use as a user or as a business for
many different things.
I can use it for generating marketing texts, which is probably not so impactful.
But I can also use it to analyze natural language of patient dossiers.
and then make a decision for certain patients in terms of healthcare decisions,
which is very high impact.
I can record interviews for HR automatically and then have them analyzed
by Generative AI to see whether I should hire the people that has a lot of impact.
So it's difficult to put an ethical impact assessment on chat GPT.
as such.
So you have to do it.
And as a user, that doesn't change because we never use chat GPT or generative dive
for whatever.
So we use it to improve this or in our legal area or in our whatever area.
So we analyze the use case of this technology.
But if you are a provider,
then it makes a difference.
And that's also where the AI Act has found a lot of difficulties in coming to
agreement.
And because if you want to regulate it as one system, let's say as a high risk,
impactful system, then you also regulate a lot of innocent use cases and the other
way around.
Absolutely.
But let's say you're in a company like Telefonica that's not the one developing
the large language models, but which has a lot of these use cases.
And so a product group says we want to use a chat bot for customer service,
generative AI.
How do you think about the addressing those kinds of ethical issues?
Well, there is beyond the ethical question.
There is also just a performance question.
So if I use a chat bot externally with customers and I based that large part on
existing systems like Lama2 or like, like chat GPT, then I have a significant
business risk, not even speaking about ethical because those things can answer
you whatever.
whatever they can go into a direction.
So what companies have to do is kind of how do you tame or limit what those
systems can say if they are talked to with your customers.
And that's even only from a business perspective.
Yeah.
You don't want, so if we have a chat bot where we can, we can talk with our
customers, you want them to ask questions about the, about the elections in the U S
and that we make a statement that George chat bot makes a statement about.
candidate or so.
Now, how do you limit that?
Of course, if you manage to do that, then there are technologies for that, rack
technologies, whatever, where you take your own content, and then you use that to
generate the information, and then you use ChetGBT to have the dialogue and the
conversation to put everything together in a natural way.
That reduces significantly the hallucination part.
But still it can still have a lot of bias.
Yeah, so like bias professional bias in terms of professions typical male or
Female process professions or it can even have Yeah, let's say use language that we
don't want them to use insinuating Things that are not inclusive.
So there's still quite some challenges from an ethical perspective.
But then what you have to do is
This is my knowing what is your target audience and then say, okay, suppose that
something is going wrong in this direction.
So what is the impact on the people it's working with?
Is that impact severe or light?
What's the probability that it happens?
Is it 0.1% or is it 20%?
And then how many people are involved?
Is it 10, 100, a million, a full nation?
So all those things matter in estimating what is the impact.
And if you do that by design and in a systematic way, then the risk that
something comes out that you don't want is much less.
Of course, you can never avoid it, yeah?
Because some things you never know in advance.
But still, I mean, it's much better to do it in such a way than just do it as quick
as possible, put it in the market and then discover, oops, we didn't know this.
What about cultural context, language, how specific do these kinds of mechanisms have
to be?
Well, it is true that because those machines, this is massive brute force
calculations with statistical models.
Of course, the dominant culture on the internet is English and US.
So of course, many things that it answers, even though in a different language, still
the culture that is encoded implicitly in the model is a specific culture.
And that has as a disadvantage that smaller cultures can be, yeah, let's see,
have no, no role.
Uh, not so much.
Of course, in the Spanish speaking world, there are still a 600 million Spanish
speaking people in the world.
So still a very large language.
Yeah.
Not as, of course, by far, not as big as English, but definitely bigger than the
Dutch and from the Netherlands.
So only 20 million people in the world who speak that.
So, um,
From a language perspective, in terms of words, that can be worked on, because
there are initiatives, local initiatives, where people who love their language
always put focus on that.
So I'm not so worried about that.
But the cultural aspect is something that has to be taken into account.
As far as I know, that is not a solved problem, but it's a research problem.
So you mentioned a couple of times the AI Act that was recently adopted in Europe.
How do you see that or the broader move globally to adopt AI regulations impacting
what companies are doing?
I think it's a very good step, first step.
It's a good step in the right, an important direction.
I think global regulation or global agreements are very important.
That's why the EU act is important, because it covers 27 countries.
It's not for one country only.
Of course, the world is much larger.
than 27 companies and there of course there is the US and there is the UK, there
is China, Russia.
In that perspective I'm a fan of the UNESCO Ethical AI recommendation because
it covers 193 plus one countries including the US, China, Saudi Arabia, Iran, so
countries that are very hard to get together.
and they are together and they have signed up to an ethical use of artificial
intelligence.
Of course, this is just a sign up, yeah, there's no sanction.
If you still do many different things, nothing happens and that's the situation
today.
But that situation is also happening with human rights.
There are countries who signed an international human rights declaration and
are not respecting human rights as they should.
So...
This is a necessary step towards a more formal regulation.
So I think the AI Act is a good thing.
But of course, it also can be improved to some extent and is still on paper.
There's very little experience with what it means in practice.
I think a very important thing is this is risk-based and that the majority of the
use cases of AI...
are not high risk.
They're limited list, so they have no regulation at all.
But there are certain areas where there is potential risk and those areas are
regulated.
So from very light regulation in terms of if you make a deep fake, you have to say
it's a deep fake.
You can't claim that it is for real.
There's transparency obligation.
If it's high risk in terms of
impacting human rights.
So if I want to use AI to hire people or to fire people, or to accept students, or
to give a loan, determine the interest rate, or whether I accept people for a
loan, a mortgage, medical applications.
So everything that is essential for people.
If you use AI for those specific things, then you need to comply with certain
requirements.
before putting it in the market.
So the data should not have bias, should have quality, should have human oversight,
the adequate human oversight.
You should log the system in the sense that if something happens later, you can
investigate whether there was a problem.
So it's a set of requirements that you have to take into account, but only for
high risk use cases.
And then there is unacceptable risk and those things are outright forbidden to do.
If you do that, you have to pay 35 million or 17% of your global annual review.
So, so, and then there is the part of general purpose AI.
So generative AI, which they have put in later.
Um, and they have struggled a lot with the fact that
The AI Act was based on use cases and suddenly there is a system that you can
use for many use cases.
So I think that if you use generative AI for high risk, then you just do the same
thing as you have to do for any other system.
You have to assess the impact, you have to comply with certain things.
Now, if you use a third party for generative AI, like OpenAI or Microsoft,
for your use case,
of little risk, nothing to do from the user perspective, from the company
perspective.
But if you are using it for high risk, then you have to comply.
And that means there is a transparency obligation towards the provider that the
provider has to say, okay, this system is trained on this data, I've done this
checks on bias, I can monitor, etc.
So that is a kind of tension that is written in the law.
but we don't know how it spells out in practice.
And then if you are a provider of such a model like OpenAI or like Microsoft, then
they speak about systemic risk systems.
And that means systems that are so big that they actually can create an impact in
society at large.
And there are some requirements on top of the system.
So they have to...
have a system of notification, they have to alert system, they have to check
periodically the data, et cetera.
And they have to report on those things to the European Commission.
But how they check, what they check is left to the industry.
So it's a kind of hybrid self-regulation, formal regulation, and that is definitely
a compromise between different perspectives.
And in my view, and that's my personal view, is a...
incorrect discussion, because it speaks about either you innovate, or you are
responsible.
Yeah, so if you want to innovate, you cannot be responsible, because there are
other countries, yeah, who are not responsible, and they can innovate faster.
So that's the kind of discussion that's put up like the US innovates, China
copies, and the EU regulates.
Now,
If you speak about responsible AI by design, so regulation by design for high
risk things, that means that in all the way, in all the process that you build
things like chat GPT or whatever, you start thinking already, or what could be
the impact if things go wrong or what about hate speech?
How do I train?
So you think in advance about all those things.
And then in the end, what comes out of it is probably a more responsible.
project rather than correcting it once in the market.
And also think, if you launch something to the market and you discover a problem,
which has happened several times with Google, with the generative AI's they put
in the market, actually impact and the cost of repairing that is much higher from
all perspectives than if you do it while you are designing.
Yeah.
And then there are actually several business benefits from doing innovation in
a responsible way.
So it's not doing either you innovate or a responsible, no, you innovate in a
responsible way.
And if you do that, society is more and more requiring companies to be responsible
beyond profit.
We see that with climate change.
Climate change is actually a business factor.
And now at this moment, investors look at your climate rankings and ratings.
and emissions before they invest in you.
So there is a trend that even your customers value, not only your profits,
but also value your responsibility.
So if you're responsible and you show that, and actually you do it actually in
practice, that's a positive point.
The same for your employees.
So employees become more and more aware of those things and they want companies that
not only
make money, but it also have a responsible role in society.
So that also is actually a business benefit.
If you are a responsible company and you've thought about the things, actually
governments who are also your customers, they talk to you more.
They ask you for support when this goes about regulation of AI.
They want to have your opinion.
So you create actually a better relationship.
with the public administration, which always is a large buyer of many companies.
So, of course, those are not so intangible that they appear on the balance sheet, but
I think those are all recognized factors that are positive.
You recently left Telefonica, although I know you're still very involved in this
whole area of responsible AI in various contexts.
Tell us what you see as the biggest issues going forward that companies and other
organizations need to focus on.
I think on the short time for companies, it is, I mean, depending of course, where
they are, but in Europe is be prepared for the regulation.
And that for some companies is going to be like the GDPR was a lot of work.
So it will be a lot of work, but it is not something completely new.
We kind of copying the process we did for GDPR with a different content, some maybe
a bit more difficult.
But so it will, that is, I think, one of the things that is coming from a company
perspective.
I think another thing that is, should be coming and is maybe not yet coming are
more the indirect and more global effects of the use of artificial intelligence.
So what happens to the future of work is in the end.
Creating more work or is it creating less work if it creates less?
So what does it mean for the financial sustainability of states?
Because there will be less income taxes.
Is this the time for Robo tax?
Is it the time for UBI?
So those discussions are not dealt with at the moment with regulation.
But I think they are important.
There is also an issue on equality and gaps.
So this is.
very powerful technologies.
It helps increase global GDP, it helps increase national GDPs, and also market
caps and profits of companies.
But if you look at how this wealth is distributed, then it's ending up in a few
countries and in a few companies.
So there is a challenge on how to make that a fair system in the long run.
Otherwise, if we keep going as we are, so the companies who are doing this now, they
will become bigger and bigger and bigger and more powerful and more powerful, and
they will become richer and richer and richer at the expense of other people.
Yeah.
So the question of leaving nobody behind is very important here and is not dealt
with either.
So regulation takes things into account of the direct impact of AI.
within the scope of individual organizations.
But the global issues that survive the use of this technology at large, they are
still only part of discussions.
Okay, much to think about.
Richard, I want to thank you so much for joining me on the road to accountable AI.
Okay, it was a pleasure to be here, Kevin.