What Happens When AI Uses Outdated Laws and Bad Data?

Regon: At the end of the day, you cannot effectively protect that which you don't understand. Every piece of unmanaged data becomes something an attacker, a bad guy can steal, they can encrypt it, they can expose it, they can use it for extortion. So the challenge isn't just about the sensitivity of the data. AI agents are great, but they are just a few days behind. They don't have access to all the legal content as well. So if they don't know something, they immediately start interpreting or more negatively hallucinating and then you get hallucinated answers and then citations and everything. What is one trend in technology or cybersecurity that is currently overhyped? For sure. I mean organizations chasing AI that promises to save or create bazillions of dollars. before they've even talked about data quality, governance, security fundamentals, privacy concerns. What is the number one reason a CISO rejects a new technology tool during a security review? The number one reason is gonna be a lack of transparency about how it handles, protects data, an inability to provide evidence that it meets security controls. I think we're gonna solve records retention and records management information governance by twenty thirty. And I think we'll have it figured out by then. Okay, well, welcome to the InfoGov Hot Seat, the Governed Intelligence Podcast. I'm Jim Merrifield. Today's episode is called Legal Data Infrastructure: Building Compliant Foundations for Enterprise AI and Cyber Resilience. That's a mouthful, but it will be a lively discussion. So here's why this conversation matters right now: Retrieval augmented generation or RAG. co-pilots and internal AI agents all share one dependency. They are only as trustworthy as the data underneath them. We might say legacy data piles up, retention rules change by jurisdiction, regulators keep moving, and the same sprawl that makes AI risky also widens your attack surface when a cyber incident hits. So that's why today we're looking at data governance from two angles. One, One of them that rarely sits against the at the same table. So for one, it's the legal data layer and the security perimeter. Now, my first guest will be Juana Pamilar, co-founder and CEO of not one company, but two companies, Lostronaut and Filers Keepers. Juana built Filers Keepers to answer a deceptively hard question. How long should we keep our data? And has since expanded that vision into Lost a nut, a platform for legal data infrastructure. Now, my second guest is Tara Ladner, SVP and Global C CISO at AFLAC, who lives every day with the consequences of data that is ungoverned, over retained, or poorly vetted when it comes through a vendor's API. And then we'll spend time with each of them individually and then bring them together for a rapid fire hot sea question and even your questions. So a quick note on that. If you're still listening, if you're actually listening live here today, we we welcome you. please send your questions in and we'll take one from the audience in their final segment and even throughout the discussion today. And one more thing before we start, this podcast is made possible by our founding supporters. they are newcode.ai, net documents, iManage, Lostranot and Filers Keepers and Fit or Future in Tech. Now this episode features Lostranot and Filers Keepers exclusively, who again is a also a founding supporter, and we'll say more about that at the at the close. So at this time, let's bring Wana to the show. Hello Hey Wana, how are you, man? I'm fine, man. hi from Germany. All right. I didn't even get to ask you. So you're from Germany now. You're always all over the place, right, these days. Always. Right. Right. I love I mean, AI and legal tech are global nowadays. So, you know, wherever the show is happening, that's where we that's where we are. Yeah. Yeah, that's right. Well, thanks for for joining us live from from Germany. And I know you're the co founder and CEO not of one company, but two companies. Before we get into some Some questions about you know what you're doing today. I know you're in Germany, but why don't you introduce yourself to to the the audience on the show? Yeah, so I'm Wana Pamela. I'm the co-founder for Filage Keepers and Law Straub, and currently also its CEO. And I'm a recovering lawyer. I used to be privacy practitioner at a top-tier law firm in the Netherlands. I helped. multinationals with their setting up their global privacy programs. I also did quite some litigations, including a litigation on data retention. And one day a client came to us and said, Hey, we're in seventy eight countries. Can you just let us know what the retention periods are that are applicable to us? And c colleagues I was working with said yes of course, because they wanted to make some money. Little did they realize that they had said yes to reading all the laws in seventy eight countries. Mind you, this was pre AI, yeah. And so we engaged 60 law firms in seventy-eight countries and that project backfired massively because the client kept saying, This is all wrong, and the law firms we had engaged kept saying, the budget is finished, what are we gonna do? Obviously, you can't ask a law firm to read all the laws in their country. So we had to write off a ginormous amount of money in cost going over budget, and that was the moment that my co-founder and I looked at each other and said, we need to make a business out of that. And that became fileless keepers. Fireless Keepers today serves over four thousand multinationals worldwide. So it doesn't matter where they're located or what kind of industry they are, it's global. And we have a software where you can say, Hey, I'm in these jurisdictions, these industries, build me a bespoke retention schedule, which we then do. And then we can calculate what's the most optimal retention period given all the countries and states you're in. and when the law changes, we can send you a ping and we s and say, Hey, the law has changed. Do you accept or decline? So you're in control. Love to talk more about, you know, where we're gonna take the business because everything is gonna be more connected. One of the themes, I guess, also for today. And why do we have Lostrap then? Lostraud basically was a project of filers keepers that you know spun out of control, became a product, became a process, became a product, became a business. because we needed to keep our own database up to date. with all those retention periods. It's for Fathers Keepers has the biggest database of its kind in the world. And it's a lot of work to kind of keep track of all the laws and to me to know when when something has been repealed or updated or something new came out. So we started to crawl government portals and that eventually led to a massive crawler and and PDF parser and then standalone product and we started to market That under Lawsront has nothing to do with retention, guys. It is the raw material. It's the legal official publications, primary sources that we can then con structure and connect to AI through MCPs, APIs and and other methods, basically. Yeah. No, it makes a lot of sense. And I saw a LinkedIn post you guys are tracking like over seventy million laws. Is that is that correct? At this very moment we're going towards seventy one million. Yeah. Well I shouldn't s deb per se say we are the fastest growing legal content database, but we're definitely one of the fastest and I think it's it we're in a absolute data race now, to the top. Yeah. Yeah. No, it's it's great to be in that in that, you know, company. Now you mentioned like retention schedules and obviously it takes a lot of infrastructure, right, to build a product like like Lost Ornaut. so it's not really just like a research tool, right? I mean it's it's way more than that. Yeah. So you talk about files keepers, it's really a research tool. If you talk about Lostronaut, it's kinda like the base layer for that research. And it's it's a massive crawling exercise. We are tracking thousands of government websites, and some of those websites are the biggest websites out there in the country. Yeah. So We're talking about millions of pages of court cases or whatever. And still a lot of legislatures are pretty lazy when it comes to their publications. So they will work in Microsoft Word and then they will be done and then they will hit print. And that's usually print PDF. maybe they even hit print from the as actual physical printer and then they scan those documents again. And then they put it on the internet. Yeah? And then we actually have to parse all those PDFs. So I think one of the themes in legal tech nowadays is it's no longer about the law. It's all about the economies of things. So you have to be able to parse millions of documents and not spiral out of control in terms of cost of operating. And this is where you see a lot of competitors struggle basically. and making e quick exits to to sell to other legal tech companies because the cost of operating is just ginormous. So yeah it's all about the economics and it has nothing to do with the law in that respect. Of course there's lots lots there that does really you know relate to law. We need to structure it. We need to have deep understanding of what it is that we are collecting and publishing. so that part is is a lot of fun to actually create kind of like a normalization of all that legal content over the globe. It's a it's a nice it's a nice challenge. Yeah. Yeah. So you I mean you consume, I mean that's a lot of loss to to consume from all those different portals. So like do you like consume them like automatically? Well, nothing is completely all automated. look, we are using a ton of AI to prepare everything, but it is super complex and every single website is different. And there's only so much you can vibe code in there. Yeah. So but we I always say that AI raises the floor but it also lowers the ceiling. Yeah. And this infrastructure we build is so incredibly complex and and sophisticated. you couldn't five code this, you need to actually have just, you know, a very good team to build this. Could it be done in the future? I I'm not ruling anything out, of course, because you know AI is keeps surprising us. Yeah. That makes that makes a lot of sense. so let's let's switch gears a little bit talking about like enterprise AI and and and rag pipelines. I mean 'cause really every major enterprises billing AI and RAG applications right now. so here's a question. What happens when an enterprise LLM ingests data without structured legal metadata attached to it? Yeah. And I can answer this from from two angles basically. I think and I'll I'll use the file exeper's example from actually the you know the records that you have within your company and also like, you know, laws. Yeah, and legal research. So when you look at your you know a typical organization with, you know, multinational or large corporate, few petabytes of data, some many petabytes of data, in there, there's a lot of rot, redundant, obsolete, trivial data. And if you have an AI that needs to go through that, you'll burn token tokens like crazy because the AI will actually start Looking, got five different versions of the same document here. Which one should I use? You know? And it's gonna go through that whole motion of kind of figuring out which one to use, it will argue with itself, like, this is the last version. Yeah, but in version two, there was the a mention of this and that that got removed. Why did it get removed? Like there was it it starts to overthink everything, yeah? And and while you're waiting, you know, and those those seconds and minutes tick away. It's burning a lot of tokens. What you need is you need to have provenance and ontology. And I I'm at risk here to become a little bit esoteric of to some maybe. But with provenance, we really can say this is the authority that published this document. And this is the kind of like course that it went through time. It moved from here to there, got copied to this repository, got accessed by that person, changed by that user, and now we're here at the end station. And I can now say this is actually an authority that we can rely on. The ontology part is that you need to understand the meaning of the document within the context of the organization or the or the or the framework. So the ideal here is that you can trust the information and the information gets also understood by the AI as part of a bigger whole. Yeah? So it's not like I'm looking for social security number. No, what what what are you looking for is social security number on a payroll record for a person that is under investigation in an internal internal investigation. There's a legal hold on all the person's records. Because you know, someone is super mad over in Michigan. Yeah. And there was an email about this between the CEO and the CIO or whatever. Yeah. That whole context you need to understand. If the AI can rely on the information, can understand the context, then you know, we're really to the next level. And that's unfortunately not where where every organization is at right now. No, no, I agree. I agree. But we do, since this is the hot sea, I told you, there's questions. So a question came in as you were talking about all the, you know, I think seventy-one million laws kind of struck a you know, kind of woke some people up. so when saying seventy-one million laws, here's the question. Do you mean the ones only related to retention? No. Or is it more than that? So and this is a common misconception because we got files keepers, right? And it deals with retention research. That's the qualitative research that we do. But the funny bit is retention rules live in almost every single law. Because the government thinks like this, right? Got a new environment environmental rule. how am I gonna make sure that all those organizations comply with this ret with this rule? I'll I'll I'll just make them keep the the documents. Yeah. So with files keepers, we're already used to reading all the laws in the world basically, in order to find those niche rules. Yeah. But lost has nothing to do with that. It is the kind of like raw material. It is the entirety of that environmental law. It's the entirety of the GDPR or Surveyens Oxley or whatever it is. Yeah. We do all the laws, all the court cases, all the regulatory guidance, regulatory decisions. Yeah. Those get often overlooked by publishers. It's important what the FTC has to say. Nowadays, I think, you know, companies look more at the regulators and the and the agencies. for for their decisions than they do actually look at case law. Yeah? Legislative history and basically any kind of like publication by the government that that bears some some authority. That's what we look at with Lost Tronaut. It's a it's a it's a universal purpose legal content database. Yeah. Where you can literally go, Okay, what are the laws in New Jersey? What are what's new in New Jersey versus, you know, what's happening on the Maldives? Yeah. It's it's completely international. makes sense. Thanks for Yeah, we got to seventy one million in a little bit over one and a half years. Yeah. So yeah. Yeah, still growing. Looking forward to having this conversation in a few months from now. You'd probably be at a hundred million by then, you know? With that yeah. Yeah, I'm sure. It could yeah. Yeah. So here's a privacy question, right? I gotta ask you the privacy question. I know IAPP was last week, so privacy is top of mind for everyone. I know they released a They released an AI governance book. I actually got it. Like Hot of the Press. Pretty cool, right? I can't wait to dig into that that publication. But so here's the question. How does Lostranot act as a legal data layer that prevents enterprise models from breaking privacy laws or making decisions based on outdated regulations? Yeah. So I think first of all, I think that legal data is becoming the AI infrastructure when it comes to like legal tech. Yeah, that's one of the trends. besides everybody everything's becoming agentic, right? That's the other big trend. But the other thing is legal data and there's a huge rush now to get get all the legal data out there and get it into the AI. So so you're not gonna get it from a legal research platform anymore. You're gonna get it Through APIs, MCPs. And that gets embedded in the AI agent. Now, AI agents are great. I use them a lot. Everybody does nowadays. But they do always kind of like they're just a few da weeks, days behind. They don't have access to all the legal content as well. Yeah? So if they don't know something, they immediately start interpreting, or that's or more negatively, hallucinating. And then you get hallucinated answers and then citations and everything. And s for some, you know, folks in the legal practitioner world, they have had horrible encounters with judges where the judge went, This is fake, you know, are you even a real lawyer? And and and Bar Association steps in and everything. So you need to be able to rely on the answer. And that's a bigger trend for AI in general, right? We all wanna trust the AI. Now That's a big issue. because don't you have that feeling that when you don't know anything about the topic and you ask AI, AI is always right. Or when you do, when you are the expert on the topic and you ask AI a question, it's like right 50% of the time. Let's just not dive too deep into that. But you need to have a solid source so that the AI cannot invent the content. Yeah. it needs to be up to date. It it really needs to tell you yesterday something came out, today the AI knows it. Yeah. No, that makes that makes a lot of sense. So speaking of like, you know, we touched on privacy laws, but we can't we can't talk about data infrastructure without talking about defensible disposal, right? So how does having an active legal data infrastructure give like general counsels, for example, the confidence to execute automated deletion schedules. Well, first of all, everybody has to manage the life cycle of data. But it is it is very difficult. first of all, there's a lot of arrivals in play. so it's hard to build a retention schedule and it's hard to then implement that retention schedule into like hundreds, if not thousands of systems. But you have to. First of all, the rules tell you to, whether it's GDPR or the AI Act or or you know anything that that that that that The US throws at you. C C P A, C CPRA. But you have to actually manage the lifecycle. but I guess AI is the biggest driver nowadays. so y you have the book, AI governance. I guess you know, part of that will also be like, you know, IG information governance is slowly becoming AI governance. So you will need to know what information the AI has access to, right? Biggest tip I can get give everybody is when you share a link for, you know, you have within Microsoft three six five you can share a link to a document with a colleague. If you use the default settings in your organization, it's share with everyone. That's the default setting. Now it usually doesn't matter because I've sent you a link, Jim. I just think you got the link, nobody else got it. So, you know, no, yeah. But now copilot has access to it. Because co-pilot respects permissions. Yeah. So check this, right? This is where information governance and records management becomes really key to AI. The same goes for keeping old data too long. You know, that's what files keepers is about, you know, telling you exactly how long do you need to keep it at a minimum when it does it need to go. it it is incredibly important because otherwise the AI has access to way too much data, old data, it has a huge risk, and it also bears a huge cost because you're just evaluating too much information. so defensible disposal becomes super important. Defensible disposal is super scary because we as human beings like to hoard data. we we we you know we're hunter goderers by nature. so gathering is in our nature and we feel like we need to gather for our survival. And for some reason that's also in the instinct of a company. where you know companies are like, I need to survive and therefore I need to hoard as much information as possible. So you need to do this thoughtfulfully. You need to build a retention schedule, have a records and management program, information governance program. you need to validate, you have the business involved, you need to automate a lot of things. But you need to actually run it and it should not be, we're gonna delete everything on a Saturday evening because that's very sus. but you you you you need to actually say, Well, yeah, this, you know, category of bucket of data was end of life. We then send it through our defensible disposal process. These people signed off, checked it, validated it, signed off, and then it was gone. And that's why it's gone, dear judge. yeah. So and then what you will see is that regulators and and and and and courts are are really okay to accept that. if it's it's a very thought-through. Yeah. Yeah. So let's talk about regulators, right? So here's my last question for you for now, before we we give you a a short break before the rapid fire session. So what's your advice to enterprise technology leaders who want to prepare for data architecture for the next three years of global? AI regulation. What would you have them focus on? definitely they should stop over retaining and they should just accept the fact that, you know, those dust you know, people that were shoved away in in dusty basements and, you know, dealing with records and and information. Invite them into the room again because they know a lot about, you know, what, you know, good data quality looks like. what what the are the records and data that matter to the organization? What doesn't? Yeah. Build a very solid data quality layer. don't over retain any anything. But really bring the information governance professionals into the AI project teams, programs, and and let them think along and help. and please don't fight code records management. It's very tempting, I know. But it can lead to huge issues because you don't wanna lose your valuable IP or or you know, business insights just like that. Yeah, so it needs to be a very conscious decision. But that's what I definitely would do, and there's a lot of hope because you have AI now, you have systems that can process data in large quantities. So it is definitely possible now. So why d wise advice there? Wana. So thank you so much for for sharing your insights on this. Stay with us. We're gonna send you backstage for a little while. All right. So that you heard it Juana. Before we turn to the security side, a quick thank you once again to our founding supporters. You see them on the screen there, newcode.ai, net docs, iManage, and you just heard from Juana, co-founder of Filers Keepers and Lostronaut, and also future in tech. just wanna thank them for the support of this podcast. Well now let's look at this from the other side of the table. Let by welcoming Tara Ladner from AFLAC. Here's Tara. How are you? Hey Jim. Good. How are you? I'm great. I'm great. I'm sure you're warming up backstage and ready for your your hot seat moment. Hopping up and down the whole thing. Yeah. Awesome. Well so where where in the world are you today? in the world, I am in Columbus, Georgia, which is where AFLAC is headquartered, surprisingly. a little town outside of Atlanta, about an hour and a half. awesome. All right. So you're you're in the US today. I know you're traveling. I am. Tomorrow I head back to Japan for like the eighth time this year. Wow. my goodness. So well I'm glad that we we were able to have this conversation before you travel literally around the world and catch up on sleep and things like that. so before we get into some of the information, why don't you just I mean, obviously CISO at AFLAC, but if you want to introduce yourself just for the audience purposes. Sure. I'll just give the the quick rendition of it. believe it or not, about thirty years ago someone came into my office and said, You're neat, organized, and detail oriented, you're gonna be a records manager. And I said, I don't know what that is, but cool. And I have ridden that wave and and done various things, but my my absolute kind of foundation is built in information, understanding information, understand the value, the risk, the the cost of information, all of those kind of underlying principles. And along the way somehow I thought it was a good idea to go to law school when e discovery was driving a lot of information governance initiatives. And then I moved into security and and am lucky enough and proud enough to be in the role that I'm in today. Yeah, that's awesome. You have a unique role. No, I mean it's it's it's unique, but it's it's amazing just seeing your career path. You know, obviously security's top of mind for everything, especially including, you know, with the emergence of of AI and all the different tools out there. So awesome. I don't think either one of us wanted to stay a records manager. Not nothing Nothing against, you know, records managers out there, but I don't think that was the the end of the the career for for most of us in these in this industry the these days. Yeah. But definitely certainly a place to to start off for sure. So, you know, wanna describe building clean legal data foundations. Now, from a a CISO perspective, how does ungoverned legacy data expand your threat during say a A cyber breach in general. So this question literally goes to kind of how my career progressed from records management to a global chief information security officer. At the end of the day, you cannot effectively protect that which you don't understand. Every piece of unmanaged data becomes something an attacker, a bad guy can steal. They can encrypt it, they can expose it, they can use it for extortion. So the challenge isn't just about the sensitivity of the data. For most organizations, as we know, it's that they don't often know where it lives, who owns it, whether it's still needed, whether it's being protected. So when a breach occurs, excess legacy data definitely increases the footprint. It increases the scope of the incident, it increases the cost of response, it increases, you know, the future cost of litigation. So good I would say information governance and and effectively getting rid of old legacy data doesn't just reduce storage costs and risks. It reduces cyber risk dramatically. Yeah, no, for sure. I I I agree. I agree wholeheartedly. Now, but many you know, talking about data and risk and things like that. many, you know, software vendors out there say they integrate via API into your environment. Yeah, when a tool makes that claim, especially through APIs or MCP connections, what specific security and privacy criteria must it satisfy in in your mind? Yeah, I mean we so as we interact with various providers, as we interact with our policy holders, for example, all of these are trust relationships and APIs are just another trust relationship. So we're gonna focus on questions like what data will the tool access? What permissions does it require? is the data tr encrypted in transit and at rest? Where's the data stored? Is the data isolated from other tenants within their environment? What logging and monitoring capabilities exist? How will I get information back to feed into my SIM? How will they notify us if there's an incident? You know, are they are gonna are they willing to kind of undergo our validation from a security perspective? So it's really it it's it's really not just a technical connection and that's what we have to remember. It's really another trust connection and it's a an extension of our kind of trust boundary. So we've we've really got to vet that and validate that. Yeah, it makes a lot of sense. I mean, those are w when you were going through those questions, you know, I was just thinking about the the questions that are passed on. from from clients to firms. You know, it's a lot of those same questions are passed on to our our technology providers, right? And we're kind of like in this this thing together. Yeah. It's not unlike any of our third party risk assessments, honestly. It's the same kind of questions. Yeah. Yeah. 100%. 100%. So let's talk a little bit about shadow IT. I know there's n or shadow AI, I should, I should say. We're kind of beyond shadow IT, but there's a lot of that that going on these days, you know, employees using unapproved tools. from your perspective, how do you tackle it without like stifling business innovation? Because obviously with AI, right, everybody wants to use tools. We're driving efficiencies and things. How do you strike that balance? Yeah, I would say many, many companies out there jumped right into creating models. And many of those have failed because it of course didn't have the expected return on investment. So we here took a much more controlled approach. Of course, our insurance regulators jumped on this technology early and with a lot of rigor for a regulator. I was very surprised. so we started by creating a pretty strong AI governance program. So any AI that gets used has to go through that governance program. but when we are finding shadow AI or AI that's being used but wasn't put through the governance program. It's really a sign that, you know, employees are trying to do their business. It's just like when we used to talk about, remember we used to say email is a workflow or email is, you know, a filing cabinet? Well, it's because we didn't give them the tool. Right. So if we're over here saying no, if we're the the office of no as security sometimes called, people are are gonna go around us and we know that. So we provide a list of approved tools. clear user guidance, training, and more importantly, we move we move the AI technologies quickly through our governance process. We don't only bring security to the table, we bring our legal partners and our compliance partners and marketing and HR. And everybody comes to the governance meetings ready to ask their questions and get the technology approved. That way we can stay ahead of what our users need and what they want. and provide that to them so that they're not using shadow AI. And of course, you know, we're still security, so we block a fair amount of things and keep them from using it, but not without giving them a viable option. Yeah, that makes sense, right? You can block I feel like in the in the era of AI you can only block so much with the tools that are out there. Block them all. Yeah. There's always something new coming out that, you know, makes its way through and And and that sort of thing. So it seems like you got a pretty robust, you know, third party your vendor management process, even into like getting all those business units together. And so when somebody submits use of a tool, it doesn't go to like a black hole and like nobody responds for weeks or months, right? That's correct. Yeah, for sure. it makes that makes a lot of sense. so let's talk a little bit about because I neglect to ask this question about models leaking sensitive. information. 'cause there's that obviously concern out there to deploy some of these generative AI tools. How how do you ensure that these models aren't leaking like sensitive customer health or like policy holder information? All right. Now you know as a lawyer, you can't say insure to a chief information security officer. I can say we put controls in place. There you go. There you go. But you know, we we review it just like any other technology. Before we allow deployment or allow connectivity if it's a vendor model, we establish the clear data classification requirements, we talk about how the data can be used, we validate controls if it's a vendor provided, or we ensure that secure development pipelines were used if it's a internally created tool. And then we define ongoing monitoring and and controls testing. The biggest risk isn't usually of course the model itself. It's allowing sensitive data into the wrong environment without guardrails. and so we do have security tools in place, but you know, just like with any DLP tool, it's looking for certain patterns and those patterns aren't always consistent and they're not always clear. So we have to we have to put other tools in place and we are constantly, I'll tell you right now, evaluating security AI tools. because they're gr they're changing quickly and you know, they're like, Can you get into a relationship for three years? I'm like, dude, I can't get into a relationship for three months. It's gonna all be different in three months. And so we're we're constantly evaluating that. But I think the most important piece is, you know, I I know I say the word governance a lot and I do come from that background and of course with a legal degree. but governance does have to be built into the adoption process. It cannot be something that's hacked on after deployment. And so we we try our best to ensure that we've got those those controls in place before we deploy a technology. That makes that makes a lot of sense. yeah. So so here's a question. Where do security teams, you know, sometimes security teams and I mean I'm talking to a legal security lawyer, so But I'm sure leagues at times, you know, maybe not speaking specifically to your situation, but where do you see legal security teams and legal counsel typically clashing during AI deployment? Yeah, I mean security and I I don't know if clash is the right word. security teams, we're really generally looking at rapid response. We're looking at risk reduction, we're evaluating security controls. Legal teams are relying on like regulatory obligations and litigation risk and evidentiary requirements. And sometimes these priorities can can be a little different, especially during incidents and with AI employment deployments. Where I find myself so so many times is that someone will bring something to security and I'll say, Hey, have you talked to legal? And they're like, Security said no. And I'm No, no. Security did not say no. Security said, Did you go talk to your legal partners? Because I can see the I can see where there's going to be a disconnect. And so I'm trying to, you know, bridge that gap. And sometimes it gets me in trouble because it looks like I'm saying no. I I'd say, you know, one of the best ways to avoid that is is through making sure that you have strong relationships. I mean, relationships are are the key to me being successful in this role. And so I have very strong relationships with my legal partners. and and we do a lot of testing, a lot of joint planning. They're a part of our tabletop exercises. So it's that shared and agreed upon decision frameworks that kind of keep us aligned. Makes a lot of sense. I feel like security and just like you know AI and other technology is definitely a team a team sport, you know, you see tabletops that are focused on security and it's incident response. And now there's tabletops focused on AI. It just depends, you know, if you do them quarterly or twice a year or whatever. it just depends what's the hot, you know, topic of that quarter, you know, what's going on. So so here's the last question for you, Tara, before we bring Wana back. looking ahead, what capabilities do CISOs need from a legal tech providers? over the next three years that vendors are currently overlooking. I know we have a legal tech provider that's, you know, sitting there backstage, but what what what capabilities do you think we need? I think that and I don't think this is different from any tech provider. I think we need platforms to provide stronger integration with security tooling, better visibility into sensitive data, better better ability to automate retention and, you know, cla data classification rules, things like that, AI governance controls and continuous risk monitoring. So much of what we lack in in tools in general, not just legal tools, is that is that seamless integration. You know, y you shouldn't have to to do governance, to do proper data management, to do proper data security, you shouldn't have to tag tools on. These companies should recognize, especially if you're targeting highly regulated industries, that it needs to be easy. Or i if it's not going to be built in, it needs to be easy to integrate with those tools that allow those actions to be taken. Mm-hmm. No, it makes makes a lot of sense. And you know, I'll just tack on there too. I mean, it'd be helpful too to not have so many tools out there and it'd be helpful at some point that, you know, maybe law firms and the corporate world could use the same tools. You know, so so we can kind of speak the you know, the same language. I mean, right now, you know, I at least on the law firm side, I'm sure it's on the corporate side as well as you know, we have so many tools out there and you know, you talk to my peer down the street, law firm, and they're transferring data to us. They're all using different tools and things like that. And, you know, it's great to have the competition out there, right, with different tools, but it's also nice at least from the law firm to the client side to maybe use some of the same tools. We're starting to see that, I think, on the AI front, that there's there's definitely interest that law firms use the same tool as the client, related to AI cost and, you know, token usage and things like that. so I guess we'll have to wait and see. Yeah. You know, for sure. Well, Tara, thank you for you know, this segment. I'm gonna bring bring Wana back for our our live rapid fire session. So here's here's Juana. I'm just gonna check the before I do go to this rapid fire session, I'm just gonna check to make sure that there were there was tons of questions in there for you, Juana, about filers keepers. I'm gonna send those to you offline because there's literally like six of them, which is really cool. so that's so that's great. so listen, here's the rules for this rapid fire session. All right. Short answers. thirty to forty five seconds each. you know, you can agree to disagree with each other. you know, whatever whatever you want to do here. so here's the first question. what is the defining governance priority in twenty twenty six? And Juana, you can go first. The defining yeah, I I'm gonna go back. I I think information governance is the basis at the moment. And we're in such a great stage now we're privileged to live where we can see a Jeff AI organize a mailbox in 30 seconds, you know? it's possible. It is I should I should have let ladies go first, but you know, being polite, but but you know Yeah, it was completely startup. But that's why it's a hot seat. I had to throw it back to you Tara. Your answer. So Tara, here's the question. same question. What is the defining governance priority in twenty twenty six? Yep, mine's gonna be governing enterprise AI at scale without slowing innovation while while using AI to fight the AI that the bad guys are gonna use against us. All right. I like that. I like that answer. All right, so this time Tara's gonna go first. Here's question two. what is one trend in technology or cybersecurity that is currently overhyped? for sure. I mean, organizations chasing I AI that promises to save or create bazillions of dollars before they've even talked about data quality, governance, security fundamentals, privacy concerns. Yeah, all the above. Juana, how about you? I think, you know, fully autonomous compliance, end to end. You know, I I I I think we're gonna go there, but I do think that at the end of the day we still need trusted advisors, human beings that actually can empathize with us. Hold our hands and and think of a plan. Yeah. So yeah, that's it. And I I d I'm not sure if we want a a rule to become a control without any supervision. so yeah. Yeah, that makes sense. So here's here's the question's strictly for for Terra, Terra only. What is the number one reason a CISO rejects a new technology tool during a security review? The number one reason is going to be a lack of transparency about how it handles protects data, an inability to provide evidence that it meets security controls. Yeah, so just being up front, right? And just giving us all the information. Yeah, they everybody wants to claim the black box lately. Yeah. Yeah, for sure. I have to agree with that. So every every vendor should be like writing that on a a sticky note. You know, and putting it in their office that you know, be just be straight up and and tell us what's under the hood, right, from the jump. Awesome. So Juana, question for you. why are legal departments still afraid to automate data deletion? Because you don't get rewarded for getting it right and you get punished for getting it wrong. So meaning if you delete the data and it shouldn't have been deleted, then you get trouble. And that's why everybody's just sitting on their data, basically. And I think modern systems can really, really improve trust and confidence in that part. over retaining is also a risk. Yeah. Yeah. I think that I I think we'd we would agree. I I said that was that was only for Wana, but Tara, do you have a an opinion on that? Why people don't delete any data? Yeah, I think he's absolutely right because y if you get it wrong then it's It's bad. If you get it right, then nobody throws a parade on your behalf. Yeah. Now I would personally, but Yeah. But we usually see with, you know, cybersecurity that they're a big fan of of these importance. Yeah. Yeah. I think, you know, the data breach was probably the, you know, biggest, you know, moment for I guess the, you know, I G professionals, right? To be able to actually delete information. And now I think AI is like the other side of the spectrum. It's not about deleting data, but it it's about presenting the data in a clean way for the tool to actually, you know, project to to kind of show off the intelligence of the organization. so I think it's you know, as as all of you have both of you have mentioned, you know, I think that governance professionals are you know, I think uniquely positioned to to drive this this stuff forward. So So here's question five. we'll start with you, Tara. Complete this sentence in twenty thirty. It's only four years ago four years away. I it's a l it's kinda long time in the future, but twenty thirty. Well, we kinda lost two years in the pandemic, right? So in in twenty thirty, an enterprise running AI models on ungoverned data will be blank. Depending on the level of of kind of oversight, I think they'll be in trouble. I mean, I you know, we already have regulators who are creating their re review kits and and we're already looking at what kinds of questions they're gonna ask when they come in. So for a highly regulated industry like ours, we better be able to answer the questions and show evidence or we will be in trouble. In trouble. So that's the yeah. So that's that's the answer there. What about you, Juana? In twenty thirty An enterprise running AI models on ungoverned data will be blank. Blank. Done. completely obsolete. Done. Obsolete. Non existent. I think we're gonna solve records retention and records management information covenants, by twenty thirty. So if you're by then I'm a very optimistic person. and I think we'll have it figured out by then. And then you know, if you're if you're n not in control. It's I think one of the reasons you could go bust. Yeah. All right. It looks like Tara has a had a comment on that one. Solving records retention by 2030. I don't know. We've been trying to solve it for how many years? I don't know. Is it gonna be solved in four? longer than thirty, I've been trying to solve it. So that's I'll just leave it at that. Yeah. Yeah. I'm very I'm very optimistic. I think we are seeing that that the legal insights and the actual, you know, capabilities of an AI to manage records and data. Would they're coming very close now. Once that has happened, boom, it's done. It's like you can organize it right away. you don't have to yeah. So it it's maybe maybe if security, you know, puts the foot on the brake then maybe not. But yeah. All right. Well, here's a question from our audience. so we're out of the rapid fire session. Had one question in there from for both of you. So Tara, how can a CISO, how can CISO and legal teams bridge the gap between technical s security controls and legal compliance rules? I don't know that they're very different, honestly. I mean, so much of what we look for from a security controls perspective. can be tested with evidence, I guess, but when when we send out those questionnaires and when we engage with a vendor, for example, to assess their security controls, there are lots of questions that we we have in that questionnaire on behalf of our legal partners to understand, you know, any sort of privacy considerations, to understand from from a contractual perspective, whether or not they are asking us to go above and beyond, you know, basic security controls. So I think that it goes back to what I said earlier, relationships are everything. I mean, creating a good relationship between security and legal is paramount to for for success for a CISO for sure. I I don't know that there's a whole lot of of gaps there. They're just a little bit different. But it's all about information and it's all about making sure that the information is protected and understood. Juana, what do you think? Agree? Disagree? I think that and I'm gonna take it a bit broader because I just let's let's close the gap between IT and legal. Yeah? And and and the bridge can be found in the fact that both think very logically about things. Yeah. However, the the gap is we ob each operate at a different level of granularity. So where the technique technical folks need to be very, you know, detailed orient detail oriented. need to fix things in the code and and and need to be actual engineers building the solution that that that you know that closes the gap. Lego can operate at a, you know, super high level like, what if we just do this? And then look at IT and go, why isn't I just told you how to do it. Can't you just fix that tomorrow? When is it done? And because we they are the architects and then IT needs to build it and we're missing the technical drawings in mi in between. That's what we're that's what we're missing. So yeah, we need to come together and and understand each other's language more and each other's perspective. And I think we're doing a pretty good job. The industry is really growing there. And I think legal tech also has to right to just add on to your point, Juana, is, you know, for most of us, right, if you're dependent when your fiscal year ends, Like at least for us it's it's budget time, right? So we're figuring out what prod projects are for twenty twenty seven. And you know, a lot of times, you know, these projects are kind of owned by IT. So legal might not have a stake at the table and there's other departments that don't get involved. So I think, you know, probably to your to your point, Tara, everybody kind of has to be involved at the table for these projects, initiatives, buying solutions and things. Cause everybody has a you know, a stake at the beginning, they're more inclined to kind of work together in the long run, for sure. Yeah. So all right. So we're we're down to the final takeaway. we're gonna let you wanna go first. Final takeaway for the audience that the listeners should carry forward. I think we need to really look at data quality a lot. It's the one topic that everybody always kind of says that's the business that does that. Yeah. Let them deal with it. Privacy, you know, they have a big opinion about it, but they don't yeah. security puts a big lock on it, but the quality so we need to really all be at the table there and talk about that. Super important. It is fundamental to how we're gonna trust AI. and the outcome of AI. so yeah. How about you, Tara? Final takeaway. Yeah, I think that's a I think it's really important that we that we both kind of hit this hard, Juana and I both. And because if we if we simply say our programs are compliant, for example, if I say my security program is compliant, I don't have a very strong security program. Compliance is absolutely table stakes. I'm looking for for a much higher level of of security controls within our program. And that takes having security. It takes having legal, it takes having information governance, privacy, all of these functions kind of at a table together because they're not separate objectives. And I I get so frustrated, I guess, because I can see it so clearly because I've moved through these various capabilities. The organizations I think that best perform treat all of these as business enablers and they bring and and they all come together to create trust, to reduce risk, to accelerate growth. And that's really where you get a you know, a successful compliance program or a successful governance program is by bringing all of these together as strategic partners rather than check the box functions that an innovation team has to move through. Yeah, no, I couldn't I couldn't agree more. It's not enough to get, you know, SOC two or ISO compliance, right? It's an ongoing process here. But in that exercise all those people are at the table, right? To achieve the the compliance. You know, whether they like it or not, they have a they have a seat at the table, for sure. Well listen, thank you both for you know, spending some time you know on the hot seat with me and with our listeners, you know, sharing your insights. I really appreciate that. so thank you so much. I know you you both are very busy. so to to spend some time to share your expertise Or I shouldn't say expertise with with with two lawyers in the room. Your your what's the word? Give me a word. Experience. Experience. Struggles. Struggles and experience. There you go. Yeah. Well listen, if you found this to the audience, if you found this valuable, you know, share it with a colleague in legal, IT or security. really those three teams and even more need to be listening to one another. It's a good place to start. subscribe wherever you get your podcast, right? This podcast is on YouTube, it's on LinkedIn, it's on Spotify, Apple Podcasts, whatever. look out for our next our next episode in November. And again, I'm Jim Merrifield and thank you so much for listening. We'll see you next time.