← CZ and Friends
CZ and Friends
AI Governance and Why Legal Bottlenecks Start Upstream with Rachel Harris of Suzy
00:45:57
Loading summary
Transcript59 lines
- [00:00]
A
If legal is a bottleneck, something upstream is broken.
- [00:03]
B
Have we not integrated ourselves into this workflow appropriately?
- [00:12]
A
Welcome back to CZ and Friends, where we talk with legal leaders, operators and technologists shaping how modern companies work. I'm your host, Cecilia Zanidi. Today my guest is Rachel Harris. Rachel is the General counsel and AI Governance and Privacy Officer at Sustainability Susie, a high growth AI company in the market research space. She started her career in multi district pharma litigations, then was appointed by a federal judge to a national steering committee, and then she pivoted into privacy and governance, building those functions from the ground up at companies that didn't have those functions. Let's get into it. I'm so excited to talk with Rachel. We know each other through the GC community and I've admired her online since. So excited to dive in. Rachel, I'm glad you're here.
- [00:55]
B
Thank you, thank you. I'm so excited.
- [00:58]
A
All right, let's go. So I want to start with, so literally the term mdl. I'm not sure, you know, non lawyers know it, but it's an example of like really gnarly litigation. So first of all, what is a pharmaceutical mdl and how did you get your start there?
- [01:15]
B
Yeah, you know, it's so funny, anyone that knew me in law school, I'm one of those people that whatever I say into the universe. You know, some people are, can really manifest things. I tend to manifest the opposite. So in law school, I swore up and down that I would never end up in private practice. And then lo and behold, my first gig right out of law school, I was litigating pharma mdls. Right? So how I got there was I had a really great evidence professor who had sat on the other side of the table from some of the lawyers at the firm I joined. And he said, hey, if you just want, if you want to go all in and get trial experience, you couldn't learn from anybody better. So I ended up at the firm, ended up in their pharma MDL practice, which is a gnarly sense of litigation. You have class actions, you have multi district litigations. And I always like to say in a class action, you have a bunch of plaintiffs eating out of one pie. In mdls, you have a hundred different plaintiffs with a hundred different pies. They're all baked in the same kitchen, but there's a hundred different pies. So yeah, got my start there. Learned a heck of a lot, got a lot of really good experience. And I look back on it now considering from there to here and think, well, it's been a little bit of a roller coaster ride in my career.
- [02:30]
A
So you were plaintiff side? Plaintiff side. Most, I'll say most of our guests and there is a little bit. So I was in big law. I was at Morrison Forrester. There is a little bit of defense side snobbery. Also, you're from St. Louis. So my other good friend from St. Louis, Mark Boyko, he's plaintiff side. Erisa litigator, has literally been before, you know, the Supreme Court on these issues. And I think that like plaintiffs side is kind of a hack to get a lot of experience. So tell, tell me about being plaintiff side. That. And, and then now that you're on the company side, how that, how that.
- [03:01]
B
It's so funny that you say Mark because Mark and I worked at that first firm together. He was in ERISA and I was in pharma.
- [03:07]
A
Amazing. Yeah. No, literally when I think about like the most successful lawyer from my past, like we went to high school together and he literally, he said he had to stop going to cles because on erisa, because they were all his cases and he learned nothing, which is like fascinating. So yeah, so tell, tell me more about the, the plaintiff side. The, the plainicide journey and should people, should law students or, you know, what can a GC today learn from, you know, or, or what, what do you take into being a GC from having been plain side?
- [03:35]
B
Yeah, you know, it's. When I think back, I had someone recently ask me because, you know, a little bit of defense side snobbery. There's also a little bit, let's be honest, in tech, there's a little bit of tech in house. Kind of we're our own little vibe. And once you're in, you're in. But sometimes it's hard to break into it. And I think back to what, if anything, could have prepared me for life in a very high growth startup. And it wasn't working at a big law defense side firm. It was hands down working at the plaintiff's firm. There are so many analogies between the vibe and the speed at which you have to work and make decisions in the ambiguity and take big, big, bold bets in, you know, nights where you're sleeping under your desk to get something across the finish line. There's such an analogy between plaintiff side, especially complex litigation work and tech startup life. So it's always fascinating to me on that. But thinking of Mark Boyko, I'll never forget when I was interviewing with this firm, they had three main Practice areas. One was Erisa, one was Fela. So essentially railroad litigation, railroad injury and pharma. And the partner for the former two was talking about, we do a lot of trials. Great. To depositions. We traveled to Oklahoma. Da, da, da. And then the, the other partner was this phenomenal female lawyer. She was a partner at the firm. And she looked at me, she goes, rachel Pharma. We traveled to Amsterdam and we tried cases in Europe. And I, I just, I always remember thinking, yeah, I, I want that one between Oklahoma and Amsterdam. I'm picking Amsterdam. Yeah.
- [05:11]
A
No, it's funny, I read that because of Ozempic. Ozempic is like a third of the GDP of the Netherlands or some like crazy thing because of Novo Nordisk. But. Yeah, that's awesome. Um, so what's the craziest case you ever worked on? Give us a story. Or the craziest thing? Like, you know, deposition where, you know, guns were pulled or something like, you must have a crazy story.
- [05:33]
B
Not one that I sat in on, but there was a crazy story where both sides were screaming at each other. Middle of deposition, judge had to get called. Right. Probably most interesting case I worked on, I was the fun thing about mdls, I guess I'll say. Also for, I don't know any law student listening to this on the plaintiff side, because you tend to be a small firm yourself on plaintiff side, so you partner up very closely with other plaintiffs firms throughout the country. So as a fresh out of law school girl from St. Louis, I got to travel to New York City all the time and essentially be shipped out to be of service to another plaintiffs firm that we were working with on an mdl. So I got to work with a, a female partner at a firm in New York who had a nurse nursing background. We were working on a very complicated testosterone medication case. Her background as a nurse got us through a deposition of a like a high ranking former FDA official. And she was able to sludge through 3,000 med watch reports. Right. Where consumers submit to the FDA they may have had an adverse reaction to a medication. And I'll just never forget sitting in New York and it was just an entire week of us sludging through MedWatch reports trying to find essentially a needle in a haystack. And because of her background, we were able to do it. It just was not sexy, but also at the same time incredibly exciting when you finally get to that point where you find it.
- [06:58]
A
Love that. So you mentioned before that this experience of, you know, the fast paced, lot of pies, lot of people you're suing complex interrelated cases was an incredible prep for startup land. How, how is that the case and so analogize the job because I, on the external, it's hard for me to imagine how you know a lot of discovery and all those cases equate to the startup GC job, which I've had a few times. So how did you adjust and what did you. How are they actually related?
- [07:33]
B
Yeah, probably the closest analogy is dealing with, not dealing with, but learning to work with high operating, high risk tolerant owners. So on startup side, think CEO, right? On plaintiff's firm side, it was one of the founding and also owners of the firm who, in a plaintiff's firm environment, they're often having to take out first, second, third lines of credits on their own home just to finance a potential litigation that could stretch on for 10 years. A lot of these cases aren't a big bet that pays off in the next six months. They're a big bet that might not pay out for a decade. And so you get that similar mindset, especially in VC backed startup life, right, where you have to make really, really big bold bets and you have to get really, really comfortable with a higher risk tolerance that then you might have as an individual person and understanding that you might not even see the return on that for the next five, 10, whatever years it might be. Or it's a big bet you make and you've got to be ready to pivot hard left on a moment's notice in order to see five steps ahead and figure out this is actually where my ROI is going to be. Right. We all felt that when ChatGPT hit the market, you know, there are a lot of companies that were operating in traditional SaaS space. ChatGPT hit and we all had to pivot hard, pivot fast to go in the new direction, to really stay not just relevant, but successful in the, in the new age.
- [09:01]
A
You know, it's interesting you should say that. I had a guest a few episodes ago, Michael Jacobs, the former chair of Morrison and Forster. And you know, I, I made the observation that when I became a general counsel, the idea of litigating or certainly becoming a plaintiff, deciding to bring suit was something that I discouraged quite a lot more than of course, when I was paid to litigate. And he made the point that for a corporation, let's say Apple suing Samsung or Oracle suing Google or these like big very billion dollar litigations, said that when he meets with the clients as sort of like intake of deciding whether the firm will even Take the case that he. He tells the. The GC or the CEO or the relevant stakeholder that starting a new litigation is like opening a new line of business. Like, you gotta decide like that, that this is, this is what you're gonna do and, you know, fund it properly, manage it properly, set expectations properly, understand your odds of success properly. But what you're saying is actually even the next level of that, which is as the, let's say, chair of a plaintiffs firm deciding whether to take on an MDL or to take on a particular case, you're deciding whether to actually found a company is. Sounds like what you're saying.
- [10:19]
B
Yep. Yep. Because litigation financing, especially back when I was practicing it, there were no options. There's a. There's a bit more options on the market today for some of these plaintiffs firms. But back then, it was really my first exposure to founders and in how a business owner runs a business. The partners at this firm were phenomenal lawyers, don't get me wrong. But they were equally great owners of a business, a small business in a lot of respects. And they understood the gambles to make and what it actually meant for the employees at that firm as well as themselves in their personal life. And so that, I think, gave me the best translation into how to work with and communicate with my colleagues once I entered the startup space. And don't get me wrong, I loved my time in big law on the defense side, too. But when you work in big law, it's a different mentality and pace of life in some respects. You know, the. You're the billable. You're almost like the seller when you're at a big law firm. So you're. You're like, I'm the one keeping the lights on in. Even in a plaintiff's firm, you're not billing. So in a lot of respects, until the payoff happens at the end, in some ways, you're a. You're an overhead, you're a cost center, you're doing the work, but there's no guarantee the outcome is going to be worth that time and investment on the upfront.
- [11:43]
A
So tell us about your journey into Susi. So you do all that, then you go to Thompson Coburn, which is, you know, a big law out of St. Louis. What inspired you to make a change and go. Go be a GC and work at a startup?
- [11:56]
B
There's a little bit of an evolution. So it started at the first plaintiff's firm. I loved being there, but it was almost odd because I came out of law school and I became immediately niche. Right. MDLs are already niche. Pharma MDLs in particular is even more niche. And there's a lot of people who've worked their entire careers and they want to become that specialist and go into that niche. And you know, all of us do. I do too. But coming right out of law school into it, I wanted broader exposure for my long term career. And so I actually made at the time a sort of a weird transition to a small firm because I wanted non litigation exposure. I want just general corporate work exposure. And so I got it there. And at the time, around 2018, what hit everybody's favorite GDPR? It was the mad dash to help all, you know, the small, medium and large businesses we represented to get all of the privacy notices up to speed, et cetera. And then at Thompson Coburn, it sort of cemented this lingering feeling I had that while I loved litigation, while in some respects it came naturally to me, and I particularly loved Ediscovery. That was always my bread and butter. I loved it. I loved being in the trenches with the tech teams on it all. All parts of Ediscovery I loved. Right. You had ALML starting to roll out on Relativity and others. But in the back of my mind, I always thought litigation's a little bit too reactive for my own personal views and personality. I guess I wanted to be part of the team that was helping the company before it ever got to that state. Right. Something that was more proactive. And I was very, very fortunate. My predecessor at Suzie, Jen Healy, she's phenomenal. She took a big gamble on me because I was someone coming from. Not the particular background she was looking for. I was coming from a law firm. I didn't have background in. In house space, in the tech space. I was in Missouri. And she took a gamble and it was phenomenal because then I was able to join Suzy. I was able to build the privacy program from the ground up. I still had mentors from my old firm who had let me start to move into the privacy and data protection practice area, even though my anchor was in commercial litigation. And so I was able to tap them for additional resources, able to tap into the tech GC community for additional resources. And yeah, the rest, as they say, is history.
- [14:25]
A
What's the put us in your head your first week, month on the job, what did you do to. To set yourself up for success? And knowing what you know now, what would you tell someone in your shoes going from a, you know, kind of different background to in house?
- [14:41]
B
Yeah, I first Week and first month, let's be honest, first year, probably what all of us feel. Imposter syndrome. Terrified. Terrified and excited all at the same time. I think what I got lucky with in some respects is my predecessor Jen, who welcomed me and also just completely empowered me. She was like, you're the privacy council, you own privacy. Your clients at Suzy are the project and engineering teams and also our head of security. Go become best friends with them. And that's what I did. I spent the first 30 days just talking, doing a lot of talking. Our head of security, Andrew Croft was his name, he was phenomenal. He taught me a lot. Because there's knowing privacy and cybersecurity in private practice when you're the outside counsel advising it. And it's very different when you're in house. And what does it actually look and feel like practically on a day to day basis? To navigate those nuances, you, you spend a lot of time, you have to get to know the company's tech stack. Right. If you're cloud based SaaS, are we Azure, we AWS a lot of those nuances. You have to give yourself time and permission to learn. And then I think if I was telling somebody who was making a similar pivot, there's no great. The best playbook is don't doubt yourself and make friends. Don't doubt yourself and make friends.
- [16:07]
A
I love it. So let's talk about make friends. I think you're talking a little bit about influence. You said in the past that if legal is a bottleneck. Right. So the department of. No, no. You know, there is sometimes a perception that that's the case. But you, you use a term that is a systems thinking term called something upstream is broken. So pull the thread, go upstream. What does that mean? And then give us a very real example, if you can, of that in practice.
- [16:36]
B
Yeah. I think it, it starts with acknowledging that legal, I also oversee security and privacy. So I'll talk a little bit about that in the same analogy. But we're never our own flows in house. We are never our own work stream, end to end by ourselves. We are always at some point, directly or tangentially in the workflow or stream of one of our other partners in the company, whether it be sales, whether it be procurement, we're fitting into that. And so a lot of times when you start to hear feedback of legal, I'm feeling you're a bottleneck here. The real question becomes, have we not integrated ourselves into this workflow appropriately to where once it gets to us, it feels like A bottleneck. And I guess an easy example would be we'll do an easy fun one for the first one for my in house friends that may be listening on customer sales close one cycles, right? Hey, legal, why are we taking three turns or why, why are we taking so long to return redlines on this? And then you start to dig in and you start to see, oh my colleague, my contracts counsel is having to spend an exorbitant amount of time going back and forth with sales on the other side to say, hey, you're sending me your professional services agreement. But we're SaaS. The base, we're SaaS. And so what you really start to figure out is the trickle down effect. From the moment the sellers start having conversations with prospects. We're missing something there in that they weren't trained properly to understand our fundamental business model. And the way to have the initial conversation with can you work from our paper? No, you can't. Let's work from your paper, send it over, let me open it up and see if it actually says sas. If it says professional services agreement, here's how I go back and have that conversation. It also allowed us to identify and there's going to be gasp when I say this. We quickly identified, oh, some of this could be cured if you know there was a clm. But at the time plot twist, if you work in a small company with limited and no budget, there's not only not a clm, there's no appetite for it. So what do you do? And for us it was starting to identify how do our sellers flow through the process. We use Salesforce end to end, beginning of identifying an opportunity all the way to closed. And we figured out we can't buy a clm, but gosh darn it, we can build one into Salesforce ourselves. And so we did sort of a hacky workaround. But by enabling us to do that, there's now a central source of truth for our sellers to always go to and reference and for us to leave notes if there's a particular nuance for that particular customer relationship. Hey, we know they prefer to work from their template, they don't, et cetera, et cetera. And it's, it's slow, it is almost completely removed. The notions of bottleneck or why are we taking three turns, We've got it down to two turns max.
- [19:25]
A
Love that. So many good threads to pull there. Basically what you're saying around in house is part of the process. Like you literally with a Salesforce example. So you diagnosed the problem and Then you went to where the clients are. Did you consider any alternatives? And when you're making that judgment, I mean, I happen to agree with it. I think in house is a fundamentally different practice than anything else and you have to be where the clients are. Do you see like are there worlds where legal is parallel and is there any reason you might do that? Obviously the CLM thing, CLM is a real business. But sounds like you solved the problem without it. I mean, give us a little bit more on that contrast. I agree with you so hard I can barely ask the steel man or whatever straw man argument.
- [20:13]
B
But
- [20:15]
A
what is the straw manner or what is the other side of this of like, oh, keeping legal independent. I did have someone, a podcast guest say he thought, okay, legal lawyers were not business people. His spicy take was that we needed to lean into more being lawyers.
- [20:29]
B
Interesting.
- [20:30]
A
Tell us about that. Tell us about either that contrast or what would legal look like otherwise? See, what you're saying is so obvious. What was the alternative?
- [20:38]
B
Right, right. And you know, I love that you say you're saying the same thing. Meet, Meet your clients where they are. And I, I can't even take credit for like identifying that myself. My predecessor beat that over my head. She was, oh, anytime I came to her and was like, hey, I want to improve this process. Great, you gotta meet the sellers where they are. They live in Salesforce. Go meet em there. You know, don't, don't pull them out and make them come over, let's say into Jira to open a ticket. No, that's gonna delay things. Meet em where they are. It's, it's interesting. I can't think of a scenario in which I would operate and not in a silo. I know that's not what you're saying, but when I'm not operating and going out of my way to meet my cross functional partners where they are versus the opposite. But I'm going to put a big caveat on that in that I work for a small, high growth startup, right? We have a hundred employees. I think it looks very, very different once you cross the threshold and you start having 500, 1000 et cetera, number of employees. And yes, I concur with your other. At that point legal starts to operate more as an independent function within the broader community and less ingrained every single day where other folks are. I look forward to the day when I get a CLM budget. I can't wait. I'm going to do a happy dance. It's going to be the best day of My life.
- [21:56]
A
That's amazing. That's usually not a. I guess budget and happiness usually are heard in the same sentence, but CLM and happiest day of my life usually not. All right, so, uh, so we're. You're a startup gc.
- [22:08]
B
What's the.
- [22:10]
A
How have you. Obviously meeting them where they are is one strategy. How else have you been effective or worked to be effective at your job?
- [22:20]
B
I've been so excited from last night till today because I want to get into like a juicy topic with you and I want to see what you think. But I guess I should just say I feel I'm even having imposter syndrome right now because I don't. You're way cooler of a guest to have on this very own podcast to pick your brain based on your experience. But anyways, I was thinking yesterday a lot about what does the future of an in house high growth GC look like? It's changing crazy fast as is. And there's so I. I have so many friends in the. On LinkedIn, in my algorithm. We're all doing really cool things and building here and there, whether it's leveraging Claude co, whatever the case may be, tools and skills and artifacts to improve our day to day operations. And I almost had an aha moment last night as the future of a product council and I'm. I might like belabor this point, so make me shut up if I do. But traditionally as product counsel, you're working with your product and engineering teams and they're thinking of, hey, I want to go to market with this new product launch. Are there any legal nuances I should be aware of? They go consult the lawyer. The lawyer's like, yeah, GDPR this or that, da da da da da. And then the product manager has to almost repackage that into product specs that can get delivered to the engineers. You have to turn that into something they can actually build into the code. And last night I had a moment where I went, you know what, let's bypass this as much as we can. And so I actually just built out an MD file. An MD file of. Hey, I think. Let me think about how much specifics I can get into. There was a feature on our platform that used to be missing and if we could bake it in, it would unlock potential new use cases on our platform. And that feature related to consents and the ability to capture consents outside of just like a digital checkbox. Right. Like, what about the situations in which you might have to get an actual signature? We've sort of talked about the idea for years, but what this new technology allowed me to do last night was actually, you know, go back and forth, get the concept down, create an MD file of. Here is how it would conceptually look from the legal perspective. Conceptually of like, in these jurisdictions, consent might look a little different. You're going to need to understand if it's under a certain age, is it in, you know, Europe versus the US Et cetera, what information is involved, the sort of detailed nuances that we like to geek out about, but might be kind of boring to the product manager. I wasn't able to take that MD file and go directly to our head of product and our head of engineer, and I was like, I don't know, this might be horse poop or maybe it's helpful, I don't know. And they were able to immediately download the MD file, plop it into their agents and say, start building me a prototype. And that's where we are this morning. And I just. Wow. Yeah, I don't. I don't know where your thoughts are on that, but it was almost. It goes back to, who will Ohms be? Our knowledge and expertise will always be needed. I think the delivery of it is just what might change.
- [25:36]
A
Yeah, so this is exactly like. You're spot on in terms of the future of legal. So product counsel, you know, it really is product managers with a legal skill set, particularly in regulated areas. You're in AI. When I was on Alexa, you know, a shining moment we've talked about on the POD before was getting invited out to the product management off site as one of the product managers. And that was fantastic. But what you're saying we're seeing across the business and is really the promise of AI, which is you can not only advise on the thing, but now you can do the thing. So it's similar to designers, right. So designers used to do your mocks, and then, you know, you send the mocks over the wall to engineering and they would do them. Now there's this sort of like, you know, standoff between product management, engineering and design, where it's like all of them think they can do the other's jobs or can do the other's jobs with AI.
- [26:32]
B
So what's left?
- [26:33]
A
And there's this concept of taste, but in this scenario, just to break it down for the audience a little bit. So what Rachel had was MD is a markdown file. It's basically a set of text, really, just natural language that you can give to the AI. And that's what she did. So she had basically what she ideally would want from a regulatory standpoint in the product, gives it over to engineering, and basically is able to create this sort of consent form in the product using her natural language instruction. So that is exactly where the feature is going. So gcai now, AI has obviously started where it's like, okay, answer questions for me, be my assistant. But then as you add functionality, as AI gets more powerful, Claude is adding the ability to actually do things. We're adding that as well in gcai where it's like, okay, don't just tell me what to type in my email. Send the dang email. And so like, what you're explaining is absolutely the future. This is also why, from an AI standpoint, you know, I push legal teams so hard, is like, you are closer to these workflows that the business needs. You can actually get in there and do the thing in a way that like, I've worked with outside counsel on disclaimers or things like that where, you know, literally we had a client. So one of our customers is operates basically point of sale machines where it's like where you put your credit card and there was a disclaimer associated with CCPA with the California Consumer Privacy act that essentially would have been way longer than the screen. And the outside counsel sends it over and it's this long disclaimer. And our customer was working with the actual engineering to be like, no, no, it's like tap to consent. And it was like maybe five words that you could actually fit. And that idea of being so practical and so embedded actually gets back to what you're saying. So I think my view is that AI is better placed in house than at law firms for this reason. Would you agree with that?
- [28:27]
B
I would agree with that. And the opportunities are endless because when you are in house, there's so many different functions that you advise. So like, think about the opportunities. That wasn't an example with product, but marketing. Marketing wants go to market and they want to do it fast. Maybe they've already built out their own skills. I'm using Claude terminology, but it could be anything, A custom GPT, whatever. They built out their own. But I'm gonna use a phrase that my CEO used when I sent this over, but can you infuse the brain of Rachel into the thing that you've built? So rather than marketing having to come to me and be like, hey, review this new go to market collateral for marketing law review. Instead, boom, you've already got an MD file from me. Put it where you already are. Right. You can do versioning control on these markdown files. Once you get an update, you just send them a fresh one. Now it's marked version two. They upload that one, it overrides the previous one, et cetera. But isn't that just so much more efficient? I love it. I don't want another JIRA ticket and another queue I have to monitor. Like, if I can just take a piece of my brain, hand it to you, and we update it as things evolve, great. It makes all of our lives easier.
- [29:35]
A
I love that. Wow. I mean, it's literally like, it's so fun to hear you explain the future as literally. I see it and our customers see it where the nexus of the legal need. Like, as you said at the top of the call, you're not trying to sell an hour of legal work. You're trying to. You're, you're, you're gearing towards an outcome which is the growth of the company and the success, you know, at the right level of risk of the company. And so you're happy when that happens. I love it. Any fun AI stories? So the markdown one, I'm not sure we're going to top that, but any other, either AI wins or AI moments that you've had, that's a tough one,
- [30:12]
B
I think, because I was on such a high from last night. The markdown file was probably my most favorite. I will say, though, and this is not. This is not you. You did not. You're not asking me to say this, but for anyone listening to this, my. My second win is, or favorite moment was when I signed up for gci. Let me say why. Let me say why. Because when ChatGPT first hit, I will never forget, I was speaking at a lot of different conferences, talking to lawyers about starting to use ChatGPT. And even at that time, there was rumblings of this, this new company called gcai, et cetera, and people were still trying to feel it out. And I, I kept telling everyone, hey, y', all, right now there's a free version. It's a light version of GCAI, but it's a custom GPT in ChatGPT. If you just want to get a flavor for the thinking behind it, go experiment with it. And I even patiently, but, like almost confidently waited, watching you guys waiting to pull the lever on when I was going to go. Because in the back of my mind, what I was waiting for was the integration and award. And I was like, oh, I just know, I know they're going to get. They're going to figure this out. And it was the day you all announced it, I immediately, I'm going to say ran, but it was like, of one of slack, because I'm fully remote. I ran slack to my CFO and I was like, do I have approval? Can I get this? And I was immediately in there. And my. My favorite moment, and I will always remember in my career, is the day I was able to leverage AI directly in word, to apply red lines and generate commentary to the opposing party in real time in Word. It seems so not sexy now in hindsight, but at the moment, I mean, that is crazy. It was crazy.
- [31:53]
A
I love that. Oh, gosh, you know, you are just making my day. This is so much fun. So let's talk about the compliance side. So you're certified in ISO 42001, just the AI management system standard. You have some real advice and chops around AI compliance. So let's put on our product council hat. So what is the Suzy platform? And then in terms of advising on AI, we have a lot of listeners who do that. How do you do it?
- [32:24]
B
Yep. So Suzy platformer, I guess in a nutshell, evolved from way back in the day we were a platform essentially for influencers. That was day one of Suzy, way back in 2018. It later evolved into recognizing that there were a lot of Fortune 100 brands that need to be able to talk to their consumers to figure out feedback on new product design, new prototypes, what have you. And so they evolved from influencers to building that into essentially a consumer survey platform. And that was the B2C side of the business. And then they separately developed a B2B side of the business, which was enabling a platform to where those brands could come in and launch the surveys directly to the consumers. It's evolved again since then to where it's a lot more of a data orchestration and data intelligence layer. But that's fundamentally where the roots were. So two things. One, I always consider myself lucky that my first gig was at Suzy because I got exposure to not just B2B, but also B2C and the former tying it back to the plaintiff's discussion. I always had a part of my heart that will forever love B2C, because there's just a part of me that will always want to kind of protect the consumer, you know, So I loved that component of it. And so when ChatGPT hit, what was really, really important to us was rolling out AI on our platform in a way that didn't surprise either. Our B2C and our B2B customers. Because at the time in tech, we were and are a lot more AI tolerant than what big corporations might be. Because we're small, because we're nimble, we have a much different risk profile. We can move faster than other companies, but we gotta be cognizant of that. You know, our massive customers might not be ready for that. So how do we go through and have those conversations? And a lot of it is just almost thinking about what would you want if you were a user of the platform? Do you want to at least know generally when you're clicking on something that it might involve AI? Okay, cool. Product team, design team, let's put a little visual that a normal person can recognize as associated with AI. Let's add a little language at the bottom of, hey, this is AI generated. Make sure you review it right. Doesn't have to be legalese, but just think about what you as a user would want. And I think that's always the best place to start. And then the second place to is get in the room with your engineers and start having the very, very technical conversations. When we say AI, what do we mean? There is line. Are we developing the massive LLM? Chances are no. So if no, how are we stacking on top of it? Are we wrapping around it? Are we improving it by virtue of fancy word retrieval, augmented generation to add context? Are we just doing prompt engineering? If all these words sound like foreign language, pull up ChatGPT and ask ChatGPT what it means. ChatGPT is really good at explaining those things. And I think all of that is more important than the actual sitting down and checking the box that you've met. ISO 42001, section A145. You need the base before anything else. Otherwise it's all just theater.
- [35:40]
A
I love that you said that about theater. So you said sometimes there's a risk of compliance. Theater. Things that look like compliance but don't move the needle or don't build the tr. You know, it's tough. I think there is, you know, particularly in privacy. You know, a whole industry sprang up. There is some. There was an economic analysis of GDPR that found that the biggest winner was compliance companies, something to that effect. What. What is that concept and how do you avoid it?
- [36:09]
B
I think it plays out the most. At least what I've seen it plays out the most in security and privacy, wherever those functions might sit. Sometimes they sit in the legal larger departments, sometimes they might not. And these are all incredibly intelligent and, well, intentioned individuals who are doing their best to navigate the ever growing, not sludge, but the ever growing volume of things that regulators are saying should happen. And we generally all agree and are aligned that those are really great intentions and things that, yes, are, are great for protecting privacy, for security, all of the things. But translating that into how does it actually look and feel every single day across industry verticals, across company sizes, across jurisdictions, that's what makes our jobs fun. But that's the rub, right? Translating it into the day to day. And so I guess one example I could give. I also sit on the procurement side of Suzy. So I'm the legal review and the DPA review on all the procurement tickets that are going through potential vendors we want to vet. And part of that is our security team tends to send out security review questionnaires. Anyone who's in house has probably been on the receiving end of those. When you sit in procurement, you're also on the sending side of it. And we started to realize, wow, it's taking a, it seems like it's taking a while for vendors to get these back to us. And so it was an exercise where we put ourselves in a room and we forced ourselves to go one by one back through every single question we asked in the questionnaire. And really a microscope to do we actually need this? What is the purpose of this one individual question? What is it asking for? Can we ask it in another way? Or even better, can we make it a dynamic questionnaire so if you answer one thing this way, the rest falls away. If you don't do those exercises, you will end up in compliance theater to where you are just putting words in a questionnaire for the sake of having the words in the questionnaire. But I think what is most important and what the regulators really intend is what is it capturing and why? And can you, can you ask it in another way to where it's clearer for the end user so that it's easier for the end recipient to answer and so that both sides of the table have a better understanding of what's actually happening with the data involved?
- [38:30]
A
Yeah, it's interesting you say that. I had a privacy governance risk and compliance manager at one of my jobs who had come from Accenture, one of the big consulting firms doing that. And it was interesting because at the time the job I was in, we were debating whether to get SOC2 certification or something to that effect. And I said, you know, that I didn't quite get it, like, why do we have to get the certification? And he made a Point similar to what you said, which is actually that if the stand that standards actually serve a commercial function, which is if the question is, you know, we're all going to wonder how secure you are and we're going to send a thousand different questions, then, you know, let's just have a standard where if you meet it, someone in the case of SOC 2, the auditor someone has determined that you have met these particular standards. That should be enough. But I actually think it maybe has over rotated where now SoC2, we have SoC2, but yet we still get all those questionnaires. So are you saying you streamline the actual ones that you sent then down from a thousand or you push back when you have your customers asking you for them or both. What's the practical takeaway?
- [39:45]
B
Yep, both. And I am so glad you said that. I 100% agree. I almost feel like, and it's maybe it's not contrary in view, but I almost feel like at this point some of it has become diluted, I guess is what I would say the pendulum has swung the opposite direction. And I do agree that there can be a commercial purpose served by the likes of soc and the ISOs. Right? You got security, privacy, AI governance, the different ISOs. But I think it also can become theater if you don't actually map that commercial impact. Meaning I know when I first joined Suzy there was some rumblings amongst others of like, oh, we should get this cert and this cert and this cert. And I would always go, why has a customer contractually required that? Or informally. There's just a lot of interest in us having that because if not, we're just jumping through the hoops for the sake of jumping through the hoops. And so you have to be very strategic in where you're investing those dollars because those audits are not cheap. Each one is expensive to procure because you have to engage the independent third party auditor. But it's also a headquarter, a headcount strain for your team that has to sit in the, you know, SOC can go on for 45 days. You have isos that if they overlap you could be sitting in audits for six. And so you really have to do that one to one on a live. But then also to your point, we keep a very detailed record on even with four different audits, how many 500 plus question questionnaires are we still receiving? And I think it would surprise most people how many we still receive. And it tends to be from the same verticals. You would expect the highly regulated Financial verticals, financial services, healthcare, insurance. And I always try to place myself in their shoes and go, okay, there's a person on the other side who's a well intentioned meaning GRC person who is doing their best to do their job today. And for better or for worse, they might be sitting in a massive company that either has to or has become accustomed to checking the box. And so they have 500 questions in their questionnaire because they need to check the box to say that they've done that. Okay, respect. Now on our side, we need to be agile enough to figure out how can we get through those questionnaires faster. And that's when you start looking at either building out your own custom GPT based off of a knowledge barriers or procuring a tool like a Vanta. I'm trying to think of the other one. Vanta.
- [42:06]
A
Drata.
- [42:07]
B
Yeah, Drata. Thank you. We'll stick to another one. And leveraging those knowledge bases to help your teams get through them faster. Because when you start talking security questionnaires, that's not security in a silo that has direct impact on your sellers, your CSMs. You're trying to get through renewals, the overall closed one cycle. You're all in those trenches together.
- [42:26]
A
I love that. Let's see, you were told you should have been a product manager in another life. I hear it. I hear the commercial forward, but with the legal skill set, I hear the thinking about the future of the industry. Have you thought about making leap officially?
- [42:43]
B
My CFO tells me this almost daily. You know, it's funny, I can see it, I could totally see it. But I also think the modern age GC is that it's one of the hats we wear. We are a product manager whether we know it or not. We're product manager, project manager, all of the things. And as we talked about with the markdown files, we're also starting to tread into the territory of being able to directly hand to our engineers things that they can add into the GitHub repository. Right. Depending on what accesses you have, how comfortable you are. But people are going to get get to that point where the handoff is more one to one and direct. And so I wouldn't have it any other way. There's parts of the legal profession that oh yeah, I mean if I never do that again in another day I'd be fine. But there's other parts that I wouldn't give up for anything. And one of the parts you probably feel this too is just the legal profession. While we can Be confrontational and it can be contentious at times, especially those of us who've come from litigation. At the end of the end of the end of the day, our colleagues in the profession will go out of their way to help you. If you have a question for a career path or tech, GC is a great example. You have a question and you're like, I don't know how to navigate this. I'm a solo GC or whatever. Can you help me? You'll get 15 to 30 people responding to your posts, giving you helpful tips and feedback or resources to leverage. So I wouldn't change that for the world. I wouldn't change navigating the fun legal complexities for the world. And I sure as heck wouldn't change getting to be a GC right now in the age of AI and how fun and crazy things are.
- [44:13]
A
Yeah, see, it's rare to have someone as excited about being a GC and AI and the future. It's just, it's so lovely to, to hear that. So let's move to the lightning round. We've had an amazing, amazing time together. What is a book or concept that has shaped how you think not legal?
- [44:32]
B
I read the book Simple Path to Wealth and that's shaped sort of how I view my own personal finances.
- [44:37]
A
I love that. And what is two line advice that you would give your younger self?
- [44:42]
B
Two line advice? A give my younger self.
- [44:45]
A
It's tough.
- [44:47]
B
Be kind and make friends.
- [44:49]
A
Be kind. Always universal. I love that. Awesome. Thank you so much for joining us. Anything else you'd like to leave listeners with?
- [44:58]
B
No, I guess I would leave it with experiment. Have fun. I, I was always jealous of lawyers that got to to navigate, you know, the advent of the Internet and all the fun that came with that. And if you're a new lawyer starting out or if you've been practicing for 30 plus years, we have this awesome opportunity to navigate essentially kind of the same. And we get to navigate the murky, messy, but also fun and exciting world of AI.
- [45:27]
A
I love that. Wow. Thank you so much for being here, Rachel.
- [45:31]
B
Thank you.
- [45:32]
A
That was my conversation with Rachel Harris, the General Counsel and AI Governance and Privacy Officer at Suzy. If today's conversation got you thinking about how to be a great lawyer for business and tech teams, that's exactly what we're building at gcai. Learn more at GC AI. Follow Susie and friends wherever you get your podcasts. Thanks for listening and we'll see you next time. Have a great day.