Episode 66: AI Governance is NOT optional

Summary

The Monopoly Report: Episode 66

Title: AI Governance is NOT Optional
Host: Alan Chapell
Guest: Shoshana Rosenberg, Chief AI Governance and Privacy Officer, WSP USA
Release Date: February 18, 2026

---

Episode Overview

This episode delves deep into the imperative of AI governance for the advertising and tech industries, focusing particularly on the concept of digital agency as a fundamental human right. Alan Chapell and guest Shoshana Rosenberg examine explainability in AI systems, the tension between privacy and transparency (especially with Privacy Enhancing Technologies, or PETs), and practical approaches for businesses to implement ethical AI. The discussion centers around moving beyond mere compliance to proactive ethical stewardship, underscored by Rosenberg’s PRISM framework—a practitioner-focused toolkit for AI governance.

---

Key Discussion Points & Insights

1. What is AI Governance, and Why Is it Important?

[05:45]

• Shoshana Rosenberg: AI governance is about oversight and strategy: knowing how AI may quietly shift an organization away from its intended goals or documentation. It is less about "checkbox compliance" and more about understanding AI’s actual impact.
  • “It’s much more about an oversight and strategy component…so that you can see the problems before they arrive as liability.” — Shoshana [05:45]
• Alan Chapell: Effective business leaders anticipate how variables (like AI) will impact their outcomes, not just hope for the best.

2. Origin Story & AI in Ad Tech

[06:19]

• Shoshana’s background as a Navy engineer and international law attorney led her naturally to privacy, tech, and ultimately AI governance.
  • Observed early that privacy and machine learning (“not AI, that’s machine learning!”) were colliding, especially as machine learning started shouldering privacy concerns.
• Alan: Ten years ago, “machine learning” could be used to obscure or gloss over privacy implications, but that’s less feasible today.

3. Digital Agency as a Fundamental Human Right

[08:19]

• Definition: Digital agency means being able to understand, accept, reject, or challenge the digital context you're placed in—knowing why an algorithm or system is making a decision about you.
  • “Digital agency is about the ability to understand the context of what you are being given so you can decide to accept it, reject it or challenge it.” — Shoshana [08:34]
• Ad Tech Challenge: Black-box targeting undermines agency; users need transparency and control beyond “why am I seeing this?” dialogs.
  • True explainability should outline what data is used and how, with options to opt out or adjust preferences.

4. Explainability & Its Layers

[10:44]

• Rosenberg advocates for explainability at several levels:
  • User level: Intuitive information and controls.
  • Client/B2B/Agency level: More technical detail.
  • Full audit level: Deepest possible traceability.
• Explains why post-hoc explainability is inadequate—ad tech’s inferential logic is not robust enough for real accountability.

5. Legal and Regulatory Gaps

[14:07]

• EU’s AI Act and GDPR have gestures toward explainability but lack practical enforcement.
  • “There are no teeth there, and there can’t be until you set a mandate for explainable by design, by such and such time.” — Shoshana [14:12]
• Alan and Shoshana agree no current jurisdiction effectively mandates real-time, enforceable explainability.
• Enforcement, tracking, and imposing requirements on big tech remain global challenges.

6. The Role of Government Procurement

[17:29]

• Even when governments reduce regulation, procurement requirements for federal contractors may drive explainability into mainstream business practices.
• Contractual obligations will ripple through vendors, subcontractors—potentially embedding governance standards even where regulatory oversight falls short.

7. Enforcement Challenges

[20:06]

• There's a chronic lack of resources in regulatory offices, making enforcement (and thus meaningful oversight) difficult.

8. Tension Between Privacy and Transparency

[21:37]

• Alan: Many PETs (privacy enhancing technologies) reduce explainability by hiding the “how” and “why” of data use, sometimes creating more opacity than they solve for.
  • “Privacy at the expense of transparency isn’t really helpful, particularly given the effectiveness of many of the PETs to actually address consumer concerns about privacy.” — Alan [21:37]
• Shoshana: If PETs undermine transparency/agencies, they're counterproductive. Transparency and privacy are not enemies—done right, both serve digital agency.

9. Trust, Auditing, and Market Incentives

[23:16]

• Platforms often ask advertisers to “trust our numbers” post-privacy tech, but there’s no way to independently audit datasets or campaign outcomes.
  • “The platform holds the cards and everyone else—both the end user and those counting on them—are at a disadvantage.” — Shoshana [23:19]
• There is no meaningful external certification, akin to “organic” labels, for PETs or data stewardship.

10. The Infrastructure Debate: Incremental Fixes vs. Overhaul

[27:40]

• Alan: The IAB and others are debating whether to incrementally improve (build on existing infrastructure) or start anew (scrap the broken foundations).
• Shoshana: Advocates a hybrid—fix on the fly, but set a date for explainability by design in all new systems.
  • “You want to try to make a fixed date by which they have real incentives, both financial and otherwise, to get to a place where the tech can do what we need it to do.” [28:32]

11. Practical Guidance for 'Little Tech'

[30:31]

• Companies should start embedding explainability in procurement and vendor management, even if partners aren’t ready.
• Be able to clearly document your contributions and controls when leveraging pre-built models or embedding AI.
  • “Be able to evidence what you have put in place, the controls you have around it, the ways in which you are auditing and reevaluating both the functional, the outputs and the way it’s working as best you can.” — Shoshana [30:31]
• Recognize you’re building on “wobbly technology”—AI is often predictively statistical, not logically deterministic.

12. PRISM Framework for AI Governance

[33:49]

• PRISM: Principles, Responsibility, Intelligence, Security, Monitoring.
  • Designed for practitioners, not just compliance.
  • Encourages holistic, adaptive governance that persists across organizational “angles” (roles/departments).
• Not just for writing policies, but for daily operational decisions, problem-solving, and documentation.

---

Notable Quotes & Memorable Moments

• “Explainability within ad tech might mean... when you look at why you’re seeing [an ad], it says you’ve been to shoe stores, you live within 10 miles of the store... and you have some controls where you can say, don't use this, don't track this, don't sell me this.” — Shoshana [09:34]
• “You have an inalienable right to freedom from interference by dragons, but we don’t have to enshrine it until there are dragons. And we're now at a point where agency is actually eroding faster... Both are on parallel tracks of complete dissolve.” — Shoshana [12:10]
• “Explainability by design by 2029.” — Shoshana [29:25]

---

Important Timestamps

• [04:53] – Shoshana defines AI governance and its significance to business strategy.
• [08:19] – Digital agency defined; shortcomings in current ad tech.
• [10:44] – The importance and layers of explainability in AI.
• [13:57] – Why explainability is unattainable post hoc (especially in ad tech).
• [14:07] – Legal frameworks: why existing statutes are not enough.
• [17:29] – The power of government procurement in driving governance.
• [21:37] – PETs, privacy, and transparency: finding balance.
• [23:16] – Trust and verification problems for advertisers.
• [28:32] – Shoshana’s “explainability by design by 2029” challenge.
• [30:31] – Advice for smaller tech companies entering the AI race.
• [33:49] – PRISM framework overview.

---

Takeaways for Listeners

• Digital Agency: It's becoming urgent to treat digital agency as a human right to ensure individuals can understand and control how AI influences their experiences—not just in theory, but in real ad tech contexts.
• Explainability: Transparent AI isn’t a “nice-to-have;” it’s essential infrastructure for responsible advertising and business fairness.
• Privacy vs. Transparency: PETs that “protect” privacy at the expense of verifiability may be creating new problems. Businesses and platforms need to pursue both.
• Practical Measures:
  • Start asking hard questions of vendors now—even if explainability notices aren’t standard yet.
  • Document your own AI practices, controls, and audits (“know what you put in your chili!”).
  • Prepare for coming regulation by building real oversight into your organization.
• Regulation is Coming: Whether it’s government contracts, executive orders, or new laws, external pressure will soon require real AI governance.
• PRISM Framework: A practical, cross-disciplinary approach for organizations to move beyond checkboxes and towards genuine, ethical governance.

---

Resources Mentioned

• Book: Practical AI Governance by Shoshana Rosenberg (May 2026, Kogan Page).
• Shoshana’s initiatives: Women in AI Governance; Logical AI Governance.
• Chappell Regulatory Insider: Alan’s regulatory outlook resource.
• Show Notes: Will include links to the book, resources, and AI governance materials.

---

Final Words

“These aren’t just systems that target ads. Increasingly, these systems can manipulate perception, automate decision making at scale, and create feedback loops that amplify bias and misinformation... With AI, the stakes are even higher.” — Alan Chapell [wrap-up at ~38:00]

Call to Action: Don’t wait for perfect standards or for regulators to force your hand. Start demanding and building explainability, documentation, and controls into your AI systems now—those ahead of the curve will hold the future advantage.

---

For more: Subscribe to the Monopoly Report newsletter and podcast. Pick up Shoshana Rosenberg’s book in May 2026 for an applied roadmap to AI governance.

Transcript

[Host/Announcer]

Market Live is coming up March 10th and 11th in New York City. With us some just some of the brands and agencies that have registered thus far. And don't worry, we'll be doing several of these announcements with us Bayer, BMO, Farmers Insurance, Electronic Arts, the Hershey Company, HP, Huntington Bank, JPMorgan Chase, Kenview, L', Oreal, Mastercard, NFL, PayPal, PepsiCo, Redfin, Synchrony, T Mobile, Verizon, Workday, Ah agencies. Want to hear which agencies are going.

[Alan Chappell]

To be joining us?

[Host/Announcer]

Assembly, Butler, Till, Canvas Worldwide, Kara Choreograph, Kridera, Dentsu, Digitas, ipg, IPG Media Brands, Magnet, omd, PMG Publisher, Sapien, Razorfish, Wavemaker, WPP Media and more. Can't wait to see you there. Go register now. Marketecturelive.com March 10th and 11th.

[Alan Chappell]

Welcome to the Monopoly Report. The Monopoly Report is dedicated to chronicling and analyzing the impact of privacy, antitrust and other regulations on the global advertising economy. If you are new to the Monopoly Report, you can subscribe to our weekly [e-mail] and you can check out all the Monopoly report [e-mail] I'm Alan Chappell. I'm a privacy and regulatory attorney and have worked with hundreds of digital media and ad tech companies over the years. I also publish a monthly regulatory outlook for digital media worldwide called the Chappelle Regulatory Insider. You can find a link to a sample copy of the Chappelle Regulatory Insider in the show Notes this week my guest is Shoshana Rosenberg. Shoshana is an experienced AI governance thought leader and practitioner. She is the Chief AI Governance and Privacy Officer at WSP usa. She is the co founder of Women in AI Governance, which works to advance equity in AI policy and leadership, and is the founder of SafePorter, an award winning SaaS data minimization solution and the author of a great book that will be out this spring called Practical AI Governance. A fun fact about Shoshana's book is that none other than Jules Polinetsky wrote the foreword to the book and Jules characterized the book as, and I quote, the serious resource this field has been waiting for. Shoshana is also an advisor to the Institute for Operational Privacy by Design. Today we're diving deep into AI governance and what it means for digital agency as a fundamental human human right. If you work in advertising, technology, privacy or product management, you probably noticed something unsettling. The AI systems we're building and deploying are increasingly making decisions that we can't explain. They are targeting consumers in Ways we can't fully articulate. They're creating profiles and generating outcomes based on logic that remains frustratingly opaque. And here's the uncomfortable truth. We're all just kind of accepting it. What makes Shoshana's work particularly relevant right now is her focus on what she calls digital agency as a fundamental human right. I'm hoping to get a better idea of what Shoshana means by digital agency today. So I think today's conversation is going to challenge some comfortable assumptions. We're going to talk about why privacy enhancing technologies or pets might actually be creating new problems while claiming to solve old ones. We're going to explore why explainability isn't just a nice to have feature, but should be a design requirement. And we're going to discuss Shoshana's PRISM framework, which offers practitioners a way to think about AI governance that goes beyond the checkbox compliance. If you're willing to grapple with the messy reality of where we are and where we need to go. I hope this conversation will give you a roadmap. So let's get to it. Hi, Shoshana, thanks for coming on the pod. How are you?

[Shoshana Rosenberg]

I'm well, Alan. Thank you so much for having me.

[Alan Chappell]

Well, it's my pleasure. And, and where are we finding you today?

[Shoshana Rosenberg]

Today I'm in Princeton, New Jersey.

[Alan Chappell]

Ah, the Garden State. I love it.

[Shoshana Rosenberg]

Snow.

[Alan Chappell]

Fantastic. You guys probably got a ton more than we. We've got some here, but it's not. And it's. It's already pretty much melted, or at least it's now like this, this brown sludge.

[Shoshana Rosenberg]

Ours has stayed longer than I've seen it happen on the east coast in a very long time.

[Alan Chappell]

Well, I'm so excited to start this conversation and I want to start it off with maybe a grounding type question, like, what is AI governance and why is it important? I always like to keep this type of thing in mind, like why is it important for someone on the quote unquote business side?

[Shoshana Rosenberg]

So it seems like a simple question, but then you ask it of me, and I have a very different vantage point on what AI governance is. But the, the important thing here is really, I think at a fundamental level, right, organizations have to have sufficient oversight to understand the ways in which AI can be pulling them quietly away from both their strategy and actually where they intended to be in terms of their documentation. Right. So for me, it's much more about an oversight and strategy component where you actually have an understanding of the forces acting upon your organization so that you can see the problems before, before they arrive as liability. So not the strict compliance route. It's not simply about checkboxes and making sure that you track everything in this sort of return to a fixed state, document it when it comes in the doorway, but much more an understanding of how AI is impacting your organization.

[Alan Chappell]

Well, I love that. And that sort of dovetails into every really successful sales or business person I've ever known. Is, is really has a, has a, has a keen sense of what the impact of various, you know, variables are going to be on their business. And so, and it's the ones who, you know, just sort of think, you know, magically about all this, I think are the ones that, that usually just aren't going to do as well. So I'm curious, what's your origin story and how did you find yourself in the AI governance world?

[Shoshana Rosenberg]

So this is an interesting part and I like to. So I teach classes at very strange hours and on the weekends and I always like to raise the point that in machine learning, which we now call AI, the models are actually, the paths are validated, even if they were completely crazy paths to get to the right answer. So that's, that's often part of my origin story musing. But to sum it up, I went from being an engineer in the Navy and then into the JAG corps as an attorney. And then I was always focused very much on international law. And then it became much more about international corporate law very early in my career. And I've managed to wear every hat save securities law within large global organizations. And now I picked up privacy as early as it started to really rear its head. Right. So the UK AI act right where we were pre gdpr and as that pulled through, having been someone who has built technologies and various other considerations and having been an engineer as technology and privacy. Right. You and I have worked in this space a long time, started to align and we moved toward machine learning. I was one of those people who was spending a lot of time saying that's not AI, that's machine learning. Which now we don't say anymore. So this pulled me straight into AI governance. I'm also sort of a systems level thinker, so I was watching for the changes and the impacts a bit earlier than some.

[Alan Chappell]

So within the ad space for a long time, you know, 10, 15 years ago, there was this, this idea like machine learning was the thing said when you didn't really want to explain how it worked and you were hoping that no one would notice that there might be privacy implications. And you see like everybody would build that. Oh, no, no, no. It's just, we're not creating a profile, it's just machine learning. And that, that, that approach I think is much more difficult to pull off today. But there's still some who try it.

[Shoshana Rosenberg]

I agree, I understand. Whereas when you say AI, you just say we can't explain it, so it's going to be okay.

[Alan Chappell]

So you have argued that digital agency should be recognized as a fundamental human. Right, Right. What do you mean by digital agency? And how does the current approach to digital advertising, which often relies on black box algorithms, undermine this?

[Shoshana Rosenberg]

Right, perfect. So digital agency is fundamentally about the ability to understand the context of what you are being given so that you can decide to accept it, reject it or actually challenge it. Right. So you need the context of what you're being given. And I think that this is particularly important where we start to see. And we saw this problem early with regard to. So you would ask sort of, what does a president look like? Right. And if it simply said to us, right, any of these tools said, you've asked for what qualifies as a representative answer. And the image that I'm going to generate is based on the data I've been exposed to. Right. That might have really minimized a host of issues. But when you come to ad tech, it's really about people being able to understand the backbone of what otherwise is pure manipulation. Right. And to really understand why they're receiving what they have and to give them some control over that. And not just the, you know, let me hide this ad, but sort of. And I think we were, we were getting to this, right. That the reason that I push for agency is to get to explainability. Because I think if we don't have the human right embedded, then the laws will not be able to pull water from a stone. So the notion there is just that explainability within ad tech might mean that you pull something up and it gives you an advertisement. And when you look at why you're seeing it, it says you've been to shoe stores. Like you've been shopping on online shoe stores. You live within 10 miles of the store, Right. And you have some controls there where you can say, don't use this, don't track this, don't sell me this.

[Alan Chappell]

Okay, I love that. But I want to bring that around to like how that could operate within the ad space. Because like that's a, it's a, it's kind of a great, like high level answer. But like, let's ground it, like, you know, how do we move from, you know, getting consumers to actually understand why they're being targeted? You know, rather than just, you know, is it, is it just limited to a, you know, generic why am I seeing this notice? Or do they need to go a little bit further? Like, how does that, how do you think that should function in practice?

[Shoshana Rosenberg]

So explainability always has to happen at multiple levels. There's the user level, which allows them to go as deep as they would be comfortable, even in the best of circumstances. Then you're going to have sort of a client or a B2B or even a very high level DPA or agency level. And then there's a full audit level, right? And so the notion is 4 for the user there. I think it does have to go to feature importance, the weighting, but all of it explained in a way that's very user friendly, even if they can drill down into something a bit deeper. So I think you have to make sure that they understand where the data is coming from and how it's being used and be given choices, not just about will I see it or not. But, you know, don't track me in this way or at least don't include me in this piece of the work that you're distributing.

[Alan Chappell]

So I kind of get this in the context of a platform where you're pretty much as a consumer, you're interacting with XYZ.com, whether that's a big website or a social network or whatever. Harder for me to grasp that in a ad setting where there could be multiple entities who are touching, improving upon, generating the ultimate ad. Given that very few within the chain really know what anybody else is doing, how do we even think about approaching what you're, what you're suggesting here?

[Shoshana Rosenberg]

I think it's a great point, especially for ad tech, because you have sort of this huge process, right, of segmentation, inference, eligibility, right? You've got this, this really large web of what's happening, pulling from, and you've spoken to it, right? What essentially turns into data brokers, right? Pulling from a, a huge amount of information from all over the place. I think in the end there are two things to it. It's not just nominal or trivial that you say we need this human, right? The point of it is, is explainability at present is not attainable. Post hoc explainability is wholly insufficient. It is a process of inference which, as you know, is not sound logic. And no matter how many layers of inference you put in place, you are guessing, right? Educated guess or not, you are guessing and so, and this is the real impetus of advocating for a new human right then. And I think you might have heard me make the argument in person, but why would we need a new human right, Shoshana? And I say, well, you have an inalienable right to freedom from interference by dragons, but we don't have to enshrine it until there are dragons. And we're now at a point where agency is actually eroding faster than whether it's organizational agency or individual agency. Both are on parallel tracks of complete dissolve. So the point is, if we have digital agency within the human rights frame and we start to put things into the law, then the regulatory groups within every country. Right. Are going to start to invest in pushing people to make technology that is both mightier and hopefully, cross my fingers, lighter, because it's going to have to be mightier to sustain explainability. Because, of course, course, if you're teaching someone how to make something that you know how to make, it's one thing to show them, it's another thing to show them exactly how to hold the knife and where to stand in the kitchen and what is happening at every level.

[Alan Chappell]

So is there a particular jurisdiction that you can point to? They're saying, you know what, these guys are sort of getting it right or these people are getting it right.

[Shoshana Rosenberg]

I mean, we have long looked to the EEA and the European Union, right?

[Alan Chappell]

Oh, for sure.

[Shoshana Rosenberg]

The right direction in this moment. However, the gestures within the EU AI act, you could go to gdpr, but that's about decision making. We'd have to stretch it to make it about advertising. Right, but the gestures to explainability are the sort of thing that will get completely run over by the rest of us going 75 miles on the highway. Right. There are no teeth there and there can't be until you set a mandate for. Explainable by design, by such and such time. And that would be for new technology, but. But it would at least give us a fighting chance and it would, you know, be another differentiator that might prove as empty as sometimes pets do, but hopefully not.

[Alan Chappell]

So if I'm understanding you correctly, there really isn't a jurisdiction, even in the eu, who is requiring this. And not to put words in your mouth, but it sounds like you're saying that's a pretty significant hole within the regulatory framework that is trying to grapple with AI.

[Shoshana Rosenberg]

They do touch on it. Yes. Agreed. And I'm going to have a lot of brilliant people in Europe and others come at me, but they touch on it. But it is like saying and then you must give us water from Iraq. Until there is a means by which we can insinuate ourselves into how the technology is built and to having those collaborative efforts to make sure that they can prioritize and are incentivized financially to prioritize explainability systems will always be optimized for the purposes for which they're built.

[Alan Chappell]

Right? And then, and then there's the age old problem which seems to be getting worse, which is jurisdictions around the world are increasingly finding it challenging to impose their will, particularly around big tech companies. And so here's another example where like they're talking up here and a lot of really smart people are being ignored because it's not hard, it's very soft, it's very ethereal. I'm not saying it isn't real, but it's, it's not necessarily hard because it's not. You can't point to it in a law and say thou must do X, Y and Z. Then that makes compliance I think a much, much more difficult in reality.

[Shoshana Rosenberg]

No, I absolutely agree. I think we're at a very interesting moment here where also the impossibility of enforcing right so much of it and, and, and tracking, I think it's happening at the M macro and the micro level. But the thing of it is, it is entirely, and you know that I, I, I'm boring, I go back to basic logic, right? It is an inevitability that the maelstrom that is growing is only going to get worse. And if we allow explainability to escape by the tail in terms of we can't do it right, then we're going to have a real problem. And I actually thought you were going to mention how so many countries and regimes are sort of setting it down and saying we want, because of company pressure, right? Saying we want less regulation.

[Alan Chappell]

Totally agree. Yeah. And I, I see that as related to my previous point. I think that the, but because it's, some of it is that there's just so much pressure. Look, we, we all need to beat China in the great AI race. And, and so for better or worse, mostly worse. But that argument is, is winning in more and more places around the world.

[Shoshana Rosenberg]

The other piece of it though is where you take away the US is a great example, right? Where you, where you strip everything away. You say we want to go skydiving. When you go skydiving, the people who run the skydiving operation, they have the insurance, they have the buckles, they have a training for you. They bear the burden and so procurement is going to take ownership of all of these embedded responsibilities that translate into liabilities. That is, and certainly the US Is a great example there, because where the government says don't let anything get in our way. Right. But from a government contracting standpoint, we're going to require these things. The government contracting ecosystem includes vendors that we all touch, small or large vendors. And so the two years that it's going to take for all of those government contractor requirements to become embedded everywhere is going to go in a flash.

[Alan Chappell]

And then what?

[Shoshana Rosenberg]

And then what you're finding is that the businesses are having to cover the liability of their counterparts. They are maybe, hopefully, I cross my fingers, coming up with explainability notices. We've, you know, you don't have to reinvent the wheel, but they are certainly having to do all the diligence and put the controls in place instead of the legislation doing it. So the pressures happen at what used to be procurement and should now be vendor management.

[Alan Chappell]

That certainly makes sense, but it also seems like we're a ways off from that. No. Are you saying that the AI Bill of Rights, or actually that was a Biden initiative, but the current iteration of that, is that going to get us there two or three years from now?

[Shoshana Rosenberg]

I believe so. And prove me wrong. Come at me. But the thing of it is, if Amazon is a government contractor, which I believe they are, if Google is a government contractor, if you lay out all the big government contractors, whatever they might be Quaker Oats to the gm, right. They, they probably sell something to the government where they are government contractors, they're going to have to account for their ecosystem. They're not going to pick and choose who. They're going to ask these questions about a biased system and this and that and whatever has been put in. Right. And as it's layered in, they're going to have to have something across the board. And so I do think that wherever your business touches that aspect, which goes global pretty quickly, right. It becomes standard that you have to answer these questions for a government contractor to do business with you. And then that trickles down because they're also asking questions about your partners and your subcontractors.

[Alan Chappell]

So I agree with that, that the, the. Where the rubber hits the road. Fantastic. To have standards, but the rubber hits the road around enforcement. And it doesn't seem like we're there yet.

[Shoshana Rosenberg]

Oh, no, no, sorry. I didn't mean to conflate the two enforcement from the regulatory standards that are being put out there. We've already seen this with privacy There are almost never enough people in the office that is assigned to, you know, herd cats and assign fees that that's.

[Alan Chappell]

A kind of an endemic challenge within the, within the privacy space, by the way, also within a lot of orgs. I mean it's gotten better in the 20 or so years I've been involved, but, but still the privacy office tends to be underfunded and it often is the thing that, you know, the company likes to point to to say that they really, really, really care about it. But it isn't, they aren't demonstrating that with budget all the time, except where.

[Shoshana Rosenberg]

It'S part of the co branding that the privacy is deemed mission critical.

[Alan Chappell]

Right, Right. So I, I want to shift gears just a little bit and talk about pets. So in the ad space at least, I've taken the position that, you know, many if not most implementations of privacy enhancing technologies or pets, they, they tend to create tension when it comes to digital agency and explainability by design. And I, I feel like privacy at the expense of transparency isn't really helpful, particularly given the effectiveness of many of the pets to actually address consumer concerns about privacy. So here's my question. You know, as an AI ethicist, how are you thinking about the tension between privacy and transparency?

[Shoshana Rosenberg]

So it's interesting to me they're both in service of agency if done properly. Right. But I also understand that in the web of ad tech, you know, if all of my data is encrypted, but it's still being funneled to all sorts of places and then manipulating me. Right. That's not exactly the same. So I feel like they're both in service of the same master of agency if done properly. I don't think a pet is a thing to hide behind. Right. When the machinations, black box or otherwise, are actually undermining human power, human agency and the ability to think clearly. This is a bit of an aside, but when you think about ad tech, I am sometimes on some of these platforms, not the ones that terrify to let my kids on or anything, but where I feel like, please don't sell me this, this is not in my budget. Right. Please don't show me, you know, whatever it is, it's an interesting world to navigate this piece. And I will say no matter what is happening with the data where you feel invaded, the, the, the magic glow of pets is, is completely dissolved from a marketing standpoint for the company using them, I don't want to say against, but to people.

[Alan Chappell]

So I'm thinking about transparency in this context a little Bit differently. I'm thinking about it as, okay, we're going to run the data set through these pets and therefore you as an advertiser are going to just kind of have to trust that our numbers are good. Because as an advertiser, you have almost no ability to really know, you know, that, you know, campaign X worked better than campaign Y.

[Shoshana Rosenberg]

So agency for the platform and not the user.

[Alan Chappell]

Yes.

[Shoshana Rosenberg]

So at that, right, the, the platform holds the cards and everyone else that both the end user and of course those counting on them. I, I think that's interesting in terms of a transparency and explainability piece there. Have you seen, and I don't mean to throw it back to you, but I'm curious because you know this space much better than I do. Have you seen any imprint of something that, that starts to be able to account? Because even if we strip away AI as it, you know, we stip generation and we just look at these systems and we can. What if you, you know, do those processes have audits whereby they too can speak to confidence levels, accuracy, and these other components that we also should be and, and hopefully are demanding of AI systems?

[Alan Chappell]

No, there, there really isn't. And part of the challenge is that advertisers, bless their hearts, aren't consistently demanding it. And, and, and if they're not demanding it, if, heck, if I was running a big platform, I probably wouldn't be providing it because why subject myself to that additional scrutiny? So the, the, the playbook over the last five years or so is to like jazz hands your way through, like we're using homeomorphic encryption and, and you know, all those big buzzwords. But at the end of the day, if, if an advertiser were to demand like, okay, but like, how do I know that the numbers you're giving me are sound right now? I don't think there are many instances of a platform or really anybody being able to pride. Provide that.

[Shoshana Rosenberg]

So this is a great example. We were talking like, we. Right, our universe was Talking about this 10 years ago already, which is, you know, you could say you're organic, but are you certified? Right? Like, who tracks that? So you can say you're a pet. And if we're going to go ahead and evaluate which we should be doing, there should be a standard by which you can say that you're a. Or not. Right? If you're going to go in there, then you should also get some accuracy pieces. Right? So does the thing function as intended with regard to privacy and does the thing function as intended with regard to Whatever the end user and the business leveraging it can't see. So I think that's a great idea. Please, someone start that business on your laptop today.

[Alan Chappell]

So what comes to mind is that there was this opportunity within the AD space about 12 to 15 years ago where we started to put icons on ads and somewhat helpful from a transparency standpoint so you can kind of know whether an ad is incorporating a profile. And there was a company called Evadon who was one of the companies who was charged with the role of serving these icons onto ads. Now their initial implementation allowed one to click on that icon and you could see which advertiser was providing the ad. You could see something about the ad tech intermediaries. You know, if they had continued to build on it, I would imagine that one could see what profiles that were created, you know, so it would be a beautiful transparency tool that, you know, maybe only 1 or 2% of users would take advantage of, but boy, would that have been really cool. And what ended up happening was they had one competitor and the competitor was, you know, Evadon had created a Cadillac and, and the competitor came in with like, you know, the, the, the Hyundai and the market said, you know what, I think all we really want is a Hyundai. And that opportunity was sort of squandered. And so I, I don't know how to get there within the ad space, but I will say, and, and then I'll get off my soapbox and like start asking you questions like a real interviewer here. But I, I would just say, as we head into the agentic AI era, all of the underlying misplaced incentives and grift machines creating the appearance of solving problems seem to be remaining with us. And it doesn't seem like, you know, you can identify the heck out of everything. And I don't know that that's going to make things any better.

[Shoshana Rosenberg]

Oh, it can only make it worse. And I see the IAB trying to tackle that and I know that there are so many other things at play and there's a lawsuit with Google. Right. There's so much happening here. But I, I definitely don't think we can let this stand. That, yes, it's only going to take us further away from, from our goal. So, so you're kind of saying that you too are an advocate for at least what, what I intend to occur as the output of an agency, a digital agency, human. Right, right. Like that we have to, we have to change the way the tech is being built.

[Alan Chappell]

Completely agree, Completely agree. And that's, that's A challenge. And, and, and one of the things I wanted to maybe explore a little bit more with you. You know, you mentioned IAB Tech Lab. You've got this ad context protocol and they're sort of philosophically two really interesting things because I think. And I'm going to have Tony Katzer and Brian o' Kelly on the pod at some point. But like, you know, the IAB is saying, look, there's a lot here, we need to build on the existing infrastructure because if you start from scratch that creates some, some challenges. And like I, I kind of get that. And then Brian and I'm way oversimplifying and he's going to yell at me probably, but, but he's like, well, we need to blow everything up because there's just so much junk in there. And like they're both legitimate arguments and it'd be interesting to see if they're able to come together. But I'm curious from that dichotomy, you know, which, where's your lean right now?

[Shoshana Rosenberg]

So you, you can't stay, stop what's in process and you have to cure it as it goes. But I do think the. By a certain date, anything new has to achieve a certain standard is something where you are doing both at the same time. Right? You're saying, hey, this can't happen, that can't happen. We're going to try to check for it. But then you're also saying any technology that is going to go on the market by. I used to say 2028 because it rhymed, right. Or explain. Or 2029. Explainability by design by 2029. But we were going to have to push it a little further. Right. But you do want to try to make a fixed date by which they have real incentives, both financial and you know, otherwise to get to a place where the tech can do what we needed to do. So I like the combination because you can't stop playing whack a mole with all the things that are going wrong. And you'll learn from that process and be able to apply a lot of the learning to what comes next.

[Alan Chappell]

By the way, let me just take a half step back and just say kudos. So explainability by design by 2029 is pretty brilliant. The only thing this year that beats it, and I say this with love, is the initiative. Like it's just in terms of, as a buzzword but like that's a, you know, bowing at the feet of the.

[Shoshana Rosenberg]

Master minus two or three is at least three years old. So, so I'm Way behind.

[Alan Chappell]

But that, yes, you beat Cory Doctorow, then that's, that's something you won't, you.

[Shoshana Rosenberg]

Won'T get me to say the other word. But I absolutely agree. I think it's the right thing.

[Alan Chappell]

So I would, I would love your thoughts. So I, you know, I'm, I, A lot of my audience is sort of what I'll call little tech. It's the, you know, it's the folks working within the, what we'll call the open Internet. Even though I'm not sure that's a thing still. But my question is, is like, if you're a little tech company who's, you know, looking to leverage all of the cool energy that seems to be directed into AI right now, how do you, what should you be thinking about? Like, how do you leverage all this and try to do the right thing, given that, you know, by your own admission, the right thing is at least three years away.

[Shoshana Rosenberg]

So you already talked about the easy part. The easy part is putting into procurement standards the things that pressure everyone in your ecosystem. Ask for an explainability notice. Let them say, what is that? I've never seen one. Right. And then start to figure out how you create your own. The other piece is there where you are wanting to ask vendors for something. Make sure that you're doing it when you're building yourself, even if you're building internally, because you might want to sell that externally later, right? If you do something really great. But the notion there is really to say, and I love this, I'm a little dorky, but where people are building upon a foundational model, I liken it to. If you were going to enter a chili making contest with a chili base where you had no actual ingredient list, right? And so your job, when I come up to you and I say, alan, you know, is there cilantro in this chili? Because it gives me hives or whatever. And you say, listen, I absolutely can't account for the base, right? Or, hey, here's an explainability notice for the base. This is what I'm working with, but this is what I added to the mix, and I can represent that to you. And I think the de minimis piece here is to say, be able to evidence what you have put in place, the controls you have around it, the ways in which you are auditing and reevaluating both the functional, the outputs and the way that it's working as best you can, if it is still not explainable so that you can speak to and evidence the work that you've done. And be able to, to monitor and account for yourself that way. I think that's the most important part, where you're building on foundational models, where you are creating agentic systems for other people. I think you want to go to the higher standard of being able to account for again, what is in place and what controls you have. The problem is, the underlying problem with all of this that we all understand is that we are essentially, this is the first time we've ever built on what I'm going to very casually call wobbly technology. Right. We are. There is no logic behind this. This is mostly predictive tooling. Right. Not all of it, because some of it is we're pulling an AI and into a lot of things, into the term AI, but the notion is we are trying to take work away from people and we will essentially make the work, the monitoring and the evaluation of the thresholds and the evaluation of the metrics and the adaptive thresholds. And, and this is, we're going to take every discipline and turn ourselves into a technology assisted, but nonetheless monitors and auditors. And it's a very interesting time because of it. I'm sorry if I went too far deep in that, but that is the next step, right?

[Alan Chappell]

No, I love that. I mean, I, I actually think that everybody listening should go back and like literally write down the last two minutes because I think that that is as clearly communicated a starting point as I've heard. So thank you.

[Shoshana Rosenberg]

Of course, I appreciate that. That's kind of you.

[Alan Chappell]

So I'd love to dive into the, the Prism framework. Are you okay talking a little bit about that?

[Shoshana Rosenberg]

Absolutely.

[Alan Chappell]

I guess my question is, and this sort of builds on, I think what you just said, you know, how can an ad tech data governance team use that Prism framework? And I'm going to put more information about what that is in the show notes. But I would still love your overview. But like, how can one use the Prism framework to move beyond, you know, a check the box compliance mindset and really try to move towards a more proactive ethical culture.

[Shoshana Rosenberg]

So since we don't have time to fully explain it, I will say this. I'm sure that you're trying not to sing Tina Turner. We don't need another framework. Right. The difference here is that this framework is not built for you to put into your policies. It is built for practitioners. It actually the origin story on sort of why I feel like this is so important is because with AI, from any angle in the organization, if you hold it up to the light, it's having A different impact, good or bad. Right. And because you don't ever see the whole picture from any one angle in the organization, there's too much happening at once. So PRISM is around principles, responsibility, which I see bears a lot of the weight, Intelligence, security and monitoring, which is monitoring of your AI governance program as well as your tools. Right. You have to have a bigger picture of this. So I do have a book coming out. The entire second half of the book speaks through PRISM to practitioners. It is a very dense resource. I spared no aspect of my brain and thinking here. But when you're thinking about it, it's partly to understand that the hull of a ship has overlapping components. Right. So that the water doesn't get in. And I want all of us to feel that where many people have been given and relied upon this sort of compliance based notion of what AI governance is, I need you to be sure that you don't have that terrible feeling that I think everyone from the board down to an individual operator and a company has, that you're missing something. I must be missing something because there's too much happening at once. Right. And so it is the, the interlock between principles, not as some sort of arbitrary, you know, marketing campaign that we throw out, but really whatever comes across your desk, whether you're going to build or you're solving a problem, does it align with what we believe or have asserted as our principles? Have we considered the four quadrants of responsibility around ethical, operational, societal? Like where, where are these touch points in that? What is the intelligence we have coming back to us about this? Or where are we going to build those feedback loops in and how will we centralize that? And then security components, which means something so different in this age, but I know we don't have time to get into it. And then of course, monitoring around the entire process. Right, which holds it together, which is your way to say this issue happened, where did we fail, what wasn't accounted for? Or we're building something? Have we truly checked all of the pieces in place that we need to so that practitioners don't have to feel, they don't have to understand technology fully. Right. But they can know and depose against the information that they're given in a really informed way and be able to document, speak to and evolve it?

[Alan Chappell]

Shoshana, when is this book going to be out and where can people find it?

[Shoshana Rosenberg]

If you're outside of the United States, it's coming out May 3rd. If you're in the United States, you have to wait. It's with a UK publisher called Kogan Page. It is coming out on the 26th.

[Alan Chappell]

Fantastic. I would encourage everybody listening to this to buy that book because that seems like you are showing a light towards the future and you're doing so in a way that I think is clear. And I think you're able to underline what the benefits to an org are in terms of if they follow this path. So a thank you so much.

[Shoshana Rosenberg]

That's very generous of you, Alan. Thank you.

[Alan Chappell]

Shoshana. This has been a fantastic discussion. Where can people find you?

[Shoshana Rosenberg]

There's a practicalai governance.com website. You can find me of course on LinkedIn. I am the co founder of Women in AI Governance with the incredible Emerald Delou. You can also find me through Logical AI Governance where I teach courses and certifications around this to sort of make up for that sense that I think a lot of practitioners have, that they don't feel truly grounded. We had too much imposter syndrome and privacy, which is the most finite realm of law, we can't let it happen here.

[Alan Chappell]

Great point. Well, thank you so much for coming on. This has been a great discussion.

[Shoshana Rosenberg]

Thank you Alan. Have a gorgeous day. Thanks for having me.

[Alan Chappell]

That was a great episode and I have to say this conversation gave me a lot to think about. Let me pull out a few key threads that I think are particularly important for anyone working in the ad space or in the privacy and regulatory world. First, I want to talk about Shoshana's concept of digital agency as a fundamental human right. I typically try to keep these discussions grounded in the law, and so it's worth noting that the concept of digital agency is more aspirational at this point, but I don't think that that diminishes its importance. I agree that we need the ability to understand the context of what we're being shown so we can accept it, reject it, or challenge it. In the ad space. That means moving beyond the generic why am I seeing this type notices. The challenge, as we discussed, is that the ad tech ecosystem involves multiple entities and oftentimes with few players actually knowing what anyone else in the chain is doing. So how do we create explainability in that environment? Well, Shoshana's answer is sort of interesting. She says that we need to enshrine digital agency as a human right first, which then creates the legal and regulatory pressure to make explainability technically feasible. As she puts it, you have an inalienable right to freedom from interference by dragons, but we don't have to enshrine it until there are dragons. Well, needless to say, we have dragons now. Second, I want to underscore the tension between privacy enhancing technologies and transparency. I've been arguing for a while that many pet implementations create problems for digital agency and explainability. Privacy at the expense of transparency isn't actually solving a problem. When large platforms run data through pets and then tell advertisers to, you know, just trust our numbers, they are creating a new form of opacity. A quick shout out to Don Marty, who's written a bunch on this topic, if you're looking for a great source of additional information. Third, I want to address the inevitable question about how to implement these concepts within the ad space. So step one is you have to have an insatiable appetite for understanding how things around you work and for not taking the high level explanation of your partners and vendors. And I know from experience that taking those types of positions can be rather lonely in the ad space. Shoshana will tell you to start asking vendors for explainability notices, even if they say they've never seen one. So begin creating your own notices for your products as part of your privacy and AI impact analysis that companies in the ad space are supposed to be engaging in already under several laws. If you're building on foundational models, you need to be able to account for what you've added to the mix, what controls you have in place, and how you're monitoring outputs. Think of it like entering a chili contest with a base you didn't make. You can't account for every ingredient, but you can document what you've added and how you're testing the final product. Finally, I want to touch briefly on something that we didn't discuss in detail, but that looms over this entire conversation. So Shoshana talked a bit about how even a set of executive orders coming from the US Administration can have a huge sort of rippling effect on the marketplace. One question that I wished I'd asked but didn't get to was to get Shoshana's take on what it seems like a dramatically different approach to AI governance. As between the Biden and Trump administrations, the focus today seems less on digital agency, on protecting civil rights, on ensuring algorithmic fairness and mitigating the risk of discrimination. The focus today is on reducing regulatory barriers, accelerating AI development to compete with China. But the move fast and break things approach doesn't really work if what's breaking is consumer trust, market integrity, and democratic discourse. It's easy to say that none of this is the fault of the digital ads industry, but in fairness, the ad industry spent years operating in a regulatory gray zone where we didn't meaningfully push the envelope on either privacy or transparency for going on a decade, and we're still dealing with the consequences consent fatigue, privacy washing, and a fundamental erosion of the trust between publishers, advertisers, and consumers. With AI, I think the stakes are even higher. These aren't just systems that target ads. Increasingly, these systems can manipulate perception, automate decision making at scale, and create feedback loops that amplify bias and misinformation. And in case I didn't make this clear, lots of this stuff is already covered under the current privacy rules in Europe and certainly at the US State level. And in case my recent conversation with Tom Kemp at Cal Privacy didn't make this clear, regulators are coming after ad tech and data brokers first, so it'll be much more difficult for companies in the ad space to hide. Shoshana's call for explainability by design by 2029 is both a pithy slogan and an extremely ambitious goal. But we need fixed dates and real incentives, both financial and regulatory, if we want to push the industry towards building AI systems we can actually understand and control. The alternative is what we're already seeing a maelstrom of opaque systems making decisions that affect billions of people with no meaningful oversight and no real accountability. That's not a future I want to live in, and I don't think it's a future that's good for the ad space either. And as I said, regulators and policymakers are focusing on these types of issues today. So here's my challenge to everyone listening. Don't wait for a perfect marketplace where all the rules are fully established. Don't wait for your competitors to move first. Start asking the hard AI and privacy questions now. Demand explainability from your vendors. Build it into your own systems. Create the documentation and controls that demonstrate that you're taking this stuff seriously. Because whether the regulatory pressure comes from Washington, Brussels, or your own privacy and data governance team, it's coming. And the companies that get ahead of this will have a significant competitive advantage regardless of which AI protocol ultimately wins, as between the IAB Tech Lab, the Ad Context Protocol, or whatever else emerges over the upcoming months. I'd encourage you all to pick up Shoshana's book Practical AI Governance when it comes out this upcoming May. Just a reminder, I'll leave the link to Practical AI Governance in the Show Notes, and you can find a link to the latest version of the Chappelle Regulatory Insider in the Show Notes as well if you found this conversation valuable, please share it with someone in your organization who needs to hear it. And if you have thoughts, questions, or even if you violently disagree with something I've said, please reach out. I'm always up for a good debate. We have a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks, so please subscribe to the [e-mail] or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.