Shoshana Rosenberg (4:10)

I'm well, Alan. Thank you so much for having me.

Alan Chappell (4:12)

Well, it's my pleasure. And, and where are we finding you today?

Shoshana Rosenberg (4:16)

Today I'm in Princeton, New Jersey.

Alan Chappell (4:18)

Ah, the Garden State. I love it.

Shoshana Rosenberg (4:20)

Snow.

Alan Chappell (4:21)

Fantastic. You guys probably got a ton more than we. We've got some here, but it's not. And it's. It's already pretty much melted, or at least it's now like this, this brown sludge.

Shoshana Rosenberg (4:31)

Ours has stayed longer than I've seen it happen on the east coast in a very long time.

Alan Chappell (4:35)

Well, I'm so excited to start this conversation and I want to start it off with maybe a grounding type question, like, what is AI governance and why is it important? I always like to keep this type of thing in mind, like why is it important for someone on the quote unquote business side?

Shoshana Rosenberg (4:53)

So it seems like a simple question, but then you ask it of me, and I have a very different vantage point on what AI governance is. But the, the important thing here is really, I think at a fundamental level, right, organizations have to have sufficient oversight to understand the ways in which AI can be pulling them quietly away from both their strategy and actually where they intended to be in terms of their documentation. Right. So for me, it's much more about an oversight and strategy component where you actually have an understanding of the forces acting upon your organization so that you can see the problems before, before they arrive as liability. So not the strict compliance route. It's not simply about checkboxes and making sure that you track everything in this sort of return to a fixed state, document it when it comes in the doorway, but much more an understanding of how AI is impacting your organization.

Alan Chappell (5:45)

Well, I love that. And that sort of dovetails into every really successful sales or business person I've ever known. Is, is really has a, has a, has a keen sense of what the impact of various, you know, variables are going to be on their business. And so, and it's the ones who, you know, just sort of think, you know, magically about all this, I think are the ones that, that usually just aren't going to do as well. So I'm curious, what's your origin story and how did you find yourself in the AI governance world?

Shoshana Rosenberg (6:19)

So this is an interesting part and I like to. So I teach classes at very strange hours and on the weekends and I always like to raise the point that in machine learning, which we now call AI, the models are actually, the paths are validated, even if they were completely crazy paths to get to the right answer. So that's, that's often part of my origin story musing. But to sum it up, I went from being an engineer in the Navy and then into the JAG corps as an attorney. And then I was always focused very much on international law. And then it became much more about international corporate law very early in my career. And I've managed to wear every hat save securities law within large global organizations. And now I picked up privacy as early as it started to really rear its head. Right. So the UK AI act right where we were pre gdpr and as that pulled through, having been someone who has built technologies and various other considerations and having been an engineer as technology and privacy. Right. You and I have worked in this space a long time, started to align and we moved toward machine learning. I was one of those people who was spending a lot of time saying that's not AI, that's machine learning. Which now we don't say anymore. So this pulled me straight into AI governance. I'm also sort of a systems level thinker, so I was watching for the changes and the impacts a bit earlier than some.

Alan Chappell (7:45)

So within the ad space for a long time, you know, 10, 15 years ago, there was this, this idea like machine learning was the thing said when you didn't really want to explain how it worked and you were hoping that no one would notice that there might be privacy implications. And you see like everybody would build that. Oh, no, no, no. It's just, we're not creating a profile, it's just machine learning. And that, that, that approach I think is much more difficult to pull off today. But there's still some who try it.

Shoshana Rosenberg (8:13)

I agree, I understand. Whereas when you say AI, you just say we can't explain it, so it's going to be okay.

Alan Chappell (8:19)

So you have argued that digital agency should be recognized as a fundamental human. Right, Right. What do you mean by digital agency? And how does the current approach to digital advertising, which often relies on black box algorithms, undermine this?

Shoshana Rosenberg (8:34)

Right, perfect. So digital agency is fundamentally about the ability to understand the context of what you are being given so that you can decide to accept it, reject it or actually challenge it. Right. So you need the context of what you're being given. And I think that this is particularly important where we start to see. And we saw this problem early with regard to. So you would ask sort of, what does a president look like? Right. And if it simply said to us, right, any of these tools said, you've asked for what qualifies as a representative answer. And the image that I'm going to generate is based on the data I've been exposed to. Right. That might have really minimized a host of issues. But when you come to ad tech, it's really about people being able to understand the backbone of what otherwise is pure manipulation. Right. And to really understand why they're receiving what they have and to give them some control over that. And not just the, you know, let me hide this ad, but sort of. And I think we were, we were getting to this, right. That the reason that I push for agency is to get to explainability. Because I think if we don't have the human right embedded, then the laws will not be able to pull water from a stone. So the notion there is just that explainability within ad tech might mean that you pull something up and it gives you an advertisement. And when you look at why you're seeing it, it says you've been to shoe stores. Like you've been shopping on online shoe stores. You live within 10 miles of the store, Right. And you have some controls there where you can say, don't use this, don't track this, don't sell me this.

Alan Chappell (10:14)

Okay, I love that. But I want to bring that around to like how that could operate within the ad space. Because like that's a, it's a, it's kind of a great, like high level answer. But like, let's ground it, like, you know, how do we move from, you know, getting consumers to actually understand why they're being targeted? You know, rather than just, you know, is it, is it just limited to a, you know, generic why am I seeing this notice? Or do they need to go a little bit further? Like, how does that, how do you think that should function in practice?

Shoshana Rosenberg (10:44)

So explainability always has to happen at multiple levels. There's the user level, which allows them to go as deep as they would be comfortable, even in the best of circumstances. Then you're going to have sort of a client or a B2B or even a very high level DPA or agency level. And then there's a full audit level, right? And so the notion is 4 for the user there. I think it does have to go to feature importance, the weighting, but all of it explained in a way that's very user friendly, even if they can drill down into something a bit deeper. So I think you have to make sure that they understand where the data is coming from and how it's being used and be given choices, not just about will I see it or not. But, you know, don't track me in this way or at least don't include me in this piece of the work that you're distributing.

Alan Chappell (11:33)

So I kind of get this in the context of a platform where you're pretty much as a consumer, you're interacting with XYZ.com, whether that's a big website or a social network or whatever. Harder for me to grasp that in a ad setting where there could be multiple entities who are touching, improving upon, generating the ultimate ad. Given that very few within the chain really know what anybody else is doing, how do we even think about approaching what you're, what you're suggesting here?

Shoshana Rosenberg (12:10)

I think it's a great point, especially for ad tech, because you have sort of this huge process, right, of segmentation, inference, eligibility, right? You've got this, this really large web of what's happening, pulling from, and you've spoken to it, right? What essentially turns into data brokers, right? Pulling from a, a huge amount of information from all over the place. I think in the end there are two things to it. It's not just nominal or trivial that you say we need this human, right? The point of it is, is explainability at present is not attainable. Post hoc explainability is wholly insufficient. It is a process of inference which, as you know, is not sound logic. And no matter how many layers of inference you put in place, you are guessing, right? Educated guess or not, you are guessing and so, and this is the real impetus of advocating for a new human right then. And I think you might have heard me make the argument in person, but why would we need a new human right, Shoshana? And I say, well, you have an inalienable right to freedom from interference by dragons, but we don't have to enshrine it until there are dragons. And we're now at a point where agency is actually eroding faster than whether it's organizational agency or individual agency. Both are on parallel tracks of complete dissolve. So the point is, if we have digital agency within the human rights frame and we start to put things into the law, then the regulatory groups within every country. Right. Are going to start to invest in pushing people to make technology that is both mightier and hopefully, cross my fingers, lighter, because it's going to have to be mightier to sustain explainability. Because, of course, course, if you're teaching someone how to make something that you know how to make, it's one thing to show them, it's another thing to show them exactly how to hold the knife and where to stand in the kitchen and what is happening at every level.

Alan Chappell (13:57)

So is there a particular jurisdiction that you can point to? They're saying, you know what, these guys are sort of getting it right or these people are getting it right.

Shoshana Rosenberg (14:07)

I mean, we have long looked to the EEA and the European Union, right?

Alan Chappell (14:12)

Oh, for sure.

Shoshana Rosenberg (14:12)

The right direction in this moment. However, the gestures within the EU AI act, you could go to gdpr, but that's about decision making. We'd have to stretch it to make it about advertising. Right, but the gestures to explainability are the sort of thing that will get completely run over by the rest of us going 75 miles on the highway. Right. There are no teeth there and there can't be until you set a mandate for. Explainable by design, by such and such time. And that would be for new technology, but. But it would at least give us a fighting chance and it would, you know, be another differentiator that might prove as empty as sometimes pets do, but hopefully not.

Alan Chappell (14:52)

So if I'm understanding you correctly, there really isn't a jurisdiction, even in the eu, who is requiring this. And not to put words in your mouth, but it sounds like you're saying that's a pretty significant hole within the regulatory framework that is trying to grapple with AI.

Shoshana Rosenberg (15:11)

They do touch on it. Yes. Agreed. And I'm going to have a lot of brilliant people in Europe and others come at me, but they touch on it. But it is like saying and then you must give us water from Iraq. Until there is a means by which we can insinuate ourselves into how the technology is built and to having those collaborative efforts to make sure that they can prioritize and are incentivized financially to prioritize explainability systems will always be optimized for the purposes for which they're built.

Alan Chappell (15:43)

Right? And then, and then there's the age old problem which seems to be getting worse, which is jurisdictions around the world are increasingly finding it challenging to impose their will, particularly around big tech companies. And so here's another example where like they're talking up here and a lot of really smart people are being ignored because it's not hard, it's very soft, it's very ethereal. I'm not saying it isn't real, but it's, it's not necessarily hard because it's not. You can't point to it in a law and say thou must do X, Y and Z. Then that makes compliance I think a much, much more difficult in reality.

Shoshana Rosenberg (16:23)

No, I absolutely agree. I think we're at a very interesting moment here where also the impossibility of enforcing right so much of it and, and, and tracking, I think it's happening at the M macro and the micro level. But the thing of it is, it is entirely, and you know that I, I, I'm boring, I go back to basic logic, right? It is an inevitability that the maelstrom that is growing is only going to get worse. And if we allow explainability to escape by the tail in terms of we can't do it right, then we're going to have a real problem. And I actually thought you were going to mention how so many countries and regimes are sort of setting it down and saying we want, because of company pressure, right? Saying we want less regulation.

Alan Chappell (17:08)

Totally agree. Yeah. And I, I see that as related to my previous point. I think that the, but because it's, some of it is that there's just so much pressure. Look, we, we all need to beat China in the great AI race. And, and so for better or worse, mostly worse. But that argument is, is winning in more and more places around the world.

Shoshana Rosenberg (17:29)

The other piece of it though is where you take away the US is a great example, right? Where you, where you strip everything away. You say we want to go skydiving. When you go skydiving, the people who run the skydiving operation, they have the insurance, they have the buckles, they have a training for you. They bear the burden and so procurement is going to take ownership of all of these embedded responsibilities that translate into liabilities. That is, and certainly the US Is a great example there, because where the government says don't let anything get in our way. Right. But from a government contracting standpoint, we're going to require these things. The government contracting ecosystem includes vendors that we all touch, small or large vendors. And so the two years that it's going to take for all of those government contractor requirements to become embedded everywhere is going to go in a flash.

Alan Chappell (18:22)

And then what?

Shoshana Rosenberg (18:23)

And then what you're finding is that the businesses are having to cover the liability of their counterparts. They are maybe, hopefully, I cross my fingers, coming up with explainability notices. We've, you know, you don't have to reinvent the wheel, but they are certainly having to do all the diligence and put the controls in place instead of the legislation doing it. So the pressures happen at what used to be procurement and should now be vendor management.

Alan Chappell (18:49)

That certainly makes sense, but it also seems like we're a ways off from that. No. Are you saying that the AI Bill of Rights, or actually that was a Biden initiative, but the current iteration of that, is that going to get us there two or three years from now?

Shoshana Rosenberg (19:03)

I believe so. And prove me wrong. Come at me. But the thing of it is, if Amazon is a government contractor, which I believe they are, if Google is a government contractor, if you lay out all the big government contractors, whatever they might be Quaker Oats to the gm, right. They, they probably sell something to the government where they are government contractors, they're going to have to account for their ecosystem. They're not going to pick and choose who. They're going to ask these questions about a biased system and this and that and whatever has been put in. Right. And as it's layered in, they're going to have to have something across the board. And so I do think that wherever your business touches that aspect, which goes global pretty quickly, right. It becomes standard that you have to answer these questions for a government contractor to do business with you. And then that trickles down because they're also asking questions about your partners and your subcontractors.

Alan Chappell (19:54)

So I agree with that, that the, the. Where the rubber hits the road. Fantastic. To have standards, but the rubber hits the road around enforcement. And it doesn't seem like we're there yet.

Shoshana Rosenberg (20:06)

Oh, no, no, sorry. I didn't mean to conflate the two enforcement from the regulatory standards that are being put out there. We've already seen this with privacy There are almost never enough people in the office that is assigned to, you know, herd cats and assign fees that that's.

Alan Chappell (20:23)

A kind of an endemic challenge within the, within the privacy space, by the way, also within a lot of orgs. I mean it's gotten better in the 20 or so years I've been involved, but, but still the privacy office tends to be underfunded and it often is the thing that, you know, the company likes to point to to say that they really, really, really care about it. But it isn't, they aren't demonstrating that with budget all the time, except where.

Shoshana Rosenberg (20:49)

It'S part of the co branding that the privacy is deemed mission critical.

Alan Chappell (20:53)

Right, Right. So I, I want to shift gears just a little bit and talk about pets. So in the ad space at least, I've taken the position that, you know, many if not most implementations of privacy enhancing technologies or pets, they, they tend to create tension when it comes to digital agency and explainability by design. And I, I feel like privacy at the expense of transparency isn't really helpful, particularly given the effectiveness of many of the pets to actually address consumer concerns about privacy. So here's my question. You know, as an AI ethicist, how are you thinking about the tension between privacy and transparency?

Shoshana Rosenberg (21:37)

So it's interesting to me they're both in service of agency if done properly. Right. But I also understand that in the web of ad tech, you know, if all of my data is encrypted, but it's still being funneled to all sorts of places and then manipulating me. Right. That's not exactly the same. So I feel like they're both in service of the same master of agency if done properly. I don't think a pet is a thing to hide behind. Right. When the machinations, black box or otherwise, are actually undermining human power, human agency and the ability to think clearly. This is a bit of an aside, but when you think about ad tech, I am sometimes on some of these platforms, not the ones that terrify to let my kids on or anything, but where I feel like, please don't sell me this, this is not in my budget. Right. Please don't show me, you know, whatever it is, it's an interesting world to navigate this piece. And I will say no matter what is happening with the data where you feel invaded, the, the, the magic glow of pets is, is completely dissolved from a marketing standpoint for the company using them, I don't want to say against, but to people.

Alan Chappell (22:48)

So I'm thinking about transparency in this context a little Bit differently. I'm thinking about it as, okay, we're going to run the data set through these pets and therefore you as an advertiser are going to just kind of have to trust that our numbers are good. Because as an advertiser, you have almost no ability to really know, you know, that, you know, campaign X worked better than campaign Y.

Shoshana Rosenberg (23:16)

So agency for the platform and not the user.

Alan Chappell (23:19)

Yes.

Shoshana Rosenberg (23:19)

So at that, right, the, the platform holds the cards and everyone else that both the end user and of course those counting on them. I, I think that's interesting in terms of a transparency and explainability piece there. Have you seen, and I don't mean to throw it back to you, but I'm curious because you know this space much better than I do. Have you seen any imprint of something that, that starts to be able to account? Because even if we strip away AI as it, you know, we stip generation and we just look at these systems and we can. What if you, you know, do those processes have audits whereby they too can speak to confidence levels, accuracy, and these other components that we also should be and, and hopefully are demanding of AI systems?

Alan Chappell (24:03)

No, there, there really isn't. And part of the challenge is that advertisers, bless their hearts, aren't consistently demanding it. And, and, and if they're not demanding it, if, heck, if I was running a big platform, I probably wouldn't be providing it because why subject myself to that additional scrutiny? So the, the, the playbook over the last five years or so is to like jazz hands your way through, like we're using homeomorphic encryption and, and you know, all those big buzzwords. But at the end of the day, if, if an advertiser were to demand like, okay, but like, how do I know that the numbers you're giving me are sound right now? I don't think there are many instances of a platform or really anybody being able to pride. Provide that.

Shoshana Rosenberg (24:49)

So this is a great example. We were talking like, we. Right, our universe was Talking about this 10 years ago already, which is, you know, you could say you're organic, but are you certified? Right? Like, who tracks that? So you can say you're a pet. And if we're going to go ahead and evaluate which we should be doing, there should be a standard by which you can say that you're a. Or not. Right? If you're going to go in there, then you should also get some accuracy pieces. Right? So does the thing function as intended with regard to privacy and does the thing function as intended with regard to Whatever the end user and the business leveraging it can't see. So I think that's a great idea. Please, someone start that business on your laptop today.

Alan Chappell (25:30)

So what comes to mind is that there was this opportunity within the AD space about 12 to 15 years ago where we started to put icons on ads and somewhat helpful from a transparency standpoint so you can kind of know whether an ad is incorporating a profile. And there was a company called Evadon who was one of the companies who was charged with the role of serving these icons onto ads. Now their initial implementation allowed one to click on that icon and you could see which advertiser was providing the ad. You could see something about the ad tech intermediaries. You know, if they had continued to build on it, I would imagine that one could see what profiles that were created, you know, so it would be a beautiful transparency tool that, you know, maybe only 1 or 2% of users would take advantage of, but boy, would that have been really cool. And what ended up happening was they had one competitor and the competitor was, you know, Evadon had created a Cadillac and, and the competitor came in with like, you know, the, the, the Hyundai and the market said, you know what, I think all we really want is a Hyundai. And that opportunity was sort of squandered. And so I, I don't know how to get there within the ad space, but I will say, and, and then I'll get off my soapbox and like start asking you questions like a real interviewer here. But I, I would just say, as we head into the agentic AI era, all of the underlying misplaced incentives and grift machines creating the appearance of solving problems seem to be remaining with us. And it doesn't seem like, you know, you can identify the heck out of everything. And I don't know that that's going to make things any better.

Shoshana Rosenberg (27:10)

Oh, it can only make it worse. And I see the IAB trying to tackle that and I know that there are so many other things at play and there's a lawsuit with Google. Right. There's so much happening here. But I, I definitely don't think we can let this stand. That, yes, it's only going to take us further away from, from our goal. So, so you're kind of saying that you too are an advocate for at least what, what I intend to occur as the output of an agency, a digital agency, human. Right, right. Like that we have to, we have to change the way the tech is being built.

Alan Chappell (27:40)

Completely agree, Completely agree. And that's, that's A challenge. And, and, and one of the things I wanted to maybe explore a little bit more with you. You know, you mentioned IAB Tech Lab. You've got this ad context protocol and they're sort of philosophically two really interesting things because I think. And I'm going to have Tony Katzer and Brian o' Kelly on the pod at some point. But like, you know, the IAB is saying, look, there's a lot here, we need to build on the existing infrastructure because if you start from scratch that creates some, some challenges. And like I, I kind of get that. And then Brian and I'm way oversimplifying and he's going to yell at me probably, but, but he's like, well, we need to blow everything up because there's just so much junk in there. And like they're both legitimate arguments and it'd be interesting to see if they're able to come together. But I'm curious from that dichotomy, you know, which, where's your lean right now?

Shoshana Rosenberg (28:32)

So you, you can't stay, stop what's in process and you have to cure it as it goes. But I do think the. By a certain date, anything new has to achieve a certain standard is something where you are doing both at the same time. Right? You're saying, hey, this can't happen, that can't happen. We're going to try to check for it. But then you're also saying any technology that is going to go on the market by. I used to say 2028 because it rhymed, right. Or explain. Or 2029. Explainability by design by 2029. But we were going to have to push it a little further. Right. But you do want to try to make a fixed date by which they have real incentives, both financial and you know, otherwise to get to a place where the tech can do what we needed to do. So I like the combination because you can't stop playing whack a mole with all the things that are going wrong. And you'll learn from that process and be able to apply a lot of the learning to what comes next.

Alan Chappell (29:25)

By the way, let me just take a half step back and just say kudos. So explainability by design by 2029 is pretty brilliant. The only thing this year that beats it, and I say this with love, is the initiative. Like it's just in terms of, as a buzzword but like that's a, you know, bowing at the feet of the.

Shoshana Rosenberg (29:43)

Master minus two or three is at least three years old. So, so I'm Way behind.

Alan Chappell (29:48)

But that, yes, you beat Cory Doctorow, then that's, that's something you won't, you.

Shoshana Rosenberg (29:52)

Won'T get me to say the other word. But I absolutely agree. I think it's the right thing.

Alan Chappell (29:56)

So I would, I would love your thoughts. So I, you know, I'm, I, A lot of my audience is sort of what I'll call little tech. It's the, you know, it's the folks working within the, what we'll call the open Internet. Even though I'm not sure that's a thing still. But my question is, is like, if you're a little tech company who's, you know, looking to leverage all of the cool energy that seems to be directed into AI right now, how do you, what should you be thinking about? Like, how do you leverage all this and try to do the right thing, given that, you know, by your own admission, the right thing is at least three years away.

Shoshana Rosenberg (30:31)

So you already talked about the easy part. The easy part is putting into procurement standards the things that pressure everyone in your ecosystem. Ask for an explainability notice. Let them say, what is that? I've never seen one. Right. And then start to figure out how you create your own. The other piece is there where you are wanting to ask vendors for something. Make sure that you're doing it when you're building yourself, even if you're building internally, because you might want to sell that externally later, right? If you do something really great. But the notion there is really to say, and I love this, I'm a little dorky, but where people are building upon a foundational model, I liken it to. If you were going to enter a chili making contest with a chili base where you had no actual ingredient list, right? And so your job, when I come up to you and I say, alan, you know, is there cilantro in this chili? Because it gives me hives or whatever. And you say, listen, I absolutely can't account for the base, right? Or, hey, here's an explainability notice for the base. This is what I'm working with, but this is what I added to the mix, and I can represent that to you. And I think the de minimis piece here is to say, be able to evidence what you have put in place, the controls you have around it, the ways in which you are auditing and reevaluating both the functional, the outputs and the way that it's working as best you can, if it is still not explainable so that you can speak to and evidence the work that you've done. And be able to, to monitor and account for yourself that way. I think that's the most important part, where you're building on foundational models, where you are creating agentic systems for other people. I think you want to go to the higher standard of being able to account for again, what is in place and what controls you have. The problem is, the underlying problem with all of this that we all understand is that we are essentially, this is the first time we've ever built on what I'm going to very casually call wobbly technology. Right. We are. There is no logic behind this. This is mostly predictive tooling. Right. Not all of it, because some of it is we're pulling an AI and into a lot of things, into the term AI, but the notion is we are trying to take work away from people and we will essentially make the work, the monitoring and the evaluation of the thresholds and the evaluation of the metrics and the adaptive thresholds. And, and this is, we're going to take every discipline and turn ourselves into a technology assisted, but nonetheless monitors and auditors. And it's a very interesting time because of it. I'm sorry if I went too far deep in that, but that is the next step, right?

Alan Chappell (32:59)

No, I love that. I mean, I, I actually think that everybody listening should go back and like literally write down the last two minutes because I think that that is as clearly communicated a starting point as I've heard. So thank you.

Shoshana Rosenberg (33:15)

Of course, I appreciate that. That's kind of you.

Alan Chappell (33:17)

So I'd love to dive into the, the Prism framework. Are you okay talking a little bit about that?

Shoshana Rosenberg (33:24)

Absolutely.

Alan Chappell (33:25)

I guess my question is, and this sort of builds on, I think what you just said, you know, how can an ad tech data governance team use that Prism framework? And I'm going to put more information about what that is in the show notes. But I would still love your overview. But like, how can one use the Prism framework to move beyond, you know, a check the box compliance mindset and really try to move towards a more proactive ethical culture.

Shoshana Rosenberg (33:49)

So since we don't have time to fully explain it, I will say this. I'm sure that you're trying not to sing Tina Turner. We don't need another framework. Right. The difference here is that this framework is not built for you to put into your policies. It is built for practitioners. It actually the origin story on sort of why I feel like this is so important is because with AI, from any angle in the organization, if you hold it up to the light, it's having A different impact, good or bad. Right. And because you don't ever see the whole picture from any one angle in the organization, there's too much happening at once. So PRISM is around principles, responsibility, which I see bears a lot of the weight, Intelligence, security and monitoring, which is monitoring of your AI governance program as well as your tools. Right. You have to have a bigger picture of this. So I do have a book coming out. The entire second half of the book speaks through PRISM to practitioners. It is a very dense resource. I spared no aspect of my brain and thinking here. But when you're thinking about it, it's partly to understand that the hull of a ship has overlapping components. Right. So that the water doesn't get in. And I want all of us to feel that where many people have been given and relied upon this sort of compliance based notion of what AI governance is, I need you to be sure that you don't have that terrible feeling that I think everyone from the board down to an individual operator and a company has, that you're missing something. I must be missing something because there's too much happening at once. Right. And so it is the, the interlock between principles, not as some sort of arbitrary, you know, marketing campaign that we throw out, but really whatever comes across your desk, whether you're going to build or you're solving a problem, does it align with what we believe or have asserted as our principles? Have we considered the four quadrants of responsibility around ethical, operational, societal? Like where, where are these touch points in that? What is the intelligence we have coming back to us about this? Or where are we going to build those feedback loops in and how will we centralize that? And then security components, which means something so different in this age, but I know we don't have time to get into it. And then of course, monitoring around the entire process. Right, which holds it together, which is your way to say this issue happened, where did we fail, what wasn't accounted for? Or we're building something? Have we truly checked all of the pieces in place that we need to so that practitioners don't have to feel, they don't have to understand technology fully. Right. But they can know and depose against the information that they're given in a really informed way and be able to document, speak to and evolve it?

Alan Chappell (36:34)

Shoshana, when is this book going to be out and where can people find it?

Shoshana Rosenberg (36:38)

If you're outside of the United States, it's coming out May 3rd. If you're in the United States, you have to wait. It's with a UK publisher called Kogan Page. It is coming out on the 26th.

Alan Chappell (36:49)

Fantastic. I would encourage everybody listening to this to buy that book because that seems like you are showing a light towards the future and you're doing so in a way that I think is clear. And I think you're able to underline what the benefits to an org are in terms of if they follow this path. So a thank you so much.

Shoshana Rosenberg (37:09)

That's very generous of you, Alan. Thank you.

Alan Chappell (37:11)

Shoshana. This has been a fantastic discussion. Where can people find you?

Shoshana Rosenberg (37:16)

There's a practicalai governance.com website. You can find me of course on LinkedIn. I am the co founder of Women in AI Governance with the incredible Emerald Delou. You can also find me through Logical AI Governance where I teach courses and certifications around this to sort of make up for that sense that I think a lot of practitioners have, that they don't feel truly grounded. We had too much imposter syndrome and privacy, which is the most finite realm of law, we can't let it happen here.

Alan Chappell (37:44)

Great point. Well, thank you so much for coming on. This has been a great discussion.

Shoshana Rosenberg (37:48)

Thank you Alan. Have a gorgeous day. Thanks for having me.

Alan Chappell (37:52)

That was a great episode and I have to say this conversation gave me a lot to think about. Let me pull out a few key threads that I think are particularly important for anyone working in the ad space or in the privacy and regulatory world. First, I want to talk about Shoshana's concept of digital agency as a fundamental human right. I typically try to keep these discussions grounded in the law, and so it's worth noting that the concept of digital agency is more aspirational at this point, but I don't think that that diminishes its importance. I agree that we need the ability to understand the context of what we're being shown so we can accept it, reject it, or challenge it. In the ad space. That means moving beyond the generic why am I seeing this type notices. The challenge, as we discussed, is that the ad tech ecosystem involves multiple entities and oftentimes with few players actually knowing what anyone else in the chain is doing. So how do we create explainability in that environment? Well, Shoshana's answer is sort of interesting. She says that we need to enshrine digital agency as a human right first, which then creates the legal and regulatory pressure to make explainability technically feasible. As she puts it, you have an inalienable right to freedom from interference by dragons, but we don't have to enshrine it until there are dragons. Well, needless to say, we have dragons now. Second, I want to underscore the tension between privacy enhancing technologies and transparency. I've been arguing for a while that many pet implementations create problems for digital agency and explainability. Privacy at the expense of transparency isn't actually solving a problem. When large platforms run data through pets and then tell advertisers to, you know, just trust our numbers, they are creating a new form of opacity. A quick shout out to Don Marty, who's written a bunch on this topic, if you're looking for a great source of additional information. Third, I want to address the inevitable question about how to implement these concepts within the ad space. So step one is you have to have an insatiable appetite for understanding how things around you work and for not taking the high level explanation of your partners and vendors. And I know from experience that taking those types of positions can be rather lonely in the ad space. Shoshana will tell you to start asking vendors for explainability notices, even if they say they've never seen one. So begin creating your own notices for your products as part of your privacy and AI impact analysis that companies in the ad space are supposed to be engaging in already under several laws. If you're building on foundational models, you need to be able to account for what you've added to the mix, what controls you have in place, and how you're monitoring outputs. Think of it like entering a chili contest with a base you didn't make. You can't account for every ingredient, but you can document what you've added and how you're testing the final product. Finally, I want to touch briefly on something that we didn't discuss in detail, but that looms over this entire conversation. So Shoshana talked a bit about how even a set of executive orders coming from the US Administration can have a huge sort of rippling effect on the marketplace. One question that I wished I'd asked but didn't get to was to get Shoshana's take on what it seems like a dramatically different approach to AI governance. As between the Biden and Trump administrations, the focus today seems less on digital agency, on protecting civil rights, on ensuring algorithmic fairness and mitigating the risk of discrimination. The focus today is on reducing regulatory barriers, accelerating AI development to compete with China. But the move fast and break things approach doesn't really work if what's breaking is consumer trust, market integrity, and democratic discourse. It's easy to say that none of this is the fault of the digital ads industry, but in fairness, the ad industry spent years operating in a regulatory gray zone where we didn't meaningfully push the envelope on either privacy or transparency for going on a decade, and we're still dealing with the consequences consent fatigue, privacy washing, and a fundamental erosion of the trust between publishers, advertisers, and consumers. With AI, I think the stakes are even higher. These aren't just systems that target ads. Increasingly, these systems can manipulate perception, automate decision making at scale, and create feedback loops that amplify bias and misinformation. And in case I didn't make this clear, lots of this stuff is already covered under the current privacy rules in Europe and certainly at the US State level. And in case my recent conversation with Tom Kemp at Cal Privacy didn't make this clear, regulators are coming after ad tech and data brokers first, so it'll be much more difficult for companies in the ad space to hide. Shoshana's call for explainability by design by 2029 is both a pithy slogan and an extremely ambitious goal. But we need fixed dates and real incentives, both financial and regulatory, if we want to push the industry towards building AI systems we can actually understand and control. The alternative is what we're already seeing a maelstrom of opaque systems making decisions that affect billions of people with no meaningful oversight and no real accountability. That's not a future I want to live in, and I don't think it's a future that's good for the ad space either. And as I said, regulators and policymakers are focusing on these types of issues today. So here's my challenge to everyone listening. Don't wait for a perfect marketplace where all the rules are fully established. Don't wait for your competitors to move first. Start asking the hard AI and privacy questions now. Demand explainability from your vendors. Build it into your own systems. Create the documentation and controls that demonstrate that you're taking this stuff seriously. Because whether the regulatory pressure comes from Washington, Brussels, or your own privacy and data governance team, it's coming. And the companies that get ahead of this will have a significant competitive advantage regardless of which AI protocol ultimately wins, as between the IAB Tech Lab, the Ad Context Protocol, or whatever else emerges over the upcoming months. I'd encourage you all to pick up Shoshana's book Practical AI Governance when it comes out this upcoming May. Just a reminder, I'll leave the link to Practical AI Governance in the Show Notes, and you can find a link to the latest version of the Chappelle Regulatory Insider in the Show Notes as well if you found this conversation valuable, please share it with someone in your organization who needs to hear it. And if you have thoughts, questions, or even if you violently disagree with something I've said, please reach out. I'm always up for a good debate. We have a bunch of other fantastic guests coming up on the Monopoly Report podcast over the next few weeks, so please subscribe to the show@monopolyreportpod.com or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.