規制下の銀行におけるAIコンテンツガバナンス ― Raiffeisen Bank International のStefan Zima氏に聞く

Welcome, everyone, to the Emerge AI in Business podcast. Today's guest is Stefan Zima, Head of Group Regulatory Compliance and AI Compliance at Richardson Bank International AG. Stefan discusses how financial institutions should structure ownership and accountability for AI-generated and AI-consumed content, and why most organizations have far less visibility than they assume into what they're actually permitted to do with their data across vendors and borders. A quick note for our audience, that's the views and opinions expressed by Stefan on today's program are his own and do not affect those of Rifson Bank International AG or its leadership. Do you sell AI products or services? Emerge gives you access to trusted content and real conversations. Learn how leading AI brands like NVIDIA and Google Cloud work with Emerge to reach Fortune 500 AI buyers.

Download our media kit at emerge.com.ad1. That's emperj.com.ad1 to download your copy. Now the conversation with Stefan. Stefan, welcome to the Emerge AI and Business Podcast. Thank you, Yolande. Thank you for having me. Thank you for giving me the chance to be here with you. And of course, hopefully, it's interesting for those who are listening in today. So hi, guys out there. Yeah, interesting. I just, to the audience members, I just told Stefan before we started that preparation for this interview was very different. It's an exciting topic, but it's also a very intimidating topic.

And we're going to start off getting right into it, thinking that the EU AI Act's full obligations land on August 2nd of this year, with fines that can run up to 7% of global turnover. And right now, there's a tracker counting more than 35 separate AI training data lawsuits moving through the Western courts. So a lot going on. And so as AI accelerates how your organization creates and shares and reuses content, and that could be research reports, training materials, things like that, where are you seeing the existing rules and governance struggle to keep up with that? That's such a wonderful question because it tackles so many aspects. And you said it's an exciting topic to be in this industry to also work with startups, regtechs, fintechs that are trying to catch up with using the technology that still accelerates and accelerates every day more. So what we discussed today, what AI could do in this creating or sharing or mutilately magically letting appear in content can change so fast. And the governance has here a little bit of a problem because knowledge and the typical PowerPoint skills is a new commodity, right?

It's not like this skill that you can build upon and say, I'm so valuable now. This is something that you can use to exploit everything that you have and have, meaning every content that your institution has, every knowledge that somewhere is safe will be found and you don't need to be somehow sitting on some treasure that nobody can touch. Everything becomes accessible and everything can become so very easily transparent. And here, I think governance has a big challenge because on the one hand, if we know that the commodity of knowledge and certain skills changes. And on the other hand, we want to be so efficient with using these tools to jump over the boring part of writing down the whole text of the policy or creating a new Power BI dashboard where we have to play around long with the technology behind and have problems with the setup or, damn it, I missed the Excel course, so I really don't know what the Excel formula is. This is all gone, right? Because now this is here with a mouse clip. And on the other hand, the governance needs to protect the cases that we already know. I mean, look in the media right now. I mean, if you ask an AI model today, and we just had the OpenAI case of hacking into a hugging phase to make a test properly.

Why? Because it found out the easiest way to pass the test is to go to the website where the test results are already saved. So it hacked out there and went out there on a free loose. Meaning you have to govern it very hard and you have to guard really whatever you are doing in your use case world and in your AI tooling world. so hard that sometimes you feel like a step back instead of a step forward, right? So this dilemma of we want to be proactive and innovative gets pulled back by we are scared because we just don't know what everything can happen. I think this is the biggest, let's say, area of where you can't prepare. Because in two weeks, we could sit together again, Yolanda, and we can say, what is the newest model coming out? What's the newest tool or startup product that you have found that promises you data and AI-driven solutions that you don't have yet? and you have just simply no clue what it does. I'm not sure if everybody is out there aware that, for example, Claude knows where you are location-wise because you think you give it all your computer and you let Claude manage your whole schedule and your outlook and whatever there is.

Cool, but you don't have all the knowledge of the power that is behind these tools right now. And the problem is that I think those who create the rules and those who create the governance, they also don't know everything yet. It's so much in the experimental phase. It's testing and trying out. It's new things are working technically, but nobody tested it yet in a real-life operational environment. Also, the deciders are, of course, more concerned. So let's take those that should be really on board, like the data protection officers out there, the IT security experts out there, the data governance persons out there. They should be on board, but they cannot even read up as much as they should know already if they wouldn't work for Anthropic directly, right? So how can they know? They also don't know what the future is. So it's hard to say somebody is not doing his or her job in this, but the point is a very simple one. You have to create the guardrails that you feel safe enough for your organization, and then you can also trustedly use these agents to help yourself.

In an example that I know very much we have a lot of scope in our area of regulatory compliance I mean you know a bank is a very regulated entity If you don want to work in a regulated area you have to work in a supermarket And even there there a lot of nutrition and other laws But I'm just saying it's very regulated and very, very sharp and very governed. And in this area, we have to know so much that AI, of course, can help me read all the policies, read all the documents and have the knowledge that I would need 100 senior people that maybe were there when the policy was written 20 years ago. Now it's a big, big use case to use the content, the research paper, the audit reports, the training material that we have somewhere in the house at one spot. For this, AI is perfect. How do I govern this now and how do I make the rules? Well, you have to create the maturity for it, right? If you limit your area of documents, if you limit your area of content, I think you can also work with the licenses that you get right now from the most common AI models.

I'm not saying here any specific preferred ones of mine. We're not doing marketing here. But I think, I don't know, everybody knows when using Microsoft that you have rather copilot or if you are a little bit more free, you maybe work on cloud and with cloud code. But it doesn't matter. In the end, the governance means what are you doing for what are you doing this and what is actually read, used, and from whom. So we come actually back to the data topic. And I think you built a nice bridge from, yes, we can create so much content. we can share so much content easier because it's available with a mouse click and the knowledge is a new commodity is cheaper in that sense but it all comes down to the data and the foundation that you need and you can't have the governance and the framework if you don't have the understanding for the data and for the processes below. For the regulator overall, because maybe I misunderstood your question completely and I was talking completely nonsense right now the last five minutes, which is absolutely possible you know, I'm not the biggest expert on anything. I'm happy to learn every day and I'm just super thankful that experts out there,

senior leaders that are peers and exchange with me on conferences, they tell me their stories, they tell me their use cases. It's just fun to understand. Maybe they crossed a bridge that I haven't seen yet and then I already heard about the story. And I think the biggest bridge that we all wait for is that European Union or other international governing bodies and supervisory brothers are really nailing something down. I mean, we saw with Table 5, with Mythos, right, from Antropic that the U.S. government was immediately stopping this and then carefully letting this out because of this hacking possibilities and for the damage that this can happen. They also don't know yet how to find the sweet spot between compliance and using everything. I always bring up the wonderful example of transforming into a data-driven organization. This might surprise you, but one of the biggest aspects here is if you want to make data accessible to everyone and if you want to have a good data foundation, you also need to find a sweet spot between give me all data and don't touch the data at all. So compliance rules and do whatever you want.

Why? Because you need to have this governance as an enabler and as a supporter and not as a blockage. If you have it as a blockade and somebody that blocks you completely, you will lose motivation, you will lose your literacy enthusiasm on it, and you will not get anywhere. so it's then also again a people and culture topic from those who sit in the governance body from those who create the governance and i'm sitting maybe not in the first row but at least in the cinema with my popcorn and watching what they're doing hoping two things very much hoping that first they find a way of taking away the fear part because i don't want this anthropic marketing all the time that it kills us all or we all replaced by ai and all this hype stuff that flies around i'm not a fan of these things because i think they don't have really a real logical ground, knowing how humanity works, knowing how far certain institutions are still in the wait and see phase, right? So before AI replaces us all, I don't know what has to happen first. And then watching how to find the sweet spot that we can all rely on.

And I think it's not the first time in history that we have seen it. The Internet was also quite an open field at the beginning when it came out. Technology always is. The only challenge, and I don't have an answer for this, but I'm sure in this podcast it's touched often, is the space. The moment you think now they found some AI-act common ground on at least knowing what is a high-risk use case, maybe the possibilities of what is all possible increases and suddenly way more ideas become a high-risk use case, and you have to sharpen the governance very quickly after that. And knowing the European Union, this takes a long discussion, this takes a lot of committees and councils. this is maybe where I see a little bit of a problem so for the next years I see still a wild west scenario where we can be in a very grey zone same as we had it with crypto same as we have it with blockchain and stuff because let's take crypto stock exchanges or the revenue that you can make or the speculation profit that you can make, how to put taxes on it etc. I think from that perspective

we are in a little bit of a AI wild west but wild west is now romanticized. We all like cowboy movies, right? So from that perspective, it's not a bad time. It's just exciting. It's definitely exciting. We're going to dive deeper on some of the things that you mentioned already, but I think something that's very evident so far in this conversation is that, yes, the speed of AI and the deployment and seeing it in the organization, that is insanely fast. But identifying the risks and attending to them and getting governance in place and getting to a place where we can trust the AI, that is still in slow motion. And I think that's where we see a major gap as well. Getting onto that whole maturity thing, there's a California law that took effect in January of this year requiring all AI providers to disclose whether their training data includes any copyrighted or licensed material. So that's one thing that we have going on. And then at the same time, we have Deloitte's latest enterprise survey that found that only about one in five companies do have that

mature governance model for the AI agents. So we're seeing a lot of things happening, and it feels like everyone's just trying to reach for some information or some data to just base the next decisions on. But what is it that actually needs to be true inside the organization for it to know it using content and data in the right way How do we know that we using AI in terms of our content and data in a way that won get us in trouble Do we know Let take the GDPR a data protection situation I think no company in Europe would say they are breaching data protection, right? They all have a DPO because it's in the law. They all protect the data of the customers as best as they can. They all, and you for sure, also got from time to time some email where you have to agree on some customer content that something may be done with your data. And still the supervisor or the potential verdict is different in the end when they take a second look, right? So what I see right now is that reaching AI maturity is a very individual thing, a very individual thing depending on in which industry and in which status quo you are to get there.

And when I talk about AI maturity, I'm talking about data maturity as the foundation. I don't want to always build this bridge back from AI, but AI is just garbage in, garbage out if you work in a closed loop or if you rely on the public data. We also know that I think a majority of AI training data comes sometimes from Reddit. At least I saw some statistics that Reddit data is very much used because it's publicly available. It's very informal. It's very truthful what people think and what people say. But it's also the Internet where people just say whatever they want without filters and without any, you know, quality assurance in between. So to get to the maturity, you need proper data in. And this means that you really have to understand that your organization is in the change management process. And in a change process, you start with culture, you start with attitude, you start with literacy about topics. And then based on this, you can discuss roles and setups and accountability, and you can field committees and councils and processes, which all will not fly if the people that are working here together are not working in the same direction, having the same enabling wish and ambition to make things happen, and also the same understanding of the risk appetite and the wish of the use cases that you want to achieve.

You can have a huge risk appetite and say, screw it, we are going into using every bit we can just to make profit short term, because the moment when we are shut down by some governance, we already became millionaires, right? This is a proper attitude that you can have if you like this or if you want to have this consequence. Or you are very much following the law or a good citizen in the governance and say, good, I follow what is officially approved, so I wait. I wait until it's set, and I wait until the AI act is clearly written, and until then, I do nothing. And here we are again in this sweet spot that I mean. You should for sure prepare for your sweet spot by focusing on your people and investing in this change management aspect, meaning prepare for AI and data literacy courses. Take away the fear of your people to get there. Take away the fear of AI replacing me. Make it visible and transparent what is possible and what makes an added value to you by knowing which problems you can tackle.

Don't build solutions just for activism, right? Don't just have five agents because it's sexy and tell to your board of management how much you use AI. If you're born tokens and just have a huge bill on the AI provider, nobody's proud of you. If it's not AI and it's just an Excel macro, then it's an Excel macro, right? So nobody will punish you for this. So I have the feeling a lot of hype goes into this activism, but focus on the problem and on the literacy, and the people will have the maturity to discuss on a level that a good foundation is met. People focus on data quality that gets in, accessibility, documentation, roles and functions that enable along the process, and then we talk about AI maturity, which has a proper inventory of use cases, a communication path, a community that exchanges on the knowledge that is already established, a knowledge hub to share, e-learnings, and all these aspects that you know where your human is in the loop and where the AI takes over to solve the problem that you have defined,

and not, I'm just so cool because I have all the tools bought for a lot of money. I told you that in preparation for this podcast recording, I was very intimidated by the information that's out there on the topic, and the lawsuit that we currently have all over the world. And that made me think about, okay, we have this multinational compliance fragmentation issue, right? So can we argue that knowing what you're allowed to do is basically almost impossible when we have dozens of countries and vendors involved? Is full visibility a fantasy or is it real? Full visibility is always a fantasy, I think, because also these vendors want to make money. So if you have seen on my LinkedIn profile, I'm also involved in certain advisory for certain AI startups or certain AI innovators that are trying to offer an added value to certain customers without scamming them. And why I'm saying this, a lot of these things that are on the market are mimicking something that you can do very fast your own or have a high price tag because a hype is flying around.

or they just use up that certain people are not there yet on their literacy and on their training that they could have in a few weeks. The visibility also on what is the consequence of what I'm doing because the governance and the ruling is not yet fully lived or just so young that it just comes into the play, is that we also don't have experience. Now I have the feeling more and more data protection experience comes up because now we have a few years already with high fines and verdicts and situations where people were discussing before legally how to interpret. And I think we will come in this area as well when we feel safe, we feel everything is now popping up like mushrooms in the forest, a lot of use cases are working, a lot of things are fine, and then the hammer of the governance will come and say, guys, you really overdid it, or guys, you really overlooked this thing that we meant, but we didn't write it exactly as you may have interpreted it. I think this will come. And in my current role of regulatory compliance, this is for me also the biggest focus area on this when we have taken over the AI compliance part because we're not AI governance.

AI governance is fully set and we support from AI compliance perspective, especially on the AI egg. The point is I need to be aware of what potential is coming ex ante right so what the moment when I see other banks are fined or other companies are already failing a little bit in this hype this would be my influence of say guys pull back a little bit You don't want to run in the same forest where, I don't know, the wolf eats you like the others did. And for this, visibility is key as much as we can get. So we have to be as close as possible to the news, to the regulatory monitoring, to the horizon screening, what's coming in. So I think this is an investment everybody should do for sure, especially those, and we mentioned this before, those who took ownership, right? So if you take the topic because you want it or you take accountability for implementing the AI transformation or the AI strategy or whatever you have in your situation, if you take accountability, this is not for your CV. This is not to make you famous because it's now the biggest topic that flies around. and I thought about when you invited me to this wonderful podcast

and I was so excited of already thinking what wonderful exchange we will have. It's really a topic for everybody out there, right? I mean, for the pure technical person to the kindergarten teacher or whatever craftsman that is very hands-on in his daily life, it still affects this person. It still maybe changes his way of doing invoices or researching something or how his cell phone will work. It affects everybody. So taking ownership is something that sounds easy because it makes you famous, it looks good on your CV, it makes you very much interesting maybe on the recruitment market, but it is a responsibility. This is really not just yet another tool. This is a big, big change, and the change management is something you only take if you know how change management works and what it means. And I think here, organizations out there or also senior leaders out there, when they put somebody in this position, for example, nominating a team or such people, that they should really be aware that they don't overlook the boring part, meaning being close to the law, being close to the governance, doing their homework, and they're not just marketing the activism that I said.

So we're saying that, and we're heading to the closing part of this conversation, so I want to make sure that we don't miss anything here. So we've basically been saying that, okay, we need to be able to audit. We need to be able to take ownership and then the visibility part as well. Is there a wrong order to do these three things in, audit, ownership, visibility, or is it just figuring it out as you go and individual decision? That's a wonderful thought. If you figure it out along the way, I think you will lose a lot of time and money. And we all notice the first thing that dies first on the battlefield is the plan. So I think you should have some kind of a structure that you follow, but then you have to adapt very quickly to the culture of your organization. Again, it all comes down to people. This is not a top-down money decision, right? It's not like now I give you that amount of tokens and now everything is more efficient. If you want to save money on implementing AI, this is a restructuring project. This is a reorganization project.

This is deeply thinking in solutions for problems that you have and thinking what would be the best streamlined processes. I don't think that any of these plans hold the moment the first use case flies off because then you have suddenly learned who is interested, who is not yet there, who is blocking the whole exercise, how is the dynamics in the house about competition. I would never underestimate the change management effort here on people and politics. People there, again, and I come back to the ownership, are very easy to be first row on the stage raising the hand and then very, very bad in taking the accountability for it. With this, also the plan goes down. Because if you, for example, find out, and luckily we don't have this, and I never experienced this in my way, but I know it from peers and from others. If you have very formal and strict, let's say, data protection colleagues that are blocking, because the easiest way is to say no to everything, because then nothing can go wrong, you have nothing but a plan. So the plan will never fly.

So you need also the right people with the right attitude. And this, I guess you only know when you get also started somehow. Only you know your organization very, very much, and I'm sure everybody does out there, not assuming anything negatively. But I'm also a realist, right? And we are humans, and we have colors, and we have a lot of private color on the daily work and on the daily doing. So the investment on this people part, culture part, knowledge part, and awareness part is so essential to make any plan happen that I cannot emphasize this enough. And I hope my dear fellow listeners of this podcast smile now a little bit or are reminded of the situation of a former project that they had, because this will be always the case and is not related to AI. This is just related to how to get things done. Yes, how to get things done and how to get visibility on what's happening, how to think about visibility. I think that is great for our content governance inside regulated environments. And as you said, it's not even just regulated environments.

Everyone should be wary of this. Stefan, it's been wonderful having you on the show today. Thank you for giving us so much to think about and for giving us so much of your time today. Thank you, Yolande, for listening and for asking me this wonderful question. It was a pleasure. And I hope it was interesting for the people who dialed in. Wrapping up today's episode, let's look at the three key takeaways from our conversation with Stefan. First, ownership and accountability for AI-generated content need to be defined before, not after a compliance review. Second, most organizations have far less visibility than they assume into what they are actually permitted to do with their own data across vendors and jurisdictions. And finally, asking on content risk ahead of an audit is far less costly than responding to one. To use our AI products or services, Emerge gives you access through trusted content and real conversations.

Learn how leading AI brands like Nvidia and Google Cloud work with Emerge to reach Fortune 500 AI buyers. Download our media kit at emerge.com slash ad1. That's e-m-e-r-j.com slash ad1 to download your copy. On behalf of the team at Emerge, we'll see you on the next episode.