The CIO’s Guide to AI Governance and Risk

[00:00:00] Paul Lekas: We’re facing a data landscape that is intent on trying to regulate this technology in different ways, and a federal government that is moving much more slowly on that front.

There are differences of opinion at the federal government. There’s a number of people who think we need federal laws to trump state laws around artificial intelligence regulation, and there are others who say we need to let states be the “laboratories of democracy.”

It’s a confusing field, and the way in which this is going to impact companies really depends on where they sit in the whole AI value chain. Are they developers? Are they deployers? Do they work with customers who are consumers, or are they other businesses? All these are relevant questions to how the policy landscape is going to affect their day-to-day reality.

[00:00:46] Intro: Technology has transformed how we live, work, and connect. And behind that change are visionary people with bold ideas. Welcome to the Bridgecast, where host Scott Kinka explores hybrid work, AI, and our evolving future with tech’s brightest minds. Presented by Bridgepointe Technologies, the nation’s leading tech advisory firm. Experience a better way—the Bridgepointe way.

[00:01:21] Scott Kinka: Hi, and welcome to another episode of the Bridgecast. I’m your host, Scott Kinka. Joining me today is Paul Lekas, the Executive Vice President of Global Public Policy and Government Affairs at the Software and Information Industry Association (SIIA).

Paul has led public policy work across three presidential administrations. He’s co-authored major recommendations at the National Security Commission on Artificial Intelligence, served as a senior counsel at the Department of Defense, and stood up governance at the federal commission on national and public service.

This is quite a resume, Paul. Today, we will explore how companies should translate fast-moving policy into operational strategy, how to engage constructively with governments around AI and cross-border data flows, and what responsible advocacy looks like in an era where tech policy and national security intersect. What all of that really means is you have your finger on the pulse. Paul, welcome to the Bridgecast.

[00:02:19] Paul Lekas: Thank you so much for having me, Scott. It’s a pleasure to be here.

[00:02:22] Scott Kinka: Well, I’m super excited, Paul. We always begin with: tell us a little bit about you. Where are we speaking from? Tell us about the family and where you grew up. Let us know you a little bit.

[00:02:32] Paul Lekas: Right now, I’m in Washington, DC. I’m with the Software and Information Industry Association. We are a trade association representing nearly 400 companies across the technology and information spaces. They include some of the biggest tech companies in the world and major developers of AI models, all the way down to startups. We represent companies in the education technology space, financial market information, publishers, and a range of others.

[00:03:01] Scott Kinka: Got it. Makes sense. And did you grow up in DC?

[00:03:04] Paul Lekas: I grew up in Michigan, just outside Detroit, and I’ve lived basically on the East Coast ever since I left for college.

[00:03:12] Scott Kinka: Gotcha. You like it more rough-and-tumble out here because you went to Harvard Law and just stayed out.

[00:03:17] Paul Lekas: I stayed out on the East Coast, but I love the Midwest.

[00:03:19] Scott Kinka: I love it. Well, fantastic. So you go to Harvard Law, and if I have the LinkedIn profile right, you started on the firm side, but it’s been almost all in public policy and government-facing efforts. Was that by design when you were in college—is that what you always wanted to do—or did you just land there decades later?

[00:03:43] Paul Lekas: Not at all. It took me some time to find this space, actually. I started my career as a lawyer in private practice for over a decade before I went into government. Over that time, I realized that it was really the government-facing work that attracted me. Now I work largely in policy. I’m still a lawyer, but I don’t practice law. I like that front-facing side of things a little bit more. It just took me a little while to find my niche.

[00:04:13] Scott Kinka: We hear that story all the time. I love hearing how people landed where they didn’t think they were going to land. Paul, you’ve got a rare mix of government legal experience and private sector advocacy. Hit me with an early career moment that shaped how you approach public policy today.

[00:04:34] Paul Lekas: Certainly. When I was a lawyer in private practice back in 2012 or 2013, I was working with a lot of tech clients on internal investigations. At that time, the general public didn’t really talk about AI, but we were actually dealing with investigations involving AI.

The one thing that really stuck out was the need to educate government enforcers and lawmakers about this technology they didn’t really understand. That stuck with me because a big part of my job right now is explaining and educating. It’s talking about what laws and regulations might do, what’s actually happening in the world, and what the effects of those policies may be.

[00:05:24] Scott Kinka: Got it. Tell us a little bit more about the SIIA. You are an advocate on behalf of 350 to 400 technology organizations facing the government effectively?

[00:05:42] Paul Lekas: Working with government, I’ll say. We try to work constructively with lawmakers and policymakers at the US federal level, across the US states, and internationally. We focus on issues like AI, privacy, cybersecurity, and cross-border data flows—the whole range of things that affect companies in the business of technology or information.

[00:06:14] Scott Kinka: We run into this all the time. We have many guests who are innovators in the AI and security space. In tech, we rarely ask if we should just because we can. As I read through your policy priorities, I think part of being in this economy is this unbridled innovation and commercialism. We’re always in the “can,” and it’s hard to pause and think about the “should.” Is that where you guys are—getting people to think that way and getting the government to catch up with innovation?

[00:07:13] Paul Lekas: There’s a ton of interest around making laws that affect the tech industry. When I talk about the tech industry, I’m talking about the broader industry, not just the “Big Tech” players. Part of our work is to explain where innovation is today and how we can foster more of it, while also recognizing that different policymakers are coming from different perspectives. They may be very concerned about something, so we have to try to meet them where they are.

[00:07:51] Scott Kinka: I think a lot of our listeners are wondering what’s coming down the pike. Regarding the current regulatory and policy landscape around AI, where are we in the US right now, and what do you see on the immediate horizon?

[00:08:10] Paul Lekas: That’s the billion-dollar question. AI is affecting every sector of society. In addition to the big AI labs, we’re working with companies that were not traditionally tech companies but are using AI to improve back-office functions, streamline workflows, and make sense of massive amounts of information.

We’re working closely at the federal and state levels on legislation. You’re seeing a different approach from the two. Last year, over 1,500 bills were introduced across the 50 states regarding AI. A couple hundred have passed. We’re facing a state landscape intent on regulating this technology in different ways, while the federal government is moving much more slowly.

There are differences of opinion. Some at the federal level think we need federal laws to trump state laws, while others say we should let states be the laboratories of democracy. It’s a confusing field. The impact on companies depends on where they sit in the AI value chain: Are they developers, deployers, or working with consumers versus other businesses?

[00:10:09] Scott Kinka: I noticed in your policy priorities that you talked about advocating for federal legislation—first to organize the states so we don’t have 50 sets of rules, and then as a basis for a uniform international code. One specific point you stated was advocating that the federal government have the sole authority for model oversight. That might make some people uncomfortable. Walk me through what that means.

[00:11:01] Paul Lekas: Absolutely. We distinguish between different actors in the value chain. There are the big models being developed—ChatGPT, Gemini, Claude—and then there are companies using AI in different ways, which we call “deployers.” There’s been a move to try to regulate these frontier models at the state level. Last year, we saw laws enacted in California and New York.

Fundamentally, these laws seek to minimize the risk of a catastrophe happening due to how an AI model is deployed. We think this is the role of the federal government because it would be incredibly complicated and resource-intensive to have 50 states looking at things like national security risks, unintended model behavior, or public safety events. Convening those resources and expertise at each state is extraordinary and probably not the best use of state resources, whereas the federal government is already doing this to some extent.

[00:12:51] Scott Kinka: So the key is to regulate enough to organize the 50 states so companies can operate, but not so much that it infringes on First Amendment rights, the ability to innovate, or economic growth.

[00:13:09] Paul Lekas: That’s exactly right. Another component is drawing the line between where the federal and state governments should step in. We’ve seen an interest in creating laws that apply across the board to AI. But the guardrails for AI in medical devices are going to be different from those for AI in vehicles or consumer chatbots. Just because they use similar technology doesn’t mean you should treat them all the same way. Insight from companies building or adapting models is critical to guiding policymakers in the right direction.

[00:14:38] Scott Kinka: If you’re a CIO of a mid-market enterprise leveraging these models to innovate, you’re rarely thinking about policy unless you’re in banking or healthcare. What is a practical piece of advice for an IT leader trying to use these tools right now so they aren’t surprised later?

[00:15:35] Paul Lekas: Any company using AI needs a governance mechanism. Engineers need to be in conversation with lawyers and business people. You want lawyers and policy people to provide clear guidance to engineers.

Ask yourself: Are we using AI in any “high-risk” scenarios? Based on enacted laws, high-risk usually includes healthcare, employment eligibility, or access to financial services. If you are implementing audit practices or explainability requirements, focus on those high-risk uses because that’s where potential legal liability is likely to be. Map your data, map how you’re using AI, and categorize your systems. If you’re using personally identifiable information (PII), there will be more requirements. Working closely with legal to conduct assessments and audits is what you should be doing right now.

[00:17:38] Scott Kinka: So, basically, apply the same level of care to sensitive data in AI that you already do for PII, medical, or financial information.

[00:18:07] Paul Lekas: That’s a great way to put it. You’re already taking care of certain data; keep doing that, and then layer the AI piece on top.

[00:18:25] Scott Kinka: Regarding international standards, your policy mentions using federal frameworks to build global standards with a “coalition of the willing.” If we regulate in the US, but bad actors or certain state actors don’t, are we putting the power in their hands? How do you build an international guidebook that ill-intentioned people won’t follow?

[00:20:02] Paul Lekas: I think about this at different layers of the AI stack. We want models to be reliable, though no model is perfect. Major AI developers are already adhering to best practices. I won’t use the word “standards” because that often implies complicated technical standards from bodies like ISO or IEC.

Companies don’t want to be ad-hoc because no one will use their models if they aren’t reliable. If you’re selling to businesses, they need reliability. We need some sort of check to build public trust. Models from other countries might not be as reliable, and the market should be able to exclude those. The trustworthiness of AI is something the US can and should rely on for competitiveness.

[00:22:19] Scott Kinka: Let’s talk about copyright and intellectual property. AI is referential, meaning everything is a derivative. Your policy states the current system is well-equipped to handle these challenges. But how do we ensure we aren’t running headlong into an IP infringement scenario by using public models before legal precedents are set?

[00:23:48] Paul Lekas: It’s going to take time for the law to settle. We think the courts are best equipped to deal with this because changing copyright law right now could have dramatic, unknown implications. I work with both model developers and publishers who need to get paid for their content.

Copyright is federal law, so states don’t enact their own, though some are looking at “copyright-adjacent” laws for things like name and likeness. There’s a political battle between the content industry and other parts of the economy.

[00:25:15] Scott Kinka: It seems it will come down to the definition of “derivative work.” As a musician in my previous life, I know every piece of music is a derivative of something else. How do you adjudicate that? Ripping lyrics is one thing, but tools like Suno produce works that sound completely different while leveraging derivative training.

[00:26:41] Paul Lekas: You’ve hit on the distinction between inputs and outputs. Those questions are adjudicated on the output side, and they aren’t easy. It’s hard to create one rule to rule them all, which is why the court system—though slow—is the place for this.

[00:27:09] Scott Kinka: For a mid-market business without a policy team, what is the first practical protection step?

[00:27:37] Paul Lekas: Data mapping and AI mapping. Know what data and what AI you are using. Stay in touch with your lawyers and plan for near-term requirements like updating terms and conditions and conducting impact assessments. If you work across borders, think about data localization and adopting a modular approach to your services.

[00:28:35] Scott Kinka: ChatGPT is the number one shadow IT application. Is an AI governance policy enough to cover rogue use?

[00:29:17] Paul Lekas: From an IT perspective, you must ensure you’re using an enterprise version so your queries don’t become part of the training corpus. Maintaining the privacy of trade secrets is number one. Also, train your people. AI will help with workflows, but getting the most out of it isn’t intuitive for everyone.

[00:30:02] Scott Kinka: Let’s jump to some fun. Give me one policy surprise you expect in the next 12 months that IT leaders aren’t planning for.

[00:30:32] Paul Lekas: There is a huge push around AI infrastructure and data centers. I think you’ll see more federal action focused on that, perhaps trying to rein in states regarding data center licensing. AI will also be a hot issue in the midterm elections, but it won’t align cleanly with party lines; it will create unusual alliances. And from an IT perspective, people are becoming much more attuned to the cyber risks AI poses.

[00:31:45] Scott Kinka: I love the take on data center power. At Bridgepoint, we help companies find data centers with enough power and space. Now, give me a contrarian view you hold around AI policy.

[00:32:43] Paul Lekas: The debate is often positioned as “doomers” versus “boomers.” I think most of the industry is actually in the middle. We recognize we must promote innovation as much as possible, but that innovation has to be responsible.

[00:33:19] Scott Kinka: Is there a governmental responsibility to define “responsible AI”?

[00:33:32] Paul Lekas: Not really, but the government is a great convener. Over the last few years, there’s been a convergence on non-legislative best practices. We want US industry to be seen as the best out there, and companies are addressing public concerns.

[00:34:14] Scott Kinka: Tell me one book or podcast shaping your thinking.

[00:34:23] Paul Lekas: When I read for fun, I read novels to get my mind off tech policy. Professionally, I follow blogs like TechDirt, Lawfare, and TechPolicyPress. For a novel, I just finished Euphoria by Lily King. It’s about human relationships in 1930s New Guinea.

[00:35:13] Scott Kinka: Last question: You’re in a dystopian future and your phone only has one working app. What is it?

[00:35:37] Paul Lekas: Google Maps. I want to know where to go.

[00:35:44] Scott Kinka: Paul, where can listeners find more about your work?

[00:36:13] Paul Lekas: Our website, siia.net, is the best place. We’re also on LinkedIn and X (formerly Twitter).

[00:36:28] Scott Kinka: I highly recommend their “26 Policy Priorities” PDF on the website. If you could leave leaders with one sentence about operating in this environment, what would it be?

[00:37:02] Paul Lekas: Let’s try to leave the politics aside and get practical policy done.

[00:37:14] Scott Kinka: Policy over politics. Paul, thanks for joining us.

[00:37:27] Paul Lekas: Thank you so much for having me, Scott.

[00:37:29] Scott Kinka: That is a wrap. If you found this insightful, please subscribe and leave a review. Thanks to Bridgepointe Technologies for sponsoring. If you need help with digital transformation, check out bridgepointetechnologies.com. Until next time, do what you can to be the signal.