3183: Navigating AI Regulations and Compliance with Insight's Juan Orlandini

[00:00:03] Are companies ready for the evolving world of AI regulations? I think as artificial intelligence continues to revolutionise industries, businesses are now challenged with navigating a landscape of increasing complexity. Whether it be managing data integrity and compliance or achieving the right balance of cost and innovation.

[00:00:28] Well today I'm joined by Juan Orlandini, CTO of North America at a company called Insight. And together we're going to be discussing how organisations can prepare for the regulatory frameworks that are shaping AI adoption, implementation and even governance. And my guest is going to break down the three categories of AI, whether they be creators, adapters and consumers.

[00:00:55] And learn more about each faces unique challenges in an era of growing oversight. Additionally we'll also examine the regulatory efforts led by states like California, how they could maybe evolve into broader federal frameworks across the US and mirroring the path of privacy laws maybe. But what steps should your company be taking to ensure compliance while equally leveraging AI for transformation and growth and making the most of so many of those opportunities out there?

[00:01:23] And how can you avoid repeating the past mistakes of adopting new technologies? And I know every single listener will have a story about that. But enough for me. Let's get today's guest on right now and we'll dive into his insights straight away. So a massive warm welcome to the show. Can you tell everyone listening a little about who you are and what you do? So, hey, good morning, good afternoon. Juan Orlandini. I'm CTO North America here at Insight.

[00:01:50] I am part of the office of the CTO at Insight. We have offices in EMEA and APAC and I have peers of mine that cover those regions. And my job is to understand what's happening in the industry and the partner ecosystem and with our capabilities and marry those two to get all three of those together and bring value to our clients as quickly as possible. Well, it's a pleasure to have you join me on the podcast today. I think over the last two years, there's been an insane amount of hype around AI.

[00:02:19] Lots of businesses jumping on board, not wanting to get left behind. But now, of course, as things are maturing, we're now starting to look at things like responsible AI and regulation, et cetera. So how should companies begin to prepare for some of the upcoming AI regulations? And what kind of steps are essential to effectively classify, categorize and manage their data assets? Because this is rising in importance now, right? It is. But you know what?

[00:02:47] AI terminology is being overused. And I think everybody will agree to that at this point, right? And it's important that we classify which AI and then what use of AI we're talking about before we talk about regulation and data and all those other things, right? And one of the things that we like to do at Insight is to broadly classify AI into three categories, right? And they're broad categories and they're fuzzy, but they're apropos for this conversation.

[00:03:17] Category number one is what I personally call the creators of AI. So think of the anthropics, the open AIs, all of those folks that are actually creating from scratch, the novo AI models. They have a very specific set of regulations that they're going to probably end up having to follow that are slightly different than everybody else, right? Then there's the other end of the spectrum, category three, so I'm going to jump ahead a little bit, is the consumers of AI. So how do we take advantage of these applications?

[00:03:46] And that's going to be embedded in all of our day-to-day interactions, everything from our devices to our enterprise applications to the products that we use as a SaaS from some third-party provider. We're all going to be using AI. And then the middle, category two, is kind of the bridge from category one to category three. I call that adapting AI.

[00:04:07] So you're taking something that foundational model builders build, then you do things like fine-tuning and embedding and RAG and all those other kinds of technologies, and then you adapt it to your very specific use case, and then publish it to be consumed by category three, right? And then every one of those categories, there's slightly different lenses that you have to use for how regulations are going to come in and affect your business.

[00:04:34] Category one, we're going to end up having a day, are going to have to make sure that they have responsible sourcing of data, demonstrable sourcing of data. There's a big debate between open versus closed data models and IP infringement and all that, and that's going to play out over long term, and that's going to be a mess, right? And TBD.

[00:04:58] Category two is going to be informed by category number one, because enterprises are going to have to make sure that they're sourcing a model that they can be attestable to on IP infringement or have some sort of protection against IP infringement and those kinds of things. On top of having their own data sets being cleansed and, I don't know, made sure that it's usable in a way that's not going to infringe on any of the regulations that are going to come out.

[00:05:28] And category number three, you kind of have a flavor of that as well, where you're going to have to make sure that if you're using a SaaS provider, you have done some vetting of them. But you also, if you're going to be using your own data against a AI model, make sure that it is a data set that's been cleansed and taken care of. So it's a convoluted mess a little bit right now, is the best way I can describe it.

[00:05:54] It really is, but I think breaking it up into those categories that you described there is so helpful. And for any business leaders that are listening, what kind of risks and equally, I don't want to focus on just the bad, what kind of opportunities should organizations be considering when leveraging their data for AI-enabled applications, particularly in the context of compliance and ethical AI practices, which is becoming almost another set of buzzwords on their own? It is.

[00:06:22] And actually, I like the fact that you categorize it as an opportunity because it is 100% an opportunity. There are some naysayers in the industry that are saying, this AI thing is going to blow over. It's not. 100% it's not. This is going to happen, right? So what remains to be seen is how it's going to happen and where we're going to derive the most value.

[00:06:41] What we are seeing is that for most organizations, until a lot of this regulation and sourcing and stability happens, where value is being driven is in internal-facing applications. So things that automate internal processes, internal workflows, those kinds of things. Those tend to be, A, easier to identify, and B, safer because you're not exposing yourself to external risk.

[00:07:11] Over time, and 2025, I think will be the year where we start seeing more and more of this, will be more external-facing AI-enabled applications that customers start or organizations start building in order to derive new revenue streams or improve the revenue streams that they have today. So as a business leader, what I would tell you is until you have matured your internal organization to know how these things work, look inwards first.

[00:07:39] Look for opportunities where you can optimize your own internal workflows. And then over time, start maturing that into external things. And you don't have to do these serially. You might be able to do them in parallel. But make sure that you understand first before you publish extern. And there's an old joke that over here in Europe, we're not too good at innovating. So instead of innovate, we regulate.

[00:08:04] So how do you view the EU AI Act, which is setting a precedent for global AI regulation? Do you think there are any lessons that businesses over there in the US could take from its emphasis on usage and transparency and all that stuff? Well, you know, it's actually a really good thing that the EU acts that way. And it's a bad thing for you guys as well, because I think you're right. I think it does stifle innovation a little bit, right? But it's the safer approach to these things.

[00:08:32] And I think globally, you are doing us all a favor by creating these things. And let's be honest, you're going to create these regulations. And then you're going to find out that, oops, we didn't think this thing all the way through. Not through real intent. It's just because it's new. We don't know, right? So that's giving us an opportunity to learn from you. So thank you. And over time, what we're going to end up doing is creating our own regulations.

[00:08:54] And as you're probably seeing, it's going to happen at the regional level first, at the state or local agency levels before it becomes a federal thing. And honestly, I don't even know that it will become a federal thing until there's a tipping point that is just overwhelming. That's just the way the US operates. So TBD, but thank you. And we're looking to learn a lot from each other. And I love what you've mentioned.

[00:09:23] And I'm glad you've brought up the AI regulations in the US because California seems to be leading state level AI regulation. So what would you say are the benefits and the challenges of that approach compared to the absence of that comprehensive federal regulation that is a million miles off right now? I'm going to get in a little bit of trouble here because I'm going to call California our EU here. There's the saying here, whither California goes, the rest of the country goes, right? Yeah.

[00:09:52] And California has always been, not always, but typically been in the forefront of regulations and coming up with things like, heck, they were the first ones starting to start banning indoor smoking. And back in the early 90s, everybody's like, oh my gosh, why California? And now here in the US, you can't smoke indoors. And so I think we're going to follow a similar pattern here.

[00:10:19] Now, the rules that were applied for smoking in California are different than the rules that were applied for smoking here in Georgia, which is where I'm based out of. But they're generally in agreement and with local flavor. And I think that's what's going to end up happening with these AI things is you're going to end up with AI regulations. Every state's going to have slightly different things until there is this watershed moment, if there is one, for the federal government to come in and start mandating a broader vision across it.

[00:10:48] So as others do inevitably follow, how do you see that state-level AI policies evolving into broader federal regulations? What kind of parallels do you think can be drawn from development of maybe privacy protections like CCPA? Are there any parallels that you see there? And if I ask you to look into your virtual crystal ball, how do you see it all playing out? You know, that's a really good question. And I wish I had the crystal ball to tell you 100% certainty because nobody does, right?

[00:11:16] But even the CCPA is being involved. So much like the EU regulations, the California regulations, they took a stab at it. They found out that they did really good, but they could adjust it. And that's what they're doing. I think that's what's going to ultimately be the pattern that we follow across all of the other states and the federal side of the house. And then we'll end up settling on a more or less well-understood pattern. But that's going to take a while. It's going to take a significant amount of time.

[00:11:45] Regulation just takes time because you got to create the regulation, enforce the regulation, find out where the regulation is right and wrong, and then adjust. And those are just things that take time. Until then, as business leaders, as technologists, we need to be flexible and be ready to adapt very quickly.

[00:12:06] So a big message in that is that you should not be marrying yourself or wetting yourself to very specific technologies or approaches in a way that are not flexible so that you don't hurt yourself down the road. And if we look at what you're doing there, what kind of role does AI play in Insight Enterprise as a strategy to help companies on this journey to streamline their IT budgets while integrating AI technologies to secure and strengthen applications?

[00:12:35] And, of course, APIs. We're living in the age of APIs right now. So if you can share around how you're helping businesses here. Well, we're looking at it two different ways broadly, right? One is how do we improve our internal systems and processes and operations to deliver value to our clients more efficiently and at lower costs and those kinds of things? And, in fact, we're using that to become client zero for ourselves. And we did that back in 2022.

[00:13:04] We deployed Insight GPT, which was our own private GPT, so we could learn what these things could do internally. We deployed it to all 15,000 teammates globally. We deployed AI PCs. We've created some internal applications that are AI-enabled. And all those taught us a lot of things that we didn't have to go learn with our clients or at our client locations.

[00:13:28] At the same time, our clients are in this very accelerated path to enabling their stuff. And what we've been trying to help them through is taking them through that journey. So how do I take a look at my data? Do I have good data cleanliness? Do I even have the right kinds of data sets to do an AI application? And if you do, what are the most likely places for you to derive value instead of a gee whiz really cool demo?

[00:13:58] Which, by the way, is what happened in 2023. There was a lot of demos, right? And then 2024, we thought was going to be the year I called it AI do instead of AI try. It turned out we still were trying a lot of different things. And in 2024, what's very, very clear was that many organizations got very excited about things and tried 500 different things inside their organization, but couldn't find a path to a value, monetization, value, whatever that is.

[00:14:25] And a big part of what we've been doing is helping our clients narrow down the scope of their efforts to two or three projects, typically, that are actually demonstrably going to bring value to the clients. And part of that to themselves or externally, right? And part of that is how do I bet the use case? How do I validate it? And then once you have that use case validated, how do I build this thing so that it can support that?

[00:14:51] And sometimes that is something that we do in a public cloud with the services and products that they offer. Sometimes for clients, they want to do it on premises because of their data locality or regulations or banks or whatever it is that they have. And that's all great. And we help them through that. And when we build those applications and all that, part of what we bring to the value chain is our traditional IT development methodology. And this is a big thing for me, by the way.

[00:15:21] People have gotten confused as to what AI really is. AI, generative AI, is just another algorithm. It's just another tool in your tool belt. And building a new AI application is no different than building any other enterprise application you've ever built. So you still have to make sure that you have the right use case, that you validate the use case. And then once you validate, you start doing all the traditional enterprise application things.

[00:15:51] So create a team around it. Make sure that you build a backlog around it. Make sure that you have all the security and cost controls and all those other things. And treat it like an enterprise application. And if you do that, all those things like the API stuff that you talked about, just kind of get hold it in. Because this is part of what we do for any enterprise app, right? The cost controls, the security, the governance, the FinOps portion of it, if you're doing it in a cloud-like model.

[00:16:20] All that gets baked into it as an enterprise app. So businesses shouldn't get the shiny technology first and then look for a problem to sort afterwards. That's all that. It's amazing because one of the many things that I do is I spend a lot of time with our partner, the OEMs and manufacturers of stuff. And every one of them is now coming up to me and going, hey, Juan, look at my cool AI thing. And then 2024, I got mad at him.

[00:16:48] I really got mad at him, got frustrated because RAG became the really cool hotness of the day, right? And everybody from the server manufacturers to storage manufacturers, data protection manufacturers, the backup vendors, they all were coming up to me and going, look at my RAG thing. It's so cool. And I'm like, oh, my God, guys, RAG is not an amazing thing. And I got to the point where I had to show them I can run this on my laptop.

[00:17:14] And I wrote a 90-line Python script that did RAG on my laptop. And then they finally stopped coming up with that as the use case. RAG is not the use case, right? It's what do you do with this amazing capability? That's the use case. And that jump in abstraction and conceptual thinking is what we're going through right now.

[00:17:36] And hopefully we'll, as an industry, overlook some of that early, bright, shiny, and start really focusing back on what we can do as traditional IT professionals that we are. A hundred percent with you. And I think it is important to remember that we've kind of been here before. If I look back to my IT past, there was a time when every business must have a website. Then they must have a mobile app. Then there was the giant rush to the cloud.

[00:18:02] So how can organizations avoid repeating some of those mistakes that we saw in the past, such as the rush to adopt cloud services just because everybody else is doing it? But this time around when they're integrating AI into their IT architecture? Yeah, that's a really good question. And by the way, I've been added even longer than that because there was the rush to client server. And then there was the – we've been doing this for decades, right? Decades and decades, right?

[00:18:27] And here's a pattern that happens every time too, by the way, is that you end up rushing to technology and then you adopt it and you go like, gee, it was just amazing. And then within a very short time span after that, it becomes technical debt, right? And then you have a bigger problem because now you have to adopt it the proper way and then fix what you adopted wrong the first time, right?

[00:18:51] You can't overcome that universally, but you can minimize that effect significantly by being measured. Like I said, it's like, look, you have decades of doing this as most organizations do, of having adopted technologies, having processes that let you adopt those. Don't get bamboozled by the bright and shiny. Don't listen to the shucksters that are telling you AI is a magical tool they'll solve all things. There is no such thing, right? It is another amazing capability that we have now.

[00:19:21] It's another tool in our tool belt. It is nothing more than that, but it is a powerful tool. So make sure that you learn how to use it and take advantage of it. And despite my sarcasm a few moments ago, I am a solutions, not problems kind of guy.

[00:19:36] So what strategies or tools are Insight Enterprises customers leveraging to better manage some of that complexity, some of those risks with AI-based applications and APIs that we're talking about right across so many different IT environments? Anything you can share around that? Yeah. So, you know, we touched on it a little bit already.

[00:19:57] I think some of that is absolutely that narrowing down the focus of what you're looking at so that you're not scattershot and hoping for something to stick. I think you can be much more deliberate than that and focus on things that are going to bring high value very quickly and teach the organization how to leverage these technologies and move forward, right? At the same time, there are places where you can start grabbing some quick wins that are on in the earlier part of the conversation category three, right?

[00:20:27] So how do I take advantage of things like co-pilots that allow you to accelerate things like coding? My personal co-pilot favorite is we do use teams here at Insight, summarize meetings. I get invited to multiple meetings at the same time every day, and I should be in all of them, but I can't. So what I love is that fact that we can record things and then it will summarize and transcribe and give me action items. So it makes me much more productive.

[00:20:54] So those kinds of things, absolutely, we should be embracing quickly. But we should not be under the delusion, right, that these tools that are making us much more productive that way are all of a sudden going to eliminate the need for a category of users or employees. So you're not going to get rid of your coders because there's AI coders. You're not going to get rid of the knowledge workers because there's this knowledge thing that sits in there. You are going to optimize some of your processes.

[00:21:24] So some of those folks that are busy time that time doing mind numbing work, and that's, by the way, what our CEO called it, mind numbing work, can be freed up to go do more meaningful things with their jobs and their lives. Right. So that's the way you should think about it that way. And then from value generation, there's a huge amount of opportunity that's out there. It's just tremendous. And I was recently at a conference where some VCs were talking about how they're looking at this world.

[00:21:54] And one of the things that they're saying is that with these capabilities and the amazing technology that they're introducing is not that we have a technology problem anymore. What we have is a failure of imagination is what they called it. That's a great term for it, right? So start imagining how to transform either your industry or a new revenue stream that is not being looked at properly because we didn't have the right tools.

[00:22:24] How that we have the right tools, look at it through that lens and evaluate. Again, enterprise app, make sure that you have the right business model, all those other kinds of things. And try it out and have imagination. And I think you can both optimize what you're doing today and then go find through this reimagination a new revenue streams and accelerate value. And, of course, there'll be many people in, especially your customers and all the people that you're talking with around the world.

[00:22:52] They're going to be looking at you to lead the way. In a position like that, you're only human. And you, too, like everybody else in the world, faces that pressure of being in a state of continuous learning. So how do you keep up to speed with this pace of change? Where or how do you self-educate? Any tips there? Oh, well, so I'm a lifelong learner. So it's natural for me. I read a lot.

[00:23:18] Actually, when I say read, I'm using air quotes because I do audiobooks all the time. I consume over 100 books a year in audiobooks. And I deliberately make sure that I span all sorts of genres and technologies and everything from business books to self-help books to stupid science fiction books to whatever, right? To make sure that you have the broadest set of input.

[00:23:44] Because one of the things that's very, very clear is that this is so transformative in our ability to think is that you have to make sure that you have a broader vision. So that's my personal approach to this is make sure that I have as much input to my brain as I can. And then my brain will crystallize something in the background, right? Now, the other thing is that there are some very deliberate things depending on your bend inside of the organization that you should be doing.

[00:24:12] So if you're a technologist, there's some fantastic blogs that are out there that give you some really good technical deep dive nerdy looks into how LOMs work or vision models or what AI can really do. And as models get revved, what their capabilities are and real, right? Those kinds of things. And as business leaders, you should be looking at some of the higher level abstractions.

[00:24:37] And in fact, I attended another conference earlier this year or late last year where the topic that I was invited to talk about was what should business leaders know about AI? And, you know, my general comment on that is like, look, I don't expect my CEO to understand how LOMs work or how RAG works. But I do want her to be enabled by myself and the rest of the team to be able to think about that as another tool in her belt.

[00:25:06] And that's the way you should think about it, right? Is she sets the direction for my organization. She makes sure that we're headed in the right direction and that we're going to be solving even greater and bigger things as an organization. That's what I need to enable her. And from her lens, how do I have a team that feeds me that kind of love stuff, right? And my job with her is to make sure she understands what is real and what is not, right? And how much is noise and how much is not.

[00:25:35] And so from a business leader, that's what you should be surrounding yourself with is people that spend time thinking about those things and educating you that way, right? Absolutely perfect. A great moment to end on. But before I let you go, for anyone listening, wanting to dig a little bit deeper on the real side of things and some of the truths that we uncovered today, where's the best place for anybody listening to find out more about you or start a conversation? Where would you like to point everyone? Well, a couple of places.

[00:26:03] If you want to reach out to me directly, I'm easy to find. I'm on LinkedIn, just Juan Orlandini. There's not very many Juan Orlandinis out there. But for Insight itself, www.insight.com. And we have lots and lots of resources there, everything from services as well as blogs and things that we publish that try to bring value to our clients. Absolutely tons and tons of information there.

[00:26:30] Well, I'll have links to everything so people can find you nice and easy there. And I think every company today are racing to integrate AI into their IT architecture. Every business is also being bombarded by emails and telephone calls from founders promising that their AI solution will be that silver bullet for everything. And many times it doesn't even have AI in it. And I think every company today is, I think, to be honest, if I zoom out, it's a timely reminder our conversation today about the importance of things away from tech.

[00:27:00] That deeper understanding of data, business processes, how to create and use data assets for decision making and operational efficiency. And I'll then think about the technology second, about solving some of those problems. But just thank you for offering such a timely reminder today. Really appreciate your time. Thanks again. Thank you. Appreciate it.

[00:27:20] I think as we conclude our conversation with today's guest, it's clear that navigating the complexities of AI regulations requires both foresight and flexibility. And whether it's categorizing AI use cases, focusing on internal applications, or even adopting traditional IT methodologies, companies must take that measured approach to maximizing the benefits of AI while also staying ahead of some of those regulatory challenges that we raised today.

[00:27:50] And I think Juan's insights remind us of the importance of treating AI as an enterprise tool rather than chasing trends. But over to you. What are your thoughts on the thought of AI regulation? Do you see parallels with other technology adoption cycles? Do you think AI requires a completely different approach? Love to hear your perspectives on this. Let's keep the conversation going. Email me now. Tech blog writer outlook dot com.

[00:28:19] LinkedIn X Instagram. Just at Neil C. Hughes. Send me a quick message. Let me know. I'll be back again tomorrow. I've got another guest on a completely different topic to explore. And I cordially invite you to join me again. Speak with you all tomorrow. Bye for now. April 20, 20, 2nd, 1st, if I just wanna come back on a bit my best trip. Bye. Bye. Thank you.