AI Content Governance Inside a Regulated Bank - with Stefan Zima of Raiffeisen Bank International AG

Welcome everyone to the Emerj AI in Business podcast. Today's guest is Stefan Zima, head of group regulatory compliance and AI compliance at Raiffeisen Bank International AG. Stefan discusses how financial institutions should structure ownership and accountability for AI generated and AI consumed content, and why most organizations have far less visibility than they assume into what they're actually permitted to do with their data across vendors and borders. A quick note for our audience that the views and opinions expressed by Stefan on today's program are his own and do not reflect those of Raiffeisen Bank International AG or its leadership.

Do you sell AI products or services? Emerj gives you access through trusted content and real conversations. Learn how leading AI brands like NVIDIA and Google Cloud work with Emerj to reach Fortune 500 AI buyers. Download our media kit at Emerj dot com slash AD one. That's E M P R J dot com slash A D one to download your copy. Now the conversation with Stefan. Stefan, welcome to the Emerj AI in Business podcast.

Thank you, Yolandi, thank you for having me, thank you for giving me the chance to be here with you. And of course, hopefully it's interesting for those who are listening in today. So hi guys out there.

Yeah, interesting. I just to the audience members, I just told Stefan before we started that preparation for this interview was very different. It's it's a an exciting topic, but it's also a very intimidating topic. And we're gonna start off getting right into it, thinking that the EU AI Act's full obligations land on August second of this year, with fines that can run up to 7% of global turnover. And right now, there's there's a track accounting more than thirty five separate AI training data lawsuits moving through the Western courts.

So a lot going on. And so as AI accelerates, how your organization creates and shares and reuses content, and that could be research reports, training materials, things like that. Or where are you seeing the existing rules, uh, and governance struggle to keep up with that?

That's such a wonderful question because it tackles so many aspects. And and you said it, it's an exciting topic to be in this industry, to also work with, uh, startups, regtechs, fintechs that are trying to catch up with using the technology that still accelerates and accelerates every day more. So what we discussed today, what the AI could do in this is creating or sharing or magnificently magically letting appearing content can change so fast. And the governance has here a little bit of a problem because knowledge at the typical powerpoint skills is a new commodity, right?

It's not like this skill that you can build upon and say, I'm so valuable now. This is something that you can use to exploit everything that you have and had, meaning every content that your institution has, every knowledge that somewhere is saved, will be found. And you don't need to be somehow sitting on some treasure that nobody can touch. Everything becomes accessible and everything can become so very easily transparent. And here I think governance has a big challenge, because on the one hand, if we know that the commodity of knowledge and certain skills changes, and on the other hand, we want to be so efficient with using these tools to jump over the boring part of writing down the whole

text of the policy or creating a new Power BI dashboard where we have to play around longly with the technology behind and have problems with the setup. Or damn it, I miss the Excel course, so I really don't know what the Excel formula is. This is all gone, right? Because now this is here with a with a mouse click. And on the other hand, the governance need to protect the cases that we already know. I mean, look in the media right now.

I mean that if you ask an AI model today, um, and we just had the open AI case of hacking into a hugging face to make a test properly. Why? Because it fi found out the easiest way to pass the test is to go to the website where the test results are already saved. So it hacked out there and went out there on a free loose. Meaning you have to govern it very hard and you have to guard really whatever you are doing in your use case world and in your AI tooling world so hard that sometimes you feel like a step back instead of a step forward, right?

So this dilemma of we want to be proactive and innovative gets pulled back by we are scared because we just don't know what everything can happen. I think this is the biggest, let's say, area of where you can't prepare, because in two weeks we could sit together again, Yolandi, and we can say, what are what is the newest model coming out? What's the newest tool or startup, uh, product that you have found that promises you data and AI driven solutions that you don't have yet, and you have just simply no clue what it does.

I'm not sure if everybody is out there aware that, for example, Claude knows where you are location wise, because you think you give it all your computer and you let Claude manages your whole schedule and your outlook and whatever there is. Cool, but you don't have all the knowledge of the power that is behind these tools right now. And the problem is that I think those who create the rules and those who create the governance, they also don't know everything yet.

It's so much in the experimental phase, it's testing and trying out, it's new things are working technically, but nobody tested it yet in a real life operational, uh, environment. Um, also, the deciders are, of course, more concerned. So let's take those that should be really on board, like the data protection officers out there, the IT security experts out there, the data governance persons out there. They should all should be on board, but they cannot even read up as much as they should know already if they wouldn't work for Anthropic directly, right?

So how can they know? They also don't know what the future is. So it's hard to say somebody is not doing his or her job in this, but the the the point is a very simple one. You have to create the guardrails that you feel safe enough for your organization, and then you can also trustedly use these agents to help yourself. In an example that I know very much, we have a lot of scope in our area of regulatory compliance.

I mean, you know, a bank is a very regulated, uh, entity. If you don't want to work in a regulated area, you have to work in a supermarket. And even there, there's a lot of, uh, nutrition and other laws, but I'm just saying it's very regulated and very, very sharp and very governed. And in this area, we have to know so much that AI, of course, can help me read all the policies, read all the documents and have the knowledge that I would need hundred senior people that maybe were there when the policy was written twenty years ago.

Now it's a big, big use case to use the content, the research paper, the audit reports, the training material that we have somewhere in the house at one spot. For this, AI is perfect. How do I govern this now and how do I make the rules? Well, you have to create the maturity for it, right? If you limit your area of documents, if you limit your area of content, I think you can also work with the licenses that you get right now for the most common AI models.

I'm not saying here any specific preferred ones of mine. We're not doing marketing here, but I think I don't know everybody knows when using Microsoft that you have rather Copilot, or if you are a little bit more free, you maybe work on Claude, uh, and with Claude Code, but it doesn't matter. In the end, the governance means what are you doing, for what are you doing this, and what is actually read, used, and from whom? So we come actually back to the data topic, and I think you build a nice bridge from yes, we can create so much content, we can share so much content easier because it's available with a mouse click and the knowledge is a new commodity

is cheaper in that sense. But um, it all comes down to the data and the foundation that you need, and you can't have the governance and the framework if you don't have the understanding for the data and for the processes below. For the regulator overall, because maybe I misunderstood your question completely, and I was talking completely nonsense right now, the last five minutes, which is absolutely possible. You know, I'm not the biggest expert on anything. I'm happy to learn every day and I'm just super thankful that experts out there, senior leaders that are peers and exchange with me on conferences, they tell me their stories, they tell me their use cases.

It's just fun to understand. Uh, maybe they crossed a bridge that I haven't seen yet, and then I already heard about the story. And I think the the biggest bridge that we all wait for is that European Union or other international governing bodies and and supervisory bodies are really nailing something down. I mean, we saw with Fable five, with Mythos, right, from Anthropic, that the US government was immediately stopping this and then carefully letting this out because of this hacking po uh, possibilities and for the damage that this can happen.

They also don't know yet how to find this sweet spot between compliance and using everything. I I always bring up the wonderful example of transforming into a data driven organization. This might surprise you, but one of the biggest aspects here is if you want to make data accessible to everyone and if you want to have a good data foundation, you also need to find this sweet spot between give me all data and don't touch the data at all.

So compliance rules and do whatever you want. Why? Because you need to have this governance as an enabler and as a supporter and not not as a blocker. If you have it as a blockade and somebody that blocks you completely, you will lose motivation, you will lose your literacy enthusiasm on it, and you will not get anywhere. So it's then also again a people and culture topic from those who sit in the governance body, from those who create the governance.

And I'm sitting, maybe not in the first row, but at least in the cinema with my popcorn and watching what they're doing, hoping two things. Very much hoping that first, they find a way of taking away the fear part, because I don't want this anthropic marketing all the time that it kills us all or we're all replaced by AI and all this hype stuff that flies around. I'm not a fan of these things because I think they don't have really a real logical ground, knowing how humanity works, how knowing how's how far certain institutions are still in the wait and see phase, right?

So before AI replaces us all, I don't know what has to happen first. And then watching how to find the sweet spot that we can all rely on. And I think it's not the first time in history that we have seen it. The internet was also a quite a open uh field at the beginning when it came out. Technology always is. The only challenge, and I don't have an answer for this, but I'm sure in this podcast, it's touched often, is the speed.

The moment you think now they found some AI acts common ground on at least knowing what is a high risk use case, maybe the possibilities of what is all possible increases and suddenly way more ideas become a high risk use case and you have to sharpen the governance very quickly after that. And knowing the European Union, this takes a long discussion. This takes a lot of, uh, committees and councils. This is maybe where I see a little bit of a problem.

So for the next years, I see still a wild west scenario where we can be in a very gray zone, same as we had it with crypto, same as we, uh, have it with, uh, blockchain and stuff. Because let's take crypto, uh, stock exchanges or the the revenue that you can make, or the speculation profit that you can can make, how to put taxes on it, et cetera. I think from that perspective, we are in a little bit of a AI wild West, but wild West is now romanticized.

We all like cowboy movies, right? So from that perspective, it's not a bad time, it's just exciting. It's definitely exciting. We're going to to dive deeper on some of the things that you mentioned already, but I think something that's very evident so far in this conversation is that yes, the speed of AI and the deployment and, you know, seeing it in the organization that is insanely fast. But identifying the risks and attending to them and getting governance in place and getting to a place where we can trust the AI, that is that is still in slow motion.

And I think that's where we see a major gap as well. Getting on to that whole maturity thing, there is a there's a California law that took effect in January of this year requiring all AI providers to disclose whether their training data includes any copyrighted or or licensed material. So that's one thing that we have going on. And then at the same time, we have Deloitte's latest enterprise survey that found that only about one in five companies do have that mature governance model for their AI agents.

So we're seeing a lot of things happening and it feels like everyone's just trying to to reach for some information or some data to just base their next decisions on. But what is it that actually needs to be true inside the organization for it to know it's using content and data in the right way?

How do we know that we're using AI in terms of our content and data in a way that won't get us in trouble? Do we know? Let's take the GDPR, a data protection situation. I think no company in Europe would say they are breaching data protection, right? They all have a data protection officer because it's in the law. They all protect the data of their customers as best as they can. They all, and you for sure, also got from time to time some email where you have to agree on some customer consent that something may be done with your data.

And still, the supervisor or the potential verdict is different in the end when they take a second look, right? So what I see right now is that reaching AI maturity is a very individual thing, a very individual thing depending on in which industry and in which status quo you are to get there. And when I talk about AI maturity, I'm talking about data maturity as the foundation. I don't want to always build this bridge back from AI, but AI is just garbage in, garbage out if you work in a closed loop or if you rely on the public data.

We also know that, uh, I think a majority of AI training data comes sometimes from Reddit. At least I saw some statistics that Reddit data is very much used because it's publicly available, it's very informal, it's very truthful what people think and what people say. But it's also the internet where people just say whatever they want without filters and without any, you know, yeah, quality assurance in between. So to get to the maturity, you need proper data in, and this means that you really have to understand that your organization is in a change management process.

And in a change process, you start with culture, you start with attitude, you start with literacy about the topics. And then, based on this, you can discuss roles and setups and accountability, and you can field committees and councils and processes, which all will not fly if the people that are working here together are not working in the same direction, having the same enabling wish and ambition to make things happen, and also the same understanding of the risk appetite and the wish of the use cases that you want to achieve.

You can have a huge risk appetite and say, screw it, um, we are going into using every bit we can just to make profit short term, because the moment when we are shut down by some governance, we already became millionaires, right? This is a proper attitude that you can have if you like this or if you want to have this consequence. Or you are very much following the law or a good citizen in the governance and say, good, I follow what is officially approved.

So I wait, I wait until it's set, and I wait until the AI Act is clearly written, and until then, I do nothing. And here we are again in this sweet spot that I mean. You should, for sure, prepare for your sweet spot by focusing on your people and investing in this change management aspect, meaning prepare for AI and data literacy courses, give, take away the fear of your people to get there, take away the fear of AI replacing me.

Make it visible and transparent what is possible and what makes an added value to you by knowing which problems you can tackle. Don't build solutions just for activism, right? Don't just have five agents because it's sexy and tell to your board of management how much you use AI. If you burn tokens and just have a huge bill on AI provider, nobody is proud of you. If it's not AI and it's just an Excel macro, then it's an Excel macro, right?

So nobody will punish you for this. So I have the feeling a lot of hype goes into this activism but focus on the problem and on the literacy and the people will have the maturity to discuss on a level that a good foundation is met people focus on data quality that gets in accessibility documentation roles and functions that enable along the process and then we talk about AI maturity which has a proper inventory of use cases a communication path a community that exchanges on the knowledge that is already established a knowledge hub to share e learnings and all these aspects that you know where your human is in the loop and where the AI takes over to solve a problem

that you have defined and not I'm just so cool because I have all the tools bought for a lot of money. I told you that in preparation for this podcast recording, I was very intimidated by the information that's out there on the topic and the laws that we currently have all over the world. And that made me think about, okay, we have this multinational compliance fragmentation issue, right? So can we argue that knowing what you're allowed to do is basically almost impossible when we have dozens of countries and vendors involved?

Like, is is full visibility a fantasy or is it real? Full visibility is always a fantasy, I think, because also these vendors want to make money. So if you have seen on on my LinkedIn profile, I'm also involved in certain advisory for certain AI startups or certain AI in i i i um innovators that are trying to offer an added value to certain customers without scamming them. And why I'm saying this, a lot of these things that are on the market are mimicking something that you can do very fast your own and or have a high price tag because a hype is is flying around.

Or they just use up that certain people are not there yet on their literacy and on their training that they could have in a few weeks. The the visibility also on what is the consequence of what I'm doing because the governance and the ruling is not yet fully lived or just so young that it just comes into the play is that we also don't have experience. Now I have the feeling more and more data protection experience comes up because now we have a few years already with high fines and verdicts and situations where people were discussing before legally how to interpret.

And I think we will come in this area as well when we feel safe, we feel everything is now popping up like mushrooms in the forest. A lot of use cases are working, a lot of things are fine. Um, and then the the the hammer of the governance will come and say, guys, you really overdid it, or guys, you really overlooked this. This thing that we meant because, but we didn't write it exactly as you maybe have interpreted it.

I think this will come. And in my current role of regulatory compliance, this is for me also the the biggest focus area on this when we have taken over the AI compliance part, because we're not the AI governance. The AI governance is fully set and we support from an AI compliance perspective, especially on the AI Act. The point is I need to be aware of what potentially is coming ex ante, right? So what the moment when I see other banks are fined or other companies are already failing a little bit in this hype, this would be my influence of say, guys, um, pull back a little bit.

You don't want to run in the same forest where, I don't know, the wolf eats you like the others did. And for this, visibility is key as much as we can get. So we have to be as close as possible to the news, to the regulatory monitoring, to the horizon scanning, what's coming in. So I think this is an investment everybody should do for sure, especially those, and we mentioned this before, those who took ownership, right?

So if you take topic because you want it, or you take accountability for implementing the AI transformation or DI strategy or whatever you have in your situation. If you take accountability, this is not for your CV. This is not to make you famous because it's now the biggest topic that flies around. And uh, I thought about when you invited me to this wonderful podcast, and I was so excited already thinking what wonderful exchange we will have.

It's really a topic for everybody out there, right? I mean, for the for the pure technical person, to the kindergarten teacher or whatever craftsman that is very hands-on in his daily life, it still affects this person. It still maybe changes his way of doing invoices or or researching something, or how his cell phone will work. It affects everybody. So taking ownership is something sounds easy because it makes you famous, it looks good on your CV, it makes you very much interesting, maybe on the recruitment market, but it is a responsibility.

This is really not just yet another tool. This is a big, big change, and the change management is something you only take if you know how change management works and what it means. And I think here organizations out there or also senior leaders out there when they put somebody in this position for example nominating a team or such people that they should really be aware that they don't overlook the boring part meaning being close to the law being close to the governance doing their homework and they are not just marketing the activism that I said.

Yeah so we're saying that and we're we're heading to the closing part of this conversation. So I want to make sure that we don't miss anything here right? So we've we're basically been saying that okay, we need to be able to order it, we need to be able to to take ownership and then the the visibility part as well. Is there a wrong order to do these three things in ordered ownership, visibility, or is it just figuring it out as you go and individual decision?

That's a wonderful thought. If you figure it out along the way, I think you will lose a lot of time and and money. But, and we all know this, the first thing that that dies first on the battlefield is the plan. So I think you should have some kind of a structure that you follow, but then you have to adapt very quickly to the culture of your organization. Again, it all comes down to people. This is not a top-down money decision, right?

It's not like now I give you debt amount of tokens and now everything is more efficient. If you want to save money on implementing AI, this is a restructuring project. This is a reorganization project. This is a deeply thinking in solutions for problems that you have and thinking would be the best streamlined processes. I don't think that any of these plans hold the moment the first use case flies off because then you have suddenly learned, um, who is interested, who is not yet there, who is blocking the whole exercise, how is the dynamics in the house about competition?

I would never underestimate the change management effort here on people and politics. People there again, and I come back to the ownership, are very easy to be first row on the stage, raising the hand, and then very, very bad in taking the accountability for it. With this, also the plan goes down, because if you, for for example, find out, and luckily we don't have this, and I never experienced this in my way, but I know it from peers and from others.

If you have very formal and strict, let's say, data protection colleagues that are blocking because the easiest way is to say no to everything, because then nothing can go wrong. You have nothing but the plan, so the plan will never fly. So you need also the right people with the right attitude, and this, I guess, you only know when you get also started somehow. Um, only only you know your organization very, very much, and I'm sure everybody does out there, not assuming anything negatively, but I'm also a realist, right?

And we are humans, and, uh, we have colors, and we have a lot of private color on the daily work and on the daily doing. So the investment on this people part, culture part, knowledge part, and awareness part is so essential, um, to make any plan happen, that I cannot emphasize this enough. And I I hope that my dear fellow listeners of this podcast smile now a little bit or are reminded of a situation of a former project that they had because this will be always the case and is not related to AI.

This is just related to how to get things done. Yes, how to get things done and how to get visibility on what's happening, how to think about visibility. I think that is, uh, great for our our content governance inside regulated environments. And as you said, it's not even just regulated environments. Everyone should be wary of this. Stefan, it's been wonderful having you on the show today. Thank you for giving us so much to think about and for giving us so much of your time today.

No, thank you, Yolandi, for listening and for asking me this wonderful question. It was a pleasure, and I hope it was interesting for the people who tuned in. Wrapping up today's episode, let's look at the three key takeaways from our conversation with Stefan. First, ownership and accountability for AI generated content need to be defined before, not after a compliance review. Second, most organizations have far less visibility than they assume into what they are actually permitted to do with their own data across vendors and jurisdictions.

And finally, acting on content risk ahead of an audit is far less costly than responding to one. Do you sell AI products or services? Emerj gives you access through trusted content and real conversations. Learn how leading AI brands like NVIDIA and Google Cloud work with Emerj to reach Fortune 500 AI buyers. Download our media kit at Emerj dot com slash AD one. That's E M E R J dot com slash A D one to download your copy.

On behalf of the team at Emerj, we'll see you on the next episode.