Join Troutman Pepper Partner Chris Willis and Counsel Shannon Patterson as they discuss the top issues a company's board of directors needs to consider regarding the use of artificial intelligence (AI) in its business.
Join Troutman Pepper Partner Chris Willis and Counsel Shannon Patterson as they discuss the top issues a company's board of directors needs to consider regarding the use of artificial intelligence (AI) in its business. Shannon specializes in advising companies on board and management governance issues, particularly publicly traded companies, to ensure that boards are well-informed of their responsibilities. In this episode, Shannon offers valuable insights on how a company's general counsel can support its board in integrating principles of good governance for the responsible and effective use of AI.
The Consumer Finance Podcast: The Role of General Counsel in Advising Boards of Directors on the Use of AI
Host: Chris Willis
Guest: Shannon Patterson
Date aired: November 30, 2023
Chris Willis:
Welcome to The Consumer Finance Podcast. I'm Chris Willis, the co-leader of Troutman Pepper's Consumer Financial Services Regulatory Practice. And today we're going to be taking a really unique look at AI and particularly corporate governance issues related to AI. But before we jump into that topic, let me remind you to visit and subscribe to our blogs, TroutmanPepperFinancialServices.com and ConsumerFinancialServicesLawMonitor.com and check out our other podcasts. We have lots of them. We have the FCRA Focus, all about credit reporting. We have Unauthorized Access, which is our privacy and data security podcast, The Crypto Exchange, about everything related to crypto and our newest podcast, Payments Pros, all about the payments industry. And all of those are available on all popular podcast platforms. And speaking of those platforms, if you like this podcast, let us know. Leave us a review on your podcast platform of choice and let us know how we're doing.
And if you like our thought leadership content and want a really handy way to get all of it in one place, check out our new mobile app. It's available for both iOS and Android. Just look for Troutman Pepper in your app store and you can find, within the mobile app, all of our blogs, all of our alerts, all four of our podcasts with ability to listen to them right there in the mobile app, plus a great directory of our people and a handy calendar that tells you what conferences we'll be appearing at and attending. So do check it out. Like I said, it's available for both platforms. Just look for Troutman Pepper in your app store. Now, as I said, today we're going to be talking about a unique AI issue. I feel like everybody talks about AI all the time and it's warranted because it's important, but today we have a special conversation from the standpoint of corporate governance.
And to have that discussion, I'm joined by my colleague, Shannon Patterson, who is one of our corporate lawyers. But Shannon's specialty is advising companies on board and management governance issues, particularly if they're publicly traded companies, to make sure that boards of directors are kept apprised of their responsibilities, but also kept safe in the sense of being criticized for not doing their jobs correctly. Shannon, thanks for being on the podcast today.
Shannon Patterson:
Thanks, Chris. It's great to be here.
Chris Willis:
Everybody, as I said, talks about AI all the time because it's the technology that's being adopted sort of across the corporate world for a variety of purposes. And at least my experience within the financial services world is that the adoption of AI gets driven from the bottom up. So, from the more technically minded people who, for example, create credit models or create customer service chatbots or things like that, and they're driving the capability up from that part of the organization. And so there may be an opportunity for boards to be kind of left in the dark about what's going on with their company's adoption of AI, but it's such a high profile visible public issue that surely that's not the right way for boards to go about it. How is the governance world, your world, talking about AI right now and what are governance professionals like you thinking the issues are with respect to this issue as it relates to a board of directors?
Shannon Patterson:
Those are great questions, Chris, and your bottom-up description of how this technology gets deployed in real world situations is exactly accurate. First, I want to start off by saying I love governance. It's about helping a company organize its internal practices so that it can make business decisions more efficiently, it can run its processes more effectively, and it also keeps the company straight with its stakeholders and its regulators. So, for all these reasons, it's one of my favorite things to talk to our companies about. And this is a great time to be having this conversation because I feel like we're sitting at a really interesting moment right now. We've got two factors that are coming together. The first is that the role of boards of directors and the nature of directors' responsibilities has been in the spotlight in a really unique way in recent years.
This is true not just with large public corporations, but with companies of all shapes and sizes. And it's particularly true for companies in a highly regulated industry like financial services. So, companies and their directors are asking themselves questions about the proper role. It's not just about maximizing profits anymore for a corporation. Companies are taking into account other stakeholders beyond just their employees, their investors, their customers. They're really looking at how they relate to their communities as well. So, you have this bigger focus on the role of directors in general. And the second factor is that the pace of development of this technology is really staggering. You have a real potential for the technology itself to be outpacing the governance guide rails that are in place, and that's what makes this question so interesting at this particular moment.
Chris Willis:
So Shannon, that sounds like something that boards really need to be attuned to and address. Are there any recent other sort of rapidly moving issues for corporate America that this has parallels to?
Shannon Patterson:
That's a great point, Chris. We've seen similarities in other major issues of corporate governance, both globally and here in the US. The use and protection of business data and information systems and the rise of data as a commodity really spurred directors to educate themselves on their own internal use and systems of that technology and to start to include cybersecurity as an enterprise risk management issue that they recognize as belonging in the boardroom as opposed to being an IT or other technical issue to work through. And we also see similar echoes in the context of the recent focus on environmental, social and governance issues in the US. This is part of what I was alluding to earlier, where you've got real initiatives that relate to sustainability, ethics, human capital matters, all of these timely topics include business elements that can impact the long-term growth and value of a company.
They have also impacted how boards of directors structure their internal decision-making processes, how they structure their board committees, and even how they identify and evaluate which are the right directors to serve on their boards. The business and governance issues related to a corporation's use of AI are following the same course as these other major governance issues that we've seen recently. They're following the same course as cyber and ESG, but it's happening on an accelerated timeline here.
Chris Willis:
Well, issues of corporate governance and particularly the board of directors are always, I think foremost in the mind of general counsels because protecting the board is one of the most important things that lawyers can and should do with a company, particularly a publicly traded company. So how should general counsel be thinking about this for their respective companies?
Shannon Patterson:
Chris, I think the best way that GCs can be thinking about this in terms of guiding and protecting their directors and their companies is to help the directors think about satisfying their corporate fiduciary duties under relevant state law. Here in Virginia, as in Delaware and many other jurisdictions, the core fiduciary duties that directors owe to their corporation and to their investors are the duty of care and the duty of loyalty. And these concepts also include the duty to oversee the company's business and their management. So the duty of care really focuses on whether a director is properly informed about the matters he or she's considering and acting with the appropriate level of carefulness and thoughtfulness. When I think about the duty of care, what I think about is a director who is curious, who's engaged, and who's informed about the matters that are coming before him or her.
In addition, the duty of loyalty sounds deceptively simple upfront, right? A director has to act in his or her company's best interests, in the best interest of the company's investors, has to be fair and truthful in dealings with the company and really has to keep an eye on things and watch out for red flags. That's part of that duty of oversight that the directors have. I think of the duty of loyalty as being a navigational beacon, the best interests of the company and its investors have to be the true north that helps the directors guide the direction in which they're steering their ship. And so this translates into strategic decisions and how the risks, especially risks to mission-critical functions of a financial services company, how those risks are going to be managed.
Chris Willis:
So let's take this sort of general principles that you mentioned a moment ago, the duty of care and the duty of loyalty. And think about it in a more practical sense because I'm a practical person and I think our clients are practical as well. So how do these two sort of guidepost duties translate into practical discussions or decisions at the board level about a company's use of AI?
Shannon Patterson:
Chris, it's about the company being intentional in how it approaches AI and covering all of its bases. So not just with investors but with their customers and with their regulators too. So management and the board have to have their arms around the company's current uses of AI, and they also need to be thinking about future opportunities and of course need to be considering the attendant risks. And they've got to do it all ethically and in an evolving landscape. So it's a lot and GCs have an important role here to make sure that their directors are following the right processes and also and importantly, making sure that those processes are being properly documented in the company's internal records. Some of the most common uses in financial services are going to be areas that your listeners are already very familiar with, credit decisions, underwriting, the use of AI in fraud detection in banking, and also as I think you mentioned earlier, the use of customer service chatbots and other features that enable financial services companies to interact with their customers more efficiently.
The benefits of using AI are clear. You can work through huge data sets. You can also reach people who are outside of the traditional banking system and you can make your decisions more effectively, more efficiently and serve those customers more quickly. And even outside of the lending and other contexts that we often think of in terms of AI and financial services, AI also has huge potential opportunities internally in maximizing support functions. Also, your employees may be using it as well. All of these opportunities that are really unprecedented in a lot of ways, even though machine learning has been around for a long time in the financial services industry, it looks like where we're going now is really into an exciting and in some ways uncharted future. So being forward-looking and thinking about the potential opportunities is a big part of this. You have to have your arms around what's already there in the company, but also be thinking about what's not there yet, how you may be able to use AI to execute on strategic business objectives, to keep up with what your competitors are doing and to look for new potentially disruptive uses that can provide your company with a competitive advantage.
So all these potential opportunities are huge, but the risks that come along with it are equally large. When you think of the board of directors as being the captain that's steering the ship and management as executing that day-to-day strategy, part of steering the ship is knowing where those rocky shoals are that need to be avoided. And so, taking the approach of including AI in your enterprise risk management system is really going to be important for directors. The use of AI exposes a company to tons of risks. First, and something that I think is interesting, and I've heard you speak about this as well, Chris, is that companies are really operating without a uniform, legal or regulatory framework right now.
Chris Willis:
And I think that will persist for the foreseeable future, by the way.
Shannon Patterson:
Right. So, what's a company supposed to do? It's got to piece its guardrails together around known entities like consumer protection, privacy, unfair and deceptive business acts, and that is a tricky way to structure the development and deployment of such an important piece of technology. Another huge issue for financial services is that risk of embedded bias. I know this is something that you talk to your clients about on a pretty regular basis and how it's so important for companies to remember that that bias can show up in both the inputs and the outcomes. Chris, what are some of the ways that you talk to companies about how they can address these risks?
Chris Willis:
Well, I think primarily as it relates to each of the areas in which they're going to put an AI or machine learning solution into production, it means having a good sense for what the thought process of regulators, politicians, the media consumer advocates are in terms of what the points of potential criticism are for the adoption of the technology in a particular area like credit underwriting or fraud detection, for example. And then designing the process to create the algorithm and test the algorithm in simple terms to address those potential areas of criticisms so that when the algorithm, for example, is to put into production, then the company already has a fully baked, very defensible position that takes into account what we know now are the common areas of criticisms of the use of the technology. That to me is the way to go in the absence of the prescriptive guidance from regulators that we're not going to get.
Shannon Patterson:
I think that's exactly right. And that process that you just described there is exactly the type of thing that GCs want to make sure are reflected in the corporate records so that in the event you have a state AG that says they want to have a chat with you or the DOJ wants to come knocking, the company can be an open book. Yes, not only have we considered this, but it's important to us and the importance of this issue is evidenced in the way we talk about this on a regular basis at board meetings, in the way it comes up with our discussions with management, and we'd be happy to share with you, Mr. Regulator, all the ways that our company is putting into practice those really good processes that you've described there.
Chris Willis:
And Shannon, if you'll just permit me a little editorial aside here, just directed to our listeners, one of the great joys of being at Troutman Pepper is that I have colleagues in all the different areas of our firm who are specialists in advising financial services companies. And Shannon is a great example of that, because Shannon's a corporate lawyer, but you've just heard her talk in a very informed way about the use cases of AI in a financial services company and the consideration specific to boards of directors for financial services companies. And I just have to say it's a wonderful experience having the support of colleagues that deal with every aspect of a company's business to be specialists in financial services companies like Shannon is. So with that little editorial aside, let me just ask you to continue, Shannon, and you talked about what general counsels can do to essentially position their boards correctly on this issue. Can you give some specific recommendations for the things that general counsels should be thinking about as they advise boards and management on how to have governance around the adoption and use of AI solutions?
Shannon Patterson:
Yeah, that's a great question, Chris. And I think number one is going to be education. We saw similarities when cyber became really important to directors, and we saw some reluctance on the part of some directors to fully engage and lean into these discussions, partly because they were a little fearful of talking about the technology. So one of the things that I think GCs can do to really support their directors in these types of conversations is to help them develop a common language with management and with the technical personnel, your engineers, your model designers, help your directors have the right language that they can use to understand and discuss these technical concepts because sometimes you have to get into the weeds with them, and you want your directors to be comfortable in discussing these terms and understanding what they're hearing when they hear from technical specialists.
It's also super important for GCs to make sure that their directors are focused on understanding and looking for the business opportunities in the financial services sector because all of this goes to the second practical point, which is that it's really important for GCs to guide the directors in approaching this as a strategic balance. You need to be able to evaluate and determine the company's comfort zone, its particular sweet spot, in between establishing guardrails and governance prescriptions and permitting innovation. Really that freedom to innovate is part of what makes AI so exciting for all of us. And then using the board's decisions about the strategic direction in which it's going to be steering this AI ship to determine the appropriate governance structure. Do you have the right individuals with the right comfort and fluency in technology to serve on your board of directors? Not everybody has to be a computer science expert or a modeling expert, but does the board as a whole have the necessary background to oversee and understand the technological issues that come along with the use of AI?
Do they have the necessary background to oversee the use of AI as part of their enterprise risk management approach? Are there any capability gaps that it may be in your interest to fill? Is there additional expertise that may be helpful to have on the board of directors? And also, which members of management have the primary responsibility for AI? And how is information flowing within the organization to make sure that the board is kept in the loop appropriately? Another practical consideration is whether there is a way you can leverage existing workflows within your organization to the extent you need to build expertise on the board?
Can you build from an existing board committee that already has primary responsibility within the organization for technological issues? Can you build and leverage off of some of your existing management groups and board committees in order to make sure that the board is being looped in effectively? Are there ways to make this lift a little bit smarter and easier on your company? And a big one I think, is for GCs to remind their directors of the importance of taking a look at those internal policies and procedures that companies have. Chris, I'm sure that you have some thoughts on how you think regulators like the FTC and the CFPB tend to approach AI and financial services companies.
Chris Willis:
Yes, I would say charitably they're skeptical about the adoption of it in the financial services industry. For example, the current chair of the Federal Trade Commission, Lina Khan, made a public statement earlier this year in which she said that the use of AI can "turbocharge fraud and automate discrimination." So, I think there's healthy skepticism among the FTC, the CFPB and other regulators about anything to do with this technology.
Shannon Patterson:
That's right. And with language like that coming from the regulators, you want to make sure that as a company you're doing everything you possibly can to encourage any of your employees who have concerns about the way AI is being developed or used at your company, you really want those employees coming to you internally first. And so, it's very important that you're taking a look at your internal policies and procedures, making sure that you're creating a culture where your employees are comfortable discussing concerns with you and where you're not going to have them scurrying off to the regulators before they even come to you with their concerns.
Chris Willis:
Well, and in that vein of course, our readers would notice that at the bottom of many, many public statements by the CFPB is an invitation for whistleblowers to contact the agency if they detect any wrongdoing within their organizations. I mean, I think I see that from the bureau nearly every day. You're very right to point out the necessity of trying to encourage that conversation to occur internally within the company because the regulator's out there begging for whistleblowers to come forward.
Shannon Patterson:
You're exactly right. And wouldn't you prefer to have that conversation with your employee first? I think the last practical suggestion is for GCs to make sure that AI is included as a regular agenda at your board meetings, that the directors are getting updates for management on both the internal use as well as the greater use in the industry across the board so that the board can keep an eye on these uses and the potential opportunities that might be available to them to capitalize. Also, to make sure that your directors are getting regular updates on the legal and regulatory developments in this space. Chris, I know you said that it's probably going to be a while before we get more definitive guidance. So, in the meantime, a lot of companies are just keeping an eye, not just on state and federal regulators within the US, but also keeping an eye on what they're doing in the EU and what they're doing in other countries where companies may have employees, customers, or service providers.
So, it's always good for companies to make sure that their directors are updated regularly on what's going on in this quickly shifting legal and regulatory landscape. And then finally, to make sure that you're discussing and documenting how the directors think about AI as part of their risk assessments and the steps that they are taking to continually monitor the development of risks in this area because those are coming at us fast too, and making sure that management has in place the proper functions to be able to address and mitigate those risks in basically real time as they arise. Very important for boards to be very nimble on this front, and I think that there's a great opportunity there for GCs to help them gain that agility.
Chris Willis:
Shannon, this has been a terrific conversation, very informative to me, and I'm sure to our listeners as well. But if our listeners are interested in more in-depth discussion of this and other corporate governance issues, the corporate group, and you in particular, have an event coming up, and I'd love for you to tell the listeners about it.
Shannon Patterson:
Yeah, thanks, Chris. We're so excited about this. On December 7th, our corporate group is going to be presenting our annual Public Company Seminar. We do this by webcast so that clients, listeners, and friends of the firm can join us for an afternoon's discussion of lots of hot topics in corporate governance. At this webcast seminar, I'm going to be spending some time doing a deeper dive on how the use of AI really affects and informs a company's corporate governance design. We'd love for you to join us, so check out our website troutman.com. There's more information about the upcoming event there. And also, please feel free to reach out to me directly. I'd love to talk with you about it.
Chris Willis:
Well, that's great, Shannon, and I really appreciate you sharing your knowledge and expertise with our listeners today. And of course, thanks to our listeners for tuning in as well. Don't forget to visit and subscribe to our blogs, TroutmanPepperFinancialServices.com and ConsumerFinancialServicesLawMonitor.com. And while you're at it and while you're signing up for the Public Company Seminar, also go over to the Troutman.com website and sign yourself up for our Consumer Financial Services email list. That way you'll get copies of the alerts we send out and invitations to our industry only webinars. And as I said, if you like our thought leadership and you want a great one-stop shop to get all of it, check out our nifty mobile app available for both iOS and Android. Just look for Troutman Pepper in your app store. And of course, stay tuned for a great new episode of this podcast every Thursday afternoon. Thank you all for listening.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.