Blog

Talking with NVIDIA’s Chief Security Officer, David Reber, I asked the question on behalf of everyone who will never read a model card: since AI relies on data and algorithms, how can normal, non-technology people make sure the data and algorithms don’t have biases — especially when decisions might be based on the AI’s suggestion?

Read the question again and notice what it’s really asking. Not “how do experts audit models?” — there are conferences for that. It’s asking what the rest of us are supposed to do. The loan applicant. The patient. The job candidate. The parent. People who will live inside decisions made by systems they cannot inspect, built by companies they cannot call.

The uncomfortable answer: right now, almost nothing. And that gap — between the people who build AI and the people who are judged by it — is where the trust crisis of the next decade is already loading.

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. Every AI strategy deck has a slide about trust, and almost none of them answer the mortal’s question: how would I know? The companies that win the next phase won’t be the ones with the most powerful models. They’ll be the ones whose customers can verify, in plain language, why a decision went the way it did — because “trust us, the model is good” is a strategy with an expiration date, and the date is the first public failure.

Politics. Bias survives because accountability is a hot potato. The vendor says the client configured it. The client says the vendor built it. The regulator says the framework is coming. Meanwhile the person who got the biased decision has no name to call, no appeal to file, no standard to point to. This isn’t an oversight in the system. For everyone holding the potato, ambiguity is cheaper than accountability — until the lawsuit, the headline, or the law prices it properly.

Innovation. The genuinely innovative answer in that conversation wasn’t a new auditing algorithm. It was transparency as a design primitive: show how the system was trained, what it knows, where its knowledge stops — and pair it with constant testing and a feedback loop a human can actually reach. The innovation the mortals need isn’t explainability research. It’s a working phone number for the algorithm: a visible way to say “this decision is wrong about me” and have a person obliged to answer.

Culture. Inside most organizations, questioning the model’s output is still read as not being a team player — the analyst who flags a suspicious pattern gets asked why they’re slowing the launch. So the bias that a junior employee spotted in week two ships in week six, and surfaces in year two as a scandal everyone calls unforeseeable. Culture decides whether “the model might be wrong about people like this” is a career-enhancing sentence or a career-limiting one. Right now, in most buildings, it’s the second one.

Execution. So here’s the machinery, sized for mortals and the leaders who serve them: every consequential AI decision ships with three things — a plain-language reason, a human appeal path with a response deadline, and a published error-and-appeal rate, reviewed on the same calendar as the financials. Leaders: demand those three from every vendor, in the contract, before signature. Citizens: when they’re absent, treat the system’s confidence the way you’d treat a stranger’s — politely, and with your hand on your wallet.

Today, we ask non-technical people to trust systems they cannot question, built by institutions that cannot be reached. Tomorrow, the institutions that survive will be the ones that made themselves answerable before they were made to.

Ask yourself: if an algorithm made the worst decision of your life tomorrow, who exactly would you call — and is that answer written down anywhere?

Sources

CXOTalk Ep. 775, “NVIDIA’s Chief Security Officer: Managing Cybersecurity and AI” — my questions on cybersecurity habits and on how non-technical people can guard against biased data and algorithms (transcript): https://youtubetotranscript.com/transcript?v=jyt0O_XG4FE

I asked the Chief Security Officer of Expedia Group a question with a simple surface and a sharp edge: “GDPR is a good framework, and we know that the U.S. federal government is not going to jump quickly onto that level of data privacy — so why don’t companies just adopt GDPR themselves as a standard?”

If a regulation is good, and no one is making you follow it, and following it would protect your customers — what exactly is the argument for waiting?

The honest answer tells you everything about how privacy actually works inside companies. It isn’t blocked by ignorance. It’s blocked by arithmetic: privacy restraint costs money now and pays out in a disaster that might happen to somebody else, later, in a headline with a different company’s name on it.

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. Adopting a recognized standard voluntarily is a strategic asset disguised as a compliance cost. The company that builds to GDPR-level discipline gets one global way of handling data instead of fifty state patches and a prayer — and gets to walk into every enterprise sales cycle, every regulator meeting, and every breach headline already holding the high ground. The strategy question was never “can we afford to adopt it?” It’s “can we afford to be the company that explained why it didn’t?”

Politics. Here’s why it doesn’t happen: the benefits of voluntary restraint are diffuse and the costs are concentrated. The data team that wants to collect less has no lobby. The growth team whose targeting depends on collecting more has a quarterly number. So the organization drifts to the common denominator — the minimum the strictest current law requires — and calls the drift a strategy. Nobody decided against privacy. The incentive structure decided, and everyone else just attended the meeting.

Innovation. The genuinely innovative move isn’t a new consent tool. It’s flipping the default: treat GDPR-grade rights — access, deletion, purpose limitation — as a product feature you ship to every customer everywhere, not a legal burden you geofence to Europe. Companies spend fortunes differentiating on privacy in their advertising. Almost none differentiate on it in their data architecture, which is the only place customers can actually verify it.

Culture. Privacy culture is measured by a single test: what happens to the employee who says “we shouldn’t collect this” in a room full of people who want to? If that sentence requires courage, you don’t have a privacy culture — you have a privacy department, which is a different and much weaker thing. The department writes policies. The culture decides whether anyone reads them before the launch, or only after the subpoena.

Execution. So here’s the machinery, and none of it needs a law: pick the strictest standard you already comply with anywhere — for most global companies, that’s GDPR — and declare it the floor everywhere, in writing, with a date. Inventory what you collect against it and delete what you can’t justify; data you don’t hold can’t be breached, subpoenaed, or misused. Then publish the gap list internally and burn it down quarter by quarter, reviewed on the same calendar as the revenue numbers. Voluntary standards fail when they’re aspirations. They work when they’re schedules.

Today, companies wait for regulators to force tomorrow’s standard at tomorrow’s prices, under tomorrow’s headlines. Tomorrow’s winners will have adopted it quietly, early, and at yesterday’s prices — and will market the receipt.

Ask yourself: if your customers could see your data practices the way your engineers see them, would you still be waiting for a law?

Sources

CXOTalk Ep. 776, “Cybersecurity Lessons from the Chief Security Officer of Expedia Group” — my question on why companies don’t adopt GDPR voluntarily (transcript): https://youtubetotranscript.com/transcript?v=1M3O3w8DLLg

Related post on this blog (the government side of the same question): “Does the United States (US) Need a Federal Equivalent to the European Union (EU)’s General Data Protection Regulation (GDPR)?” (Sep 19, 2023): https://arsalankhan.com/2023/09/19/does-the-united-states-us-need-a-federal-equivalent-to-the-european-union-eus-general-data-protection-regulation-gdpr/

I asked Lynn Perry Wooten, the president of Simmons University, a question that makes higher education visibly uncomfortable: “It seems like students are your customers — hence the focus on customer experience. How do you think about that?”

Watch what the question does. In a business, “the customer” is an organizing principle: the person whose experience you exist to serve, whose departure you fear, whose feedback you instrument. In a university, the same word sounds like a surrender — as if admitting students are customers means the degree becomes a product, the professor a vendor, and education a transaction with a diploma at the end.

Both reactions miss the point. The question isn’t whether students are customers. It’s what breaks when an institution refuses to decide.

Look at it through the SPICE lenses — Strategy, Politics, Innovation, Culture, Execution:

Strategy. A university that won’t name who it serves ends up serving everyone’s second priority: rankings for the board, research prestige for the faculty, amenities for the brochure. Wooten’s answer points at the strategic alternative — the student’s transformational experience as the product. That’s a harder promise than satisfaction. A customer-experience strategy for a university isn’t “give them what they want.” It’s “design, deliberately, the experience that changes who they are — and measure whether it happened.”

Politics. The customer word is a turf war in disguise. If students are customers, students get a vote — on schedules, on modality, on what a degree should contain — and every one of those votes dilutes someone else’s authority: the faculty’s over curriculum, the administration’s over tradition, the alumni’s over what the place is supposed to remain. Institutions don’t reject the customer frame because it’s inaccurate. They reject it because it’s a redistribution of power wearing a vocabulary question as a costume.

Innovation. The genuinely innovative move isn’t a chatbot for admissions. It’s importing the discipline of customer-experience design — journey mapping, friction audits, feedback loops with closing dates — into an institution that has historically run on anecdote and prestige. Where does a first-generation student actually get lost: the application, the aid letter, the first semester, the advising gap? Businesses instrument those moments because churn taught them to. Universities mostly discover them at the exit interview that never happens.

Culture. Here’s the cultural trap: in higher education, caring too visibly about the student’s experience can read as caring less about standards — as if rigor and service were opposite poles. So faculty distance themselves from the “customer” language to protect their identity as scholars, and the student’s experience becomes nobody’s identity and therefore nobody’s job. The institutions that escape this trap separate the two cleanly: the standard is non-negotiable; the experience of meeting it is a design problem, and designing it well is a form of respect, not surrender.

Execution. So here’s the machinery: pick three moments that decide whether a student stays — the aid letter, the first failed exam, the advising meeting that never gets scheduled — and assign each one a named owner, a measured outcome, and a feedback loop that closes with the student, not about the student. Publish internally, every term, where students actually fell out of the journey and what changed because of it. You don’t need to call them customers to do any of this. You just need to admit that their experience is designed — by you or by accident.

Today, universities debate the word while their students quietly judge the experience — and transfer, drop out, or never apply. Tomorrow’s winners will have stopped arguing about vocabulary and started owning the journey.

Ask yourself: if your students reviewed your institution the way they review everything else in their lives — publicly, specifically, and forever — what would the rating say about the moments you never designed?

Sources

CXOTalk, “Simmons University President: Higher Education in 2022” — my question to President Lynn Perry Wooten on students as customers and customer experience: https://www.cxotalk.com/episode/simmons-university-president-future-higher-education

I'll say the quiet part out loud: your reskilling program is theater. And everyone — the employees clicking through modules at double speed, the managers quietly denying anyone time to learn, the executives presenting the completion stats — everyone knows.

Look at what gets measured. Course enrollments. Hours logged. Badges issued. Certificates downloaded. Every dashboard is green, every quarterly review applauds the "investment in our people" — and the skills gap sits exactly where it was last year, untouched. If the goal were new capabilities, someone would have noticed by now that nobody can do anything they couldn't do before the program started.

Theater needs an audience, and the audience was never the employee. It was the board deck, the press release, the ESG report. The program was designed to be announced, not to work.

That's the Culture problem, and it's the deeper of the two. A reskilling program teaches your people something — just not what's in the curriculum. It teaches them what the company actually values: the appearance of investment over the investment itself. It teaches them that learning is a compliance exercise, something done to you on a deadline and graded by attendance. And it teaches them the quietest lesson of all: that the organization would rather fund the illusion of growth than do the uncomfortable work of changing how work gets done.

There's a second cultural poison in the framing itself. Nobody wants to be "reskilled." The word sounds like repair — you're broken, we'll fix you, then put you back on the shelf. It's something done to people at risk, not something offered to people with ambition. So the employees who most need to grow avoid it, the ones who show up are the already-motivated, and HR reports record enrollment as if it meant engagement.

And then there's the manager layer, where every reskilling program goes to die quietly. The manager is told to champion learning while being held accountable for output that leaves no room for it. Guess which accountability wins. The employee who blocks two hours for a lab gets the look. The one who finishes the course goes back to the same job, the same metrics, the same manager who never once asked what they learned. Everyone's watching, and everyone absorbs the real lesson: growth is a hobby you're permitted on your own time.

Execution is where the theater becomes visible — because real reskilling looks nothing like a catalog.

Real starts from the work, not the course library. Name the three capabilities each team will actually need next year — the ones tied to where the business is going, not where the LMS vendor's content happens to be. Build the learning around those. Put it on the clock, in the sprint plan, with the same legitimacy as a customer deliverable. Make the manager accountable for the team's growth the way they're accountable for the team's output — same review, same weight.

Then measure the thing that matters: applied capability. Can the team now do the thing it couldn't do before? Not "did they finish the module" — can they do the work. I've never seen a completion-rate dashboard close a skills gap. And close the loop visibly: the person who builds the new skill gets the new role, the new project, the new pay band. Mobility is the proof. Right now the loop runs in reverse — learn on your own time, return to the same desk — and then leadership wonders why the ambitious ones leave for the competitor who will actually use what they learned.

None of this is complicated. It's just uncomfortable, because it moves reskilling out of HR's budget line and into the operating model — into managers' calendars, into promotion decisions, into what gets rewarded on Monday morning. Theater is cheaper. Theater doesn't require a single executive to change anything about how their organization actually runs.

So here's the honest audit, and it takes about ten minutes. Pull up your reskilling dashboard. Now answer: what can your people do today that they couldn't do before the program existed? If you can't name three specific capabilities, you don't have a reskilling program.

You have a very expensive slide.