Responsible access to the data AI needs

Audio replay transcript

Fireside chat recorded on October 2, 2026

How do organizations turn AI ambition into business value while protecting privacy and building trust? In this frank fireside chat, Jan Kestle, President and Founder of Environics Analytics, and Khaled El Emam, Founder and CEO of Woodway Assurance, explored how responsible access to data can support better decisions, improve productivity and create business value. Their discussion covered regulatory uncertainty, advances in anonymization, independent privacy assurance and the practical challenges of putting AI to work. Lucy Mosquera, Chief Operating Officer of Woodway Assurance, served as MC.

About this transcript. This is an auto-generated transcript. Check against delivery.

Transcript

Lucy Mosquera 00:00:15

Hello, everyone. Welcome to our webinar today on Responsible Access to the Data AI Needs. We're going to get started in a few minutes after folks have a chance to join, so sit tight.

Lucy Mosquera  00:01:45

Good morning, everyone. Welcome. Thank you for joining us today for Responsible Access to the Data AI Needs. My name is Lucy Mosquera, and I am the Chief Operating Officer of Woodway Assurance. I'm very pleased to be here today as the MC for our webinar.

We are at a critical moment in the evolution of data and AI. Demand for data has grown rapidly, largely driven by AI. Robust, realistic data is needed both for the training of AI models and for organizations to use those models to generate specific insights and efficiencies in practice.

Advances in AI are making it possible to extract insights from data in ways that previously would not have been possible. Insights that would have required significantly more time, technical expertise and resources can now be generated easily using AI. This creates enormous opportunity to generate more value from data and to do it faster.

But it also raises important questions. What data can organizations use? What data should they use? And how do we make data more accessible without compromising privacy, trust or responsible governance? Those are the questions we're going to be exploring today, from both technical and business perspectives.

I'm very pleased to be joined today by Jan Kestle, President and Founder of Environics Analytics, and Dr. Khaled El Emam, Founder and CEO of Woodway Assurance.

Jan has spent more than four decades shaping how organizations use data responsibly, with a career grounded in privacy by design and rigorous data analytics. She founded Environics Analytics in 2003 and has built it into a company trusted by thousands of Canadian business leaders to use data and analytics to solve complex challenges and make smarter decisions. Her career has also included leadership roles at CompuSearch and the Ontario Statistical Centre, as well as contributions to Canada's broader data policy landscape through the Canadian Statistics Advisory Council and academic advisory roles.

Khaled is an internationally recognized expert in anonymization, re-identification risk assessment, privacy-preserving data sharing and medical AI. He's the Founder and CEO of Woodway Assurance, which applies AI to re-identification risk assessment and anonymization. He's also a Canada Research Chair in Medical AI at the University of Ottawa, leads the Ontario Medical AI Research Institute and directs the Electronic Health Information Laboratory at the CHEO Research Institute. Most recently, he served as Scholar-in-Residence with the Office of the Information and Privacy Commissioner of Ontario, supporting its work on modernizing de-identification guidance.

Before we get into the discussion, I want to make it clear how we're going to be spending our time together today. Throughout this webinar, we're intentionally going to have no slides. This is meant to be more of a fireside conversation, and we very much want the audience to be a part of it.

Please submit questions through the Q&A box throughout the session as Jan and Khaled are talking. We will be going back to these questions to make sure that we are spending time on the issues that are most relevant to you. We're going to follow the audience in terms of what issues you're finding most interesting and most pressing for your organization to explore.

This webinar will also be recorded, so if you want to share it with any colleagues afterwards, we'll send out the recording to you directly.

Over the course of the discussion, we're going to be looking at some of the practical challenges organizations are facing as they try to make better use of their data: uncertainty around privacy requirements, responsible access to data for AI training, the role of anonymization versus other privacy-enhancing technologies, the risks of model training versus inference and how credible evidence can help organizations build the trust their data ecosystem depends on.

To give everyone a little more context before we dive in, I'd like to start by asking each of our speakers to briefly introduce their organization and the work they do. Jan, perhaps we can start with you. Can you tell us a little bit about Environics Analytics and the role that data plays in the work you do?

Jan Kestle  00:06:16

Yes, thank you, Lucy, and thank you for having us. I think the best way is to start with the mission of Environics Analytics, which is to make Canadians' lives better and our clients more successful by using transformative data and analytics.

When we think about that, it's kind of obvious that a business that's been around for 20 years and serving a thousand Canadian customers would be interested in ensuring that our clients can use data and analytics to transform their businesses and lead to greater success for them. But it's also important to emphasize that we believe, as a company, and we've been committed since the beginning, to making sure that high-quality data, good methods and standards are used to make things run better, to make cities run better, to make communities run better.

I've been a mathematician for a long time, and I kind of think math makes sense of everything. I know that's not always true, but I do believe that the more we turn data into information and actually change what we do based on good data, the more we can come to successful outcomes. We say "activation," which might mean changing the way a program works or picking the right media. There are all kinds of ways to talk about how data can be put into action. And that's what we do.

We produce a very detailed set of data about people and places in Canada. We work with survey providers, government data sources and signal data, and our job is to put all that data into a framework that makes it easy for organizations to use. We have about 150 data scientists, about half of our staff, who work in the background to take disparate data, model it, safeguard it and put it into a framework that makes it easy for organizations to use.

Interestingly enough, although people often think of our role as serving businesses, banks, insurance companies, retailers, mall developers, telcos and car companies, about a third of our business goes to governments. That's because governments are also very interested in using data to really connect with Canadians and understand at the local level, because our data is granular and at the local level, what people do, what motivates them, what they care about and what they need.

In doing all of this and bringing a lot of different data sources together, we have to ensure that there's no contradiction between using data to make things more effective and based on informed decisions, and staying true to the trust of the people who gave data to governments, businesses and other organizations. There's no contradiction, in my view, in being able to do that.

As you said, we've been involved in that privacy conversation for decades because we really want to make sure the best data and the right data are used for the right purpose. But we also know that it's very important for organizations to maintain trust with the people who gave them that information. That's kind of our mission.

We have ISO Privacy by Design certification, which is different from just saying, "We're privacy compliant" or "We obey the laws." We've gone through rigorous audits and processes to ensure that the data we produce, like our PRIZM and our mobile movement data, meet the highest level of design and pass that ISO certification.

Yesterday, we got the results of our latest audit, which looked at how we use data blending inside clean rooms, which we can talk about later, and how we deal with de-identification and anonymization in our data collaboration platforms. I'm really happy to say that we got ISO Privacy by Design certification for that data blending function.

That is so important now that we have the power of AI to look at disparate data sources and help organizations get better outcomes. But we still have to make sure that however we're combining disparate datasets, it's done with the highest standards of safeguarding the data, making sure that it's used for the intention for which it was collected and that the consumer or citizen understands what we're doing.

We're very proud to have that extra level of certification and to be a company that wants to work with regulators. We're privileged to work with Khaled and Woodway because I feel that the work we're doing in marketing, government policy or other generalized data development can benefit from the learnings and the work that Khaled's done to the highest standard in healthcare. To the extent that we can take his advice and Woodway's advice about what to do and how to do it, if it's good enough for the healthcare system, then it's got to be good enough for our business uses. We're very fortunate to do that and excited to have this conversation today.

Lucy Mosquera  00:12:00

Thank you, Jan. That's fantastic news. Congratulations. A big theme of our discussion today is credible evidence, so certification is one really good example of how that can be applied in the privacy space. I'm thrilled to have you and your expertise here as part of the discussion today.

Khaled, I know you wear a lot of hats, but maybe you could take a moment to introduce Woodway Assurance and the problems you're trying to solve when you wear that hat.

Khaled El Emam  00:12:29

Thank you, Lucy. We're largely a technology company, and we develop technology to evaluate risk, mostly privacy risk. When organizations are implementing data pipelines, whether that's reusing their own data for secondary purposes, sharing their data with external parties or commercializing their data, they can bring a third party into the mix to evaluate and attest to that data flow and ensure that information flowing through it is not personal information. We see a lot of commercialization happening right now.

A lot of the organizations we work with are using data for training AI models and then deploying these models for internal or external use. They want to make sure that the training data is safe, that it's not personal information, but they also want to have some comfort that when these models are used for inference, they are not leaking information and that the risk of these models being attacked is managed. We act as a third-party evaluator for these data pipelines.

We also have technology to do the actual de-identification or anonymization. If or when the risk is found to be high, we can provide concrete recommendations on how to reduce that risk and bring it to an acceptable level.

The approaches we use, and I think we'll discuss this a little bit more throughout, build on best practices, existing standards and guidelines from regulators. I think that's important to emphasize. We are building on a large body of work from different organizations around the world, so we're integrating best practices.

We've also been doing this for quite a long time, so we've brought in a lot of experience over the years. That means we take a pragmatic approach. We know what works and what doesn't. We have a good sense of what are high-risk practices and what are low-risk practices, so we can tailor our assessments to manage the risks in a practical way.

At the end of the day, the value of data is very high, and organizations will use the data. We want to make sure that this is done in a responsible way. I don't want to jump too far ahead by talking about some of the things we'll cover, so let me leave it at that. That's the background on what we do.

Lucy Mosquera  00:15:32

Excellent. Thank you, Khaled. I believe you'll be starting us off with our first question.

Khaled El Emam  00:15:40

Jan and I spent a bit of time preparing and discussing the topics we wanted to cover today. We'll start with the first one, which is around regulatory uncertainty. We'll ask it from the perspective of our companies, what we're seeing with our clients and our observations of the market. It's essentially the same market, but from different perspectives.

How is this regulatory uncertainty affecting the ability of organizations to use their data? Let's start by focusing on the Canadian landscape: regulatory uncertainty within Canadian legislation and guidelines.

Jan Kestle  00:16:20

I think it's been a rough time for the past number of years. First of all, we welcome legislation, both Bill C-27, which didn't make it all the way through, and C-36, which is now tabled legislation. We do think it's extremely important for businesses and other organizations to have certainty.

Given that we had a bit of a hiatus and now have new legislation at the same time as we have so much potential for AI, we see more urgency for clarification to take place. We need a coming together of the finalization of some details in Bill C-36 with the consultation that's going on around AI frameworks, AI governance and AI policy.

Our teams have spent a lot of time with our clients and also directly with regulators and a number of organizations to try to be part of that conversation and identify the places where clarification is needed. We're also looking at harmonization because we're not just dealing with federal legislation anymore. Because our customers are often global, we're trying to help customers who have a perspective from Europe or the United States, who are doing certain things with AI or data where they need a Canadian version.

Right now, harmonization, global standards and some clarification in Bill C-36 are a focus. The sooner those things are clarified, the better. On the other hand, things like ISO certification and taking advantage of Khaled, Woodway and other organizations bringing the perspective of global standards to Canada have helped us help people move forward.

In terms of whether it's slowing us down, I see two really distinct patterns. Large and medium-sized responsible organizations that have trust centres, chief privacy officers and an AI governance focus are looking at external attestations. That's one of the things we did for our ISO certification. They're looking at global standards and deciding to move forward, ensuring that we're not moving forward based on just the existing law, but where we think it's going to be. There are a lot of organizations doing a lot of great things.

The other side of the coin is that the proliferation of AI has enabled a whole lot of entrepreneurs and startups to do some really cool things very fast. I talk to them every day. They want to use data and attach the data to the AI. When we ask them about understanding the provenance of the data they're using and the trust relationship, I would say it's sometimes uneven.

I worry that some people are moving too fast and other people are moving too slowly. The more the whole community can work with regulators, participate in consultations and get clarification on the friction points people are anticipating, the more I think it's going to help the bigger challenge: making us more resilient and helping Canada build its use of AI and data to make our businesses stronger.

The faster we can get to a good understanding of de-identification, anonymization, data blending, inference and harmonization across the federal and provincial systems in Canada, the more I think it'll help us move faster.

Khaled El Emam  00:20:47

You mentioned inference, so let me quote the definition of personal information in Bill C-36. "Personal information means information about an identifiable individual, including information that is inferred about the individual." The concept of inference is part of the definition of personal information.

This is also included in the Quebec regulations on anonymization, where the regulations define three criteria for data to be anonymous. One of the criteria is inference: ensuring that you cannot infer information about individuals.

The concept of inference is new, at least in a Canadian context. In a European context, the Article 29 Working Party published the anonymization techniques opinion in 2014, which included inference as a criterion. The European Data Protection Board, in its most recent guidelines, also mentioned inference as a criterion. This has been adopted in the Quebec regulations, and now the concept of inference is showing up in the federal Bill C-36.

When we speak to organizations, there is concern, or questions that may lead to concern, about how to interpret inference and how to operationalize it in a practical way. A brute-force or naive interpretation of inference is that if you learn something new about individuals from the data, then that's an inference, and therefore the data is no longer anonymous; it's personal information. But learning something from the data is really the whole point of having data.

There are much more practical interpretations of what inference means that will enable data use. One has to be very nuanced and build on the body of work that has been done around this concept of inference to be able to assess it and demonstrate that the risks of inference are low in the dataset.

I think that's an important thing to emphasize: don't be scared of inference. It's new. It's an added concept or understanding of anonymity, which is fair. But because it was introduced in the European context more than a decade ago, there's been a lot of work on how to operationalize this and make it work in practice. I think we've landed somewhere that makes sense. There are ways to evaluate inference risks that are reasonable.

We've implemented those metrics in our tools and our risk assessments. This builds on an existing body of work that has emerged over the last few years to make this concept applicable in practice.

Folks have mentioned that Bill C-36 introduces this, that it's new and asked what they should do. But, as I said, I think this is a solved problem. We know how to deal with this. It doesn't have to be complicated or of concern. As we're in the consultation on Bill C-36, I would say this is not a topic you'd want to push hard on because I don't see it as a practical problem.

The other thing in C-36 that I've been hearing as a concern is the definition of "anonymized." Again, I'll read the definition in C-36: "Anonymized means to irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified from the information, whether directly or indirectly, by any means."

Including the term "irreversible" has also created some concern because irreversible means zero risk. When I speak to some of my legal colleagues, they say, "If we apply this strictly as it's framed, then we cannot meet that standard."

In the context of other work we do, there's an organization in Canada called the Canadian Anonymization Network. We submitted some recommendations in the previous consultation period for C-27 around including "reasonably foreseeable risk in the circumstances" as an important part of the definition. That made its way into the current version, C-36.

The argument is that by including "reasonably foreseeable risk in the circumstances," we're essentially reinterpreting "irreversible" to mean something more practical. You have "irreversible" and then "reasonable." The idea is that the reasonableness argument overtakes or diminishes the irreversibility wording.

I don't know if that's convincing enough for the community, but I wanted to highlight that "reasonably foreseeable under the circumstances" is really important. It carries a lot of weight in that definition because it enables us to interpret the concept of anonymity in a practical way in C-36.

Jan Kestle  00:26:47

I think it's a super important point, Khaled. Canada's been a leader, and we're perceived as a leader in our privacy practices around the world. A lot has depended on the fact that our legislation has depended on the reasonableness concept. That's generally how academics, regulators and business people in Canada have interpreted and implemented PIPEDA and the Privacy Act.

I think reminding people that the reasonableness test is an important principle when looking at the new legislation is valuable. For us, we're in the data blending business. We take de-identified data from different organizations and help blend it together, create analysis and assure anonymization at the other end of that analysis so that people can take action by working together, whether they're public or private organizations.

Ensuring that we can continue to do that while having minimal risk of re-identification be the test is very important. Otherwise, businesses would not be able to do a lot of the things they've been doing for a long time and depend on.

Your voice and the examples you have from around the world on interpreting that particular part of anonymization are very important. We've reviewed your interpretation and talked to other experts, and we feel comfortable with it. But my perception is that there are a lot of people in the business community who need assurances around that. The more we can have that conversation and help people understand what it means practically, the more I think it's going to help the dialogue go further, faster.

Khaled El Emam  00:28:54

Yes, absolutely. At this point, when Bill C-36 is still under consultation and this government is pushing very hard to pass it, there are a lot of good things in that bill. It's not perfect. There are things that need to be changed, and I think there's limited capacity for a lot of changes. You can't suggest a hundred changes. I don't know, three or five or ten, but a small number of changes are likely.

I'd emphasize that it's probably important to focus on the bigger problems, and there are some in the bill, rather than the ones I just highlighted. I think these are practically not significant issues the way things are written. They can be operationalized in a very reasonable way based on everything we've learned. Focus on the bigger problems, not on all the problems, because time is running out and I think there's limited capacity to make changes.

Let's move to AI. We started talking about AI in the introduction and the first session. As we mentioned, a lot of both of our clients are using data to train AI models. Early on, Jan, you talked about public trust and maintaining a social licence to use data for secondary purposes. That's always been the case, but now it's also for AI, and there's increasing unease around AI in general, but also around using data to train models.

When AI leaders are talking about a 10% chance of humanity ending in the next few years, people are very concerned about what this means. There are actually two schools of thought. One is that AI is going to lead to humanity's extinction. The other is that AI is going to lead to utopia, where people don't have to work and can have a leisurely life because automation is going to create a lot of abundance. Actually, neither of those is a good outcome because you're going to have a lot of idle people at that point. But anyway, that's creating a lot of concern.

How do we maintain public trust in this kind of environment, especially when we're part of the ecosystem that's enabling this to happen and our business depends on enabling it to happen at speed? We're doing it responsibly, but how do we maintain the social licence to continue using data for these purposes?

Jan Kestle  00:32:03

Our experience so far is that you still go back to the first principle. When you collect data from people, particularly personal information and their behaviour data, whether you're a government, a not-for-profit or a business, you tell people what you're going to do with it. You have a trust centre, details around internal purposes and any external purposes, consent and frameworks that are a big part of the process by which data gets exchanged between Canadians and different organizations. I think those principles apply to how the data is going to be used.

We have two different kinds of data at Environics Analytics. We have the data we produce that has virtually no personal information in it. We create a consistent set of indicators for postal codes and license that to our customers. But we prescribe to our customers that when they use our data in internal models, our data must not get exposed to other users who can combine it with other data. They're using it for their internal purposes.

The other side is that some of our project work involves personal information that belongs to an individual customer. Sometimes two or more individual customers ask us to blend that data. That blending, not so much now, but certainly in the direction we're moving, involves using AI models.

To me, when we're using data that is personal information in AI models, it has the exact same restrictions as it had before we were using it in AI. In other words, did the consumer know? Did the consumer have the opportunity to prevent that from happening? Do we have governance inside our organization? Are there privacy impact studies?

I've got lots of people, particularly entrepreneurial people, who say, "Nobody's getting the data. We're just creating the patterns." If you're creating patterns of behaviour out of personal information that wasn't intended for that purpose, the disclosure wasn't there and you don't have an agreement to do it, then the AI should not be allowed to do it.

Organizations need AI governance and frameworks. How the data is obtained, secured, stored and shared all has to have a provenance and a path, with stewardship and governance policies inside organizations. That is how we're going to use AI to do a better job and make use of the data we can have, within a very detailed governance framework.

Organizations are spending a lot of time and energy developing best practices and processes, and some are doing it faster than others. I think the government's AI strategy and AI governance policy consultations can help everyone do that. But it comes down to the very same principle: a transparency, consent and disclosure framework applies to what you can do with data for training, in the same way as what we could do with data before we had the opportunity to use AI.

Khaled El Emam  00:35:51

One of the issues that has come up repeatedly, including in recent investigations by the Ontario Privacy Commissioner as well as the federal one, is transparency. To your point, how do we communicate all the good practices being implemented by our organizations, your organization and our clients? What's the best way to achieve transparency? That has not been clear, and various reports from these investigations indicate that transparency has been an issue.

Is putting information on your website enough? Is that enough to communicate that all these practices are in place, that the data is going to be used for these purposes, that it will be anonymized and that this will all be done responsibly? How do you communicate it? Do you put ads in the papers? Do you put posters on buses? What is your sense of appropriate transparency to the public when we're using their data in this way?

Jan Kestle  00:36:59

Lucy mentioned in her introduction the importance of audits and actual certifications. It's part of the content, not necessarily what medium you're using. It's not okay to just say, "We're privacy compliant," "We're privacy by design" or "We have strong AI governance." I think we have to actually have those authentications and certifications, which we have around Privacy by Design.

Now we're moving into using Privacy by Design to talk about not just content but processes. I think those audits and attestations are going to have to be available for organizations working with data and AI, and we're looking for government and organizations like yourselves to help with that badging.

But I think you raise a good point. There was an article in the Harvard Business Review about three or four months ago which said that privacy, AI governance and data stewardship have to be part of your marketing message, not just your legal defence and safeguards. We have to be proactive. We have to not only post it on our website but be part of conversations.

That's why, at Environics Analytics, we talk about it with our clients. We ask our clients who are doing a lot of data work to socialize their governance, safeguarding principles and use cases across their organizations. It's not just a technical conversation; it rises to a public conversation. There has to be data literacy, and there have to be data governance and AI literacy conversations.

I always say that if I go to a cocktail party and people ask, "What business are you in?" and we say, "We're in the data business," everybody wants to step back and say, "You must be one of those bad people." It's very important at this point that we address, with politicians and the public, that data and AI can be used for public good. It doesn't have to be used for bad purposes.

Many people, businesses, government organizations and academics are working hard to help the public understand the importance of data to making their lives better and making their communities work better. It's a collective endeavour for people in the data and AI space, particularly those who understand the fine technical points, to popularize those conversations and be part of a movement for public education on the role of data, how it can be safeguarded and how it really does make people's lives better.

Lucy Mosquera  00:40:05

I think navigating that fear and complexity ties really nicely to one of the questions we have. Are the risks associated with AI models the same across the board, or are there situations that are more or less risky?

Khaled El Emam  00:40:25

That's an interesting question. It depends. Of course, it depends.

You have open and closed models. We're talking about generative AI because that's the common interpretation of what AI means today. There are known attacks on models. If you have an open model, the attacks are much easier because you have access to the weights, you can run as many attacks as you want and the model developer doesn't really have the ability to impose constraints on those attacks. Those are more vulnerable.

With closed models that are provided as a service, more controls can be put in place to protect against these attacks. There can be contractual and technical controls: monitoring the prompts and how they're used, throttling and intervening if certain patterns are detected. The nature of the model and how it's deployed is important.

Then, of course, there's how the models are trained. Ideally, model trainers would perform some kind of red teaming exercise to attack the models themselves or hire people to attack them, to protect against adversarial attacks coming from outside. They would put the necessary safeguards and guardrails around their models before they're distributed and made available to a broader community.

It's not just the models themselves. It's what the model developers are doing during training and deployment to protect the models. There are many issues here. There are intellectual property issues, but there are also privacy issues. If you attack a model and can recover the training data, there may be privacy concerns that bubble to the surface.

This is part of what we're moving towards: developing and extending the concept of anonymity and privacy assurance to these different scenarios for model deployment. I think open models are much harder to protect, but certainly for closed models, you can put things in place and develop frameworks to manage the privacy risks from these deployment scenarios.

That's what we're seeing from our clients as well because they're using their data to train these models or providing data to external hyperscalers who are training models. Those risk management frameworks become very important moving forward. The question is coming up more frequently now than it was even three months ago. It's becoming a really important issue.

Jan Kestle  00:43:39

I want to jump in on another risk issue. Those are top of mind, and I support everything Khaled is saying. In addition, the statistician in me comes out here. What's really important is that the models do the best job of simulating reality.

Here's a concern I have. AI is really helping develop and test models and enabling us to do complex things. I'm talking more about machine learning and data development kinds of AI models. But there's also a lot of best practice around the right statistical or mathematical method to use to predict something.

One of the things that's concerning me lately is that I see amazing models and products using AI and doing a really good job of curating the data, finding and assembling the right data and automating processes. I say to people, "If you're predicting the demand for a certain kind of healthcare service in a certain area, can I talk to your methodologist to understand the actual standards and methods of calculation and prediction?" Sometimes I hear, "We're just leaving that up to the AI."

That would be okay if all the tried-and-true methods that researchers and companies had developed over the years, and all that intellectual property, were available. But the truth is that there are different ways to analyze different business problems, and sometimes they're more complex. What's fit for purpose? What's right for the problem you're trying to solve? What outcome are you able to take action against? That has to be part of it.

I'm a hawk, and I'm known for being a real stickler. It's security, it's privacy, but it's also best practice from a statistical point of view. People are spending a lot of money to try to simulate reality, to know what they should do about where they locate things, what kinds of programs they create and how they communicate with Canadians.

These are business and government funds being used to make things run better. If we're not taking a stand on best statistical, mathematical and standardized methods in the modelling, then it's not just garbage in, garbage out on the data side; it's garbage in, garbage out on the methodology side too.

That's a risk I think we don't think about often enough. We think about it a lot, but I think the general community needs to think about the quality and standards of methodology as well as what we're applying to the technology.

Khaled El Emam  00:46:52

Perfect, thank you for that. The last topic I was hoping we'd talk about today was the adoption of AI. Our tools and technology for risk assessment use AI. We are essentially an AI company, in the sense that we have AI technologies and tools embedded within our broader risk assessment framework.

We're still seeing a lot of friction in organizations adopting tools that have AI. It's getting better, but there's still a considerable amount of friction. There are multiple review cycles, which can take a long time, and it's not always clear what criteria are used for these reviews. These are often a work in progress, so the decision-making process within organizations to adopt new tools has been slow.

Part of this is that they have so much demand. Everybody's trying to adopt AI tools, so the backlog is not small. Notwithstanding that, the process itself is still very manual, and there's uncertainty about what criteria are suitable for deciding whether a particular AI tool can be adopted within an organization. Some are better at this than others.

There's a lot of discussion about the need to adopt these tools and optimize businesses. The tools can be used internally within companies to use their data, gain insights and help advance and optimize the business. If you're not able to use the tools, you're not gaining these benefits.

There's friction in the AI adoption process. I want to get your perspective: is that also something you're seeing? What do you think the next steps should be in trying to reduce that friction, especially in a Canadian context, but more generally as well?

Jan Kestle  00:49:12

Yes. Some of the things we've talked about already are contributing to it, including uncertainty in the regulatory environment. But for us, it's changing very rapidly. What we saw six months ago is different from what we're seeing today. Some organizations are showing significant adoption, but it's still a question of adoption for what?

You can't say you're an AI-enabled organization if you're taking meeting notes, planning agendas and creating PowerPoints. It's a good thing to do, but that isn't necessarily changing the productivity of an organization to reach its goals and objectives. I think the measures of AI adoption are still pretty unclear. When we talk to large and small customers, some think they have widespread adoption, but "AI for what?" is an important question.

The second question is whether this is C-suite-led. If AI governance is in IT, they may be doing a good job looking at the models and what to deploy and what not to deploy. But there's horses for courses. There are different tools for different purposes, and that's not necessarily well understood.

The third thing is the financial models, which there's been a lot of conversation about. If I go from this one to that one, all of a sudden I might get a big monthly bill my CFO didn't anticipate. People getting their heads around usage and how things are actually being paid for is very important.

But I think the real question organizations still have to get their heads around is: what is the measure of success? People are still working on that. We see a lot of organizations that started quite a long time ago with governance policies and more internal stewardship. They're now advancing to a later stage of using AI in ways that are really changing productivity. Other organizations that have done a very good job of socializing the tools and using them for general productivity are trying to move to the next step.

I'm very optimistic that the various financial and governance pressures are getting people to make decisions. But you have to remember that it's all happening in what we politely call the geopolitical circumstances of the trade war, economic pressures and economic uncertainties.

A lot of organizations are cooking dinner while renovating the kitchen, or whatever the thing is about flying the airplane. Organizations are generally resource constrained. A lot of people say, "How can I possibly take advantage of the productivity potential of AI when I still have my day job?"

We're seeing that organizations do well where they set up centres of excellence and have a concentrated focus on AI implementation to make the organization use AI effectively. That's in addition to people generally adopting AI across the board.

I think the next stage, to make us move faster, is a lot more intention, process, focus and KPIs from the top. We encourage organizations to make sure there is executive-level focus, measurement and resource allocation to AI. But the resource allocation for AI can't be on top of doing things the old way because people just don't have the money to do it.

Khaled El Emam  00:53:30

Great, thank you. Lucy, are there any other questions coming in? We're coming close to the end of our time.

Lucy Mosquera  00:53:36

Yes, there's one other question. This is specifically for organizations that have already started some AI adoption. Perhaps they've got transcription, meeting notes and some of the productivity tools you addressed, Jan.

You're at that adoption point, and you now start to look internally at your own data sources and want to start using those, maybe for training your own model or commercialization. How do you make that jump from working with a tool you've evaluated and brought in to starting to use and potentially feed your data directly to AI models for training? Where would you start?

Jan Kestle  00:54:23

Are you going to take that one? I'd start with "carefully." Last time, Khaled said, "It depends."

It's not practical for organizations to have every tool, yet some tools are better than others, so you have to have that expertise. You have to stay on top of the conversations and the financial side. It's not a case anymore where generalists can just say, "I'm going to use this model, and I'm going to use that one."

At the end of the day, for people moving from general productivity to really embedding it in their organizations to make a difference, number one, you have to be clear about the business outcome you're trying to solve for and what your current processes are. Take it apart. Look at the workflows. Then you have to have expert advice about the right tool for the job, as IT departments and analysts have done in the past. We have to really focus on it. That's as far as I'm going to go on that one.

Khaled El Emam  00:55:35

I think there are some easy wins. There are certain things where the adoption of these types of tools can be transformative for parts of the business. A simple example is software development. If you're an organization that's writing and developing software, some of the contemporary tools are just rocket fuel for improving productivity.

But this only works if you have professional developers doing it. Sometimes I see folks vibe coding without the appropriate background. They can get certain things done very quickly, but maintaining that is a challenge over time. Ensuring the security of the applications also becomes a challenge because that doesn't come out of the box. You need expertise to manage those things.

There are some easy wins, but as Jan said, when you move away from those, the rest of the journey is harder. It has to be deliberate and draw on all the things we've learned in the past about adopting technology.

I think the number of easy wins will increase. What's happening now is that the models being developed are consuming so much data about how things work, including how businesses run and how data analysis is done. Over time, I think these models are going to get better and better, and the list of easy wins will keep growing.

As I mentioned before, there are folks who predict doom and folks who predict utopia. In the utopian version, these tools can do everything because they've learned so much from the large volumes of data they've consumed about human activity that they can perform a lot of the same tasks just as well. We'll see.

Jan Kestle  00:57:45

Let me tell you about one example of a quick win in our organization. For the past 18 months, we were launching a new platform used by hundreds, almost thousands of users to get at our data. It was an old platform, and we had to modernize it. Part of that was changing a bunch of workflows from one approach to another.

We had to employ AI experts to work with existing programmers, actual coders, to get the AI to rewrite, I think it was, about 25,000 workflows. That was in data development, software development and data integration. We had to do it in a short period of time, and it was a really extensive project.

Once we did that and those developers and data scientists could see how the AI could work, it enabled them to adopt it in other parts of their work. But there was a very specific thing, with a timeline and a deadline, that had to be done.

If there's a business imperative, and the results of that business imperative can be applied to other parts of the work, people get really excited about what it means for their day-to-day work when they experience that transformational rewriting of code or automation of a process. Then that enables them to do something that can make the business even stronger.

Lucy Mosquera  00:59:18

I think that's a fantastic note to end on. As we've gone through the conversation, we've had a lot of good points brought up about the rapidly changing regulatory environment and how organizations have to be nimble to adapt and navigate the complexities of AI models, the data we're working with and the regulatory space.

That is a beautiful case study, Jan. Thank you for sharing it. It shows that, at the end of the day, there's a reason we're doing all of this. The business value and the opportunity of these technologies are absolutely transformative. In a past life, if you had to rewrite your entire 25,000 workflows, you just wouldn't do it. It would come to a point where it would grind your organization to a halt and cause all sorts of knock-on effects.

That's a fantastic note to end on. It shows that despite the complexity and the challenges we're navigating around trust, AI use and privacy, there's a reason for it, and there's business value that can be quite impactful across the board.

I thank you both so much for your expertise and for sharing in our webinar today. Thank you to everyone who attended and asked questions. It's always helpful having an engaged audience. After the webinar, we'll send out a recording if you want to share it with anyone who wasn't able to attend today. Thank you so much for your time, and have a great rest of your Friday.

Jan Kestle  01:00:41

Thanks very much for the opportunity. Thank you, Khaled.

Khaled El Emam  01:00:44

Thank you, Jan. Have a good day. Bye.