Danny Tobey: At the Intersection of Law and Artificial Intelligence

0:00Hi, I'm Craig Smith, and this is Eye on AI. This week I talked to Danny Tobey, an attorney with the global law firm DLA Piper, which is at the forefront of the changing legal dynamics of AI. artificial intelligence. He talked about the current state of legislation and regulation, how regulatory bodies like the Federal Trade Commission are already tackling issues, and what the law firm of the future will look like as AI transforms the economy. Before we begin, I want to mention our sponsor, MetSuite by Oracle, a cloud-based enterprise resource planning software to help any business manage their financials, operations, and customer relationships in a single platform.

0:53For the first time in NetSuite's 22 years as the number one cloud financial system, you can defer payments on a full implementation of NetSuite for six months. No payment, no interest for six months. Take advantage of this unprecedented financing offer at www.netsuite.com slash I on AI. That's I on AI all run together. www.netsuite.com backslash I on AI. Now here's Danny. Why don't you start by introducing yourself, your background, what kind of law you've been practicing, and then I'll start asking questions from there. Sure. My background is fairly broad, which I think is why I ended up focusing on AI, because AI as a technology cuts across so many different areas.

2:05And I don't think it's a coincidence that the two heads of our AI practice, myself and Bennett Borden, both came from humanities backgrounds and social sciences backgrounds. Even though we eventually got into tech, we came up thinking about philosophy and economics and history and moral theory and all these really interesting aspects of humanity that are being flipped upside down by AI. So I really came to AI in a really organic way. I had this, on the one hand, liberal arts and humanities and social studies background. On the other hand, I was focused a lot on healthcare. I have a medical degree that I got with my law degree and have always focused on products, liability, and other issues in healthcare.

3:00So what are the ways that new biomedical technologies create risk? And then the third part of my background was I founded and ran a software company as a student, and it ended up being a multi-year project where I grew it and ultimately exited and sold it to a global publisher and then consulted for a number of years afterwards on the technology side. So all of these things kind of came together and I was representing clients in pharmaceutical and biotechnology space who were saying, hey, we're starting to think about artificial intelligence. What are the rules? And I said, well, that's very interesting.

3:42And I started researching and this was many, many years ago. I said, well, there are no rules. And that's very scary. And so I started writing on the question of AI and safety and liability, and how was AI going to challenge a lot of the rules that we have in place to keep products safe and to keep consumers well treated. And I realized that a lot of the assumptions we had built into the law, like human gatekeepers, weren't going to be around all the time as AI got more complex. And we needed a new legal regime that could keep up with this technology. And I've been working on that ever since. What's new at DLA Piper?

4:26I mean, have you sort of announced an AI practice or is this an evolution? It's an evolutionary leap for us. We have had what I would call a legal AI practice formally for the last four years. And really, a lot of us were doing it before that. But that was where we would go out and advise our clients on AI the same way we would on taxes or banking laws. And we would say, OK, these are the rules. These are the risks. We're going to help you set these systems up and have good governance, have compliance, same way we would any product. What we realized in helping our clients was AI was changing the way we were giving legal advice, and we needed not just to be giving them sort of words, but translating those words into math and technology.

5:19Because it's great for everybody to sit around and say, AI needs to be fair, and it needs to be transparent, and it can't have bias, and it needs to be reliable. well, yeah, we all pat ourselves on the back and say, great, we've come up with a list of AI ethics. But what does that mean? How do you know if your AI is fair? How do you know if your AI is ethical? How do you turn that into a quantitative test that you can put an algorithm under and say, yeah, we did it. This is a fair algorithm. So we have partnered with Duke and Stanford Law and a lot of thought leaders on this issue. And the big announcement we made a month ago is we brought in a team of about 10 lawyer data scientists.

6:07And this is a team that's been on the ground investigating AI. So now when one of our clients, say, a Fortune 50 company comes to us and says, we've got a thousand algorithms out in the field making, I'm making this up, say insurance, making underwriting decisions, algorithms deciding who's going to get insurance, whose claims are paid out and whose claims are subject to scrutiny. How do we make sure that's compliant with all these new laws coming out? Now we can say, okay, here are the laws and here are the controls that we're going to put in place. And actually, as part of our combined legal and computational support, we're going to help you investigate your algorithms to make sure they're actually hitting those marks and getting a clean bill of health or a good report card.

7:02And really the marriage of that computational legal practice and our legal advisory practice is unprecedented. I'm not aware of another law firm of this scope and scale that can provide the full package like that. So it is a phase change. And when you talk about the rules and laws coming out, are you talking primarily about state laws? Let's confine our discussion right now to the United States. GDPR is a whole other thing. But are you talking about state laws or federal laws and what is the pace of legislation either at the state level or the federal level that you see? Is this developing rapidly or not?

7:56And I have to say from the hearings that have been held in Congress, it's kind of appalling the lack of knowledge of this technology on the part of lawmakers, and I don't know how they're reasonably able to formulate laws without the underlying understanding, even though they have staffs that are talking to experts and that sort of thing. Well, it's getting better to give credit where credit's due. I think people on the Hill and at the state level are getting educated really quickly. I mean, the explosion of interest in AI just in the last few months because of generative AI and general purpose AI, I think it's a wake up call.

8:44And so I have seen a rapid education process in our politicians. But, you know, I have a lot of sympathy for regulators right now. I mean, AI may be one of the most unregulatable technologies in human history. I mean, you think about something with catastrophic potential like nuclear arms. it's relatively hard to make a nuclear weapon. You have to have the materials and those are highly safeguarded. It requires a lot of infrastructure, even if that infrastructure can be hidden, but there's barriers to entry. AI, I mean, processing power, of course, is a limiting factor, but it's not so hard for someone to pick up the tools, the basic ingredients of AI and repurpose them.

9:43And it doesn't take much to flip the switch from good to bad. If you have something that's maximizing wellbeing, stick your negative sign in front of it and you're suddenly minimizing it. And AI itself keeps changing. So I know we want to talk domestic, but we will be affected by the Artificial Intelligence Act that is in Europe right now and is the furthest along of all the efforts. And like GDPR, it's going to affect most Americans that are doing business with Europe or affecting Europeans. And they did a pretty good job over the last couple of years putting this regulation together. And then chat GPT comes out and flips the apple cart over.

10:33And suddenly a law that was really focused on narrow task-specific AI, the stuff we had gotten used to like, okay, do I get health insurance or not? Is this dot on my skin benign or malignant? The kinds of narrow focused AI that frankly was already blowing our minds because it was outperforming humans in some cases, they had a pretty good law directed at that. And now suddenly they have to ask, where does chat GPT leave us? Where does general purpose AI that is unrestricted and can comment on anything under the sun? How do we test that? How do we externally assess the safety of that? With the old fashioned AI, and it's hilarious, we can even talk about old fashioned AI, but with the old fashioned AI from say six months ago, we had really reasonable ways to talk about, is it working or not?

11:33We can say, well, this algorithm is going to spit out a yes or no answer. And we can talk about the false positive rate and the false negative rate and ways you can sort of tune between those two for appropriate trade-offs. And then you could say, okay, this is safe enough. And bodies in the United States, like FDA were doing a really smart job. They would say, look, what's the technology that exists right now before AI? It gets us, let's say, 90 % sensitivity and specificity. Okay, well, then an AI product needs to be at least that good. And if you can monitor it and make sure that it's staying above those quality levels, then it's probably a net benefit to patients.

12:21Well, now you got to think about a chatbot where any person can reach out to it and say, hey, diagnose me. What medicine should I take? What home remedies are there? It's just a whole different dilemma. So I'm very sympathetic to the regulatory challenge. And we can talk about some possible solutions. There are some. But to your question, is it moving quickly? Absolutely. Does it keep hitting these boulders falling onto the road of new technologies and new surprise outcomes that no one anticipated. Yeah. And that's going to mess with the pace. In the US, regulation is happening at the federal level, at the state level.

13:08It's a patchwork. The White House put out a really good blueprint to what they called an AI Bill of Rights. And on the bright side, it was a really thoughtful document. And it talked about some of the things that we all agree are problems right now, like biased AI. We all understand at this point that AI, like most things in life, is garbage in, garbage out. And if you take a bunch of data that's biased because historically we discriminated as a society, historically we only promoted certain people, we only treated certain people fairly, yeah, then your AI that's learning from that is probably going to reproduce those biases.

14:00And the White House was very smart and said, we need a solution to that. And other really smart ideas from the White House, like if you're going to be dealing with AI, AI needs to declare itself. It needs to say, hey, you're talking to a chat bot and this is generated in a certain way. So there were lots of good ideas and that set off a flurry of activity. So I think a lot of people know by now that NIST, which is the Department of Commerce, put out the first real voluntary framework across industries for US companies to think about. And they had a level of specificity that's good, that's new, and I think is helping people put tools in place.

14:46But you see proposed laws on the Hill talking about algorithmic accountability and impact assessments. You see laws that have already been passed at the state level in Colorado and New York and other places talking about insurance and employment and all kinds of ways that AI is making automated decisions about people's future. And then you've got the regulators. So FTC and other regulatory bodies have come out and said, look, legislative branch, thank you for the new draft laws you're working on, but we got to deal with this today. And we think under our current authority, we can be out there dealing with privacy breaches from AI and anti-competitive activity from AI and discrimination from AI and safety issues from AI, all fraud and overstatement of AI claims, all the things that AI is causing some mischief on right now, you've got regulators saying, hey, we've had tools to go after these for decades, if not centuries.

15:57So we're not waiting around for new AI shiny laws. We're going to start going after and enforcing these things now. So the answer is all of the above faster than anyone knows how to deal with it. So the legislative process is sort of clunking along. Is it following Europe? Because Europe has been much more responsive and sensitive to these issues, you know, even before AI, just on privacy, on digital privacy. Is the U.S. federal legislative process following Europe? And are there any laws that have been passed that are AI specific at this point? That's two questions. And then the third is, have you seen a surge of cases now that are relying on existing fraud laws and things like that?

16:59Yes. To the last part. So is the US following Europe? No, I wouldn't say that. I think it is moving more slowly than Europe, but I don't think that's a a following phenomenon, I think you're seeing a real cultural difference in how do we balance technology and regulation. You know, Europe has always struck a different balance than the United States on that. And you saw it with GDPR and you see it with the Artificial Intelligence Act. And I think the AIA, in some respects, is a reflection of European enthusiasm over GDPR. I think there is pride, and not wrongly so, that they set the agenda for privacy with GDPR and the so-called Brussels effect.

17:55they were able to craft a legislation that changed companies' behavior around the world. So I think there is an appetite in Europe to do that again with AI. The United States has always, I think, taken an approach that's more hands-off and that says, let's let innovators innovate. And we don't want to get in the way of that. And we want to regulate safety and key issues on privacy. But we don't want to impede our status in the world as being on the true cutting edge and leading. But there is some reaction now, and this is not following Europe. I think this is following technological developments.

18:47I think there's a recognition that the emergent properties of AI are potentially occurring faster than anyone predicted. And there's a great little example of this, but it's happening again and again. But Oxford surveyed a bunch of world-leading AI experts on when they thought AI would be the best human players at Go. This is obviously a couple of years ago now. And you got projections out into the future, decades. And then it happened in real life a couple of months after the survey. So that order of magnitude of misprediction, inability to predict how fast these technologies were going to advance, I think startled everyone.

19:37But then, for every example, there's a counterexample. There were articles many years ago saying, say goodbye to driver's ed. We're all going to be in fully autonomous vehicles by 2022, 2023. And that obviously hasn't happened, although there's great advances. I think my kids are still going to have to get a driver's license when they come of age. So it's just really hard to predict AI in both directions. We're usually either too soon or too late. We're rarely right. And I think what was really behind in some respect that the letter that came out recently with lots of signatures, and we can debate whether a moratorium on AI is even feasible, that may have been more of a expressive, notional letter than a real policy proposal.

20:40But they use the words emergent capabilities from black box algorithms. And that's an important word. I mean, emergent to me means qualities and abilities that we did not predict and that we don't quite understand how they're happening. And the ultimate example of an emergent ability is our own human consciousness. Nobody quite knows how you go from a few pounds of jelly and electricity in the brain to self-awareness and a consciousness. And while I don't think that is exactly happening at this stage from the electronic AI, I think there is a recognition among a lot of pretty sophisticated people that emergent properties, at least in a lesser extent, things we don't predict and don't quite know how it got from A to Z are happening.

21:45And that's worrisome when the tools are already so widely distributed in society. And to me, something that worries me is you've got systems that you want to be well-behaved and you say, okay, we've got them in a sandbox, but everything's connected to everything else. And AI is continuing to surprise us in its ability to maneuver through connected systems. So I think that's something that is catching a lot of people in politics as a security issue and as a safety issue. So I think people are waking up to that. Yeah. And I want to talk about the letter, but just on the current state of legislation, again, at the federal level, is there any concrete AI-specific legislation, significant legislation that's been passed on, you know, regulating what's allowed in terms of false positives, maybe, or explainability or any of these issues?

22:53the researchers are struggling with? Not on the level that we're seeing in states. So the states have put out the types of legislation that you're talking about. So an industry-specific law that says, okay, in insurance or with biometric data or with employment, you're going to have to follow these privacy safeguards. You're going to have to follow these anti-discrimination safeguards. And usually those look like forms of self-auditing. So, and there's lots of flavors of this, but the gist is you got to do design impact assessments when you're training and developing your models to show that you're thinking about those issues.

23:39And then once you've unleashed your algorithm out into the wild, you need to continually monitor it. and the laws disagree on how frequently or who does the monitoring? Is it within the organization? Is it external, third party? But that's the basic gist. At the federal level, not so much. There have been laws passed that speak to AI. That's what led to the NIST risk framework. That was a law from a couple of years back that said, okay, we are going to promulgate these voluntary standards. But so far at the federal level, it's really been more of an executive branch, both under the last administration and this administration saying, hey, agencies, here's the big picture problem.

24:34Go out and roll out these guidelines and rules within your jurisdiction. And so we're seeing a patchwork coming out from that. But again, rules, guidelines and regulations are not laws. So from your point of view, they're moot, right? I mean, you can't sue somebody for not following a federal guideline. Is that right? No, I would actually not call them moot. When you see some of the sizes of fines that have been levied already using existing jurisdiction and authority to reach some of these new issues. And, you know, what you see the regulatory authority saying over and over again is the same song, different verse.

25:25You know, discrimination is discrimination, whether it's an algorithm doing it or a group of people misbehaving. And some of these fines, you know, get into big numbers, tens and hundreds of millions, in some cases, billions. So not at all moot. And part of the legal practice is helping our companies make sure that they're doing things the right way so that when the regulators come around, they can say, yeah, we've really been thinking hard about this and here are the controls. Come in. I'm recording. Ah, apologies. Is that Beauregard? Yeah, yeah, that's Beauregard. Well, on that point, the fines, those are coming under, I would presume, state statutes.

26:20I mean, you can't be fined for not following a Miss Skyline or White House Bill of Rights. No, but think about, for example, the FTC. So the FTC has its mandate to make sure that consumers are not being deceived or treated unfairly. if someone is going around selling AI as magic beams, then they don't need an AI law to go out there and do basically a fraud investigation. Same thing with discrimination. So FTC came out there and said, I think they put it out in a tweet, actually. They said, hey, we have an existing mandate under Section 5 to prevent unfair, deceptive treatment of consumers. And by the way, that would include selling racially biased algorithms or using racially biased algorithms that affect consumers.

27:22So the message is loud and clear from the executive branch. They're not waiting for AI-specific laws. And rightly so. I mean, some of these things, whether you're selling a AI tool and you're saying it's going to make someone taller and handsomer and smarter or a toaster, you know, it's still fraud. But so I think where the federal legislative activity will come into play is really authorizing and in fact, mandating some of these controls that right now, to some extent, they're coming into regulatory and we can talk about that. But to say horizontally across the board, if you're going to put out an AI that affects people's basic rights to, you know, you name it, healthcare, a job, education.

28:21And if it's going to affect more than X people and more than X dollars, then you need to send quarterly reports to someone or annual reports to someone. And you need to disclose these risks per SEC regulations. You know, I think we'll see more directives that sort of cut across the board. What about certifications or licenses or that sort of thing, which seems to me you would expect that algorithms or AI systems have to be submitted to some expert body for testing? Where does that stand? Well, I mean, that's a very European approach in some respects, and it's certainly part of the contemplated regulation in Europe is that there would be a need to have things assessed and certified if they fit into appropriate risk levels.

29:22not all AI, but things that are captured by the regulation. You would have to get your independent body to put the stamp of European conformity on the product. It does happen to a lesser extent in the United States, but it's usually just because of our political appetite, it's often tied to some kind of federal dollars. So if you think about in healthcare, if you want your customers to be able to get certain incentive payments from HHS, then you have to have certain certifications of your technology that is qualifying. So there's usually some hook in the United States. It's usually not just a blanket.

30:12Everybody, all comers are going to have to submit to this inspection. I think one thing you'll see in the United States, almost for sure, is voluntary accreditation and certification. And that's, you know, that's more in line with, I think, political appetite and political philosophy in the United States. You know, I think we could have a healthy debate about where self-regulation works and where it doesn't. But I could see a free market of qualified certifying bodies that will put the good housekeeping seal on AI. and when AI is a consumer product, maybe that's something you look for. I think where the legislation has to come in is when AI is being imposed on us and we may or may not even know it, but it's making decisions about our life.

31:10That's where someone from above is probably going to have to say, does this pass muster? But my own law firm at DLA Piper, we're one of the founders with Mayo Clinic and Duke of the Health AI Partnership. And that's exactly what we're working on is, you know, helping hospitals have a way to tell good healthcare AI from bad healthcare AI. Because, you know, two Cadillacs can be nice and shiny from the outside and you can't tell the difference unless you know how to open up and look under the hood. And so we're working on voluntary systems to help train hospital procurement officers. Okay, they know how to pick a good CAT scan machine or a good syringe supplier, but they don't right now know how to pick a good medical AI supplier.

32:07And so we're creating curriculums to educate them on that. And then down the line, there may be a certification as well to say, okay, this is a qualified AI professional who can test and validate. So I think you will see efforts like that arising pretty quickly in the United States. What are the bulk of the cases that you guys handle? And are they plaintiff cases or defendant cases? And which side do you generally find yourself on? Well, we're an interesting case because most large law firms tend to be defense firms historically. And certainly that's the case for a lot of what we do. But we do have an affirmative litigation practice that's fairly interesting and innovative where, you know, it has to pass a committee and it has to be carefully vetted.

33:06But there are cases where we will be bringing affirmative litigation on behalf of pretty large clients, not typically single clients, but our institutional clients where they do need to bring a case. And we will do that if the circumstances are right. With respect to AI, we have seen really interesting litigation. As a firm, we have worked on class action cases involving the insurance industry and allegations of algorithms that were allegedly producing biased outcomes or using variables that ran afoul through proxies and other things. things like that. We're helping a client right now think about products liability litigation for AI enabled products.

34:06And then there's IP litigation involving AI that we're seeing. Some of that is infringement. And then some of that is what about content that's been created using AI. and we have clients who are very concerned on all sides of that issue. We have content creators who are worried about generative AI using their content to create new content and how does that get traced back to the original. But then we have very well-known generative AI clients who are thinking about it from the other perspective of fair use. And every artist creates new art by looking at the artistic milieu of their time and the great artists that came before them.

34:55And how is this different? And these are questions that are being actively discussed and litigated. And so I would say, you know, we have a very dedicated products liability practice. And I mean, I think AI products liability is the next wave of products liability. And we're thinking very deeply about that and working with clients on it. Yeah. And the applicable laws in those cases are the existing liability laws or existing fraud laws, which bucket does it tend to fall into? Well, it can be all of the above. So for example, disputes over AI transactions, you will have representations and warranties about what AI can and can't do.

35:49And I can tell you in boardrooms across America, we're hearing what are we doing about AI? Are we falling behind? You know, the statistics on the number of companies in America that have already adopted AI or are exploring it, it's well above 50%. It's extraordinary. And private investment doubled in the tens of billions into AI over the last, from I think, 21 to 22. So everybody is getting marching orders to go out and acquire good AI products. And some of those deals are going to go poorly. What's so interesting about our practice is we have the lawyers who have done these sorts of computer-related transactional litigations, and then we have the data scientists who are also lawyers on our team, because a lot of times we really have to get in there to understand where did the software, where did the algorithm go wrong to breach this representation and warranty if it did.