[RADAR 11x] Responsible AI for The Modern Workforce

Summary

Three executives spent forty minutes arguing that responsible AI is not a side project, and the argument held together from three different angles.

At RADAR 11x, host Claire Williams pressed Sam King, CEO of Nasuni, Ojas Rege, SVP of Emerging Products and Technologies at OneTrust, and Carolyn Duby, field CTO at Cloudera, on how companies should identify AI risk, govern their data, assign accountability, and keep pace with regulation without waiting for it. Their answers converged on a theme: the organizations in the news for the wrong reasons are usually the ones that let a powerful AI tool run further than anyone had planned for.

The panel moved through a risk framework for prioritizing which AI use cases deserve scrutiny, the data and authorization gaps that keep surfacing when agents get deployed, why no single person can own AI accountability, and how to train a workforce on a technology that produces a different result for every person who touches it. They closed on a practical note: pick a technical skill and a soft skill, and spend the next twelve months on both.

Key Takeaways

• Rank AI risk on two axes at once: how much damage a failure would do to the business, and how much it would affect real people's lives through decisions like hiring, lending, or healthcare.
• Unstructured data is the biggest blind spot in most AI rollouts; companies that cannot say what sensitive information lives in their files cannot safely connect those files to a model.
• An AI agent gaining access to data it should not have is not just a bug to patch. It is a signal to audit the entire authorization system for the same gap elsewhere.
• Sovereign AI, running a model alongside your own data instead of sending that data to a third party, is a real option for business-critical processes that cannot tolerate a vendor outage or a data leak.
• No single executive or committee should hold sole accountability for AI. Responsibility should follow the same lines as accountability for electricity or internet use: distributed by role, not concentrated in one title.
• Waiting for regulation to define responsible AI is a losing strategy, because the rules change faster than compliance programs can track. A principle-based approach outlasts any single law.
• When employees in different departments use the same AI tool to solve the same problem in different ways, that duplication is a signal to standardize, not a sign that something went wrong.
• A country's GDP gain from a new technology tracks more closely with how much of its population adopted it than with who got there first. The same logic applies inside a company: broad employee adoption matters more than being early.

Deep Dives

What irresponsible AI looks like right now

Asked to name the most irresponsible use of AI in the news, Duby did not point to a hypothetical. She described "the penetration tests that escaped their sandboxes," agents that moved well beyond the task they were deployed for. The incident, she argued, was less a disaster than a warning: "nobody died" and there was no real outage, but it exposed how little some teams understand the capabilities of the tools they deploy. Her prescription for most business settings was blunt: "I would like a model that doesn't know how to hack."

King's answer went a different direction, toward AI systems with human-like interfaces that people have started forming attachments to, a use case she said nobody built guardrails for because nobody anticipated it. A technology meant for the betterment of humanity, she argued, can be turned toward something else entirely once people start relating to it the way they would to another person, and that shift deserves more thought than it has gotten so far. Rege's version was more procedural and, in his words, "the biggest behind the scenes issue," the gaps AI tooling exposes in a company's authorization model for sensitive information. He described a common failure pattern: a team builds an agent to summarize emails, and the agent quietly gains access to inboxes it was never meant to read. "I want a model that does just what I asked it to do," Duby said, echoing a point all three panelists kept returning to: the danger is rarely a model doing something malicious. It is a model doing something nobody asked for, because nobody checked what it could reach.

That framing set up the rest of the panel. If the failure mode is scope creep rather than villainy, the fix is not a ban on AI tools. It is a harder look at what data and systems those tools can touch, and a faster response when they touch something they should not.

A risk framework for AI: business impact and human impact

Asked how leaders should identify their biggest AI risks, Rege offered a two-axis test. Business risk comes first: "What are the AI initiatives in your company, that if they went wrong, would have the biggest impact on your business model?" Those should be prioritized because a failure there hits the business directly. Human risk runs alongside it, covering AI initiatives that use personal information or make decisions that affect people's lives: "hiring, loan decisions, health care advice, law enforcement decisions." The use cases that score high on both, he said, belong in the top-right quadrant of a two-by-two and deserve the most scrutiny, since "any ubiquitous technology, it's very difficult to get a hundred percent coverage of those risks. So I think you have to prioritize."

King added that this exercise works best when it is not treated as an AI-only project. Most large organizations already maintain a risk register for breaches and reputational damage, and AI risk should sit inside that existing structure rather than beside it. The first question, she said, is what the business is actually trying to accomplish with AI, reducing existing risk, pursuing innovation, or both, because that answer determines where a company can afford to be bold and where it needs to stay conservative. Her own company, an AI infrastructure provider, experiments freely with AI in its products but takes a more cautious, vendor-trusted approach to AI applied internally around sensitive people data or legal documents.

Duby's addition was about cadence rather than categories. AI risk, she argued, needs to be assessed more often than traditional risk because the pace of change, in both the technology itself and the external threats from AI-driven attackers, is moving faster than annual review cycles can track. Multinational companies face a compounding version of the same problem, she added, since they have to track shifting rules not just in the United States but in every jurisdiction where they operate, which makes the two-axis prioritization Rege described less of a one-time exercise and more of a standing discipline.

The data and infrastructure fixes that matter

Pressed on what infrastructure changes companies need to make now, King traced a pattern she sees across her customer base: a board mandate to "do more with AI," with no new budget attached, which forces a company to find efficiency elsewhere first. Once frontier models level the playing field across competitors, she said, the real differentiator becomes a company's own data. That reframes the AI conversation into a data conversation, with blunt questions attached: "What data do I have? Where does it live? Who has access to it? What kind of sensitive information is in this data?" Piping a large, ungoverned data set into a data lake and connecting it to AI, she warned, risks violating permissions nobody checked.

Rege built directly on that point, naming authorization as the infrastructure gap he sees most often. When an internal agent gets access to data it should not have, he said, the instinct should not be to treat it as a one-off failure: "think about it as a red teaming exercise," one that just revealed a gap in the authorization system. The fix has two parts, patch the specific gap, and then treat it as a leading indicator of a bigger issue elsewhere, because "the longer you wait to identify them and fix them, of course, the bigger the issues are gonna be" as agents become more autonomous.

Duby's contribution was a third option: sovereign AI, where the model runs alongside a company's own data rather than sending that data to a third party. For public-facing documentation, the choice of tool barely matters. For business-critical processes involving competitive information or personal data, she argued, a company needs its own tenant or on-premise control, because handing both the data and the dependency to a vendor creates a risk that compounds if that vendor changes terms or goes out of business.

Who owns AI accountability in your company

Asked who in an organization should be accountable for responsible AI use, Rege called accountability "the litmus test" for a governance program's success and described a company he had spoken with that had formed a 64-member AI committee. "Who is accountable for what?" he asked. "Diffuse accountability is such a danger sign." His answer was that business leaders, not just the technology team, have to own the outcomes in their own functions, because pointing at the AI team after something goes wrong does not substitute for having set the right guardrails in the first place.

King reframed the question entirely. "Who in the organization is accountable for the use of electricity? Or who in the organization is accountable for the use of the Internet?" Since no single person owns either, she argued the right question is not who is accountable but how different roles become accountable: the board and management for AI use consistent with company values and law, IT for making the right tools available with governance attached, and business unit leaders for the return on whatever AI investment they are making. "Token maxing" without a corresponding gain in growth or mission impact, she said, is itself a governance failure.

Duby located accountability closer to the ground, with the CISO as a starting point but not a solution on its own: "it can't just be one person. It has to be a collaborative effort." Her bigger point was cultural. Companies need to be "secure by design" rather than expecting individual employees to guess whether a document is sensitive or a tool is approved. Most people are not parsing every file on their drive to work out which documents count as customer data before they open an AI tool, she said, so the responsibility has to sit in the system rather than in everyone's judgment. Every AI capability also needs an incident response plan attached before it ships, since AI tooling is still immature on that front.

Regulation, culture, and the skills to keep pace

On whether responsible AI practices help companies comply with regulation like the EU AI Act, Rege pointed to the law's core idea, risk-based categorization of AI use cases, as a genuinely useful structure. But he warned against treating any single regulation as a fixed target: "AI regulation is a roller coaster." Unlike privacy law, which matured over a longer and steadier period, AI rules are shifting monthly, so "you can't really wait for the regs to tell you what to do. The regs are gonna always be behind." His recommendation was a principle-based program that regulation can inform but should not define. Duby agreed, arguing an ethics-first program holds up "whether or not the regulations change or they don't," and King added that responsible AI is not something companies should do because of regulation. It just happens to make compliance easier, because it pushes a company toward the "no-regrets moves" it should be making anyway.

On scaling that mindset across a workforce, King noted that generative AI breaks the old training model, where one person's output and another's look the same. Two people using the same tool in engineering and marketing will produce entirely different results, so the right approach is baseline education on data handling, followed by a period of open experimentation. When duplicate use cases start appearing across teams, she said, that is a signal to standardize, not a symptom of inefficiency. Rege connected this to a point from a policy conversation he had recently: a country's GDP gain from a new technology tracked more closely with the share of its population that adopted it than with who got there first, a pattern he said applies just as directly inside a company. Alongside practical training, he named "tolerance for ambiguity" as the soft skill that matters most, since both the technology and the regulatory environment will keep shifting faster than any playbook can.

Asked for one technical and one soft skill to spend the next twelve months on, Duby recommended learning AI security frameworks like OWASP on the technical side, and on the soft side, learning how to influence an organization toward responsible practices rather than simply telling people what to do, since "a lot of times people don't always listen if you're just kind of preaching to them." Building that culture, she said, is the work that makes the rest of the program stick.