How to Build an AI Governance Career Without Writing Code ( Lawyer -> AI Architect POV) - w/ Aashita

So my Elvin was almost coming to an end and H1B was not picked up. That's when I came across O1. That's Ashita Jan, a lawyer who became an AI governance architect. And by the end of this episode I promise you will know exactly how she pulled it off and how you can walk a similar path. Me as a lawyer I know that sometimes flood can come so I'm helping you build that boundary around that house so that you can enjoy your house. She also broke down her exact O1 strategy and shared what work and spoiler alert it's not the thing that everybody preaches. I learnt that it's not about quantity, it's more about putting your idea out and it should just resonate with the right people. Plus the one thing she tell every engineer trying to break into this field. People try to chase certifications but play with it unless you build something or not build something you won't be able to understand both sides. Please join me in welcoming Ashita Jan to the Reddy Set-Do podcast without any further ado. Let's get into it. Ashita, welcome. Now and thanks for inviting me to your podcast. I want to jump off with the fact that you're a lawyer who became an AI governance architect. So when you look at that sentence in isolation, can you just talk through what comes to mind? And of course as you will do that, I'm sure there'll be some snippets or anecdotes from the journey that you've had that will come up. But how do you reflect on your own journey that you've been on over the past years or past few years? I think the hook that you've given me, I think that itself summarizes governance is very dynamic and that journey, I feel you know, you're each time stepping into a new stone learning what is coming and that's how my journey been. Learning and exploring what is coming next. That's how I pivoted to AI governance. So when you first started your career, I know you were a lawyer, you were doing like lawyer stuff. Can you kind of take us back to the ashtah of that time? You know, kind of set the stage for us in terms of what it is that you were planning to do. So was the plan always to move into the tech side of things when it pertained to still being around or being a lawyer and just being around the lock or was it just more open ended and it just kind of fell into place for you. Yeah, there was no plan. I'll be very honest. In terms of, I was very fascinated from the law field growing up because of the environment, I had my cousins who were pursuing law and as well as I was growing up, I had the family of engineers. So I had to take background also. My own interest was more in law that I more in the course of law, I'm sorry for the AI part, MNA and commercial transactional. That was something that really intrigued me. I wanted to just explore what it is and the environment in law firms and companies, very corporate stuff that I was drawn to. Yeah, so that makes sense. Can you kind of bring us then up to speed in terms of the bridge that appeared between when you were just being purely a lawyer doing law stuff and then the first time you saw a bridge get extended into what you do now, which is super heavy into AI, LLM, all of that type of thing, which first of all, we will get into that. But I'm just curious in terms of how that one connection occurred for you. So I was not very honest with the idea or with Tecloh. During my law school, I'm a very experimental learner. So during my law school, I was just open to anything and everything that was coming in. So saying, if you are going to law firms and they are practicing say, IP laws or Tec laws or even civil laws, Climbin and law, I would just go and put myself out there in those rooms. And that's how the idea of privacy fell into my lab. I was a very active student in terms of these conferences to just get going in the another opportunity. So IAPP as an organization, they have a knowledge net chapter in Bangalore. And during my third year of law school, I volunteered there with all the industry professionals. I was interacting with them. And I think one of them offered me that position with emphasis. He was from and he guided me that this is something an area that you should roll explore. I did not drop everything since then, but I kept in touch with privacy since then. Interesting. And then so when did the move to us happen slash how did that come to be through, you know, your journey as I'm just trying to kind of put myself in issues and, you know, go through the steps slash motions one by one. So how did the move to America turn to turn out to be? I moved America pretty recently. I moved in 2023. This was more of a personal need move. Okay. And I had my company transferred me. I was working in Ireland and then they transferred me to my first stop in the US was Boston. Got it. And so for those of us right, which is literally all of my listeners and that is my list is and that includes me because I'm my first listener. We're all, yeah, can you just kind of help us understand from like a really layman point of view. Exactly what IP entails when it comes to LLM sorry, I or those sort of things. I feel like so a lot of my audience are super heavy into AI with like thinkors, very constantly building, breaking things literally on the cutting edge. And often we find or I find that these are important discussions that we should be having in the circles that I come from that we just don't. And a lot of it is just not, I mean, obviously it's ignorance. Of course, 100% but also, yeah, we just don't have access to folks such as yourself that are doing such important world in this field. So one of the many goals of me reaching out to you for this episode was kind of to, you know, have the other side come into picture. What does governance slash guardrails slash, you know, all of this important things that you're doing. What does that look like? And before we get there, obviously it's important to understand what it is that you do. So can you help break down kind of maybe just you can go about it with a day in the life or any other approach that you, you know, you know, if you think would be most helpful, but just trying to understand what it is that you do when it comes to, you know, just us out here, baking, Claude or using codex or what have you. So one of the biggest myth, if I'll understand your question clearly, you're asking a that what is this guardrails controls and governance that means on folks to the legal side. Okay, that's exactly right. Yep. Yep. So first let's break down the idea of governance. Governance is very much taken as a taboo that Ola has put some stop checks and they are asking us not to build this. How do we get to this innovation as lawyers. Sometimes that is a tricky part that we navigate as day to day because to if I am part of a corporate or a part of an enterprise, of course we are not innovation hours are job and day to day is to make sure what you are building goes and ships smoothly. And it runs and as intended or revenue that you are trying to achieve without lot of stoppers from regulators. So governance is something which is not law, but it is more about anything that could break so if I have to explain it in the lab and language say you as an engineer you are building in house and me as a lawyer. I know that you know sometimes flood can come something can come so I'm helping you build that boundary around that house so that you can enjoy your house peacefully. Now this is not a breaker. This is more like a complimentary thing where we both are building together. I'm making sure that you are what you are building is growing with you. So if you say you start with a say small house with like simple plain things then you might me as a legal person I'll help you. Okay, let's add a door to it. And then I'll say okay now house is getting bigger we have kids in the house let's add a fence to it. So that is what governance is and it grows with you. Interesting. Yeah, I mean when you put it like that it yeah I agree that it does seem to be less of a you know adversary type relationship and more of a complimentary one so but I am curious. So when you say governance, who do you work with? I guess so do you work with like the frontier model companies or do you work with the companies that are implementing the models? Does that make sense? Yes, it depends what you're like if I am with a company in house. So all their clients would be my clients. So I work and based on their product, what they are building. So everything would be part of the scope and with law firms again and consulting, it depends on the startups and what they are building becomes part of our scope. Interesting. So how deep into the weeds do you have to be with the tech to do your job? Because I guess where I'm coming from is these are these two things are seeming really intertwined in my head. So first is that right? And so did you have to like undergo any sort of actual full blown tech learning or was that just something you learned on the job? It is part of something that we learned in the job. I like a lot of my day to day job includes interacting with engineers and specifically product managers reviewing their architecture diagram and making sense of it that how the data is flowing and generating a data flow diagram with it. Wow. I can try to risk in a document saying something and claiming something until I know that that is actually somewhere in the code. So with them sitting with them learning more about the tech, how we deal like it's a common joke and I think internally we get a very simple thing and it's like, oh, when GDPR came we started seeing that encryption but for GDPR this is not waiting and a lot of engineers what give us looks like in G encryption is secure and this is where you can't get joke I'm saying sure. But that's not what I can say to the regulators. I need you to help me how I can sell your story better. Interesting. I'm so fascinated by this. So this can be a totally meetup example like because obviously I understand that some of what you do is you can't talk about publicly. So again, feel free to just make it up but where I'm trying to go and what would be incredible for a list is can you just give an example of let's say maybe a toy case where an engineer was trying to do something they had an architecture and maybe we can even brainstorm something very quick and dirty here together. But then like the following was the risk that that engineer probably maybe they flagged maybe they didn't but it's not something they care about but you were able to flag that because of your job title and your expertise and then you were able to be like no we cannot do that instead let's do that. Does that make sense because I feel like that would really help us fully understand and contextualize where it is that you know you you come in and like your profession comes in. Yes. I think a lot of the times what we are building not in B2B but it's easier to understand in B2C context. Consent architecture or consent models. Got it. Is something that is our day to day friction and also partnership with engineers. So in B2C models whenever they are building say e-commerce site they would need and they are running ad personalizations. So they need to build consent architecture. Now how that consent and that data or that leads are generated is different compared to US it's more open but when you go to Europe it's very strict and specifically some countries in Europe you need. So that's where we really need to have that have this partnership that if we can just open and get a lot of that data which you don't even need and you're not even sure specifically with marketing teams also or marketing I'm talking about Eddick that we might need in future. And we can turn on I think as a feature we can add that capability but as of now why do we just place it and just get it what are our parents if the cost to find is cheaper why not then placing those controls with then I think are more solution or recommendation is mostly into building a way that you can collect that data when you need it but architect that consent that when there is an inquiry we can go back or track it. Got it so if I'm understanding what you said correctly you're saying that there could be the same company that has a certain you know let's say they have a rollout in the US versus Europe but obviously because of the jurisdiction differences they can't have the same rollout like they have to have different it's the thing where I just skip to the end and just be like I agree you're saying that the stuff that goes in there needs to be checked by somebody so that it's not just being predatory or you know harmful and such is that roughly am I catching that right or am I just way off. Yes you are like I can give you some real life examples. Yeah that'd be great yeah. So if you'll see Apple card capability that is in US that's not actively available to Europe users and reason being it's very hard the way that capability or consent model is designed it's very hard to provide the European users. Wow. So they came up with a solution where let's activate and test it out with the US consumers with the kind of data and the partnerships that needed compared to the EU users. Another example would be their Twitter and these American Airlines how they connected so Twitter there's like a big work that has done that they also moderate the content the consent models what they need I'm not fully able to recall the cookie placement but there was a big work that was done to actually categorize and classify cookies when you see those functional cookies is necessary cookies that's like an active partnership which each company works as a big massive project. Wow I mean it almost feels to me like you're more like a technologist than a lawyer at this point do you get that would you say there's any truth to that or not really. I think with AI now it's becoming a little bit ground reality. Yeah because if we say can you cannot do that that is not enough we need to find solutions we are working actively how in ideating that features how we can achieve that so yeah sort of that's so cool so what if I'm just curious right so what if the tables were turned so let's say we have a technologist that is not a lawyer right that does not have the credentials at least formally that is trying to work with or do similar work of course they cannot do the exact work that you are doing because that needs obviously the years of training that you've had as a lawyer but if they were to maybe work on your team or maybe be an analyst on your team have you seen jobs like that evolve over the past few years and would that be something that you recommend to somebody that's like our listeners that are mostly engineers that care about governance like that have a key knife or detail and that want to do work in the same field that you're in so can you speak to that piece at all. Yes in fact to your question in emphasis when I started my work there was a separate independent department called Data Privacy Office and that was my best year because the team was so multidisciplinary like you said we had technologists who were building solutions and we had lawyers working together and working then going to the business with the solution together. So how field has evolved and we have now designations like data privacy architects a lot of privacy engineering has evolved as a field which bridges this gap where it trains engineers with the principles of privacy law and interpretation and help them also come up with solutions and architecting those solutions in the CI/CD pipelines or productize that. I feel like that just opened a new door that I did not know that was the thing that happened. What are these roles called if somebody were to seek them out specifically what would be maybe a couple of search terms that could put somebody on their way when it comes to exploding stuff like this in terms of job titles I mean. I think it is still similar titles architect or principle engineer analyst sometimes leads it's not very different what we have as a designations today. I just this these are more specialized fields and also companies really invest in these engineers because you also have to keep upskilling yourself with certifications and with building and what is coming with the new laws so that is also part of it. Got it. So just while preparing for this episode I I've noticed that you're the recipient of the OVNA. So are you able to buy a chance to share a little bit about that particular experience? Because obviously a lot of my audience is also looking to looking at how to build their profiles for visas such as that. So is that something that you're willing to share any light on by chance? Yes. So O1, I started my journey in 25. I was about-- my Elwin was almost-- I was on Elwin visa. So my Elwin was almost coming to an end, and H-1B was not picked up. But then one of the things that I've noticed in the O1 journey, a lot of the people, the focus on quantity, have scholarly articles, ten articles. What helped me was I approached it as like, we all see OV, want to be successful. And then this is how I want to build my thought leadership and authority. I looked at it from that lens that somebody gave me a guided starter kit that I have to start with, and these credentials. So way I approached my O1 was paved beyond then just for the visa part. Interesting. Can I ask why? Because it just goes against the grain of everything I've heard about profile building. It's almost like a grind. You're doing reps. It's like working out. You have to do the thing, do a lot of it, and then hope and pray for the best. It sounds like you did not have that approached. So why was that? I guess who was your coach slashed? Where did you learn how to do this so effectively? Because clearly it worked. So you did win in the end. But can you share why slash how? I mean, as part of my law school LLM, I did have research papers. I always was scared of putting that idea out. So that is now needed. I tested out with one article. It was cited a lot of 13 times. And that was very surprising to me in a very candid way. Because I don't that it's not about quantity. It's more about putting your idea out. And it should just resonate with the right people. And those right people will automatically will be willing to write about your work and independent expert letters. Is that criteria? So that really give me a lot of insight. So I chose my profile and projects that is intentional. Since I also proscied as thought leadership, so I would always evaluate on a very side note. I would search myself on Google. And I would see how it's coming and how my thought leadership. And now we have AI tools. So I would search myself that what AI is picking up about me and how I want. And that helped me to very intentionally carve out how I want to be known. That's so interesting. Yeah. I mean, I have Google myself in the past. I won't lie, but I haven't AI searched myself. So I am curious what that might unearth. So thanks for that tip. I'm sure a lot of those watching slash listening will be keen to do that. Or maybe it's just me. Maybe I'm just the only one that does not do this. Jumping gears a little bit. Something that I've seen, discos around, especially on Twitter and such is this notion that Europe, as a legislative unit, turns to be or is at least, again, as it's portrayed. And again, I don't know the first thing about any of this. But they're almost positioned to be this, like extremely anti-progress, like don't be doing anything. We won't allow innovation, anti-innovation even, right? At least compared to America, where things are almost flipped, at least from what I gather. And then somewhere in the mix, we have India as well in terms of Indian laws, in terms of where we stand, in terms of, you know, just like innovation and such, at least protect slash governance stuff. So if you had to kind of big picture this, right? For folks like me and my listeners, that are not super dialed in to these things, but would trust the authority of somebody like you. How would you go about doing that, like in terms of contrasting those three units, so to speak, when it comes to AI innovation specifically. - So when I started my career, I've worked in all these three countries, technically. So I feel that first from the legal side, and the way law or legislative aspect of going, is not about technology or innovation. It is about more like a cultural shift. So if I have to sell privacy in India, my or AI governance in India, it's not that Indian culture or not aware of it, but users are more open there, and they are in US also compared to Europe, because Indian culture is a very community-based culture. - Yeah, yeah. - It's an influence, so they do not consider privacy as a thing. What they, if I have to sell AI governance, what they are more focused about, that it is a safe environment for our community to thrive, and we are developing, so we should be able to contribute. And that's the culture and AI governance part. Europe and US population is quite mature, but Europe is a very socialist economy and culture, so it's very right-based. A lot of my work there, now I think it's pivoting as a discussion in AI governance, also, was about the rights, why is my data, how are you using my data? Users would be, we received a lot of requests, how to access even in an employee-leaving company, they would ask to delete my request, how my data outside, how am I monitored within a workplace organization? All of this was very part of the culture there. And a US is very innovation-focused, tech-focused development, and it's very entrepreneurial in approach. So in my day-to-day job, when I have to discuss the same thing with my American lawyers, compared to my European counterparts, it's more high-risk focus, they would focus, oh, this is high-risk, how the focus would be, this impact, how we curve that. Whereas, it's not that those thoughts are not there in US law, or with American counterpart, but the way the problem is approached to solve is more about that we have to sell this product, and we have to get this there, but we want to make sure that it is done aligned with the laws. In a tech part. And plus, again, because you, US, being now, you are also in the US for so long, so you're aware that how you can receive the call, do not really, you receive so many spam calls, and the audience is also very open about it. Okay, it's coming, there will be spam calls. It happens, yeah. We just learn to live with it almost, yeah. Instead. And they are used to hearing different rights, and the audience is open, so yeah, let's. No. So I think what I advocate more is privacy and AI governance, it's not absolute, it grows with you. It is as much as innovation, that's why I go with AI governance and privacy is a product, and influence, and as cultural revolts, people's mindset evolves, and that's how it evolves with you. So you need to ship out products and features of privacy every time. It's not a activist or a. Which is a taboo that it will. It is stopping innovation, that is not the peace. I think the most fascinating part about what you just said was the notion that it is not purely objective in terms of zeros or ones, but it's just a function of the culture that it's supposed to protect. Which. Yes. I mean, that almost feels like a der now that you say it, but it's just not something that I'd ever considered. And I think. I mean, yeah, I feel. I have thoughts around that, but I guess. Do you think that. Yeah, I guess, how do you. Go about that? Do you think it's okay for it to not be purely objective? Like, is this something that is fine? According to you, or do you think that if you could wave a magic wand and change things, would you change anything about this aspect of what you just underlined? I would first like to hear your thoughts before answering this question. So again, my just like. Really left brain engineer, heavy. decision maker type thing, makes it almost feel like. These should be universal, right? So if it's bad in Europe, it should be bad in America, it should be bad in India. Just. across the border. I can understand some sub bullets here and there being more or less flexible, but I don't fully understand like it just feels really like we're mudding the waters by applying you know different bars to different like geographies right. But then again you have to keep in mind that I'm purely looking at it from an outsider perspective and I lack the nuance that of course you have. But yeah that's mostly what I'm coming it's I'm just looking at it like code right if you pass a test case in India it should also pass test cases in Europe and US it shouldn't be like oh seven here is fine but three here is fine does that make sense. Yes so if I have to answer this from the engineering piece of it what if you'll pass test seven test cases you'll put all the cost and revenue to say something and it will not be sold people won't use it what's the point. You're facing much more backlash and then there will be studies around it. If I have to my own personality if you have to ask that is it objective I never believed when I started my career the privacy is absolute privacy is objective wow constitution of India clearly says that it is not absolute there are certain exceptions they give you that right but it is not an absolute right. I think part of it is also in Europe but if you remove that full lens of law or what is tech how it should be I again go back to the same point cultural. AI was designed to be human intelligent form in the mind mimic the human mind so you have to guard it like humans you have to also take personal cultural preferences so I treat if it is mimicking human it is building a second frame so I treat it as my colleague and we have now AI colleagues as agents so yeah literally in we are in that era so think of it as another machine economy and machine culture and then you have to take the cultural influences into a that's awesome yeah I I feel like yep that is so good it literally like it's like you just you know for not for the first time in this conversation but opened a door like to an entire universe that I'm very excited to dig into but yeah I just straight up did not even know that these considerations or this entire you know sphere of work slash you know things to think about existed so that's awesome um final segment here before I let you go for those that are trying to walk your footsteps maybe that are just a couple steps behind um what would be some of your you know what would be some things that you would like to share with them for those that are trying to build a career in this space that are maybe you know maybe like five or seven years behind where you are today well I think one of the things that I noticed that people try to chase certifications I feel that's good as a starting point pick your certification as a overlap that gives you a ground finding but play with it the best way to learn around privacy and AI is play with it uh play with the privacy solutions play with the laws uh the only way you can thrive in it if you can give engineers a solution or brainstorm with it uh and then you also need to understand the move on so you unless you play with it unless you build something or not build something you won't be able to understand both sides I just love it when organically something a guest says is just bar for bar one of the core philosophies of the show of this podcast which in this case what I'm referring to and this is literally on the website today if you go there but the ice like one of the things I you know the hills that I will die on is the only way to learn is to do you know which is basically what kind of what you just said so yeah I just really love it when that happens organically but um yeah ashtah this has been so cool like genuinely I I have a bunch of like you know this is episode number 120 give or take but seldom is it with a person slash a person in a field or slash niche that's just completely raw and uncharted territory for me and I suspect a lot of our listeners and every time I have one of these it's like really nerve-wracking for me because you know even though I do my research it's still just hard to able to match you know just kind of the guest and where they're coming from and such but I really want to commend you for making it so easy for you know not just me to follow along but I'm sure anybody listening has been able to just really you know relate to what you're saying and truly understand where you're coming from and maybe you get this a lot but it is not a quality that many people have so I just you know really want to commend you for being so transparent so cool so open and lastly for you know taking the time here today to share with us your journey your experiences this has been so so incredible thank you so much thank you number thank you for inviting me to your podcast it was really fun chatting with you Awesome!