From records retention to AI readiness: Building a foundation for AI governance

Transcript:

Anthony: Hello, this is Anthony Diana from Reed Smith, and welcome to Tech Law Talks and our podcast series on the importance of data governance to AI governance. Today we will be discussing how retention schedules can help with AI governance. With me today are Therese Craparo, Kiriaki Tourikis, and Kristen Pologruto. Welcome guys. So let's just dive in. Let's start with, you know, we're talking about record retention schedules and how they could be helpful. So Kristen, I know there's a lot of people who don't really know what a record retention schedule is. Could you just explain what it is and what are like the elements of a retention schedule?

Kristen: Sure, Anthony. So the retention schedule, really in its basic form, is a list of the data and information that an organization or business uses, creates, stores, all of which is needed to fulfill its business purposes as well as its legal and regulatory requirements. So the retention schedule will really list these business records, provide a short definition of what the business record is, will also include a couple examples of various record types that are specific to that organization. The schedule will then attach a retention period to each of the records, which is really based on a legal requirement or a regulatory requirement or a requirement of the business needs of the organization. And with that retention period, there will also be a triggering event which will start the retention period. So it really will provide to its users information regarding the records that a business keeps, what that record entails, some examples of what that record would be, how long you should retain that record, and really, when does that retention period start, you know, that starting point of the retention? Retention schedules help businesses take stock of its information in a systemic manner. Oftentimes, businesses will have an old retention schedule that it'll dust off and, you know, sort of update, or sometimes it will just start from scratch and really, talk to the business leaders, the heads of their corporate groups, and really get an understanding of the information that the business has. And really the retention schedule will then become a building block for data maps, record inventories, which will provide even further information regarding that piece of data, that record, you know, its classification, where it's stored, and how somebody can find that information when it's needed for a business or legal purpose. Retention schedules are really the building blocks of a robust records management program and critical for effective, compliant, and future ready data governance, including AI management.

Anthony: Yeah, and I think a few things. Number one, I think record retention schedules historically, like 10 years ago, and we still see it with some clients, they view it as, well, that's physical records that are stored off-site and they have a schedule and they manage it and the like. But that's really changed. I mean, certainly in the past 10 years; it is now much more useful, and it's important. The importance of the record retention schedule can't be undervalued because, like you said, it's the basis of everything. You can't manage data in your organization without a record retention schedule. Therese, like just highlight it, right? It is not, which we hear all the time, well, just gonna use a template and that's fine. That's not what a record retention schedule is. You can't just get it off the internet or have, you know, Chat GPT develop your record retention schedule. It's useful if the business is, as Kristen said, if the business is involved and starts saying, I'm defining what's important to me and my business. Obviously there's regulatory things, but a lot of it is what is the most important information that I have for my business?

Therese: Yeah. And I think yeah, I agree. And I think the misconception around this, what's the template for your record retention schedule is really a throwback to an earlier time where we were in a pay world of paper and we had these retention schedules and people didn't pay a lot of attention to them, quite frankly, and they didn't really understand the value and the use of a retention schedule. So it was viewed as sort of a check-the-box exercise, right? I just want to check the box and say I have this thing, so you know, we can say that we have a retention schedule. And I think what we have found is not only are, whatever you would call a template or a standard retention schedule really not useful at all to the company in its process, we're also in a world now where people are starting to understand the value of a good, specific retention schedule. A retention schedule is your justification for why you keep what you keep. It's your identification of where your most important data is and how you know that you are securing it properly. We are seeing audits from regulators around what are you retaining and why are you retaining it? We're seeing requests for DSARs and things like that where you have to justify why you have your data and what data you have. And why does that matter for AI? Because the retention schedule is your evidence of what is my best set of data, the most reliable set of data. If somebody comes to me and says, I need this, where is it? I need this, is not just, you know, I need my general ledger. It's the data that also makes the company go. It is the most important data that the company relies on for its function. And that is every company. Because as our - Anthony and I's colleagues like to say, every company is a data company, right? Data is the most valuable asset. And so when we have a specific schedule that reflects the actual business, then you can say, this is my actual business need, right? Not just that I comply with the regulations, which are different for every industry, and you need to make sure that you are complying with those regulations and you can prove that I have the records identified that my industry requires and I am therefore complying with these rules, but also that here's where my business data is. And as a consequence, when I know where my most important, most reliable business data is, then I now know what is the best data and the most reliable data for the use of my AI tools.

Anthony: Yeah, and obviously there's the regulatory issue, which is - which is important, but I also think, you know, as we start talking about AI, but it's also basically a blueprint for what's the type of data that I have and what the business values, right? Like we've had discussions with the business where they say, well, I need this data type, right? I need a model. Like say it's source code, whatever it is. And they say, well I really need that for, five years because I have this business process, whatever. That's what you put in the retention schedule, right? If there's a regulatory reason, you have to keep it. But often it's starting the blueprint for I need to know from each of my businesses, and it's corporate groups, right? What does legal need? What does tax need? But then also what does the manufacturing people need? What does my RD people need? It's saying what is the type of data that we actually use? That's an incredibly valuable roadmap for people. It's not just, we have to keep it because of regulatory reasons, which a lot of people think it is, it's also what does the client need? And when you're talking to the business, you start seeing that some of them say, wait a minute, I need this for 30 years. Why? And they explain it. And you say, Okay, let's document that. We're just documenting somebody saying, This is type of information we need to keep for 30 years for the following reasons. Now you have that. And again, we'll get into it, but that is incredibly valuable to an organization, for a whole host of reasons. And we'll talk about AI next, but just think about it that way. And that's why you can't just get the blueprint; it's not the checkbox, it's something that every organization should really give a lot of thought to in terms of really understanding what data they have and what's valuable. Okay, so now let's get into AI. So Kiriaki, now that we know what a retention schedule is, record retention schedule is, how does that help with AI governance?

Kiriaki: So I think in the AI context, you can kind of reframe a record retention schedule more as a data eligibility framework, not just what should exist, but what information is potentially available for AI use in the first place. 'Cause as we said, the schedule is telling us what we create, how long do we keep it for, and ultimately, and hopefully, once you've made those decisions, you're gonna have a basis to defensively dispose of information you no longer need, right? And so why does all of that matter for AI? Because as we've said before in the previous podcast, AI makes "keep everything" really problematic. Historically, it was cheap and easy just to keep everything just in case, and even though there was risk associated with that, that risk is relatively passive. Somebody would have to actively go and try to hunt down that old information, and AI changes that, right? In an instant, it is searching and combining all sorts of data, including your oldest information. And the problem is, a lot of times, your oldest information is the data that you're least confident about. It's outdated, it may not be accurate, it could contain personal or confidential information you no longer have a reason to retain. And so when you're putting that AI layer over an environment where you keep everything forever, you're potentially magnifying, I think, all of the existing data problems. So a retention program, and I think hand in hand a little bit with a disposal program, becomes part of your overall AI governance program. Because, you know, if you've determined what you need to retain, and hopefully maybe even disposing of the stuff when it reaches the end of its retention period and disposing of the stuff you don't need to retain, you're giving the AI a cleaner, more current, more intentional universe of information to work with. And I think it becomes really clear when you start to stand up an AI program. So I think we saw this recently play out where an organization was moving very quickly. They want to stand up an AI program. They want to do, you know, what you would expect, a policy, a governance process, right? We're gonna review and identify potential AI use cases. We were thinking about risks and approval. And then you start to ask just simple questions about the data that would be used, and you realize there was a gap because they did not have a record retention schedule. So you can't answer very basic questions. And it's really difficult to have a mature conversation about AI governance if you don't even have a baseline. So they quickly pivoted and I think started to prioritize developing at least a baseline retention schedule. Again, not like a template, but something that's baseline for their organization. They realize this is not just a records management exercise in the abstract. It's very practical in terms of enabling their AI strategy. And so I think this is where, you know, the traditional kind of starts to converge with the more modern and also we've talked about this, we'll continue to talk about this. AI may create records, and that's really hard to understand if you don't even have a baseline of what is a record for your organization. Practically speaking, if you don't have a schedule, you want to consider at least creating what would be a baseline for your organization. Again, not a template that you get off the internet. But what are the key data that you need either for business and operational purposes or for legal and regulatory purposes? And know that that can mature over time, but at least, I think, having a baseline to work with will give you an easier time standing up any sort of AI governance program. But like you want to know what you need to keep, what you want to dispose of, and be intentional about what data you make available to the AI. And then be able to govern the data that AI creates and determine is that a record, how long do we need to retain it? Where? Or is it a non-record? Let's - let's make sure that we're disposing of it and keeping a very clean data environment.

Anthony: Yeah, and I think because you now have sort of a an inventory of all the different data types that the businesses have, and this is one of the challenges everybody has, is figuring out how to manage risk, with these AI tools. If you can almost risk rate from an AI perspective, each record category and say, look, HR, here's all the HR records. You know what? We have to stay away from that from an AI perspective because of privacy concerns and some of the state laws and the like. That becomes - from a risk matrix, which I think is really important for AI governance - it can help you start defining that risk matrix in a real way, not just generally, personal information is going to be high-risk. It's now I can say, here are the record types that have personal information based on my retention schedule. So now I can map it and now you can start advising the business. and they have record types, so you can say these are the types of documents you can't use for AI. The record retention schedule gives you that ability, so I think it's really important to think about that, and frankly, justified. As you said, we have so many clients moving to AI governance, but they don't have a record retention schedule and it makes it difficult. Well, this is great. We're gonna have further episodes. I thank everyone for joining. We're gonna have future episodes on record inventories and some others, so please join us for those as well. Thank you.

Outro: Tech Law Talks is a Reed Smith production. Our producers are Shannon Ryan, Amanda Saunders, and Mason Kautz. For more information about Reed Smith's Emerging Technologies Practice, please email [email protected]. You can find our podcast on all streaming platforms, reedsmith.com and our social media accounts at Reed Smith LLP.

Disclaimer: This podcast is provided for educational purposes. It does not constitute legal advice and is not intended to establish an attorney-client relationship, nor is it intended to suggest or establish standards of care applicable to particular lawyers in any given situation. Prior results do not guarantee a similar outcome. Any views, opinions, or comments made by any external guest speaker are not to be attributed to Reed Smith LLP or its individual lawyers. 

All rights reserved.

Transcript is auto-generated.