The Intersection of Law, Technology, and Business Risk

I'm so excited to be here. Thanks so much.

Yeah. Two words, Eric. Certain destruction. Just doom and gloom it up. But in reality, we do present them with a vast array of the data privacy, for example, to use something you were just talking about, regulations that have already gone into effect at the state level across many states and that are proposed in almost all fifty states at this point and are almost certainly eventualities.

We see all these protective data privacy laws being enacted. And if you don't comply with them, the results of your noncompliance are written into the laws. And so there are civil penalties. There can, in some cases, be private rights of action.

And so I think presenting the facts to the client is the first step. Let them know what the consequences are going to be of noncompliance. But then I think your question goes beyond that to not just, all right, we've convinced them they want to comply. But proactive?

How do we convince them to take these sort of measures that are going to make it less likely that they're gonna have a breach or make it less likely that they're going to not comply? And the answer to that is just to sometimes put the data in front of them as to the most common causes of data breach. And I'll give you an example. The new data privacy regulations that have been going into effect maybe I shouldn't say new because some of them are now three, four, five years old, have a lot of requirements surrounding a consumer's right to be able to locate what data a company may possess of theirs, change or correct that data, or delete that data.

A record request from a programming perspective, from a back end perspective that requires deletion exposes the entire network because you have to go into an API and you have to request all of the records for that particular person. And in order to find them, you have to be able to access all of the records company wide so that you can be sure you've accessed all of that consumer's records. Well, when developing teams are forced to create those kind of APIs and not have a chance for their security features to harden, there's actually a report from I can't remember the name of the organization that listed that as the number one cause of breaches is the lack of hardening around new APIs that are designed to do something like locate records.

So it's high stakes. And I think that when we explain to our clients and they fully understand the stakes, it makes them more willing to invest in proactive measures.

No. That's a great question, Daniel. And I agree that that angle is always the most effective angle to use. And I think across the board when we're pitching to clients, anything proactive, using the business value angle is the best and most effective.

With Wilson, I think it depends on our clients. So we have a lot of clients that are really large companies that already understand this concept of managed risk. And in those situations, a lot of times, we're being brought in by their in house legal department. And in house legal always wants things to be compliant, always wants to minimize their downstream cleanup efforts.

And so they will then bring in the product folks and the development folks and the compliance folks. And we're usually all around that table having that discussion. And frankly, in those situations, it's a bit easier because since this is being internally driven by their legal folks, there's some budget that exists. There's some amount of money that they're willing to spend.

Now does that mean they wanna spend what they need to spend to Eric's earlier point? Would they rather get it for half? Absolutely. And in that case, that's where some of

these AI tools come in.

That's where some of these new products that can go out and scrape different compliance obligations off of websites and compile reports can become part of those solutions.

Do those solutions work as well right now as the type of manpower heavy tracking that we do of regulations for some of our largest tech clients? No. They don't. They're not there yet.

But is it a great solution for a smaller company? Yes. And so that transitions to the second part of your answer, which is when we're talking to more of a startup, which we also handle a lot of those at Wilson, the solution we're going to be proposing to them does have to, first of all, stress why this is worth it to them to avoid litigation, to avoid compliance problems, to avoid a breach. But also it has to increasingly, our customers are demanding that our solutions incorporate AI, that they incorporate ways to keep the billable hour down.

Sure. And, of course, we all know that K&E recently announced their massive investment into developing their own AI tool. And one of the things that they talked about in that press release was this idea that they were looking at going to value based billing as opposed to all the billable hour. And to your point, Daniel, I think it can go both ways.

I think there are a lot of companies, our customers included, who have expressed to us their desire to see that we are using AI solutions in performing tasks for them. And so we are being asked to show those customers, okay, how much time did you save by using an AI solution? And please articulate which solution you used in order to perform this task. If we go to purely task based or value based billing, I think that that opens up the possibility that customers might get a deal, and it also opens up the possibility that law firms will make more money.

Because K&E, they're shrewd. I don't think they're looking at this entirely because they wanna give value to their customers. I think they also wanna make sure that it helps their bottom line. And you can envision a world in which if you are negotiating with a client as to how much a certain task is gonna take because you are going to be able to use AI to assist with that task and then you get really good at that task, it's going to end up where the firm is actually making more money than they would be if they were just billing by the hour.

And frankly, that's how I think that would inevitably go. I think customers will demand it because they want savings. They will get some level of savings, but then firms will start padding the value building so that they make sure that they're getting money and it's that dance. Maybe.

Yeah. Great questions. I'm gonna answer it in two parts. The first is as it pertains to litigation because I do a lot of litigation as well.

And it's interesting that you bring up knowledge management because this is a topic that we have a lot of conversations about here at the firm and then also on a more like with my colleagues at other firms as well. And you can see immediately the use cases. And so the simple answer is yes. I think it's very undervalued what AI can do for knowledge management.

But we do see companies in this space that are putting forth rapidly advancing tools that enable you to do things like comb through all of the pleadings that exist within your entire organization since the dawn of time and be able to search for a particular argument that was made on a particular obscure rule or statute.

And no longer do you have to manually power through even Lexis. You can instead of trying to find your cases in Westlaw, you can go directly to the argument that your colleague made fifteen years ago in the same district court and pull that. Right? So this is huge.

To your second part of your question, which I think is more focused on, like, data compliance regulations, that sort of thing. I would say yes. But the biggest problem we have right now with being able to use AI tools as it pertains to ongoing, like, regulations and obligations that change is access. AI has a fabulously difficult time accessing what it needs to in order to give you correct answers.

And we can see that in the difference between if you ask, for example, co counsel from Westlaw. If you ask that AI a question about the law versus if you ask Claude a question about the law. The difference is that Westlaw has access to the Westlaw database. And so they're gonna be able to go in there and get you an actual answer.

Well, the same thing is the problem right now with regulations. They're constantly changing.

And AI, as we know, is not good at making human like actions, clicking on this button, entering into this search bar, clicking on this bill, clicking on this regulation so that it can actually read the regulations and come up with the right answer to your question. So can you take every document that you're interested in and upload it to AI and ask AI a question about those documents and get a reasonably good answer? Sure. But can AI right now, even agentic AI, can it go in and on its own scrape those websites so it's getting you information for today instead of for the last time it was published and you uploaded it? No. It can't. Now I'm sure we're gonna get there, but we're not there right now.

That's the goal. That's what I would love to see happen. And the reason though the difference between what you just pointed out, Daniel, the alerts that you're getting and what we need from a regulatory or compliance angle is the websites that your agents are accessing in order to get you that information. So AI is really good at going out and finding things that are published, news articles, things like this, even court decisions that are published to the web.

What AI is not great at doing is going into a website where it has to sort through a bunch of things that are published and trying to find the thing you want and the thing that's new. So what I mean by this is state legislature websites, as an example, are fabulously archaic. They're also filled with a ton of information. And so right now, I'm not aware of an easy way to or even a workable way to program your agent to go into all fifty states legislative websites, pull up the active bills, search for bills that relate to data privacy, find them for you, and bring them to you because it requires so much clicking, and that's the part that the AI isn't good at.

But there are companies that have built tools that work. Like, Lexis has a tool called StateNet that essentially does that. Yep. But that's like millions and millions of dollars worth of development.

And it works really well. But even with the power of Lexis behind it, it still doesn't do everything that you just mentioned you wanted to do. But I think it will soon.

Hopefully, just from an issue of compliance. Like, yeah, we do think that that will happen, or I do. I can't speak for anyone else. But one of the things that that we do to help our clients is that tracking.

Tracking legislation as it's going through the different state legislatures is so important because as you mentioned, with the data privacy regs where we saw California came out with one, Texas came out with one, and they're like carbon copies. Right? Okay. Same thing's happening as you correctly observed with these AI regulations.

And so if you have AI regulations that are important to your particular client, it is a bit of a crystal ball in the sense that if you're tracking these and you notice that there's a bunch of copycats, as soon as the first one passes in the first state and oftentimes it is a lead state like California, then you need to be on high alert and your customer needs to be on high alert because they need to recognize, like, okay. This is probably gonna downstream. On the other hand, we see other attempts at regulation that don't pass, and you start to realize that those are probably all gonna die.

And same thing with tracking litigation challenging those regulations. Once it falls in one district, it's a lot more likely it's gonna continue to fall, not always, but continue to domino in other districts. But back to your question as far as a federal law that would potentially supersede these state regulations, at least in the avenue of whether AI generated output is speech, how we are going to regulate that, I do think that that will ultimately be a federal question. I think it will probably go to Supreme Court.

I think it will probably be decided there. Or I think that Congress will get involved and they will do something similar to what they did with section two thirty of the Communications Decency Act where they saw this need to regulate this what at the time was the burgeoning Internet and how that was going to be regulated. And and they've passed this federal statute that does in fact provide the framework for all of the regulation in that space to this day.

Sure. Well, to the first part of your question, when it comes to European Union regulations or regulations ex US, not a lot of guidance because as you know, Europe goes its own way. A lot of times, the free speech protections in Europe are often not as robust as the Supreme Court's current interpretation of our First Amendment. And so the United States, the best predictor I found of federal action tends to be more so what is happening at the state level and less so what's happening ex US. That having been said, just generally, what sort of AI regulations have a lot of traction right now? Absolutely. I would say the number one is the regulation of AI chatbots.

Anything that is interacting with human beings in a way I'll caveat that. There's a second one. I'll get to that in a second. But the first one, the AI chatbots, anything that is interacting with human being in a way that the human being cannot necessarily tell that they are interacting with AI. We've seen a lot of laws that have already passed in the states just in the last few months to regulate AI chatbots, and there's a lot that look like they're going to pass imminently before the end of this legislative session.

And frankly, a lot of the regulations that are in those laws are something that our clients can comply with. They're not ridiculous.

There are things like having age verification systems in place to verify the age of a user that's interacting with an AI companion bot. There are things like, let's imagine you have a customer service AI bot requiring there to be some sort of notification that the customer service that's being provided is being provided by AI, that they're not actually talking to a human being, regulating what sort of decisions AI can make when it comes to terms of employment and things like that. So those things are here, and we need to be advising our clients about those. And then the second category that I wanted to mention is deep fakes. That's another thing that is a huge hot topic right now and is being regulated, which is these images, whether it's nonconsensual images or whether it's, like, election related deepfakes. These laws are in effect right now, and more will be in effect within the next month or two.

I have been thinking for a while now that we were gonna get a federal data privacy law at least. Because to your point, that makes a whole lot of sense. The EU has done that most of their member states, and it's like a bill of rights, right, for data privacy over in the EU. And so it seems logical.

And, frankly, enough states from both sides of the political spectrum have passed data privacy laws in the last five years that it seems like this could be a relatively bipartisan issue to get something going at the federal level. So I am hopeful that that will happen. I will say with data privacy, there just isn't a lot of wow factor to that right now. There's not a lot of push for it.

There is a lot of talk around AI because that's something that's on everybody's mind. So although it would be much easier to create a federal data privacy law, we might see some sort of federal AI laws more quickly just because it's a more of a hot button issue. It plays better to constituents at election time who are concerned about their kids interacting with AI and what this does to their jobs. So there's more of a push, I think, for the federal government to get involved at that level just from an optics perspective.

You are implying that that is a simple question, Eric. I think that we are not regulating ourselves well right now. I think that there are areas where we are under regulating and we should and could and need to do better. And I think there are areas that we are over regulating that are making it difficult. And the problem is to something Daniel said earlier, I think this patchwork piecemeal approach to everything is just killing our ability to both protect consumers, to protect constitutional rights like free speech, but also to nurture growth.

And frankly, the AI frontier is a perfect example of that. I'll give one quick example if I can. There was a law review article that came out in the Stanford Law Review, I think it was, and it was called speech certainty. And they were discussing the authors were discussing regulation of AI output as speech.

And their argument is that it should not be speech, that machine learning if you don't have a speaker that knows what they said when they said it, I believe was their test, that it should not be considered speech. And it's a super long law review paper as all law review papers are. And then at the very end, you have, like, one page on regulatory and how this would actually in real life work out. And the author's conclusion is basically like, well, yeah, if none of this AI output is speech, then the government's gonna be able to regulate, like, a ton of stuff on social media, and it'll be fine.

And what they don't say is like, AI would disappear, and AI is not going to disappear. And so these regulations that people are proposing that, like, might sound great in theory or they're connected to what the founding fathers thought about speech two hundred years ago, it doesn't matter because it doesn't work. So at some point, we have to get away from these purely theoretical discussions and get into the more meat and potatoes of, like, okay, what are regulations that can actually accomplish what we want them to accomplish and be practical because AI is not going away.

So fun. Thank you so much for having me. It was a highlight of my week.