Transcript
Speaker: Welcome to The Exchange, a podcast produced by Audit Wales. My name is Sam Williams and I work for the Good Practice Exchange team. Audit Wales is the audit body responsible for the financial and performance audit of the devolved Welsh public sector.
Speaker: This ranges from the Welsh Government to your community council and everything in between.
Speaker: In February 2024, the Audits of the Journal for Wales published From Firefight into Future Proofing, the challenge for Welsh Public Services. The report draws on the work of Audit Wales to reflect on the way our public bodies are governed and managed. The importance of minimising losses through fraud and error, the complexity of the public service landscape and challenges around workforce capacity, digital transformation and planning for the long term.
Speaker: It emphasizes too the need more than ever to ensure value for money in public spending. Adrian Crompton, the Auditor General, spoke about these issues on this podcast in the episodes that were published before Christmas.
Speaker: As we look towards digital transformation across public services, we wanted to have a particular focus on AI and the ways in which public services can implement robust governance frameworks. The aim is to ensure that the use of AI is responsible, ethical, transparent whilst building and maintaining public trust and confidence across public services.
Speaker: Additionally, there is growing an interest in understanding how leaders and boards within public services obtain assurance regarding these governance arrangements. With technology moving at such pace, it's increasingly important for those in leadership to have clear oversight and assurance mechanisms in place.
Speaker: AI and other digital innovations offer the potential for significant benefits, such as more efficient delivery of aspects of work. At the same time, their use must meet requirements on issues such as data protection and cybersecurity.
Speaker: In this podcast, we will discuss some of these requirements as we join a conversation between Dave Teague and Pete Thomas. Dave is Acting Head of Welsh Affairs at the ICO, the Information Commissioner's Office, and Pete is the Head of Artificial Intelligence, Cyber Resilience and Digital Capability at CDPS, the Centre for Digital Public Services. Welcome both. Starting with you, Dave, can you give us a brief introduction to yourself and the work of the ICO?
Speaker: Thanks, Sam. Lovely to be here today. I'm Dave Teague. I'm the Acting Head of Welsh Affairs for the Information Commissioner's Office, or ICO. We are the UK regulator for information rights, and including data protection and freedom information, among others. And ah my team works a lot with Welsh public sector organisations on helping them get their data protection and privacy concerns and information rights of work correct.
Speaker: Thanks, Dave. Over to you, Pete, for your work and the work of CDPS. Thanks, Sam. It's great to be here. Yeah, my name's Peter Thomas and I have responsibility for artificial intelligence, cyber resilience and digital capability in the Centre for Digital Public Services. And CDPS is all about creating better public services for Wales. And we work with teams and organisations to transform services by designing and building things that meet the digital service standard for Wales, basically making sure services are fit for the future and fit for everybody to use.
Speaker: Okay, we're going to start the conversation today with where the relationship of AI and data protection came from. Dave, over to you. Thanks. um So for me, AI is very much an extension of the power, the increasing power of technology that happens over the years. For those of you familiar with Moore's Law, which roughly says the power of computers will double every two years or so. And I can remember my first job back in the early 90s, at the risk of dating myself, working for a local, working for Gwent County Council as a computer operator in a massive mainframe that was the size of a small factory.
Speaker: um dealing with those things. And as technology had evolved, it meant that organisations could do a lot more with personal data. and That's why 1984, the first Data Protection Act came into being in the yeah UK. And that was basically there to address the fact that computers could suddenly do so much more with our personal data.
Speaker: As technology evolved, so has data protection with 1998 Act and now we're currently in the UK. We've got three pieces of legislation which cover it, including the UK GDPR and last year the Data Use and Access Act came into power in the UK. Okay, so the start of our questions then. So what does effective AI governance look like in the context of Welsh public services?
Speaker: So I'm going to dive into this one, Sam, and I think ah it's it's a really, really important question that ah it's important for all public service deliverers to consider. So there's an enormous pressure being felt right across the board at present.
Speaker: And there's a, you know, AI is a buzzword. AI seems to be in every conversation. There's a huge expectation that public services are ah being improved and using AI to deliver more, to deliver faster, to save money, save time and so on. And the the question about effective AI governance needs to address all of those things.
Speaker: It's all about making sure that um we don't rush into decisions to buy something because it sounds like... It's great, it's shiny tech, it's going to solve so many problems as per marketer's and spiel.
Speaker: Actually, effective AI governance needs lots of thought, lots of input, and and we we have some and recommendations that we use in CDPS, things like involving and members of the organisation, involving risk and audit committee members, perhaps, or involving...
Speaker: looking at existing legislation and making sure these things are taken into account before steps are taken to buy any um any new shiny promising AI technology.
Speaker: It's really important for data protection to come into play as well because for public services, um almost every public service will deliver a bespoke service to an individual and will therefore have to process their personal data. So while not every AI and new technology will use personal data in what it can do, for public services it almost certainly will. And that's where all the the privacy risks need to be identified as part of that deployment as that's used.
Speaker: What are the biggest challenges facing public sector organisations in Wales when implementing AI responsibly? So I touched on this a moment ago in that there's an enormous pressure being felt, um but public services are generally under enormous pressure already.
Speaker: There's a pressure to deliver more and with less usually. And then there's this promise of this fantastic new technology just just around the corner. and Just buy this and it'll it'll make all the difference.
Speaker: So one of the challenges I think is is realizing that you should take your time before stepping into the market and just buying something. thin um There's question of...
Speaker: governance and and accountability and assurance. So for me it's all about, ah so one of the biggest challenges is making sure that you don't leap ahead and just dive in without proper forethought and consideration of what the technology can do.
Speaker: I'd go on to say that some of the some of the things that people, leaders in organisations need to think about are things like the impact on the workforce. um Lots of the workforce, we've we've done some work with the Workforce Partnership Council, we've got brilliant social partnership principles in Wales and in working with the Workforce Partnership Council, we surveyed lots of the workforce and there are all sorts of worries.
Speaker: You know the the buzzword exists. Lots of the worries come from science fiction movies and the fact that robots are coming in or jobs are going to be lost, and which are not quite accurate, but um those worries exist. So I think, you know, one of the challenges is actually engaging with the workforce and making sure that they understand and what's being proposed, that they have representation, that they can feed in.
Speaker: um that That's just one. There are lots of other challenges too. I don't know if Dave, you want to... Comment on that? I think the challenge has been there for a long, long time. um And in many ways, they're similar to the challenges that we're faced in any digital transformation project. um You could argue now that AI is just digitalizing, transforming ah digitally, existing digital transformations as it's taking it to the to the next degree. And and I think that that one of the biggest challenges really is just getting that balance right between innovation and privacy for us. Certainly in the in the ICO, looking at it from an information rights angle, um our view is that data protection is not a barrier to innovation. It's more of a how-to rather than a a not-do. And it's something that you know that we were certainly work into to promote that message right across Wales and the UK.
Speaker: Yeah, that's some really good messages there. So people should take their time, make sure that things are in place, don't leap ahead and understand what's happening before they make decisions on those things. So with those things in mind, how can public sector organisations ensure ethical use of AI, especially in sensitive areas like health, policing and social services?
Speaker: In terms of data protection law, if you're doing the data protection ah compliance side of things as part of an AI deployment or procurement exercise, then that will help you towards looking at the ethical side of things on there. Just because you can doesn't mean you shouldn't. And within data protection laws, there's a principle of fairness, which means that the processing shouldn't shouldn't ah Should be within reasonable expectations of the individuals and shouldn't have any adverse effects on the individuals as well um So particularly for the the areas that you mentioned around policing and health where there's extra sensitive personal data or in in date protection terms special category data extra care needs to be taken and definitely that can be an ethical choice um but certainly from the the data fairness side of things if you can evaluate the fairness and make sure that that's built into it and that
Speaker: If there are automated decisions being taken as part of the system, um they need to cover the fairness principle as well and have significant human interaction or involvement in there as well. And people have the right to review any decisions as part of that might be taken as part of that as well. And that's whole we built within the fairness principle of data protection laws, which can can help people get things right.
Speaker: I'd add to that, that um we we're in a pretty good place in Wales because we have lots of and guidance and legislation and ways ways of working as a Welsh way of doing AI that and is really important to take into into account.
Speaker: ah so We have the Future Generations Act in Wales, which is all about ethics in my view. It's all about you know the impact of decisions now on on generations to come.
Speaker: um We've got to consider things like the Welsh language and the fact that AI generally is well trained on English language corpora, so it's really good at English language, but less so in Welsh, although that is changing. It is improving and getting much, much better, much more quickly. But and you know with the Welsh Language Act in Wales, we need to make sure and that public services use of AI is is done appropriately and and ethically in that sense. And as part of our standards in CDPS, the 12 standards that set out what good services look like,
Speaker: We need to take account of accessibility as well and be aware of the digital divide and people who do not use AI may well feel disadvantaged. So we've done lots of work with the younger people's commissioner, the older people's commissioner and and and lots of others just to make sure that um everyone who cant who who wants to have um access to AI has has that ability. Public services are for everybody, so we can't exclude um members of the public.
Speaker: Yeah, that's a really lovely way of putting it there Pete, the Welsh way and including the Wellbeing of Future Generations Act is a really good way of ah making sure that the Welsh public sector distinguishes itself from the UK and global approaches to AI.
Speaker: And making sure that we don't leave people behind is a really important part of but the First Regents Act. So moving on now, so what mechanisms are in place or needed to ensure transparency and accountability in AI decision making?
Speaker: but Again, from a ah data data protection perspective, it's built into the legislation and the requirements of data protection. Transparency and accountability are big principles for the the legislation there.
Speaker: So, in terms of transparency, you'll all we'll all have seen privacy notices where we where we're using services, which tell us how information is going to be used, why it's going to be used. um and and the security that might be around it. And the whole the whole that fulfills the transparency principle of that side of things. In terms of AI, it's going to be really important for people whose personal data is being processed by an AI system, that they're aware of how it's going to use their system, when the AI is going to be deployed. and There's also the there's ah the issue of explaining decisions that might be made with AI or how the AI is going to work. um A little plug for our own guidance here that we've got a report on explaining decisions made with AI on the ICR website. And that's really useful and it and it breaks down the guidance in terms of um the the three of the different roles involved in the AI deployment in the the data protect the role of the data protection principle, the role of senior leaders and the role of technical experts as well that are developing the AI systems. And I think that's absolutely yeah important. It's essential in order to be compliant with data protection law, that that's done as part of the procurement and the deployment, and that will
Speaker: enable the transparency and and which can then lead to the the necessary trust and buy-in which I think is absolutely essential and key to the success of AI.
Speaker: I'd add that um there are there are mechanisms to use already in place, and things like the algorithmic transparency recording standard, which has been recommended to be followed by public services in Wales and for any algorithmic tools that are being used with the public, essentially. But it's a really good guide to to consider um what you're doing, who's involved, what the impact could be.
Speaker: um And another... Another thought for me is the um on the transparency and accountability piece. One of our recommendations to public sector organisations is to make sure that everyone in the organisation has some familiarity with AI. So that's from the most junior, youngest, possibly earliest in their career and users to be aware of what their decisions can be.
Speaker: um can the kind of impact their decisions can make when they're using an AI, right up to the top of that organisation, the CEOs, those carrying the can, the buck stops here.
Speaker: i And I've i've heard, ah it is a story, it's not a genuine fact, but this it does illustrate what I'm talking about here. in that Imagine as a junior doctor on the ward who's discovered an app that helps diagnose and skin cancer. They don't use it generally, they think, oh, this is interesting interesting. And they've tried it out on a couple of patients at the end of a very, very long shift. They're very tired. They might not be in the best frame of mind for making critical decisions. They just want to get home. But they've they' found this thing. And maybe it's dismissed something that might have been skin cancer, but maybe probably not. It's OK. Forgot all about it.
Speaker: But then the worst happens. And that patient actually develops into a life-threatening condition. That cancer becomes more widespread. the The chief exec of that hospital trust or that that board may have no idea that there was an AI agent or an AI tool being used in that situation. and There's no accountability there, but yet it's influenced the decision and influenced, in this case, fantasy story, but um a person's life, you know, potentially at risk because of it. So...
Speaker: you know Having an organisation must have, and they probably already have, routes of risk management and transparency for decisions about data. AI should be the same. you know that If there is AI in use, there should be a ah way of making sure that it's transparent and accountable. And again, as we as we're talking about public services here,
Speaker: People don't have a choice about public services. They have to use them, essentially. they you know My local authority, I have to use their services because that's my local authority. Health is the same and the government is is equally the same.
Speaker: um I want to know if artificial intelligence is being used in any decisions made about me. You know, if it's going to help with my job application, for instance, is it going to help and in in any other way? But it's that transparency. People need to trust that organisations using artificial intelligence are doing it the right way. And I think the only way we can do that is by being transparent and open about it um accountable ultimately.
Speaker: Yeah, and I'd go as far as to say with the accountability principle in data protection law, that's about demonstrating compliance, but it's also linked into transparency. Then if you're demonstrating your compliance and you can publish what you're doing with it and how you're complying, then people will be able to understand a little bit more about that that side of things. There's lots of toolkits out there.
Speaker: There's one on the ICA website as well and that can help. organizations show how they've built in this, the the the the the rights of individuals and um and good practice within their deployments.
Speaker: okay That was a really great answer that both. um It's really nice to hear some sort of achievable good practice. So both the having or asking for privacy notices and making both your employees aware what to ask for and making sure that you have your own and making sure that everyone within the organisation has some experience with AI all the way from junior employees all to the chief exec is a really good piece of advice. and We will make sure that all of the links for things that we mentioned are in the show notes. So the explaining decisions made with AI and the toolkit are all below.
Speaker: How do we build public trust in AI systems used by government bodies? I think one of the key tools for us here is the the role of the data protection impact assessment.
Speaker: It's not something that is specific to AI projects. It needs to be done wherever there's new processing or changes to existing processing of personal data. And it allows an organisation to fully assess the risks as to whether or not you know this is the most important The only way to get things done the most in the most effective way, the only way to achieve the goals of the project, whether there's a less privacy intrusive way of getting things done with it with the AI.
Speaker: um And the data protection impact assessment is a really, really important tool and it and it lives throughout the... the course of the project and that's something that can help engender that trust because if you can publish for your findings from the data protection impact assessment it'll just demonstrate our thinking so it not only is an accountability tool as well it's a it's a trust building tool and it's something that we expect to be in place for anything that does that that that does something different with personal data or in some cases does something completely new
Speaker: Yeah, I think this is really important. um As I said previously, you know, the public expect organisations to be using their data properly and looking after that data. um And AI has such a buzzword at the moment and such ah a concern for lots of people.
Speaker: Public sector, and we need to be on the front foot. We need to be saying this is what we're using AI for. This is what, you know, the result is. And also to be... um very transparent about the fact that it's being checked and it's not a black box operating in a corner somewhere with some mystical things going on and an output coming out that's not checked that human in control or human human in loop some people say but human in control and the ability to have somebody double check fact check and
Speaker: you know Yes, hopefully it'll speed up waiting lists. Hopefully it'll give you the information you need much more quickly. Hopefully it'll reduce stress and in lots of situations and various other advantages, as we know. But actually having that...
Speaker: Trust that somebody is involved. There's a human in there that knows that stuff that's being generated is actually accurate, reliable, authentic. And and then being open and honest about that. Let's put it out there. Let's put on a website that we're using AI to do this. Let's use um other tools and techniques ah as we mentioned. Let's share DPIAs. And in fact, one of the things CDPS is busy doing is promoting exactly that. And we're asking organisations to share...
Speaker: we might redact certain information you know but we're sharing dpias and other impact assessments um on a digital sharing hub so we we host the digital sharing hub some organizations have started using it for exactly those purposes and and it's great from my point of view when i get asked Giovanni advice and literally yesterday, I pointed to David's advice about um the ICO's toolkit.
Speaker: ah And I was also able to point to the knowledge hub or the digital sharing hub to say, look, here's an example that somebody's shared from ah another public sector organisation. But I think that's really important.
Speaker: one last thing on this and that is were we're currently conducting a survey of usage of ai right across wales so we're emailing everybody we're nagging everyone to fill in this survey it's not a simple five minute job it's a it's a pretty intense survey of who's doing what with ai in wales and the point of that is to establish a baseline to see where it's being used because it's very widespread already um and also to look ahead, to look at who's doing what. And the idea is we'll be able to share amongst people in in public services in Wales who's doing what and what the plan is for future procurement, future builds, future uses of AI and so that we can learn from each other.
Speaker: And CDPS is all about bringing the community together. Yeah, and I think that learning from each other is a is a huge statement, isn't it? And it's such an advantage that we've that we've got here in Wales as well. um it It could be that there's ah a product that one organisation has found a risk for and is able to mitigate that risk, and others may not have done that. we do were We're probably all familiar with some of the issues with AI systems, with hallucinations and producing incorrect messages or having inherent biases built into them. And ah if an organization isn't aware of those, that surely sharing that knowledge can help organizations be aware of some of the challenges they might face if they're looking at a particular solution to to a problem that they've got through AI.
Speaker: How did data governance and AI governance intersect, especially regarding data to sharing across public services? In terms of data sharing for Wales, we've got the Wales Accord on the Sharing of Personal Information or WASPI.
Speaker: And that is a framework that enables organisations in the public sector to share information um and it helps them share information securely, safely, proportionately and appropriately.
Speaker: And it's something that we would expect to see in place where that that data sharing is regular or even on an ad hoc um one-off data sharing. And I think that the principles that underpin WASPI would underpin a lot of AI and data sharing governance as well. They're so intertwined. I think, as we've said earlier, because public services are using personal data to deliver services to individuals,
Speaker: they will need to undergo or make sure they are screened against the data protection principles. And in doing so, they the the the governance between data protection NIA is very, very similar as a result.
Speaker: Yeah, I think you're right, so which is a good thing. So I agree. the i I think there's already good data governance there has to be in lots of organisations and people should not panic about needing another layer of ai governance. They've already got people in places with the right steps about sharing information correctly and safely. um And AI should be tackled in the same way.
Speaker: They might not be aware of it. That's what we're we're finding, that some people don't realise that AI is their responsibility. But it's here, it's now. People in the organisation that you work in are using it. So if you're already a data protection officer or you've got some kind of information risk owner and aspect to your job, you need to be thinking about AI. If you're not, then, you know, you need to be now.
Speaker: And I think as well, these are organisations it's buy-in into the into the whole concept of AI and and and new technologies that are improving. And we've the the ICO published this year, but we made public our own internal policy on AI.
Speaker: um And we've seen that coming out some Welsh public sector organisations now. And I think it's a really useful tool for for letting everybody in an organisation know what the approach will be to AI. And as Pete mentioned earlier, letting everybody at every level know what they can and can't do with it, what the expectations might be on them, what are some of the risks there. And it's a really useful tool, I think, to to to help get that that governance throughout the organisation.
Speaker: Is the Welsh public sector equipped with the skills and knowledge to govern AI effectively? This is a very loaded question. ah So I've got to say yes and no at the moment. I think there are some parts of the public services that I've come across that are really, really well equipped and they're doing this brilliantly and they've got fantastic things going on and that are being managed really, really well, governed really appropriately. And they've thought about everything from right at the beginning.
Speaker: um Quite often that's building their own, you know, and that's right across different organisations. um But then in others, there's so much pressure being felt to jump on the AI bandwagon that there's...
Speaker: not a reluctance to do governance properly, but there are people looking for almost shortcuts through it. What what do we need to do? What's the minimum we have to do? Can we just trust what's being sold to us? And, you know, I would say no to that. But... um It's it' an ever evolving field as we know AI is changing so rapidly. So will we ever have the right amount of skills and knowledge to keep up with absolute cutting edge changes to the technology?
Speaker: i don't know, but there are definitely approaches that lay the foundation for getting it right in future. and And I've mentioned them before, but we've got these nine recommendations, which are practical steps that people can take straight away. And they include things like having an internal steering group So we've we've done this as ourselves in my organization and it's been absolutely groundbreaking. It's been brilliant for me.
Speaker: It's not just a bunch of people who are really enthusiastic about It's not just a bunch of middle-aged men my age thinking about AI. It's a really diverse cross-cutting section with lots of different opinions. um And it it it's had massive impacts. The idea of it is to and produce...
Speaker: guidance or recommendations for those in in charge of making those decisions and to have some context and and make those decisions based on data. But it's had real impact on our rollout of AI tools, and how we approach it, how we talk about it. And, you know, it's tempered enthusiasm with common sense, a bit of worry. How do we address those worries first? What's the impact? That sort of thing. So,
Speaker: It's not rocket science. I think the difficulty is that there's a lot of guidance out there. you know So I think what people need to do is look at authoritative sources and they would be for me. Dave's in the room here. That's definitely one.
Speaker: And again, you know shout out to the nine recommendations that we have based on yeah UK government guidance, based on Welsh government guidance. It's all about getting it right and getting the foundations set and first.
Speaker: I'd agree that the pressures are ah ah different for every organisation in different sectors, they live in different services. I think ah with AI, there is a knowledge gap there. There naturally will be. I think if you're procuring an AI system, you have to ask different questions and new questions that you've never had to ask before, such as, you know, how did the AI system learn? What personal data is being used? If we are using personal data are in our system, if we're putting personal data into this AI system, where does it go?
Speaker: is Is it staying within our within our estate? um And and you know so their decisions have to be taken based on that. And they're not questions that, like I say, they've never been asked before on some procurement. and So it's about building those things in there. um but But as Pete says, I think it's really positive that we've got all this this information that that is available and can help equip our leaders ah and our and our technical experts. um I know...
Speaker: Certainly for him in my line of work, there's a hugely strong data protection community within within the Welsh public sector. And i think there's a lot of expertise within there that that can be brought in into the projects that we've seen, and that that we see being deployed. And and we do see, like like you, Pete, we do see some organizations have really got it going on really well. There's excellent compliance in others. There may be some gaps. It could be project-specific within there. um But if you can get that the the right people around the table for each project, and I think that's a that's a key way to making sure it's successful.
Speaker: Just before you come back in, Sam, I think that's right. So getting the right people are around the table is really important and they probably already exist. So they may feel they don't know much about AI, for instance, but they've already, if ah if they're the people I'm thinking of, they've already dealt with data protection. They've already got risk um in their job description. you know, there's audit and risk committees exist for a reason, for lots of public sector organisations.
Speaker: You know, there are people who know these kind of things. we're not ah I'm not arguing for that we need to set up an entire new governance strand here is The skills and knowledge to do it might be slightly different, but those processes and those people and those roles exist and the guidance is there.
Speaker: Yeah, those are some really important considerations, especially for those new questions. And I imagine it can be quite daunting for people when they have to come across doing things with AI. And like you say, they've previously done these things with data. So a lot of the structures are actually in place that are very similar. and The first part of what you mentioned, Pete, reminded me of a quote of one of our good practice colleagues has used for quite few years now, which is, the future is already here, it's just unequally distributed. um So bearing that in mind, what training or capacity building initiatives are most urgently needed?
Speaker: This is right up my street. So um digital capability is it's it's an interesting one. So Wales has got some very talented, very capable people.
Speaker: working really really hard in public sector jobs trying their hardest to improve outcomes and services for the people of Wales. and But what we found is in digital transformation to begin with maybe they don't have exactly the right skills needed or they're not enabled to do the things that they need to do to make those differences the most impactful they could be. And that's Probably the same for AI. We've got some amazing areas, ah as as in, you know, we we just said, we've got some people with incredible skills creating ai tools that are, you know, making an immense difference already.
Speaker: ah So, but that's not equally distributed. so there are some places, there are some...
Speaker: hot spots of it. um But there's a lot of worry and a lot of concern and a lot of foundational knowledge needed just so people can understand it's not terrifying.
Speaker: You know, I haven't used AI, I haven't used Copilot because it's terrifying. I haven't used ChatGPT because I don't know where my data goes and and all those sorts of things. So and there's a lot of work going on at the moment in in lots of areas. Everybody I talk to seems to be worrying about foundational AI understanding and making sure that public sector or public servants know the basics, know the minimum.
Speaker: what What are these things? How reliable are they? What worries should they have? um How do they go about it? and We've come up with some simple rules for for our teams in CDPS that we're happy to share.
Speaker: But There's a range here, isn't there? there So that there's skills for everybody who's using AI. So there's that basic introductory foundational sort of side of things. There's skills for leaders and managers in terms of how is this going to impact my my workforce?
Speaker: what considerations should be and shout out to the workforce partnership council guidance that was written and released just before Christmas, which talks about engaging with the workforce and working in a social partnership way. Really, really important for leaders and managers to look at that.
Speaker: and there's There's specific leadership questions. Should we be using AI in this case? You know, is it just because everybody's shouting about it and saying how wonderful it is, is it really the right thing for our organisation do?
Speaker: Do we need to, could could we look at something else? So for instance, the other the other thing on my mind is um ah RPA or robotic process automation. Lots of success with that. Enormous time savings. We've seen in different organisations across Wales. It's not ai although AI gets sprinkled in every now and again. People talk about AI powered RPA, but actually robotic process ah automation no No physical robots in the room. It's just a bit of a... It's a computer program on the screen that automates processes. And doing that can save enormous amounts of time.
Speaker: um The elephant in the room, the bit I haven't mentioned, is the you know the engineering aspect of it, the data science part of it. you know People who are actually building and using AI, there's skills, not so much a skills shortage there.
Speaker: can always do it more. um But again, that's that's going to be a growth area, I think, in terms of skills needed. More and more interest in that. More and more people looking to build their own localised infrastructure.
Speaker: AI uses or or agents. But that's another story. Yeah, and and I think from a training perspective, again, because, again, the use of personal data is going to be so important to these systems, it's going to dovetail nicely with data protection and training, which should be in place across organisations. And what we say for training, certainly the best training, is it's specific to each role.
Speaker: They're going to be different data protection and different privacy issues. faced by social workers versus police officers versus doctors versus school clerks, for example. And I think it's important, it's really important that that that that the training that they receive enables them to do their jobs securely and treat the personal data that they handle securely and safely and appropriately. And there's just a short hop then across to how that AI is going to impact their role and how AI can do that. So I think it could be built into, in some cases, it could be built into existing training method going alongside the organizational policy, as I mentioned earlier, that that can define how the the appetite for towards AI within the organization and let everybody know about it.
Speaker: i got one more thing to come back on that if that's okay. So I mentioned there's lots of training going on lots of people thinking about it. um CDPS have got our own um offer at the moment, but I know in working with Welsh Government colleagues, a pressing and initiative at the moment is the setting up of an AI college for public servants in Wales.
Speaker: It's not a physical building, it's not the plan at the moment, but it will be curated content that's particularly relevant to public sector workers. and So that's been deeply considered at the moment and there a really um there's there's an urgent need to do something so that everyone gets a basic understanding, but there's also opportunities to to grow in particular areas as well.
Speaker: What emerging trends in AI governance should public sector leaders in Wales be preparing for?
Speaker: I think this might be timely for me to answer this one because we've recently published um ah a paper on agentic AI and what the future might hold for agentic AI, whereby pockets of AI processing is happening and being passed to other pockets, other agents, if you like, and combined, they can actually deliver a service there.
Speaker: And it our report is looking at where the date protection and the privacy implications could come into play with those things there. And I think that's something that you need to be, ah aware everybody needs to be aware of. and But my message to senior leaders there would be just to make sure that you are aware of the emerging trends and to break it down into what that actually means for your organization um and and and and see how you can build that your processes around the new technology and and make sure that you can use it.
Speaker: for your advantage. I think there's ah another key message as well for us is that, um you know, data protection and privacy, the laws that we regulate, they're not a barrier to to innovation and and the use of AI. In in fact, they're more of a how to do it properly, how to do it responsibly. So I think um that that's a common myth that we hear but a lot about that I think we can dispel.
Speaker: got to say that's really timely guidance because everybody's talking about agentic AI at the moment. um And one of my worries is what happens to those agents? Who's keeping them up to date when every employee in your organisation can create their own autonomous agent, essentially. And off it goes and is using information to answer certain queries, but that information's maybe updated them you know the main and policy or the main idea behind it has changed slightly and that agent still referencing something that's out-to-date and nobody's checking but if everybody in your organization is doing that that's quite terrifying you know how do you manage that so for leaders yeah let's think about this and um think about how to do it fairly and and appropriately again not to stifle creativity
Speaker: But let's get people doing this in a thoughtful way. um Do we need to be doing it? Should we be publishing? Should we be sharing those agents? Again, we should be being transparent about the fact that they exist and making sure that there there are ways to do that.
Speaker: and There's one other emerging trend that's on my mind, which is um a concept that I've heard recently about, well, it's commonly known as an AI factory, but essentially it's being, my understanding is it's bringing the GPU or the processing power, the the the AI itself, the model itself, in-house.
Speaker: So currently people using AI tend to use a model created by corporations based around the world, um But there are increasing concerns about the the privacy of the data being transferred. and is it being intercepted? Where's it going? And and where's being stored? Those sorts of questions. So people are beginning to think about having their own home-based or office-based AI ai he um Models and having that GPU located in internally, which sounds good in terms of, you know, addressing privacy concerns. But from anybody looking, you know, looking into that organization, how are we going to know what's going on in there? You know, at least with external models, there's ah there's a level of
Speaker: Public expectation is a level of trust that needs needs to be maintained. But if this is ah a ah model that's been trained on your own data, it's being updated inside the black box, inside the four walls of of your office. How can we in ensure public trust in that process? It's an emerging field. I'm not sure if anybody actually doing this in um in Wales at the moment, but it's something that's coming over the horizon, I think.
Speaker: I think with every emerging field as well, if you just go back to basics and and start with your data protection impact assessment, it'll tease out those risks. And if there is a risk of interception or or there's an international transfer of data, it'll highlight those risks. And if you look at your data flows, you'll see which organizations are involved and you'll be able to hopefully put mitigations in place or decide that that's not the correct avenue to go down and and to move into another way. And again, sharing that information, as we spoke about earlier, being open and transparent, I think that's um that that's that's the key to it. That's the key to handling any new technology that that comes down further down the line.
Speaker: Okay, so we've already heard about some really good things that the rolsh public sector are doing um and some things to look forward to over the next few months, like the AI college and CDPS surveys. But how can Wales position itself as a leader in ethical AI within the UK and globally?
Speaker: Well, I might be straight out of my lane here a little bit. and This isn't data protection related, but this is based on my experience dealing with with so many Welsh public sector organisations as we do. And and and'm I'm going to paraphrase. I don't know where this has come from. Somewhere else probably. um But Wales is is small enough to get things done and large enough for those things to really make a difference.
Speaker: And I think the collective nature and the collaborative nature, the natural collaboration that we have, I see i certainly see, between organisations and sectors in Wales, ah gives me a lot of positivity around the ability for Wales to do good things collectively as a nation um and position itself there.
Speaker: ah So again, I think it's that strength in community, strength in sharing and and and and strength in skill sets. Spreading that word will be key to harnessing all the the benefits of the new technology that's coming down the line.
Speaker: I'd emphasise that's right as well. I totally agree. I totally agree. So Wales is definitely a small place which makes us nimble, makes us quick to adjust and get in touch with others and that collegiate nature, you know, we work really well together. It's really important. I'd add that we've got some pretty groundbreaking approaches as well in Wales in terms of things like the Future Generations Act, we touched on it earlier. That that in itself, you know, if if AI is considered in light of and future generations and the impact of use now or building now and you know what impacts arere going to have on on them our youngsters and and people in the future.
Speaker: That's really important. We can capitalize on that. And another one for me is the work that's going on with the Welsh language. So really important part of Wales.
Speaker: ah we We touched on this slightly earlier, but you know the many LLMs that are in use now have been trained on English data or English words um in the most part.
Speaker: It's pretty good at Welsh, lots of them now. they you know They're pretty good and improving, improving rapidly. But for us in Wales to to treat um AI bilingually and do it well...
Speaker: first that makes us a global leader as well as lots of other countries around the world that don't use english as their first language they've got smaller training corpora um so you know i think there is a lot of really good work going on there to make the the um the local dialects i couldn't think of the word the local dialect in wales um recognized by uh ai models um just north and south slightly very different variations on the language and the valleys to cardiff and newport for instance different ah um accents in play different words but scraping all of that from
Speaker: Welsh podcasts perhaps or and not just formally translated documents that Welsh Government or local authorities or health boards or or others have produced will make a difference. and I think, you know, as I say, there's lots going on there.
Speaker: We should shout about it. We're doing really good job. And it's amazing that I've got a nice little anecdote around that and I was using co-pilot to summarize some of the information for today It was just to get the notes ready save me a lot of time going through guidance ah and and making my own notes there and um It came up and said oh do you want me to you know redo the jointed do your summary? That's aimed at the Welsh public sector. Yes, please and it produced a document for me in Welsh I didn't ask it to, but it assumed that because I was in Wales, and I thought it was fantastic. That shows how far ah the the Welsh language has become integrated into into that particular system. um But I absolutely agree with what you say there, Pete. We are in a unique position as ever in Wales, and i think if we can reap the benefits of that, then it'll be for the good of everyone.
Speaker: Thank you for your time and sharing your knowledge today. um Before we wrap up, is there anything else that you want to say that we haven't covered in any of the questions so far? I would just say that if anybody's listening and has any queries on that, then feel free to get in touch with the ICO at wales.ico.org.uk. Get in touch with our team there and we'll see what we can help. Do look at the website for any of some of the guidance that we've put in and referred to today and um hope to hear from people.
Speaker: Yeah, similar. We have... um A public sector in Wales version of guidance. ah It's not different to what's going in the UK or wider. It's curated the best kind of guidance out there, but we've tried to...
Speaker: tailor it to a Welsh audience so that's available on our website and we run an AI and automation community practice so if you're interested in joining that there's a monthly meeting it's only an hour really really friendly really active group great bunch of people come together to raise worries concerns excitement share good news that sort of thing it's a brilliant place to be if you're interested and that group links in to the AI leadership group for Wales that CDPS hosts um and that group late links in to the strategic AI um group that Welsh Government have set up, the AI advisory group that directly speaks to ministers. So there's ah there's a connection there, there's a chain. So if you're interested in in any of those, and please have a look on the CDPS website.
Speaker: That's perfect. It's really... important in the job that we do to share the good practice that we come across and you've given us lots of examples today um and lots of published resources that we can share all the way from the workforce counseling guidance, the work on agentic AI from the ICO and the explaining decisions made with AI and then all of the CDPS resources and Pete if you're okay sharing your in-house rules that you mentioned earlier that would be great and we'll make sure to put in the show notes all the information about joining in the CDPS community of practice.
Speaker: Thank you for being so generous with both your time and your knowledge today. I'd like to finish on one of the quotes from you earlier today, which was that Wales is small enough to get things done, but big enough to make a difference.
Speaker: Thank you.
Speaker: Thanks for tuning in to this episode of The Exchange Podcast. If you enjoyed it, then hit subscribe via your podcast provider to catch future episodes. A quick review and share with your friends or colleagues would mean a lot to us.
Speaker: For more information, check out the show notes. You'll find all the relevant links and contact details there. You can also visit our website at audit.wales. If you have any questions or thoughts, we'd love to hear from you.
Speaker: you
