WTF Recap: Regulation Armageddon—Are You Ready?

In recent years, the tech industry has seen exponential growth and transformation, with companies disrupting traditional business models and ushering in an era of hyperinnovation. This remarkable evolution has triggered an increased focus on regulation across the U.S. and EU.

Jessica Lessin, founder and CEO of The Information, explored the path forward with three industry experts at the 2023 WTF Summit:

• Michele Anderson, partner, Latham & Watkins; former SEC Corp. finance associate director
• Alissa Starzak, vice president, global head of public policy, Cloudflare
• Shelley McKinley, chief legal officer, GitHub

The State of Regulation at the Moment

Lessin opened the conversation by asking what areas regulators currently have in their sights.

Michele Anderson of Latham & Watkins began. “Regulators are focusing on things that are very important to a large segment of our society, whether it’s climate change or human capital. They’re assessing technology developments and the opportunities for fraud.”

What about climate change? Anderson explained that about a year and a half ago, regulators proposed extremely expansive and prescriptive disclosure requirements relating to climate. The regulations involve numerous metrics many public companies aren’t used to disclosing. The final version is expected any day now. “If you’re a public company, it’s going to be somewhat welcome to get consistency in terms of disclosures. But the effort, expense and resources it’ll take to produce those disclosures will likely be daunting.”

Panelists also called out cybersecurity, diversity, security buybacks, human capital–related disclosures like workforce turnover, and crypto as other areas regulators have their eyes on. And, of course, there is artificial intelligence.

The Topic Topping Everyone’s Agenda: AI

Alissa Starzak from Cloudflare got straight to it: “AI is the thing to talk about right now.…We’ve heard rumors of a very long executive order. Congress, too, has gotten involved. And, of course, the U.S. is not the only regulator. It’s not even the most active regulator. There’s an AI act coming from the EU that will probably go into effect soon.”

In 2018, every large global company came out with policies on how they were going to govern AI, Shelley McKinley from GitHub explained. And then they realized how difficult it was going to be to integrate them. “Figuring out how to embed those principles is what companies have been working on over the last few years. At the [Securities and Exchange Commission], they are working out how to hold people and companies accountable for their principles and practices.”

Moving From Principles to Prescriptive Regulation

There’s been a major shift in the regulatory approach in recent years away from the broad-stroke principles McKinley referred to above with AI. “What we’re seeing from the SEC is a recognition on its part that principle-based regulation is not serving investors well. It’s purportedly not giving them the information that they are asking for. The result is a lot of prescriptive—very detailed—attempts to impact regulation,” said Anderson.

Anderson hopes regulators will keep the focus on high-risk scenarios—AI as it relates to consequential health insurance decisions, for instance—and not go so wide as to quash creation and collaboration. Anderson asked: “How do you make sure that you don’t stifle innovation by regulating in every single area that’s not dealing in actual risk? How do you ensure you’re holding the right people accountable at the right parts of the chain?”

Starzak agreed, adding that it’s a difficult balance for regulators, who are learning along with the rest of us as the technology develops. “The key is to actually develop legislation that doesn’t require passing new legislation every time there’s a change. So how do you write something that puts guardrails in place but doesn’t mandate? It’s not easy.”

What Can Companies Do to Be Prepared?

Anderson recommended putting the right procedures and processes in place early on. It’s much more difficult to do so when you’re bigger or public, she noted: “Make sure you’re documenting things well, that your information processes are solid, that people know when to report things up the chain and to whom they need to report them. And, of course, you need a good lawyer.”

You also want to create an internal culture where you have employee buy-in and participation, said McKinley. Accessibility is an area where companies have had great success. They’ve helped their workers see the impact. People feel proud and inspired to work to drive change. “You have to figure out how to sell it. Why is it important? Why should people care?”

One of the best ways to navigate the world of regulation today is to learn from others—and McKinley suggested you do just that. Pointing to AI, McKinley said, “One of the pluses of responsible AI right now is that it’s basically been open sourced. You can look at the Microsoft Standard. You can see the governance processes, how the whole thing takes shape. It’s a great way to get up to speed quickly.”