Your Staff Already Use AI. Who Owns the Risk?

Chris Hutchins: Welcome back to The Signal Room. I'm Chris Hutchins. Quick thing before we start. I wrote a book. It's called Beneath the Signal, and it's about the human work behind trusted data and responsible AI in healthcare. Search Beneath the Signal on Amazon now and pick up your copy. Okay, here's our episode. My guest today is the co-founder and CTO of Liminal. With more than 15 years across software, AI, and enterprise architecture. He's led engineering at Fortune 500 scale, was a CTO of a pharmacy savings platform, and ran engineering innovation inside FIS's Impact Labs before co-founding Liminal. His argument is a contrarian one, one of my favorites. You don't wait for perfect AI controls before you deploy. You govern what the AI does while it runs with the controls you already have. Aaron Bach, welcome to the Signal Room.

Aaron Bach: Thank you, Chris. Great to be here. I really appreciate the opportunity. Looking forward to it.

Chris Hutchins: I've been looking forward to it as well. I mean, I always love the chance to kind of connect with my guests beforehand and really enjoyed our conversation. I'm really excited that everyone else gets to get in on it now. I'm sure you're not going to run out of great insights. So this should be a fun conversation. So I want to start with something a little bit provocative, so to speak. If you wait until your AI controls are perfect before you ship, you never ship. So what's the least you can put in place today and still look at a regulator and a patient in the eye and be comfortable with it?

Aaron Bach: It's so true. I think a lot of the industries that I've worked with in my career and that we serve, healthcare but also other regulated industries, they are trapped in that exact motion that you described, which is we've got to have our processes put together and we've got to have committees review them and we've got to have reams of documentation. That's kind of the traditional way that healthcare and other industries have had to run for so many years. It is directly contrary to the kind of progression of introducing a new technology. And we've, look, we've gone through technological revolutions before, but the AI as we know is progressing faster and more impactfully than anything I think we've ever seen. And it's, it's stressing the boundaries of that notion of get all your stuff in a row before you deploy it in any way. It's not being contained by that practice like it used to be. And so I think on your notion of, you know, what is, what is kind of that one thing you got to think about? This is something we talk about with our customers all the time. If you are going to wait until your processes, your governance, your committee decisions are perfectly put together before you roll out anything, number one, you're probably not going to get there. But number two, your users are already using this. They have already found the benefit of it elsewhere. And the belief that people are going to refrain from using it in a professional setting because it hasn't been authorized, unfortunately, is just not accurate. A lot of data shows that. I'm a big fan of get your toes in the water in somewhere or another. You have to do that. And it's going to require a different way of thinking about this, especially in a world like healthcare.

Chris Hutchins: I love that. Before we jump too much into you know the real exciting stuff for the folks that are really technical and really trying to solve significant problems with AI, who I'm sure are gonna learn some things today. I wanna hear just a little bit about your why and then we'll kinda delve into your path as well. But just tell the audience a little bit about yourself and what has been your journey that led you to be working now in the healthcare space in the way that you are.

Aaron Bach: Yeah, you know, as you mentioned, Chris, my entire career has been in technology. I was born a technologist. You know, my grandfather worked on the Apollo space program. My parents are technical people. You know, technology was always in my bones. And so from the earliest age, I was fortunate to know what I wanted to do. I wanted to build things. I wanted to create things. You know, for a lot of my career, and I've run the gamut across industries, types of technologies, things that are deployed applications, hardware, mobile, AI, that's begun here. And, you know, for the longest time, I think I ran into a feeling that a lot of people in technology have felt at one point in their career, one, at least one point, which is, this is cool, I'm building interesting things. Is it really doing anything materially positive for people around me? You know, I'm not going to pretend that everybody has that sort of crisis moment of asking that question. But I really started to think about, you know, building certain applications or rolling out certain deployments. I could see their use, I could watch human beings interacting with them, but as to whether it was actually creating a benefit in their lives, I couldn't answer that. So, you know, kind of what I'm doing now, the perfect moment in time of AI becoming this force of nature back in 2023, but also having had a lot of experience in regulated industries, watching them actually trying to serve real people, you know, in your world, watching clinicians and front office staff and providers trying to materially create a better outcome for their patients. Watching small credit unions try to serve their members better, watching insurance providers try to rethink how they're going to provide benefits to their members. I started to kind of feel this scratching of sort of a confluence or maybe a moment in time where multiple things crossed for me. Number one, here's this huge opportunity with this new technology that is moving so fast. People are really excited about it. They're also kind of scared of it. At the same time, these industries serving core human needs and thinking about these individuals, not only serving their downstream users or customers, but also, Chris, thinking about the people in these industries. I bet you and I could think of hundreds or thousands or more of people in healthcare who want to do the best job possible. They want to provide those outcomes and they are buried under manual processes and endless work and trying to do their job and then get home to their families and they're trying to kind of struggle through that. I just started to see this kind of feeling here that we could cross a really interesting moment in time where there was a technology that could provide material benefits to people in a way that hadn't happened before, but also to actually serve the human beings in those realms. Look, you know, I'm not a first responder or somebody working on front lines directly saving lives. There are individuals who actually do that. For me, getting to this point, I've been really honored to understand how I could combine my long, almost 20 years of loving and building technology with maybe the greatest technological revolution I've experienced in my life with an opportunity to serve real people in the industries that need it most. You know, I'm very fortunate to have arrived here. I think every founder, every entrepreneur would say the same thing. And there's a good amount of luck at arriving where I'm at. And I'm really grateful to be in a spot of helping real people with real problems using the tools that I happen to love very much.

Chris Hutchins: That's incredible. I love the diverse background you come from. And you know what your parents probably had for aspirations for you, probably early on, hopefully that you'd be, you know, walking in the footsteps kind of thing. And it just seems like you've taken that in a whole different direction. It's compounding the impact even more than what you or they probably anticipated could be done. So congratulations on the success you've had so far. I think it's really phenomenal and I love and admire people who bring this kind of intensity innovation and passion into the healthcare space because you appreciate, understand, and want to support the mission. Tell me another industry where the payback can be so immediate when you have the satisfaction of seeing an individual that's benefiting from what you built.

Aaron Bach: Absolutely, gosh. You know, when I think about us serving financial services, serving state local governments, serving school districts, you know, there's a lot of impact there. Every one of us, for better or worse, ourselves and our loved ones is attached to health care, are attached to its services and outcomes and positive stories, difficult stories. It is, you know, maybe one of the three or four or five core human needs. And so I'm 100% with you being able to kind of step into a space that I know I will need in my life, others that I care about will need in their lives and we will need it to be done well and to be done efficiently and with good outcomes. And I agree with you, I'm very, very motivated to be connected to that mission.

Chris Hutchins: I love it. So let's kind of get started on a little bit about the past. So, you know, you went from a Fortune 500 company in an engineering style and approach with a scale that's you know beyond what most of us do in the healthcare space, then you became a CTO of a pharmacy savings platform, then to FIS's Impact Labs, to co-founding Liminal. What convinced you that gen AI has to be governed at the behavior layer, not just watched on a dashboard?

Aaron Bach: Yeah, you know, early on, Chris, as with many entrepreneurial ventures, it was a gut feeling. It was sort of this kind of aura that was around me of kind of watching how people used technology, how they thought about working through problems. In a particular setting, though, early on when we founded Liminal, we actually did, you know, kind of the direct motion, which was we paid for some research. We paid individuals across industries just shoot straight with us about your use of AI. And this was, you know, middle 2023, ChatGPT had exploded onto the scene, but it was still very new, very nascent. And so we asked a lot of questions without trying to tip our hand too much, but it was very geared towards what is your organization doing with AI? What are their policies, you know, what's your thought on those policies? We're really trying to get to this core notion of were these employees actually doing what their organizations believed they were doing with regards to this rapidly emerging technology. And what we found, maybe not surprising, it sort of confirmed for me that feeling that I had, but still kind of shocking to watch. There was a huge number, Chris: almost three out of every four employees that responded said, yeah, we're already using AI tools at work. Whether they're provided by the organization or not, I'm already using them. The belief of the speed of this thing was very much confirmed. But the bigger one of those three out of four, two out of every three of those admitted to us, I'm using unsanctioned generative AI tools at work. These are tools that my organization doesn't, it's not that they don't have an opinion. No, they have an opinion. They have explicitly told us we are not allowed to use this, but for one reason or another, I have known of the benefits of this thing and I'm kind of using it. And so that's sort of where the notion started of why can't you just view it in a dashboard? Maybe the notion has always existed in terms of shadow IT. People are doing things whether you think they ought to or not. And then this particular case is we interviewed more of these individuals. We found something that was striking in, I think, an affirming way, which is the vast majority of these individuals were not setting out to harm their organizations. They were not setting out to break rules or God forbid, introduce vulnerabilities or do anything malicious. These are not, you know, hackers waiting to get into the network. These are people, as I spoke to earlier, who are looking at a tool that promises to be able to allow them to do various tasks faster, more efficiently, higher quality. And they're thinking, I'm buried. I've got so much on my plate. I want to get my job done. I want to do it well. I don't want to go back to my life. And it was this kind of crystalline realization for me of, how in the world could I say no to that? And I was brought back to what I've known for years. I've been in product development technology my whole life. The CIO and the CISO have always been good friends of mine at every organization I've worked at, many customers and partners. These individuals, as I know, you know, they are the javelin catchers. They are the ones I think I always tell people I think of the CISO in particular as Hollywood special effects. If they're doing their job well, no one's ever going to notice. And if they don't do their job well, everyone's going to notice and everyone's going to talk about it. Right. So their standard motion has been, well, I cannot put us at risk, so I've got to shut things down, lest they produce risk. So I started to think about, my goodness, the CIO and the CISO, that's sort of how they've run forever because they've had to. My gosh, here's more than half of employees are telling us that they're using unsanctioned AI tools. We're heading towards a bomb going off somewhere. And that really, back to your question, it is about behavior, but from both sides. It's behavior of the individual who's trying to use the tool to do their job, but it's also the traditional behavior of cybersecurity, which is shut down, block, you know, wall you off, shame you a little bit if you try to break through. We sort of had this belief that I didn't know if it was going to be fully possible at the time. But we had this belief that if we were going to solve a problem like this, we had to develop the behavior of both sides, we had to give the cybersecurity the tools necessary to feel confident that they could govern and audit, you know, all these interactions, but we also had to give the user a sense that the organization was enabling them to use the technology. And so long winded way to say, when I looked at this, cybersecurity, I think, long has been very focused on the dashboard, because they have to be. This is moving so fast, human behavior is moving so fast with it, the cat's out of the bag. And so a shaming blocking motion, which a lot of security tooling does, I think runs the risk of enforcing the user behavior that is scary in the first place. And so if we can govern this from the side of both behavior, that's where I think the real opportunity is.

Chris Hutchins: You know, there's some great things that you just mentioned there. And I think one of the things that we probably don't really understand, first of all, your sentiment about CIOs and CISOs, couldn't agree with you more. I don't think I would still be in healthcare had I not been around some extraordinary leaders that are in that space. I mean the threat matrix that is being monitored and hopefully kept ahead of by some very, very smart people, always looking at the evolution of that threat matrix. They're doing things that we don't even know most of the time. But there's a good chunk of it we can know about. And even that is just mind blowing because there's so much inundated and concentrated work that people are targeting health systems. And the numbers are staggering. So, you know, the fact that I still have hair and sleep at all is probably the result of having really great people, partners, to work in those spaces so that guys like me can get some rest and keep pushing the envelope of data.

Aaron Bach: It's so true. So true. I'm sure you have too. How many rooms have we sat in? I've been a part of many such conferences and seminars or whatever with CIOs and CISOs and the exhaustion on the face is not only with hearing the words AI, but the exhaustion with here's another thing that to your point that I've got to add to the threat matrix. And then I've got to somehow, my goodness, I, just, you know, knowing that audience is fundamentally why I got into cybersecurity software in the first place. They're exhausted and they're carrying the lion on their back and very few people are really…

Chris Hutchins: You know, to your point, it's not the most glamorous job that everyone talks about. But I mean, I love this analogy because I kinda had to think through how do I make this translatable for people. The idea that if you know who they are and you see them, then probably things are not going well. I liken them to the audio engineer that's, you know, running the mix for your favorite live band. If you know who the sound guy is in the course of a concert, that's probably not a good thing. Well, let's get into this, you know, the perfect piece of it that we kind of tend to aim at. It's interesting. In so many different ways, oftentimes we have exceptional people and they know that, then we've got the 80 percent handled. So they kind of focus on that 10 to 20 percent that's really nuanced and hard.

Aaron Bach: Probably not great.

Chris Hutchins: And sometimes we actually go a little bit overboard with that and we neglect some of the other 80 percent or more that we should be doing well at the same time. But you talk about shipping the governance you have; that's the phrase I think I've heard you use. What does that actually mean? And what are the first controls you put in front of a clinical AI tool today before anything's perfect?

Aaron Bach: It's a great question. And I admit here, Chris, I'm, you know, from a background of being a pure-play technologist, to recognize, you know, I kind of have the vision of moving fast and trying things and adjusting those things. And, you know, there's a, there's a certain degree of that kind of entrepreneurship that you can't do in healthcare, right? We can't, you know, ship new drugs and try them out really rapidly and see what. So I understand that maybe the kind of perspective for a long time of how pure-play software development works is just not going to work in healthcare. But I think there's actually some interesting kind of parallels. For almost my entire career, there was a long kind of drawn out conversation on agile software development. That was just the rage for decades and decades. Software development's moving too slow, how do we speed it up? And I think there's a lot of argument about what was produced was more different types of governance. It just has a kind of more interesting tagline to it. But I think what a lot of software developers learned and product managers and people developing product, they learned that, man, we are spending months and months and months producing product specifications. And then we're going to spend more months talking to customers. And then by about month seven, we'll start building. And then we're going to build for like a year. And then we're going to QA for six months. And it's kind of funny to look at software development through that lens now because the world moves so quickly. And the environment changes so rapidly. Okay. I look at kind of what I imagine most of these regulated industries that we work for, including health, we have got to make sure that we are buttoned up, we are under regulatory compliance requirements, there are pretty stringent penalties if we break those compliance requirements. And so we're going to spend the six months producing the report with the consultants, then we're gonna spend another six months testing it, etc, etc. Here again, I think there's two things that AI has triggered that are going to make this particular approach challenging. Number one, we've already talked about employees are already using it without being too abrupt about it. Anyone who believes because we have said AI tool X is not allowed. That means our employees aren't using it respectfully. It's just not right. That's not the human behavior we have observed time and time again. So number one, people are already using it. But number two, I think about this a lot in healthcare, Chris, lately: the generation that kind of maybe just took their physician's advice, you know, during their annual visit, and then I'll see it next year's annual visit. And that's all it ever was. That generation, you know, is getting older now. And the generations that are coming up behind it, they are used to really fast asynchronous communication with their service providers, they are used to self service, right? They are used to talking more to technology than they are to people for better or worse. So the second thing I see here is the customers of this industry are changing and their expectations of those customers are changing. And so when we come from wait for perfect here, I'm going to keep returning to this notion that healthcare, like so many other industries has long had this process of we are going to work out the plan and then we're going to talk about the plan. Then we're going to test the plan and then we'll roll the plan out to a few people. And seven years later, it will be in great shape. I think now at this point in time that moment is knocking on healthcare's door, that strategy is not working and it's not going to work. So what does it really mean when I say ship the governance you have today, I'm certainly not saying that if you don't have any governance whatsoever, just kind of shotgun an approach out there and hope and pray it works. Clearly we're not saying that. No healthcare institution is going to survive with that attitude. But I think what we have seen serving a wide variety and honestly, a lot of our customers are more traditional, maybe mid-market healthcare systems. And I think there are a lot of lessons that can be gleaned from these organizations. They've got small IT teams, they're already burdened with how much they're trying to do, they recognize their employees and their patients and the users, whoever they are, are running with AI. And they've had a motion of kind of not developing an overall AI strategy, but kind of allowing the select deployment of AI tools or processes to select individuals, letting that motion help build what the AI strategy is. It's another element that I kind of see time and time again, and not knocking anybody and certainly not knocking AI, but we all have a tendency to kind of build huge committees and here's the plan and now go and act the plan. When really I have to think from my experience of what I've seen, I have to think a lot of the very best use cases in healthcare for AI are sitting with front office staff right now. They're sitting with PAs and clinicians. They're sitting with the individuals who the very best kind of workflows are already in their minds, but they don't see them as AI workflows. They just see them as this is what I do to get my job done every day. And so shipping the governance you have, how can we enable this? If I was going to be contrarian with a healthcare entity, this quarter, what is the one team or the one department that you could roll out a production and I'll explain what I mean by that production AI use case and feel comfortable with it for the purposes of watching how the actual individuals doing the actual job or using the actual tool. It's not rocket science, but this idea of getting people boots on the ground, right, frontline people in the game and allowing their experiences to actually produce the outcomes to produce the workflows and use cases. It kind of decouples you from that old world thinking of big plans and let's have an AI strategy and let's have all the perfect workflows mapped out before we tell our employees about it. And instead it flips the pyramid a little bit and allows people's real behavior with a safe and sanctioned way to use the tool to actually show the organization where those high value use cases are. And then I think, Chris, at the end of it, you've got somebody who's actually trying to do this, and they're actually trying to serve a need, versus it being more intellectual or philosophical.

Chris Hutchins: Now you've hit on a couple of things that I think are just elusive sometimes for folks. And the first one's around governance and whether it's happening or not. I think you point out something really important. There are people that are operating in particular verticals that are subject matter experts in what they do. Now the things that they have to do to make sure that they're being compliant and they're, you know, protecting the data, to your point, is part of their jobs, part of their core competency that they've developed over time. So when we're talking about introducing governance kind of conversations, it's not that we are adding something that we don't already do in most cases. It's making sure that we've got common understanding of what we do and how we do it and what some of the guidelines are. And to your point, let's not just do it in a vacuum somewhere. Bring in the SMEs and let them help to really codify what we actually have, what we really know, so that there's visibility that's there. And on occasion we're gonna stumble across things like, you know what, we probably need to adjust that or tighten it up just a little bit because here's a risk. That's more likely the scenario that people are facing, I think, for the most part than they actually maybe even realize. And the other side of the governance, to your earlier point, is the real value comes when you have something you have to make a choice or a decision about. And right now, use cases are probably, you tell me if you disagree, but I think they're one of the biggest needs that we have in terms of governing which ones should we be focused on and do we have everything in place to do that? What's your assessment of that?

Aaron Bach: Absolutely. Absolutely agree. And I think it's right on the money, Chris. And I would even say, one of the things we've begun to notice when we think about agentic automation, words that every CISO rolls their eyes at because it's just getting talked about constantly, so much of what is being talked about is here are the systems, quote unquote, for health care. Here are the use cases for health care. And here's the entrepreneur in me. So take this with a grain of salt. But you might as well say, here are the use cases for humans on planet Earth. You know, at the end of the day, a problem statement that large and attacking such a wide generic swath, I think 999,000 times out of whatever, that's going to just die on the vine because people who are already burdened are already trying to do so much to move their institutions forward. They're going to look at health care use cases. And I would think a lot of them are going to say, this doesn't describe me and I candidly cannot pierce past the generic tagline to find me in there. So I think you're right on the money. And I would even say finding the great use cases in healthcare probably more often than not comes down to what are the use cases derived from my healthcare institution through the lens of my employees. One of the things we're particularly passionate about is this idea of behavioral automation, which is rather than kind of building things in a vacuum, as you say, could we watch Chris and Aaron working in their institution and could we detect with high accuracy what they're trying to do and where they get stuck and what frustrates them for the purpose, not of surfacing great healthcare use cases, but great use cases for Chris and Aaron who happen to be operating in this healthcare suite or this institution. I think this desire to have a one size fits all strategy for everybody is very human. Of course, we want to know that we're doing what's right by how humanity decides what's right. Probably more often than not, to your point, there are actually great use cases for your small rural healthcare system that you're not gonna read about through some huge McKinsey report on AI and healthcare. It's gonna have to come out of the workings of the front office staff, the clinicians, et cetera, working in your environment. I'm a big believer in that. I'm right there with you.

Chris Hutchins: There's this whole governance conversation with the backdrop of a culture that's kind of reverted backwards a little bit in terms of trust. This, the trust piece of it, is the part that I think we're now starting to understand a little bit better where we need to dig in on that. Because for this to really work, you gotta trust the people who are up close and personal. And historically we'll talk to them for a little bit and then we'll go back and brainstorm, we'll go ahead and develop something and then expect them to just deploy something new and start using it. This isn't a drive-by requirements gathering exercise you do one time. We're talking about an evolution to your point. This stuff is a living, moving, breathing thing that we're introducing. And it does take an ongoing review of those things. Agile methodology was an interesting way for us to get our toes wet a little bit, but at this point it's way beyond the cycles, you do a seven-week sprint, eight-week sprint, whatever it is that you're operating in. This is way beyond that and it has to be scaled. And it does matter and impact the frontline people who are gonna have to execute with the tools that we give.

Aaron Bach: Yes, it's so right on my mind. When I think about the frameworks that people try to apply to AI risk, the NIST AI risk management framework always comes to mind. It's one that we hear about in healthcare and other industries. As you look across the different nomenclature in that framework, this notion of AI and how it's deployed and what it's doing for us, this fits squarely in the manage portion of the framework. It's not a policy problem. Manage takes actual action. And you're right. How many times has there been some home office somewhere dictating standards from on high and then suddenly that cage is put around the front line. I also think, though, as we're discussing this, Chris, I've seen a lot of other situations where suddenly it's there's diversity in the discussion of how AI or other tooling is going to be adopted. But it's sort of theater in terms of committee. There's physicians and there's cybersecurity and there's legal and there's compliance and there's a billion people on that committee. And so it's very representative, but the same problem is there and that nothing's getting done. So I feel like the manage portion of it is some sort of intentional action that skates the line between ensuring there is diverse representation of everybody who's going to be impacted by this tool, but also that it's not just dictated from on high. To your point, it takes diligence. It takes persistence. It takes moment after moment after moment in any institution that sort of believes as many of us have at points in our career, I've got my AI policy, it's now on the shelf and when I need to know anything about it, I'm gonna pull a policy off the shelf. Anybody who's in that mindset, you're already behind, right? The people and the technology and the alchemy that this has made is changing so rapidly that whatever you do to manage it has to be active and it has to be persistent to your point. It can't be one point.

Chris Hutchins: And this kind of goes into an area that I know you've talked a little bit about, but this whole idea of a multi-model approach, sovereignty, managing the risk. There's just a lot of levers here, but having the right partners, I think, is a really important thing to do. And I think historically it's been difficult. And I was telling you my own experience, I'm sure you've had it, countless people are dealing with it even today. From a ratio standpoint, there are so many technologies that are coming to the forefront. On a daily basis, brand new things, brilliant. Leapfrogging the things that were done yesterday, that's going on. So the ratio between solutions and a health system or solutions that an executive that's gonna make a decision, those numbers are staggering. My inbox has never been easy to keep up with, but it's gotten exponentially harder over the last two to three years in particular. So, I mean, if you've got a thousand people a week trying to get a meeting to show you their technology, and that's not an exaggeration. Probably some people deal with more than that. That's an untenable amount of activity that no one's being paid to do. If you're in the health system, you've got responsibilities, and that's not a full-time job, and it shouldn't be. But you know, you've argued that leaning on a single model or vendor is in and of itself a governance risk, which I happen to agree with, and I like how you talk about it. But tell us why. What does model sovereignty mean for a health system holding PHI, and what are your thoughts on the best way forward for organizations who are trying to figure out the way to diversify and have 20 different solutions in one big wide area? Or should we be thinking about development partnerships that allow us to grow and adapt fluidly?

Aaron Bach: Yeah, great question. You know, back when we founded the company, Chris, in 2023, as I mentioned before, ChatGPT was all the rage and that's what all the news talked about. But there was the beginnings of this little company called Anthropic. There was the sense that Google and Amazon, they're not going to stay on the sideline. Microsoft, come on. And so early on, we sort of had this somewhat cheeky, but I think time tested belief that the world was going to become multi-model and not simply because there'd be more people providing more technologies, but because the different approaches to those technologies, to those models, to those agents was going to produce outcomes that were materially different. Model X might have a particular approach or style or training set that is well suited for a problem over another. I think stage number one, it's an obvious thing, is accepting that truth. I can't tell you the number of organizations that I've worked with, healthcare and otherwise, who come into, you know, maybe a demo with us or a conversation with me and you sort of learn very quickly what they're hoping for. And God bless, I understand why they want this. They want a single solution for "AI," air quotes. Because of course, to your point, they're already burdened. We've already got a huge catalog of solutions we're managing. I'd love one place for models, for agents, for workflows, for governance, for security controls, for observability. I'm here to say, and I'm very straightforward with this, even with our prospects and customers, such a thing does not exist. Every single time we have watched an organization pick even a large name and try to deploy that as their one size fits all AI strategy solution, it falls down. And it falls down simply because no one platform has got every single capability. People say AI, I'm kind of chuckling here because a vast majority of my conversations is helping individuals and organizations understand that AI is really representative of like 15 to 20 unique product categories. It'd be like saying that I'm going to mix and mash my cloud services provider with my hardware manufacturer, also with the person who handles my transportation. I mean, it's all over the place. And so I think number one, an institution, an organization, cybersecurity, but also from an executive level has to understand that to do AI is not one solution. It's just a hard pill to swallow when we all want one solution. Of course we do, right? Because the visions of it are in our head. But once you accept that, I think that naturally drives organizations down the correct next road, which is, well, if this is 15 to 20 product categories, what are those categories and do they matter to me? Again, that sounds obvious. You know this just as well as I do. The media around OpenAI, Anthropic, Microsoft, Amazon. They're blitzing people with new frameworks and new technologies. And we just deployed this new thing and here's this new stuff, da da da. People are overwhelmed. And I think part of the overwhelm is it's coming at them with such speed, but it's also using a verbiage that they're not terribly well versed in. And so kind of recognize, okay, there's not one size fits all for AI because that's made up of 15 to 20 product categories. Maybe just the nudge needed to understand the product categories just enough to say, Do I really need a general purpose tool? Do I really need a coding harness? Do I really need a design centric tool? I'll notice that a lot of times we get people coming to us and they'll talk about a tool like Claude Cowork and they'll sort of bring it to us as my CEO saw an example of Claude Cowork and now they want the whole business running on it. Not recognizing that Claude Cowork is one particular type of tool built on top of a coding harness, very good for certain use cases, not necessarily well suited for others. They don't know that because the media doesn't advertise it and God bless Anthropic. The marketing does not pitch them as, I really want you to understand what this does. They pitch it as here's this really cool product. Come check it out. Okay. So we go from AI is this writ large thing to multiple categories and maybe that'll nudge people into a position of understanding what those categories are. I think that's where this has to start.

Chris Hutchins: No, I totally agree with you. I think there's just a lot of the hype cycle that we see whenever something new comes on the scene. And I mean, I get it. It is fun. I mean, I was probably more excited and enthusiastic the first couple of times I started to see some real measurable impact, stuff that I do myself. But then as I continue to work with it, I started to realize that I'm the guy actually putting input into it. And that's actually having an effect on the direction it's going. Sometimes that makes a lot of sense and it's right. Sometimes it reflects the way I think through and analyze a problem to get to a conclusion. But by the time I make my conclusion, this thing has actually kind of already delved off into one direction, past a point where it's going to be easy to bring it back. And so the prompt engineering stuff, I think is an area. And please, I'll tee this up for you to take a good swing at it, for executives to really just understand, as complicated as it may seem today, for you to figure out from all the inputs you're getting, which are the right things, it's even more important, I think, that the people who you're expecting are going to use these things have some basic training to understand how to write the prompts. Because this is more so than any other thing. So data visualization is a good example. I don't know, decade or so ago, we started seeing great visualization software. When you plug it in, you can put data into it, whether the data's good or not. It looks perfect. And people think it's brilliant. They like the movement, they like the interactive nature of it, but it didn't actually address some of the underlying problems. And they had to figure that out the hard way. Your data quality is going to be the driver of everything. And just because something looks great, that doesn't mean that it is.

Aaron Bach: Man, isn't that the truth? And what a good moment for humanity to remember that just because something looks good does not mean you're 100% correct. People kind of quickly whiffed over model hallucinations as a topic. I can't tell you, Chris, you know, just speaking in my own world building software, I use agentic tooling to help me in that. I cannot tell you the number of times I have watched a model's reasoning process. Its internal dialogue as it's trying to come to the conclusion I've asked it to. And I'm watching it. And it's just making so many slightly wrong calls. Now it's trying. But I feel like what I'm watching is I'm watching a very enthusiastic, very junior employee do a bunch of things. And dad over here is trying to say, whoa, like, you don't go down the seven roads. But I can't tell you the number of times in my tooling I'm hitting my escape key. I'm saying, hold on, that's not the direction to go down. Now I'm savvy in this space. I work in this space. I've got the intuition. You're absolutely right. Think about the downstream individual who maybe doesn't have the training around. By the way, folks, this is not a search engine. It is a statistical generator. It is trying to pick the most statistically likely next word in the sentence. So here's what you need to think about. How many people are sitting downstream from us right now going, wow, this looks really good to your point. It looks really correct. It's worded better than I could word it. By the way, I'm really busy right now. I've got a lot of stuff, so I'm going to huck that email or that, you know, diagnostic or whatever over the fence. And then, you know, we can laugh about it. Somebody on the other end, just ingesting your AI-produced thing and another AI to produce another AI thing that gets hucked over the fence somewhere else. Not only is there no one size fits all for this tooling, it does not replace your individuals, period. Now I understand there may be some job functions out there that are going to change in healthcare otherwise based on this tooling. But the human being's ability to discern whether what you are looking at is correct is the outcome that's actually needed is not subtly wrong, is not replaced. 12 to 16 months ago, we heard it was going to be replaced. It has not been replaced. I'm here to tell you that the human being is more critical than ever. And to your point, our staff, the downstream front office clinicians, whoever, how in the world can we expect them to just pick that up on their own? We've got to do a better job if we're going to equip people with the tooling to give them a sense of understanding of how they are going to remain in command of it.

Chris Hutchins: Right. And I think it goes along the same guidelines that we've historically, I think, done a reasonably good job with, at least in any company that I've been a part of, you can speak for your experience, but I think companies do a relatively good job figuring out what it is that they need to teach people during an onboarding and training process to help them to be successful in their job. Now, introducing AI in it and just assuming it's gonna be automatically be valuable and your employees are just gonna figure it out magically. I think that's the wrong assumption and I think that's what we're talking about. The training has to be adapted to be able to incorporate the AI and which means the people need to have a healthy relationship with it, means they have to understand it well enough to have a healthy relationship with it.

Aaron Bach: Yes, right on the money. And here we can see the easiness by which we can fall into the extremes. It's really easy to fall into the extreme of get a committee together, spend a year, talk about it, develop a process that, not knocking it, but that's easy because it's understandable. We get the people in the room and we debate and dialogue and then we produce a document. It's also easy, you know, I'm not saying I see this as much in healthcare, but it's quite easy to go the other direction too of just, cat's out of the bag. I can't control this. So please, anybody, don't do anything dangerous. You can see how difficult it is here to do this well. It's the right amount of governance with the right amount of freedom, with the right amount of training, with an ever present, ever persistent sense of vigilance through it all. That's hard to do, but it's what's required to do it well.

Chris Hutchins: Let's talk about the risk piece of it for a minute. You know, we're getting close to the end. I wanna make sure we hit this and I definitely want to hear your advice and wisdom to some folks out there that are having to make decisions on a daily basis. But talk about the risk, 'cause I think people understand, at least on some level, that who owns the risk is still really where it has been for a very, very long time. But because it's now touching the patient more directly and, you know, there's an awareness of the outcomes that maybe wasn't as pronounced as before. Where does the human review need to sit before a tool acts? And you mentioned this before, but where is it just theater? Because there's places to do it. And we're not talking about buzzwords saying human in the loop. Yeah, we need human in the loop. Yeah, great. What does that actually mean? And where does that human actually sit and have the ability to question or challenge an outcome or to raise their hand and say, will it stop?

Aaron Bach: Absolutely. I think, you know, Chris, from my vantage point, I think it sits, it sits in different spots. And I will say, this is not a challenge unique to healthcare. I cannot tell you across all the industries we serve who owns AI is still an incredibly unanswered question. And because as you point out, a lot of times where it started is, well, we're going to try to fold this into our existing risk management program. So it's going to be a mixture of cybersecurity. Legal is going to be in the mix. Maybe there's a bespoke governance function. But my God, it's moving so fast and people are using it. So that's not sufficient anymore. OK, well now we're going to have an AI officer and that person is going to be in charge of AI. OK, but how does their work in terms of risk overlap with the people who have risk in the title? Point being, I think this is still a very unsolved problem. So from my vantage point, I think risk has to sit in kind of a multichannel approach with appropriate elements where the risk is being encountered. I think you can start at the very front end. I had a moment recently where a good friend and a loved one who's going through a cancer diagnosis and had a situation where they got an automated message in their portal on their phone denoting a fairly scary outcome or something that transpired here, come to find out that the physician or whoever is managing the physician's notes at that point. That was an AI-generated thing that came out of their EMR that they didn't properly review before firing it off to the patient. Here again, it's not rocket science, but it seems to me that if the physician, a physician staff is fundamentally going to own patient communication, then the first element of risk management has to be managed there. And it has to be a good rule, regardless of your industry, which is don't huck AI output over the wall before you review it. And I think that's got to start there. But it's not all on that individual. That poor physician, probably an oncology group, they're seeing hundreds, I don't know, thousands of patients, they're buried. I'm not saying it all lands on that, but it's got to start there. I think cybersecurity plays a role in terms of we provide the observability layer. We are the ones that are going to showcase who's doing what with what model or agent, when and where, and we're going to surface that data in whatever meaningful fashion. And that data could be surfaced in the form of traditional dashboards, it could be surfaced in the form of analytics or alerting, but we're going to be the channel by which that data flows upward. I think, you know, for the organizations that have a compliance office, obviously risk is going to have to sit there in some regard. What I have noted is a lot of the compliance offices that we've encountered, AI is still so new to them. And there are, you know, I don't want to say they're behind the ball, but it's moving so fast that they've not had or taken the opportunity to really come up to speed with why AI is a different fundamental technology. So if you're going to have an overarching risk management program for your organization, you've got to understand technology there. I think in this stage, until we have a better definition and maybe, I don't know, one day, thousand years from now, a chief AI officer is a real thing. I think until then, risk has to sit at the points through which data transitions from the patient to the physician, from the physician to the platform, the platform to the organization. And that those individuals maybe have some cohesiveness together.

Chris Hutchins: And I think that's well said. And the argument against, you know, chief AI officers, to me, you can go at it from any number of angles. I think the critical pieces of it are, you know, you gotta have a multidisciplined set of leaders who are just paying attention to this stuff. And the pieces that I think are most concerning for me are the ones that kind of fall in between two verticals. So that's in every organization. And that's where your SME knows this vertical extraordinarily well. They know some about this one, but not as much. But the person over here knows this. They're a rock star. No one knows more than they do. But they might have some gaps in what they understand about here. The understanding that AI has been designed as a platform to answer the questions you're asking it to answer for you. It's going to assume, unless you tell it otherwise, you're giving it what it needs to go execute that. If it doesn't occur to you that some data might actually be sitting over here in this other vertical that the model shouldn't touch. If you don't even know it's there, you're not telling it not to touch it, it might very well go do that. And so having people understand from a basic standpoint, I think a sports analogy makes sense. So if you're looking at an offensive line or a defensive line for that matter, in the game of football. You're responsible for the area from this point to this point. And you have to be able to trust that the people next to you are covering the same space to your right. Because if they miss and somebody breaks through, it's going to affect you too. So it's to me it's that leadership understanding of accountability and stewardship, and making sure that, yes, I know that you're not an accountant, but you need to have some level of understanding of what your colleagues are dealing with. so that you can properly help them to identify risks as you're working together and moving forward some of the use cases that may or may not touch that. And I just don't know that we're doing a great job of that. We're trying to figure it out, but it's a difficult space to figure out. And I don't think it's just a person or an office that's going to resolve it.

Aaron Bach: Great analogy. I love that metaphor, Chris, that we don't need 15 quarterbacks on the team here. We don't need everybody to kind of be the authority. We need everybody in a position with definition, knowing that position matrix is stitched together. I love that. It's a great analogy. And it's one that I think when I look at a lot of these committees that we've talked to, that there are a lot of high level people and there are a lot of thinkers and maybe more academic types. And it's not that we don't need that, but at some point you have to have those operations in place. I just think that's such a great analogy. It's one we could really hook onto.

Chris Hutchins: Thank you for that. So, last one as we land here. If you're to be advising a health system leader on the single move to make this quarter towards governing AI responsibly, what would you tell them and what is it specifically that you think that they can do that will put them in a better position coming out of this in this quarter? Because Lord knows what we're gonna be dealing with in the next one.

Aaron Bach: Yeah, absolutely. You know, I think about two things, Chris, one is maybe more optimistic, one's a little edgier, we'll kind of go in that direction. You know, for the, for the optimistic side, I would tell somebody this quarter, pick an AI touch point that already exists in your organization. And if you don't know what those are, then that's, that's a little nudge to go maybe discover what those are, but pick one AI touch point in the org that works somewhere. Somebody's using a model for task X. And I would say a great experiment is to put some sort of behavioral control in front of it. Maybe that behavioral control is you are prevented from using this ever again. Maybe that behavioral control is, hey, here's a policy. I want to make sure you read the policy. Maybe that behavioral control is a piece of software. I don't know what it is. Put some sort of behavioral control in front of it and watch what happens to that individual's usage of that touch point. Is it improved? Do they seem more frustrated? And do they seem like they're producing materially better outcomes? And I find that's a really interesting way to do several things at once. It gets the sort of overseeing body into the game, understanding the core actions of the individuals who are using the stuff. And it gives them a sense, and I think a real deep honesty, around, well, if I just block you and they are so used to this already, now I've got a frustrated employee on my hands and that's gonna mean X. Or if I just let it go and I'm watching this, I'm noting that they're putting, you know, PHI into these interactions unbounded, but it at least gives you some more direct connection to what that individual is doing, what they're trying to achieve, what they're bumping up against. And I feel like that data in and of itself gives you a far better shot of producing an actual workable long-term control there. So that's sort of my kind of easy one. Maybe slightly edgier one. And I'm just thinking back to that friend that I just mentioned and how difficult it was for their spouse to receive that message from the oncologist that turned out to not be correct. I think one interesting thing they could, you know, an organization could do, a leader could do right now, sit with this question. If an AI assisted decision materially harmed a patient tomorrow, whose name is on that incident report? And how would you show the control that was supposed to catch it? Now, I think that can produce some anxiety, that could produce some nerves there because there's a lot of questions in terms of, okay, we just dealt with something that was allowed to impact our customer, fundamentally who that is. Somebody's name is going to be on that report, right? Somebody is going to have been held responsible for that outcome. And the very natural next question is going to be, why didn't you catch this? And that kind of chain of reasoning is another way of looking at the same problem of understanding the pieces on the board. But just looking at, you know, maybe materially more impactful experience, our job in healthcare is to do no harm to our patients, right? To materially provide them outcomes that we all deserve from our healthcare. And if this were to not happen in this particular setting, something like my friend's spouse, you get a report that is not about you and it materially panics you and you start flying into a new plan, but whoops, it turns out that wasn't correct. Whose job was it to catch that or what control was supposed to catch that? And the answer to that I think will at least start to illuminate how behind the ball or how on the ball you are in a space where you need to be on the ball. Being behind the ball is no longer an option. So depending on where you sit on that spectrum, if we want a little more comfort, you want a little edge, those would be the things this quarter, I'd say sit with those, those options and be willing to do something with what you learn from them.

Chris Hutchins: I love it, and I love the notion you're protecting a patient. But the other thing is, organizations and leaders, I just encourage you, also protect your providers because when they sign the note, they're accountable for it. You're sharing the accountability, but their name is attached to it. That's really, really important to remember that. And make sure that your entire team, your workforce that's working on this, make sure they understand that clearly as well. This isn't the success or failure of a piece of software. It's very different stakes and outcomes that are on the line. This has been fantastic, Aaron. I really appreciate the perspective you brought to this conversation and I'm very excited for my listeners to be able to hear this. If folks that are listening have some ideas, thoughts, questions, they just want some good advice from you, maybe they need your services, how should they find you?

Aaron Bach: Yeah, absolutely. You can find me on LinkedIn, my name Aaron Bach, one word there, and also liminal.ai. That's our organization. And fundamentally, I think, you know, what I always kind of promote what I like to do for people. This is the most unbelievable, fastest moving craziest technology I've certainly seen, maybe we've ever seen. I take it as a personal point of pride, not only to, you know, not to just pitch my product, but to help everyday people trying to reach material, good outcomes for their organizations, their industries, their people, understand this space, not just to understand it, not to just stop at an intellectual understanding, but to really be able to utilize it for their betterment. I'm particularly passionate about that. So I welcome the dialogue and really appreciate this, Chris. It's been a great conversation.

Chris Hutchins: Thank you so much, Aaron. I just love the passion that's here. The conversations that I've been having, there's many more to come on the show, of course, but I just want to encourage everyone. There's a reason you're hearing from so many people who are very, very excited, very, very optimistic. They've got their eye on the risk side of it, but the passion is unmistakable. I just want to encourage you if you're kind of feeling down about the news or whatever else. Go talk to some people. I just encourage you to do that. You can always watch an episode of the show, even if it's a short or something if you want to, because you'll pick up on that passion. And it inspires. This is certainly no different, Aaron. This has been very inspirational to me. I'm learning a lot from you, and I really can't thank you enough for coming on the show. I can't wait to stay in touch. And you see what's coming next. I am sure there's good things coming for you in the future. So once again, Aaron, thank you so much for coming on the show and my audience. I hope you enjoy this one. That's gonna do it for this episode of the Signal Room. For now, I'll see you next time.