Hannah Cornett

Welcome to the third season of State AG Pulse. In this season, we’re selecting one story every week from the state AG news. Over the next  minutes, we’ll take a quick dive into that story to analyze the impact of AGs as regulators and consumer protection guardians, and provide tips to help your business work successfully with state AGs.

Meghan Stoppel

My name is Megan Stoppel. I’m a partner here at Cozen O’Connor in our State AG Group coming to you from the Mile High City of Denver, Colorado. And it is my pleasure to be joined here today by my colleague, Hannah Cornett, an associate from our Washington, D.C. office. Hi, Hannah. How are you doing today?

Hannah Cornett

I’m doing well. How are you?

Meghan Stoppel

I’m doing great. I think we’ve picked an interesting headline for this particular episode, but it actually comes out of the Consumer Financial Protection Bureau this week, not a state AG’s office, which some of our listeners may find surprising given our practice area. Tell us a little bit about this headline and sort of the story that our audience needs to take away, and then we’ll dive into a discussion.

Hannah Cornett

Yeah. So the CFPB just recently released guidelines on the specific use of AI in credit underwriting.

Meghan Stoppel

Right, right. And Hannah, I know sometimes, especially for folks who don’t work in the AI space on a regular basis, maybe they’re in marketing or finance, we throw around the term AI all the time. And I think most people have a general understanding of what that is, but sometimes concrete examples are more helpful. Did the CFPB guidance, is there anything we can take from the CFPB guidance that could give our audience some more concrete examples of what the Bureau considers to be AI? Did they reference any particular tools or technologies in that guidance or things like chatbots or algorithms?

Hannah Cornett

Yeah. I think it’s primarily, it’s complex algorithms, so it’s making key decisions based off of huge data sets versus making it specific to the individual. And so, that is really, I think, what they’re trying to avoid, particularly in the lending space where your credit score and credit worthiness, that has a huge impact on consumers’ day-to-day life. They want to have human oversight over AI processes and any consideration of complex algorithms when making a decision. So you can use those tools, but you need to make sure that you have a oversight of it and can point to concrete examples to back it up.

Meghan Stoppel

Sure.

Hannah Cornett

And make sure that you aren’t just relying blindly on, “This is what the dataset says.” And the big takeaway here is they’re trying to counteract, I think, this notion that companies will use AI as a way to just auto-generate and make credit decisions. You have to give specific reasons whenever you are notifying a consumer about a credit decision.

I think that this is relevant for a couple of reasons, even if you aren’t necessarily regulated by the CFPB. First of all, I think AI, it’s no secret this has been a huge area of interest for the AGs. And Megan, I think you can probably speak some more to that. These kind of regulations, I think all companies should be aware of, just in terms of how regulators in general are going about tackling this ever present issue.

Meghan Stoppel

Yeah. Yeah. I think that’s something we should definitely discuss, because as I alluded to, this is a headline out of the Bureau. It’s very specific to disclosures that may need to be made by lenders when they’re using AI to inform those lending decisions. So I imagine some of our listeners may be wondering, one, why we picked this particular headline, but especially those listeners who don’t operate in that lending space or maybe aren’t subject to the Bureau’s authority. And I think we should take a minute to talk about why we picked this particular headline and why we think it may be more applicable to a broader audience than you might initially suspect just by glancing at the headline. So yeah, let’s talk about that because you alluded to that a little bit, Hannah, that this issue is definitely on the AGs’ radar. For the summer, I think there were, what was it, two panels at the AG meeting in June where they talked about this topic? Is that right?

Hannah Cornett

Exactly. They dedicated two full panels to this at the AGA conference. And yeah, this is just something that we know is on their radar. They submitted to the NTIA, they submitted a comment, for the request to comment, on specifically artificial intelligence. And then, also a bipartisan group of AGs submitted a letter to Congress recently asking for them to take action regarding AI and particularly risks that it could pose to children. So yes, it’s definitely been in the news.

Meghan Stoppel

Yeah. And certainly, as more and more organizations look to use these types of tools or just massive amounts of data to inform new products or their decision-making, I think you’re going to see that enhanced regulatory scrutiny. And the two comment letters you mentioned from just the last four months are a perfect example of how we’re seeing AGs start to weigh in with their federal counterparts or policymakers on this issue.

But to tie it back to the headline, I think it’s worth noting that in both of those letters, and for those that are listening in that may not have seen the letters, there was bipartisan support in both letters. I think the one that came out earlier this month, it was all  AGs that signed onto that letter to Congress about the potential for the children’s pornography to be proliferated through the use of tools like OpenAI. But even the one from June, wasn’t it like  or  AGs?

Hannah Cornett

Yeah, exactly.

Meghan Stoppel

Of Republicans and Democrats, yeah, and so you’ve got bipartisan support. So that’s important to keep in mind. But it’s also helpful to keep in mind that because of those comment letters, I think you’re seeing some signaling from the AGs that maybe the federal government is best positioned to start to develop the standards or the regulations that should exist in this space, obviously, subject to comment and review by the AGs and subject to provisions of the law that give the AGs concurrent enforcement authority.

It’s important to keep in mind that if past is prologue here, we know the AGs are not going to sit around forever and wait for Congress or the federal government to act, right? So the bureau has actually been fairly quick here to act in issuing these guidelines for those in the lending space. But I do think if the federal government, if they’re moving too slow, we are going to start to see states attempting to pass legislation in this area. And when that happens, state policy makers are going to start to look at things like these guidelines from the Bureau for inspiration. Businesses need to start paying attention because that has the potential to be the roadmap for where state policy makers start to go on these issues.

Hannah Cornett

Right, exactly. If you look at just privacy in general, we’ve seen that the federal government has been very slow to act on having a comprehensive, I think, data privacy law. And so, you’ve seen several states step in and pass their own regulations. And so, now we’re sort of getting this varying, this map, I guess.

Meghan Stoppel

This patchwork.

Hannah Cornett

Yeah, a patchwork. Thank you.

Meghan Stoppel

I would love to use the word patchwork. Yep.

Hannah Cornett

Yes. That is a great way to describe it, a patchwork of various regulations. And it just becomes, I think, even trickier and even more important for businesses to stay on top of this so that they’re aware of how these regulations or guidance or what have you will vary based on the jurisdiction they’re in.

Meghan Stoppel

It really is incumbent on the business community to know when those comment periods exist and to consider weighing in for this very reason, because if the agencies do start to act in this space by issuing guidance or regs, like I said, those will start to be the benchmarks for state regulation, for state policy. And it’s very hard to walk some of that back once it’s already written in stone at the federal level.

And certainly, we’ve seen that with respect to just general consumer protection standards that the AGs have been enforcing for the last three decades, right? They look to the FTC for guidance on what is an unfair trade practice, what’s a deceptive trade practice. I think they’re going to do the same thing here. And Hannah, in terms of practical advice on what companies can take away from this guidance, even if they’re operating outside the lending space, or maybe if they’re not subject to the Bureau’s authority, little nuggets of wisdom they can take away from listening to this podcast….

Hannah Cornett

Yeah. So I think it’s pretty clear that companies, if you haven’t already, you need to start thoroughly assessing your AI practices. Take note of the potential risks of it, and is there any risk of bias, discrimination, or privacy violations that could come from your AI algorithm? Stay on top of the ever-evolving regulatory landscape. Keep in mind, I guess, for your particular markets of where you are doing business predominantly. Yeah, I think this is something that’s going to be changing, and you need to make sure that as soon as regulations are passed or enacted, you have a plan of action of how to be in compliance with that.

And through that, you should also develop an AI governance policy and procedures. I think it would be good to go ahead and have a plan of action in place for routine monitoring, just so it’s more of a proactive review of your policies and procedures versus a responsive review for if a regulator decides to take interest in you.

Meghan Stoppel

We are sort of also seeing, as AI becomes more, I think, ingrained in at least lawyers’ vernacular and the business community’s vernacular, people talking about these tools where if I just feed the program what it is that Section  of the FTC Act prohibits or the requirements of the TCPA or whatever it is, or the Truth in Lending Act if you’re talking about financial services, then the computer will figure out what it is I can and cannot do, and we can go from there.

Hannah Cornett

Feeding a CFPB checklist into your algorithm, that’s not sufficient either. You can’t just rely on that, because I think a lot of times companies will use that as justification. But in reality, when you dig a little deeper, that may not be the full story. So I think don’t rely on, I guess, standardized forms for checking boxes. Have kind of more concrete examples teed up and ready to go.

Meghan Stoppel

I know the Bureau publishes some of their sort of enforcement manuals, the tools that they use to do conduct reviews, but that’s really interesting to know. And I think this has been a really interesting conversation about AI and the business community in general outside the CFPB. So thanks for taking the time for the conversation and for sharing your insight, and looking forward to having you back on another episode.

Hannah Cornett

Thanks, Meghan. Take care.

Meghan Stoppel

You, too.

Hannah Cornett

You’ve been listening to State AG Pulse, brought to you by Cozen O’Connor’s State AG Group and the State AG Report. Please leave us a five-star rating and of course, tune in next week.