Good afternoon, and welcome to another episode
of the Oxford University Undergraduate Law Journal
podcast. I'm your host, Isaac, and today we are
joined by Mr Adrian Mak, a fellow at the Stanford
Law School AI Initiative. Adrian has contributed
extensively to academic discourse on the intersection
of technology, dispute resolution, and private
law. He was a co -editor of Privacy and Personal
Data Protection Law in Asia by Hart Publishing,
and contributed to the Cambridge Handbook of
Private Law and Artificial Intelligence. He also
has extensive practice experience in international
technology, commercial and energy disputes. Good
afternoon, Adrian, and welcome to the podcast.
Good afternoon, Isaac. Thanks very much for having
me. Okay, so just to get started. For our listeners
who do not know much about data protection and
privacy, can you give a brief overview of data
protection principles and the legal basis in
which companies and individuals can interact
with personal data? Yeah, thanks, Isaac. So let
me set the framing a little bit. So last week,
I was at the India AI Impact Summit. So it's
one of the largest AI summits, something apparently
300 ,000 people went. But one of the panels that
I went to, it was about data privacy and data
transparency in the age of AI, right? It doesn't
seem obvious, but there's a lot of underlying
tensions in how we think about data privacy and
also these other competing rights or other demands
that we have in the age of AI. So a good framework
that I like to have is by Professor Helen Nissenbaum
called contextual integrity. It's about not so
much how we control information and data privacy,
but sort of underlying norms in data privacy.
So what she's saying is it's about the norms
that governs the data flows and the norms in
the original context of the data, right? So the
main theme I want to highlight is a lot of these
norms are changing. A lot of it is subject to
debate, whether from AI, a lot of the changing
geopolitical tensions that we're seeing. But
it's also when we talk about GDPR and different
frameworks, they are legal tools or attempts
to encode these norms that we have. And it's
interesting to see how the legal and these underlying
norms are changing and having this discussion.
But that's the macro framing. And I think if
we go down to the details, let's look at like.
personal data, right? It's a broad definition and
would be any information that relates to an identified
or identifiable natural person. What does that
mean? What are some of the principles? I think
an easy way is you look at seven different principles
and the GDPR, they're in Article 5, but I think
some of the main ones include It's not so much
a list of litany of principles, but a hierarchy.
I think it's quite helpful. So you have lawful
basis. So has the data been collected lawfully?
And then you have things like... data minimisation
and purpose limitation. Even if you have it,
you can't just get everything and everything
you want, right? And then you have these things
like quality control, like is it accurate? Is
it being stored in the right place? And then
you have further on top these nice things like
just whether it's integrity and whether it's
being held accountable. But as I'm sure we'll
discuss later, a lot of these principles will...
are being challenged in the age of AI so i just
want to flag that very briefly but also when
you look at some of the basis for processing
these personal data that there's six main ones
but i i really just want to highlight um three
of them they're in article uh six of GDPR people
can take a look i don't want to go into too much
details but um there's things like have you consented
to the collection of that personal data? It's
things like, is there a contractual or business
necessity, right? And then the main thing of
interest for AI is legitimate interests, right?
Like you look at what's the interest in collecting
this, whether the rights involved in this and
balancing exercise. But also just very briefly.
what does this all mean, right? So there's these
corresponding rights for us as individuals or
companies to demand things like, let's get a
set of the data to look at what data, personal
data that companies have, or can we demand erasure
of these personal data? Can we rectify incorrect
information? And a lot of these, again, are interesting
themes that will come up in the age of AI. Thank
you. Thank you so much. And I think, yeah, you
kind of, you know, prefaced my question there
that actually my next question is going to be
about how large language models um have affected
some of the principles you've talked about some
you know you said they've gone in a hierarchy
so is there is it okay if it affects the principles
at a lower hierarchy and then you know is it
more problematic if it affects principles higher
up the chain um yeah so there's really a few
principles in particular that are being affected
by generative AI in particular. So principles
such as data minimisation and purpose limitation,
right? It's principles of whether when we demand
an accurate um result um of the AI output um
how accurate does it have to be right there's
these problems of hallucination there's these
problems of memory regurgitation um of personal
data that we see from the outputs of these LLMs
um so there's various things that that are going
on i'm happy to delve into these um into more
detail yeah uh that that would be great you know
if you could like you know maybe give us a few
examples and maybe uh elucidate a little bit
more on how these uh challenges and how they've
been managed by AI companies and also how maybe
legislatures and courts have kind of responded
to these challenges yeah yeah That's a good question.
So it's an evolving scene. So I like to think
of AI and large language models as a data supply
chain, right? And there are many data privacy
risks involved in each of these phases. So let's
start with a concrete example, right? So you're
an Oxford student and you're sharing... You're
asking ChatGPT in the UK about like this weird
medical sport condition that you have, right?
And you're taking photos of it. And this, let's
say, personal data information is sent to the
US with some Microsoft Azure server. And let's
say it's being stored there for training purposes.
But at the same time, once there's the processing
of that. question there's the inference output
stage where it's sent back to the UK and gives
you like an answer um what you know what the
medical condition is um this example is quite
neat so it flags um three different themes that
are ongoing in data privacy with AI one is the
training versus the inference. So the training
of the LLM involves a lot of personal data.
How much is too much? Is there legitimate interest
in processing all this personal information?
There's the output stuff, right? Where you have
these models, yeah, hallucinating and giving
or regurgitating very specific personal data
that it was being trained on. So that's one big
theme, and there are different privacy risks
involved in these two sectors. And then a second
bucket from this example is the sort of international
versus local cross -border data flow versus data
sovereignty theme where, you know, when you have
these, for example, the UK's data privacy regime
being applied here, but also there's the US stuff,
and then there's... different servers everywhere,
which data protection regime applies and what
happens if there are conflicting data protection
regimes and how do you resolve these conflicts?
But also that's why many jurisdictions are trying
to assert things like data sovereignty and AI
sovereignty, whether that's having data localisation
rules, you need to have your full stack of AI
from the chips. being more open source and um
to running on data centers that are being located
in this specific jurisdiction um to even things
like you know data centers and um critical minerals
and all that um but but that's sort of a second
bucket and i think the third bucket when it comes
to privacy is this sort of um the the cloud versus
the on device so um a lot of companies are pushing
for things like oh like a big proponent would
be Apple right so a lot of the times they would
say this uh AI inference all runs on your machine
and it doesn't go out to other data centers and
the well there's some nuance to this like often
when they say that actually it's just sometimes
it's encrypted secure channel um it's sometimes
it leaves your phone but um the the intuition
is the the more it's on your device the less
likely there are security risks although um or
personal data risks although we can still um
talk about that um but yeah um i mean i i like
to think about the more interesting stories um
when it comes to like the the training and the
inference side of things um in the training side
of things there's i mean the training corpus
is huge right so um like a Common Crawl set where
AI is trained on um it's like 250 billion pages
um another common set is like LAION 5b which is
like 5 billion pairs of text -to -image pairs
that AI is trained on. And a lot of this contains
super sensitive personal data of you and me,
right? And this involves questions of, okay,
what's the legitimate basis of processing these?
It's not consent when we post it initially on
the internet. It's not necessary business need.
And so what is the legitimate interest when billions
of people didn't really say, oh, I... I didn't
have a reasonable expectation that this would
be used to train on AI in the first place, right?
So this is sort of one interesting area and there
are techniques to resolve that. But the other
way more fun stuff is in the output side. So
I believe we chatted about this before in Japan,
Isaac, but the sort of when you look at the...
Stability and Getty Images and um Stability and
The New York Times these are copyright cases
but they involve similar concerns which is uh
when you prompt the AI to say generate a Caucasian
woman in a red dress and pearl necklace literally
the output is the same as the training sample
which is very limited sample right and if you
prompt the AI to to say a theme related to the New
York Times paper, it gives a very much verbatim
answer as the training sample. And you look at
the risk when it comes to personal data. So there's
these papers that show when you prompt, I think
it was GPT -2, where you ask GPT to say, repeat
the word company or poem infinite times. And
it does this for like... 20, 30 times and then
it starts regurgitating super sensitive personal
data of like a company litigation that it was
trained on, right? And we find actually there's
these papers that show even for the larger models,
this regurgitation memorisation still occurs
and actually the sort of more knowledge intensive
tasks, it does have this risk more versus like
if it's very reasoning intensive tasks. um so
that's super interesting and then there's the
there's another bucket where there's a hallucination
example as well so um there's these cases like
um Starbucks uh versus um Google and um not he's
he's an activist he's not i don't think he's
related to Starbucks the company but when you
search his name um it would come up with things
like um he's uh he's the like literally child
rapist and serial abuser and like he's uh like
offender like multiple things on Gemini right
and um he has another case where it's against
Meta Meta's ai where you know he's he's accused
of being in these riots but none of this is true
right so um the the pretty crazy stuff and you
know what the one solution was was to whenever
you search the name um on Gemini um Gemini would
just block the output. Because, for example,
it's very expensive to retrain the whole model
just for one person, even though there's these
principles of erasure under GDPR. And there's
these other techniques, like could you do machine
unlearning, where you just unlearn one part of
the data, but then there's these other risks
involved, right? So technically, there are these
super interesting advancements and maybe the
legal rights is one direction to tackle it and
maybe the sort of technical solution is one way
to tackle it but there's there's many aspects
to this that are very interesting a lot of privacy
personal data risks are involved and i think
um This is a long answer, but I think just the
third thing to flag, apart from the input and
the output side, is the infrastructure around
AI. So we're in an age of agentic AI. It's not
just the LLM, which is just the next token prediction,
but the architecture. So when you use agents
that have access to email. I'm giving it access
to send replies on my behalf. A lot of this increased
the surface area for attack and increasing traditional
risks for personal data and data infringement
risks. but also new categories of data privacy
risks like prompt injection and enlisting new
sorts of personal data from your AI agents. So
there are lots of developing things, but it's
helpful, I think, to think of the risks in terms
of this AI data supply chain and what are the
different vectors that map across it. yeah i
actually just want to bounce off some of the
things you talked about earlier i think i was
listening recently to a Financial Times podcast
and they were talking about how uh you know they've
got some sources at OpenAI that's saying that
OpenAI is now switching from you know long -term
development like AI research to commercialising
their main product which is ChatGpt and do you
think like about all the issues you mentioned
earlier you know do you think that there's obviously
a technical solution which would involve a lot
more long -term deep research into how the AI
models work do you think this is something that
can be kind of controlled by legislation in a
way that both so both the legal solution and
both the technical solution kind of work together
such in a way to put pressure on these AI companies
to adopt you know to really think about the the
technical solution to such problems rather than
just focus focusing on commercialising their
product because you know That's what these companies
want to do. I mean, in particular, I think there's
been talks about ChatGPT having ads now. So it
might be possible that if you prompt them about
something, they'll just give you an ad or they'll
insert an ad into their response. And is this
really the right direction AI companies should
be going? Or do you think there could be some
form of legal pressure put on them to start really
looking at these models and continually developing
them to avoid such risk? Yeah, there's the famous
Super Bowl ad run by Anthropic, where they basically
do a parody of what the future looks like if
it was run by OpenAI. And OpenAI gives you, you're
asking very sensitive, highly important information,
and then suddenly AI gives you an ad in the middle,
right? And maybe that's the last thing you want
in an AI. look not all AI companies are the same
and they have different business models right
like so traditionally you would think of um Anthropic
as be like Claude looking at much more of B2B
and their business model is slightly different
from OpenAI which is traditionally seen as more
B2C and sort of the ecosystem of OpenAI why
they had to double click on Sora video generation
like a social media app is Because a lot of the
concerns around revenue and whether the current
trajectory of investing hundreds of billions
of dollars in data center and energy is that
sustainable, right? And different companies are
really trying to figure out what is the way to
monetise and keep this sustainable, right? If
we are to have a leading edge. So I think the
business model question... is a big one and how
that ties into safety research and um data privacy
risks is is a big one right so so these these
companies have for example like OpenAI has like
a model behaviour team they have like like psychology
psychologist looking into how different personalities
of AI would react differently in different safety
scenarios. Anthropic is very big on the constitutional
AI and they released a new one where they have
different ways of collecting values from different
folks and trying to see how to embed that into
the way that both the training and also how the
answers that AI gives are different. And I think...
You're right in pointing out that there are these
concerns with AI companies. But there is also
this flip dynamic where we're talking largely
about closed source AI, but there's this movement
with open source and a lot of the leading open
source companies, particularly coming from China,
which means they're technically open weight. You're
you're allowing people you're releasing into
the public and you're allowing people to fine
tune it. And a lot of them do release their specs
on how they train it. And there's all sorts of
regulations around product specs and documentation.
So this is one way where we encourage more transparency
around the ecosystem and a healthier debate around
what should be done. I think the legislation
question is is. interesting one that different
jurisdictions are grappling with, right? So there
is the question of, do we do the whole Brussels
effect with GDPR and try to out -innovate and
lead by regulation? One of the concerns, both
externally outside of EU, but also within EU
with things like the Draghi report is whether
there is too much regulation within the EU and
whether that hinders innovation, especially when
it comes to compliance costs for small and medium
enterprises. If you look at some of the obligations
for, not for OpenAI or the likes of those foundation
model companies, but for small companies who
are just trying to make something interesting,
the compliance costs are super high. Now, of
course, there is that conception. And then there's
also the counter argument that you know, we're
thinking about regulation as a hindrance, but
actually regulation is in many instances an enabler
of innovation, right? So think about the aviation
sector, where it's because we demand these high
standards for aviation and we establish things,
international standards, but also like federal
aviation administration, that we have such great
technologies behind aviation. And, you know,
there's similar arguments going on, like how
much of the regulation can we push to have to
encourage these companies to have much safer
and also taking care of much more of our concerns.
And you see something similar in, you know, GDPR,
I think Article 25, like these mandates for privacy
by design. So it's a legal obligation, but it
says, look, let's push companies to embed privacy
principles when they're designing some of them.
the tools, including AI tools that they have,
right? So that's why people develop technologies
like differential privacy, where you try to add
random noise into a sample when training AI.
So you don't really know whether any individual
is in that sample or not. And there's other technologies
like Things like federated learning where you're
training the model locally and then transferring
the weights outside to another place. So there's
less risk of transferring personal data or things
like machine learning. So we are entering into
a phase like you hinted, which is we need the
technical governance and we need the legal governance,
but we also need normative governance. We need
people working together because it is such a
cross. cross interdisciplinary foundational general
purpose technology right thank you for that Adrian
uh i think you mentioned a little bit about like
different jurisdictions and how they manage it
uh if you don't mind maybe could you do a little
bit of a comparison i think you've done a little
bit between the GDPR and uh maybe and maybe the
UK and the US but you know maybe if we're looking
towards Asia especially because China is a huge
AI jurisdiction maybe Can we compare across these
jurisdictions and see, and maybe you can give
us your opinion on what you think, you know,
the right things they are doing and maybe, you
know, what do you think could be improved? Yeah,
that's a great question. So there's a paper written
by my friend at Stanford. It's called Comparing
Apples to Oranges. And it talks about how when
we talk about the different AI regulations, actually,
it's a wide spectrum. And some regulations focus
on risk. Some focus on the technology itself.
That's one. uh difference right um another way
of thinking about it is uh some focus on ex ante
so um so before the fact how we have these regulations
and some focus on expose where it's much more
after the fact let's have litigation and try
to regulate this stuff and then there's some
that focus on sort of a more general uh wide
ranging act that tries to be comprehensive and
then there's some that try to be more sectoral.
Let's look at sectors like biometrics, health,
financial services, and then how AI is being
applied in these sectors. And then how, let's
look at the specific instances. So the EU AI
Act, I think it'd be helpful to give some backstory,
which is after the GDPR, which is late 2010s.
um the working commission they came together
and they said let's let's try to regulate let's
look at the AI and how we can look at specific
risks uh from using of AI and this is early 2020s
and they you know basically looked at these sort
of uh banned banned categories because of the
high risk because of the risk and then there's
these high risk or minimal risk and limited risks
um similar to what you see now in the AI act
and then They pretty much wrapped. And then in
late 2022, November, this thing called ChatGPT
came out or GPT 3 .5. And people were astounded,
right? Like this wasn't really the type of technology
that the EU was looking. And then so they sort
of had to... um scramble and giving a very high
level storytelling manner of how the process
went uh they they try to look into also the regulation
the technology itself so they were looking into
some of the um foundation models categorising
into high risk and um general purpose and whatnot
and um so you have this sort of behemoth of a
regulation and captured in the EU AI Act And then
that's sort of meant to be complementary to the
GDPR in many ways. But there's also many tensions
within the EU AI act and GDPR, like the things
that we discussed, right? So purpose limitation,
data minimisation. Yes, we want to limit that.
But then in the age of AI, to train these models,
we do want like larger, diverse data sets to
train these models. access to sensitive, high
-risk categories of data in order to at least
know whether there is bias in the AI, right?
So these are types of tensions, and recognising
these tensions and also the huge advancements
that LLMs are making. Last year in November,
so just a few months ago, the commission came
out with... digital omnibus package. So it tries
to reconcile some of the differences between
the GDPR and the AI Act. So looking at legitimate
interests and can that be done for AI? Can we
delay some of the high risk obligations under
AI Act? So that's sort of a moving picture of
AI. And there's a big question of how much that
model has been exported to, say, China, say,
the US. In the US, it's also very a scattered
approach right now, right? So federal level,
there's always been discussions of whether there
should be an APRA, so American Privacy Rights
Act at the federal level, which hasn't been passed.
But there's a lot of sort of state level privacy
acts, but also a lot of sectoral approaches.
um like in like HIPA like VIPA which in the
US which deal with sort of health and um privacy
rights for uh schools that are funded uh publicly
and then sort of you know these um there's these
things where there's these acts um that are coming
out specifically for AI that sort of tangentially
relate to privacy, but actually don't deal with
it directly. So Colorado has a huge AI act that's
comprehensive in nature. Tennessee. This is interesting.
Tennessee has one called the Elvis Act, which
was in 2024, which relates to AI deepfakes for
singers. They don't want singers to be cloned
with AI, right? So that's sort of related to
some of the concerns in data privacy. And then
there's some existing... um legislations like
the Wiretapping Act um but that relates to things
like on Zoom like in this conversation do you
need one party to consent to the recording or
do you need to put both parties in different
states of different approaches? So it's very
scattered, different approaches. And again, there's
discussion of like, how much should we try to
do it on the federal level? With the current
administration, should we have no state level
regulations because we want a uniform compliance
standard in the US? So that's sort of changing
as well. And then I think, as you rightly pointed
out, in certain text circles, people do think
like at least with the Chinese approach, they
are super specific. applications when it comes
to privacy, when it comes to AI. There's some
super specific legislations like, oh, let's look
at watermarking and you have to watermark AI
outputs. There's some super specific ones related
to algorithm, recommender algorithms. And I think
what you'll find in the current state of jurisdictions
in different including Asian jurisdictions, is
they tend to do a bit of both. In the legislative
process, they look at some of the Chinese style,
they look at some of the EU style, some of the
US style, and they have a bit of everything,
right? So a lot of them tend not to have a super
comprehensive one like the EU AI Act because...
For example, they don't have leading model companies
and there may be a huge compliance cost, but
let's do some sectoral approaches and regulations.
And then let's also try to develop technical
interoperable standards that are more soft and
non -binding in nature. for example, like the
Japan equivalent of the AI Act focuses much more
on innovation and how to encourage investments
into the AI economy. So it comes in all flavours.
And yeah, I'd recommend people looking more into
this changing scene. Thank you. Thank you. And
I think you also mentioned about like the difficult,
I think this may be something you talked a little
bit more about in Japan when we met that. there's
a difficulty when it comes to regulation simply
because you know the pace of AI models are developing
so quickly that you know we're going to have
you know sometimes the models the the regulations
and the legislation just can't keep up with the
new developments in these models the the intrusiveness
of some of these models actually i think you're
talking a little bit about transcribing just
now and just as a little personal anecdote before
you join the call i use Notion which is a you
know a note -taking app and Notion AI there's
a Notion AI now yeah it's great basically offered
to transcribe the call if i wanted to i mean
similarly Descript the platform that we're
currently on uses an AI model to transcribe whatever
we're saying like i mean i'll plug this in and
the AI will just transcribe whatever we've said
we'll just say it and that will create a transcript
and i don't have to like manually listen to it
and type it out and and that kind of intrusiveness
and i guess i was just so surprised that things
are developing so quickly And I guess in relation
to that question, do you feel that the best approach
to regulation is to think a little bit about
normative theories of law? Like in a sense of
like, maybe do we use the approach of like going
on general principles rather than very specific
legislation that targets a very specific technology
or very specific area of risk? Instead, should
we... use i guess because i'm studying jurisprudence
now i guess use these you know principles of
ethics that may be that that granted may vary
depending on the focus of the country i mean
japan might want to focus on innovation um countries
in the west might want to focus a little bit
more on regulation but can we use some general
normative principles of ethics to influence the
way we approach legislation and come up with
a more i guess a more loose legislation but also
a legislation that's therefore more flexible
to it adapt to the changes in technology yeah
that's a great question i i think just to relate
to your story i mean um in in meetings nowadays
you always have like these when you join Zoom
they ask you consent but also a separate note
taker that joins and it's always it looks like
a separate person who's joining but it's actually
just someone who transcribed But the summaries
are pretty good, right? But I think in this story
that I'm trying to tell, it's important not to
focus only on the risk, but also the opportunities.
I used to work in big law, doing IPOs and M&As.
And a lot of what junior lawyers work was transcribing,
typing manually, using hours. And I remember
one story was like, I mean, just doing this Chinese
huge AI company, well, just a huge company, but
transcribing the call. Literally, I had six rounds
of back and forth just with the senior associate
just on how the notes should be taken. And the
associate was great. I learned so much from this
is a better standard of how to note take. But
that spends so much of hours and billable hours
where you could release that time to focus on
much more valuable work. And that's a narrative
of how much are we replacing humans and augmenting
human work. But onto your point about the normative,
and I think in the way you've defined it, I think
it's essential. I think it's not just a good
to have nowadays, right? Even in the example
that we're talking about, so this makes me think
of Professor Erik Brynjolfsson from Stanford,
I think a few years ago, he talked about this
within the AI circle, people always talk about
um replacement rather than augmentation of human
labor right like there's this company i think
Mechanized Inc that like sort of makes fun and
tries to say the billboards would say we're here
to um replace humans right and um like it's that
like narrative of you know we like we don't need
human labor but but that's sort of the the paper
by Erik Brynjolfsson and also my professor Professor
Rob Reich talks about this, which is even in
the early 40s and 50s in the CS AI field, there
would be debates by Alan Turing. The Turing test
is sort of, in some ways, encourages us to think
about this replacement because it's how can humans
replace, how can AI's machines replace human
and what we're doing? But another framework by
the founder of Cybernetics in the 40s is how
can... AI and machines augment what humans are
doing and complement humans are doing. So even
in the AI field, where we don't think a lot about
ethics and normative framework, or traditionally
we don't think they're that field, there's a
lot of normative discussion. And the current
vibe shift now, at least here in Silicon Valley
at Stanford, is a lot more people are trying
to do this alignment work. even in the examples
i mentioned like Anthropic they're trying to
do a lot of like safety and alignment work which
is super cool but also in the law and AI field
right there's a lot more discussions on law following
AI agents so um previously people would talk
about how can we get agents to um abide by our
values and there's a lot of like normative and
ethical discussions but it's um difficult once
you think about okay this is super vague but
it's that's a good start and helpful in how we
conceptualise AI agents but now people are talking
about wait let's talk about how they follow the
law um when AI agents are roaming around and
then there's questions of which law does it follow
um so for example there's an Institute of Law
and AI and they're doing a workshop with Cambridge
as well just focusing on like how how does it
follow these values and how does it value these
follow these laws but yeah, to answer your question,
I think it's essential to do these normative
work as well as the practical work. And I always
think it's the intersection that's the most interesting.
I think... um one one potential resource um and
and not to shamelessly plug myself but the sort
of Cambridge handbook of uh Private Law and AI
um i contributed to a chapter um but a lot of
the the chapters were discussing about these
sort of normative aspects of of uh AI and how
it relates to the law and i think um yeah i would
love um that there's that there's more uh there's
a lot of work on this as well and i'd love for
you and other people to join in this discussion
no yeah definitely because i think one of the
so we have to do a mini thesis for our summer
over you know over our summer break this time
around uh moving from the second year to the
third year and one of the mini options that we
can write about is on uh law and technology and
it's and and it's a jurisprudence mini option
so i i would think that this would actually be
very helpful because you know we want to think
about how these theories and these values that
we've learned in jurisprudence, like traditional
jurisprudence from people like Hart, Dworkin,
Finnis, and how we're thinking about such things
in relation to AI, in relation to the tech, in
relation to the risk or the intrusiveness that
it has, but also the potential for innovation
and that growth. And I guess definitely just
bouncing off a little bit on what you're talking
about, very practical, that kind of experience
within the legal sector with AI, I think. Anthropic
does a legal AI, there's Harvey as well, and
Legora as well. There's one very big legal AI
competitor. And so maybe, I guess, just to kind
of wrap up this episode, I think a lot of us
are definitely possibly considering going to
big law. I mean, it's either, you know, some
of us also think of going and becoming barristers,
but whichever path we choose, I do believe that
AI is going to play an important role. And so
maybe, I guess, this final question to wrap up,
I just wanted to know what are your thoughts
on how, you know, us as students going you know
graduates going into the into the job market
can capitalise kind of let AI augment the way
we work and what kind of where do you see it
going and where do you think you know maybe a
line should be drawn or a certain boundary or
do you think there should be no boundaries at
all like you know let as AI develops let it you
know continually augment up the chain and maybe
you know up the chain of legal work so maybe
just that yeah that that's my question Yeah,
I sort of run these workshops with some friends,
sort of either teaching students or sometimes
judiciaries on sort of usage of AI. And there's
these sort of 20 to 30 principles that I always
like to start with. And it's things like, you
know, just start playing with it, right? Like
a lot of like, we're actually in the minority.
Like when you look at the world's population,
I think some... report just came out it's like
84 of the world's population have never used
AI and then there's further categories of like
um how much do you vibe code with it and um do
you only use the free version instead of the
premium version um have you used the deep research
function um and also like you know things like
don't not not just like try to prompt it or like
prompt engineering but like just try to converse
with it and um um understand your own tastes
um and judgment It's as much understanding yourself
through the process and learning how to develop
better taste and judgment to better prompt and
converse with AI. So things like that. But I
think you're absolutely right. There's so many
different tools upcoming. I think specifically
the companies you've mentioned, they're all great
companies. Some of them have like programs with
scores as well. So law schools as well. And I
definitely encourage people to just play with
it instead of like, do we have these preconceived
notions? but also like the hot take would be
what is their mode right like we saw uh Claude
co -work and code having these legal plugins
a few weeks ago and that caused a couple billion
dollars wiped out from the market the so -called
sas apocalyptic like how easy it is for us with
minimal background in coding to just vibe code
a new app that's similar to the AI legal companies
that you mentioned, right? Or that's similar
to the particular use cases you have in a law
firm. And we see this upcoming new generation
of lawyers who are somewhat familiar with vibe
coding and they're very useful in law firms not
only because they can vibe code specific applications
in the law firm using enterprise version that
are safe and have data protection privacy protections
but also they can teach the senior lawyers who
frankly don't have much time in learning about
these tools, but who would love to know how this
impacts their bottom line. And so I think I would
just encourage people to use it. And then, of
course, once you start using it, there's so much
just nuance and so much exciting developments
that you can keep track of. And it's always,
I think, important to um use it but also be critical
of it so having that balance of you know um not
outsourcing all of your thinking and retaining
the essential legal tools that you have and work
um in augmentation um to deliver value right
and then the other thing is like there's the
AI and then there's the human part which um there's
a book called AI Mirror which talks about you
know it's great you know that AI supercharges
us but also it's a mirror for us to understand
um our faults and biases and how do we level
up and, you know, work together better, right?
Even as lawyers, we still work largely in silos.
Like if you go into big law, you go into these
systems where you have to check in a document
and then check out. And then when you're using
it, nobody else can work on it. Whereas like
a lot of like CS people are using Google Drive
or like collaborative methods of working, right?
So the legal industry is changing. I think it's
important. going to reflect on how do we use
these tools the best and also reflect on how
do we use AI to increase our human intelligence
and wisdom the most thank you and maybe okay
i know i said that was the last question but
i think you just talked a little bit about like
AI tech and just reminded me of this funny like
video that i used to always see on like Instagram
where it was this guy in the US i have no idea
whether it's AI generated it looked quite
legit but you can never tell basically yeah you
can never tell but like basically it's a clip
showing a judge in a US court I believe being
very upset because this plaintiff basically you
can imagine a litigant in person uses AI to generate
an AI lawyer to give his submissions and he just
plays it off this video and it's like you know
it shows up on the screen in court and it's like
you know if it may please the court and it's
this AI guy talking and obviously she catches
on and then she says like oh wait is this a record
and then she you know she goes on to scold him
and all that uh but i guess my point of asking
that question is do you see AI actually serving
that purpose like am i is it going to be a day
when i just you know plug in a bunch of submissions
to this AI model and it's just going to generate
me in court and it's just going to be able to
deliver my oral submissions and i wouldn't re
you know it's not good it's going to kind of
take over that that role because i think a lot
of us believe that you know we're going to use
AI and drafting first drafts all that kind of
stuff in terms of researching processing but
we don't I think a lot of us lawyers would like
to believe that we still have a job because the
oral bit, the stuff when we're doing negotiations
for terms in an agreement or terms in an acquisition
agreement or even in terms of speaking in court,
giving oral submissions, that's something AI
is not going to replace us in. Do you think that's
true or do you think it might just enter that
area and we're just going to have to accept it?
I think the short answer is read my article with
Professor Reyes in the AI and Private Law handbook
on AI and commercial dispute resolution, where
we discussed this. But the long answer is, I
think one possible scenario future is there's
going to be multiple options for plaintiffs,
litigants to choose from, both in terms of how
much of AI will be used in the court and how
much of AI will be used by judges and in the
submission process. In some parts, also influenced
by these private markets and arbitration and
mediation, where there's a massive push for these
different user -consented mechanisms. And as
long as the user is fine with it, and it delivers
justice. in a faster, much cheaper form in a
way that's better for them, better suited, then
perhaps that's one way to go. And another form
is perhaps you can have these first layer AI
-assisted or AI, fully AI judges, and then you
have a human layer of review. if you want, and
that's more expensive. And I think last I heard,
and anecdotally, this has already been implemented
in some Middle Eastern, I think, Abu Dhabi courts,
right? But I think that you have to look at it
more holistically, or at least that's how I think
about it, which is, like, in some jurisdictions,
it's been said, like, you know, the waiting time
for courts is 3 to 4 years, right? courts like judges
are systematically overwhelmed this is not just
unique to one jurisdiction this is a lot of jurisdictions
and that's why partly the the push for arbitration
mediation which also now has like procedural
burdens but um we are seeing um people use these
tools more uh creatively um both for judges and
litigants and i think um how to use it in a responsible
way um is is a big issue right um so there are
multiple guidelines by judiciaries and um by
arbitration institutions on how to use this but
the the second component that you're saying which
is the super interesting part is what what does
this mean for for us students and lawyers um
that are coming into this world right and what
are the tools um what are the skills that we
should be using i under the paradigm that i've
discussed i'm not sure if even just saying i'm
only going to do my oral advocacy and then all
the written advocacy is going to be done by AI
is is true right um it's a fast changing world
where just a few years ago people would say AI
is very good at you know analytical and intelligence
and then um well the um and there's a differential
the premium is on things like EQ and collaboration
and how to work with clients and talking with
clients because we're going to be the trust is
going to be built by humans human relation where
everyone sort of increasingly uses AIs i still
think that's true but then you see papers like
AI is super good at empathy it's more empathetic
in its responses than doctors which is like understandable
because the doctors are so overwhelmed in in
hospitals right um and so um that there are these
things like the heuristics that we have like
of course like it's it's humans humans connection
and all that which i think is still true and
maybe it's a matter of waiting at the weight
that we lean towards these things But I think
it's just playing around these tools and following
your passion. And if you think these things are
very fun to play with, then go for it, right?
Another way of thinking about it is what Professor
Andrew from Stanford calls, you know, it's the
overlap between the... the AI and your substantive
expertise, that's going to reap the most value,
right? You're very good at one thing and then
you're very good at using AI and that's where
the value comes from. And then there's other
types of people where you're just very good at
CS and AI and that's another category of people
who will succeed. And then there's like maybe
a third category of people who just know how
to use AI to leverage the businesses and whatnot.
So I think... It goes back to what we discussed.
There's a lot of threats, but there's a lot of
opportunities and navigating that as students,
as lawyers requires a lot of wisdom and humility.
And I think we'll just have to wait and see,
but also call for action for a more responsible
future. Thank you. Thank you so much, Adrian.
And that wraps up our episode for today. So thank
you, Adrian, for your time. And I look forward
to having you on the podcast again in the future.
Thank you so much. thank you thank you so much
guys have a good one yep