People Don't Resist Technology; They Resist Ambiguity with Elena Vekilov

Khullani Abdullahi (00:01.314) Good afternoon, good morning, good evening. Welcome to the AI in Chicago podcast. I'm your host, Khullani Abdullahi, the founder of TechniAI, a Chicago-based AI governance, risk compliance, and strategy firm. AI in Chicago spotlights our local operators, builders, thinkers, leaders, executives, who are scaling applied AI from their home in Illinois, but with a global impact. Each episode delivers practical stories and actionable insights. empowering leaders to understand AI and its use cases minus all the hype. Today, I'm so pleased to welcome to the AI in Chicago podcast, Nielsen IQ's chief privacy officer and global general counsel, Elena Vakulov. Today, Elena Vakulov and I will be talking about her global leadership and strategy at the intersection of data protection, product innovation, and AI governance across more than 90 markets. Before Nielsen, Elena held senior privacy and regulatory roles at TransUnion, where she helped implement US and global privacy laws, built risk tiered governance frameworks, and advised the C-suite on high stakes AI data decisions. She's one of the few leaders who's actually operationalized responsible AI in the enterprise at scale, where she sits at the intersection of AI data, law, risk, and growth. Welcome, Elena. Elena Vekilov (01:27.038) Thank you so much, Kalani. It's a pleasure to be here. Khullani Abdullahi (01:29.784) Thank you so much for joining me. I always like to start off before we dive in and having you reflect a few minutes on your journey to being the Chief Privacy Officer today at Nielsen IQ and just kind of reflecting on key or different pivotal moments throughout your career to help our audience get an understanding of your journey. Elena Vekilov (01:56.116) Yeah, absolutely happy to. I mean, I guess my journey started with just curiosity. I have this anecdote that I share so often. I won a prize in third grade at my third grade graduation ceremony. Move with me into this moment for asking the questions that everyone else might be wondering but is too afraid to ask. And so, know that that instinct to dig deeper to challenge the assumptions to you know, just ask the questions. It's kind of been my brand by like guiding force ever since So, you know, I started my career in law working with organizations in these highly regulated industries energy and infrastructure where I you know first got the importance of balancing innovation with compliance that the two can go hand in hand. then later as I moved into the global corporations and the technology and data services space, right when privacy became a thing, right, we got our GDPR, I guess became more of an everyday thing, let me rephrase. And that's when privacy and AI governance and this data use and data governance really became my passion. You know, I guess over time, what I realized is that, you know, trust isn't just a legal requirement. It is the foundation for growth and innovation. It helps my clients do what they need to do by me being able to provide them with that foundation from my expertise in the law. Did I answer the whole question? Khullani Abdullahi (03:45.806) Absolutely, I love it. I'm not gonna forget that third grade anecdote and it may be the highlight of podcast that I pull out because it's very apropos. There's a lot of attorneys, I think, who discovered their inquisitiveness early on in life and then to have that be supported with an award, I think at the age of nine, is pretty great. Yeah, it's very cool. Elena Vekilov (04:08.606) Isn't that cute? And we've got some pictures that my mom still has and I'm wearing these pretend high heels that are two sizes too big. So she has this picture of me just flopping my way up to the front to get my award. Core memory, core memory. Khullani Abdullahi (04:25.286) Absolutely. someone with a seven year old, I hope that she has a similar experience, right? What more could you want for your kids than to find their, see, to find their calling. So 2025, I love that we're talking two and a half weeks before the year ends and we speed run to 2030. I don't know what happened to the 2020s. Elena Vekilov (04:32.69) I also have a seven-year-old. Elena Vekilov (04:44.382) I know. Yes. Khullani Abdullahi (04:51.63) in addition to COVID. But the 2025 reality check, it has been a gauntlet this year for so many reasons. Just thinking about data and the AI governance landscape, what does, if you had to put 2025 into a headline, like what is your headline for 2025? What is that quintessential phrase that is going to define this year? Elena Vekilov (04:59.371) Mm-hmm. Khullani Abdullahi (05:19.886) with respect to your work. And then secondly, where were the concerns this year? What kept you up at night? What did you want to double down on and what areas of concern were kind of defining for the year? So I'll stop there and see what comes to mind for you. Elena Vekilov (05:40.758) Great question. Okay, so I think my headline, I think my headline would be. AI finally grew up, but we're still having to figure out its chore chart. So something about, know, 2025, I feel like was the year that AI stopped being this, this like shiny toy that, you know, we tested in the corner and it actually moved into something that, you know, we all depended on in our work and in our decision making and in our personal lives. It, it felt like Khullani Abdullahi (05:50.273) Yeah. Khullani Abdullahi (05:53.959) I love it. Elena Vekilov (06:15.592) It was the first year where AI moved from feeling like this demo wonky concept and more like actually being a coworker who's, let's say shockingly fast, a very efficient coworker, but that, you know, just sometimes absolutely misinterprets everything. So I think I've heard you say previously, Kalani and I loved it. I used it. that like your eager intern is I think what you had said, yeah? So it, you know, it's grown up but. on a chore chart. Still, still, still some work to do. Khullani Abdullahi (06:57.334) Yeah, absolutely. When it connect that to the things that maybe because it's growing up and we're figuring out the chore chart, tell me more about what areas of concern 2025 triggered for you. Elena Vekilov (07:13.366) 100%. So. I'm gonna, in no particular order, let's go there. Each of these certainly I think would have earned their spot on my Insomnia Leaderboard. First, we just have to start with coming full circle to the pace of change. AI innovated faster than organizations or the market or the world could almost digest it. 2025 had the sense of a rocket taking off while we're all like, Khullani Abdullahi (07:28.014) Mm-hmm. Elena Vekilov (07:48.352) still trying to read the assembly manual or something. It was this feeling like, okay, cool, we've incorporated into our workflow, we're ready to go, and then there's another one knocking on the door. Model upgrade, new iteration, reorganize your workflow again. So that rapid change of pace, it created this constant tension between opportunity and overwhelm. And so it's super exciting. But then, for us governance leaders, we had to ask or answer questions like, how do we build for stability when the ground won't stop moving? And advise on things like, what capabilities do we adopt now? Which do we wait on? See if the next iteration is better. So that definitely kept me up in a good way, in an exciting way, but awake. Khullani Abdullahi (08:41.014) Okay. Yeah. Elena Vekilov (08:43.326) And then relatedly, I think the trust gap that resulted from that, right? So maybe not necessarily like the fear of AI, but the fear of using AI incorrectly, maybe is how would phrase it. Like most people, guess that, you know, I interact with on a daily basis, at least in my industry and in our industry, in this space, aren't necessarily lying awake worrying about AI taking over the world, right? But people are. Khullani Abdullahi (09:10.328) Yes. Elena Vekilov (09:10.614) worrying about it taking over the slide deck or the spreadsheet or the particular tasks. so what I saw over and over again was this very human hesitation of, we trust this and how do we verify the output and what happens if the AI is wrong and I don't catch it, like it's still on me at the end of the day. And so I think 2025 forced us to acknowledge that that AI competency, this understanding, this comfort level is now a core professional skill. Like spreadsheets were in the 90s, right? So if you didn't learn it, if you didn't keep up with it, you felt left out in the conversation. And so helping people get there, building that literacy, that was one of the big themes of the year that I think kept me up. And you know. Maybe the next one also pretty universal one. Let's go with like the data diet, like what we were feeding it, feeding the AI. Everybody wanted gourmet AI, but like kept feeding it fast food. We kept seeing these stories and headlines of organizations that were expecting Michelin level insights from data that was more like, know, well, we threw our mysterious. Khullani Abdullahi (10:13.027) Yes. Yes. Yes. I love that. Elena Vekilov (10:32.502) casserole smorgasbord into the tool and we didn't give value. And, you know, we were seeing, you put everything into it, nothing was labeled, nothing was structured. And then we're disappointed that the model would just like figure it out. And so 2025, I think, had this moment of everybody kind of taking a beat in this big realization, maybe a quarter or two ago of, on guys, like the AI is only as strong as the data that we give it. You know, we all need to collectively realize that data quality, it's not something, you know, some back end IT chore, like this is going to be a strategic differentiator. So we started seeing the companies that were getting the biggest wins weren't the ones necessarily with the fanciest models, but they were the ones with the cleanest, best prepared data foundations. So that kept me up, you know, figuring out. figuring out that landscape as well. So I guess sum it up. I've been talking at you for a minute here. Khullani Abdullahi (11:38.03) No, I love it. What I really appreciate you sharing is like those particulars of the things that kind of shape how a chief privacy officer thinks about risk and innovation and how that intersects with even what is top of mind for you. And I know that changes throughout the year, but it's fascinating. I think. At least from my clients, what I've noticed is they are dealing with legal more than they ever have. I have clients in IT that are like, I have to go talk to the chief legal officer. Yes, yes. For the first time, you can't just send a vendor contract for review, get your edits back and call it a day. You need to sit down with your legal partner. Elena Vekilov (12:19.35) Uh-uh. Khullani Abdullahi (12:25.006) that have those conversations about priorities, about the technology. And I don't know if this is true for you, but I'm seeing it become a much more integrated multi-stakeholder process. And so as you look back in the last 12 months, and you think about enterprise organizations, broadly speaking, nationally and internationally, are there areas where you think in addition to data readiness and clean data, great data, where enterprises may have overestimated their ability to adopt and implement AI technology safely. And what do those potentially look like? What do those gaps look like in the marketplace at large? Elena Vekilov (13:13.27) Yeah, yeah, great question. So I mean, I think if we had to summarize what we were seeing in the industry in terms of, know, where most enterprises seem to have overestimated or been surprised in this journey, I'd say I think most companies thought that they were adopting AI, but you know, maybe it was more just like the aspirations for it. Khullani Abdullahi (13:41.11) Hmm. Elena Vekilov (13:43.156) You know, so like that feeling like you're assembling IKEA furniture and halfway through we're realizing we've got the wrong screws and the instructions are upside down and we're missing the wrench and that piece goes there. I feel like that was a lot of the enterprise AI journey that we kept seeing this year. And I think there were several reasons for it, right? I mean, so we talked about organizations thought, I guess maybe misread. Khullani Abdullahi (13:57.326) Thank Elena Vekilov (14:11.476) the tea leaves on, you know, having data does not equal having usable data. A lot of organizations we saw that we said, we've got tons of data, so we're ready for AI. But the truth is, having the data is not the same as having the data that's clean, that's structured, that's governed, that's understandable by anything, whether that be human or machine. And so people figured out, you know, this beautiful, glamorous celebrity closet Khullani Abdullahi (14:16.651) Exactly. Elena Vekilov (14:41.11) that they thought they had, it was actually like their kitchen junk drawer of random cables. And so we had a lot of conversations of why isn't the AI working? Why aren't I getting the value? And I put everything I had in it and we kept seeing, well, there's your answer, right? So the gap, the overestimation or maybe the misestimation, if I may, was like that data muscle maturity thing. So. And relatedly, think companies underestimated the cultural shift that would be required. And not everyone was ready to work with AI, right? We saw this one come up constantly of organizations saying, we're ready for AI, bring it on. But then the people themselves were doing what? Say what now? And so we saw everything from kind of, you know, genuine curiosity to cautious optimism to straight up You know, if this thing so much as auto completes the wrong sentence, I'm unplugging it. And so, you know, that's human. That's normal. mean, humans, I think, don't resist technology. They resist ambiguity. And so we saw the headlines coming out. We stood up the pilot. Nothing changed. We bought the platform, but the adoption that happened, the value isn't there. And so I think the overestimation was You know, people, companies just missed their people's emotional readiness for the change management required. Which, you know, again, ties into also, you know, the overestimation of the having AI equals having value, right? All of this kind of fits together into the value doesn't come of a company, of an organization, doesn't come from the model, it comes from the workflow it transforms. And you can do it better if you can do it. in a way that actually identifies and solves a business problem, not just having it or having it, right? So whatever you've got in the bottom, we've learned at this point that AI will amplify your clarity, your abilities, or your chaos that's already there. So, I mean, coming full circle overall, I think if I could sum it up where we got it wrong, some lessons learned is overestimating the tech maturity, underestimating the data health, Khullani Abdullahi (16:51.017) Right. Right. Elena Vekilov (17:06.678) maybe skipping a bit on the cultural prep, overall trying to sprint before stretching. Well, the good news is I think at this point we're coming full circle and organizations are slowing down, taking a beat, trying to establish that right foundation. And what I'm seeing is a lot less overwhelmed feeling and more the excitement of feeling like, okay, all right, so now that we've learned how to do it, we know how to do it, which is exciting. Khullani Abdullahi (17:22.318) Right. Khullani Abdullahi (17:31.926) Yeah, I love that. I'm going to quote you on this. I'm going to steal this. People don't resist technology. They resist ambiguity. And I think that's such a great phrase. And I think it encapsulates. a lot of what I hear during AI implementations and AI strategy use case interviews where employees, the rank and file will say, you know, I have concerns. What implications does this have for my work? What does this mean? are the company's priorities? And there is ambiguity at the executive level about what is communicated to the organization. And I think Elena Vekilov (18:12.341) Mm-hmm. Khullani Abdullahi (18:13.58) What you shared is that that cultural piece is critical to, in order to ensure that you actually derive full value from the AI technologies that we implement, right? That if you're going to derive true and full value from the technologies. removing that ambiguity, addressing those questions, updating and upskilling the culture and the employees is a really critical piece. So I think that's an excellent phrase and I'm steal that. So if you see that in one of my PowerPoints, I shared with you my intention in person via video. Elena Vaclav, yes. Elena Vekilov (18:43.51) Absolutely. Elena Vekilov (18:51.926) I want an asterisk with my revenue share. want my royalties. I want my royalty cut, please. Khullani Abdullahi (18:58.99) 100%. I shouldn't have told an attorney I was going to take their phrase. my God. I got to block your email ASAP. I love it. I think this flows really well into this next piece about how do you operationalize AI and privacy? So we kind of talked through some of the things, the trends over the year, some of those gaps and issues and opportunities. Elena Vekilov (19:06.136) agreement on your desk. Thanks. Khullani Abdullahi (19:28.268) that have kept you awake and that you've seen enterprises try to address. then, you know, as we close the year, do a much better job of pausing and addressing, you know, for people with backgrounds in law, we think of law as like the quintessential path, I think, to success. And inside the enterprise, people think of the legal department as the department of no, they think of friction. They think of red lines that will cause me to miss my quarterly bonus, right? There's all of this that is caught up in it. You have done, I think, a great job of working in several technology forward companies where you're addressing risk, innovation, and balancing the two, and working with everyone from the board on down to the engineers. And I think that perspective is really helpful in kind of helping our audience understand from the chief privacy officer's perspective, what are you thinking about for balancing innovation and risk so that legal is an enabler and not a block? Elena Vekilov (20:45.398) Yeah, absolutely. I love this question. Let me start with this. If your legal team is known as the Department of No, you're doing something wrong. It's time to rethink your approach. You know, especially I think in house, right, as a as a internal department, but I mean outside as well. If you're outside counsel, you know, legal's role, it's not to halt innovation. It is to help my client, my clients, whoever it is. to help ensure that new products launch safely, both from a technical and a regulatory perspective. And there's a big difference between blocking progress and guiding it responsibly. Right? So think of legal as not a roadblock, but maybe as like a GPS, helping the organization reach its goals without unexpected detours or collisions or road blockages. Right? So Khullani Abdullahi (21:19.586) Right. Elena Vekilov (21:45.594) you know, an effective strategy for any company, whether, whether you may consumer electronics or develop software, anybody is to embed legal into your product development process right at the start. so instead of waiting until a product is nearly finished, establish that intake or review process where legal, along with other key stakeholders, right? Like you've got engineering, you've got architecture, you've got security, you've got compliance. where all of these parties can get involved early in the conversation. Everybody has a seat at the table in the conversation. And that will ensure that like as a new product idea or significant changes or anything moves through the development flow, that it's routed to the right experts from day one. The mistake that I see is people bringing in legal at the end for the final rubber stamp. I mean, that's... That's like trying to install a seatbelt after you're already on the highway, right? I mean, like by then you've missed the opportunity to put in the seatbelt, right? Like your car is still gonna go on the highway, just like take the beat to put in the seatbelt. And so, similarly then, like when a new AI feature product is proposed, it should enter a structured intake or review process. Whoever, whatever team owns that architecture, product teams, whoever, that can, you know, does that first pass helps determine, you know, hey, is this something that needs to pull in certain departments, if certain key criteria are met, legal pops in, legal comes in, can conduct a focused review on it, using standardized templates or checklists, whatever it might be that that cover privacy and intellectual property, commercial risk, regional requirements, AI laws, HR law, right. So the goal is never to say no. it should always be finding a way to help your clients know what the clear path would be to guess, right? So for instance, if a new product or a new app that we're talking about handles personal data, sensitive data, health or financial information, if we're integrating GNI in a way we haven't before, automated decision-making, we're talking about cross-border data flows, we're bringing in third-party vendors, we're... Elena Vekilov (24:11.456) changing how we manage user consent, there are so many implications. But like all of that could come to legal upfront. Legal can say, great, well this would require stronger encryption, updated consent flows, here we go, check, check, check, this what we need to do, upfront. So that product teams then can move forward in their build with the confidence, knowing that as they're building their product, they're not gonna have to circle back afterwards and redo all the work that's been done already because they did it in a way that wasn't compliant, right? So I think that's a big missed opportunity that we see in some organizations and something I'm passionate about is the legal department being seen as an enabler, being seen as somebody that further streamlines collaboration, that encourages compliance. as this design principle, not the afterthought. Think about what your product developers are going to need to consistently watch out for. And then give them the playbooks, show them approved patterns, approved data flows, checklists, share it with them proactively. You don't want to always have to start from scratch either. So if people know upfront what they need to do, what they need to think about, it makes it easier on everybody. And then you measure success by both Khullani Abdullahi (25:14.381) Right. Khullani Abdullahi (25:24.387) Right. Elena Vekilov (25:35.264) how quickly something ships, but also how safely it ships. So if the risk remains manageable, everybody's winning. So coming full circle, you know, the Department of NOAA hate that. And that's how you avoid it, right? You avoid being the Department of NOAA by legal taking the initiative to establish that we intend to be part of the product architecture. We're not paperwork and approvals. We can scale privacy. We can scale compliance. across markets, across product lines, across industries without slowing down innovation. Khullani Abdullahi (26:10.478) Yeah, I love that you said legal has to be proactive because I think that is a cultural and strategic shift. I know historically in-house counsel and in-house legal teams receive and respond. And so I think the shift is dynamic that you're pointing to that brings legal in early and often is really compelling. I just have one follow-up question. or at least one follow-up question. When you think about that relationship, do you find informal or formal mechanisms or both to be effective in helping the product and engineering teams understand how you think about risk and compliance and transmitting that information? Or would you recommend to companies that... information transfer is a very formal process, whether it's a joint council or multi-stakeholder meetings, etc. On balance, how do you see that being operationalized? Elena Vekilov (27:20.278) So I know you're going to love these, this answer, but you know, it depends. I'll say the smaller the company is, the less random pockets there are, the easier it is to keep it in an informal thing. At a certain point, the need for a formal process makes itself clear, right? As you mature into a forward thinking, Khullani Abdullahi (27:24.769) Yes. Khullani Abdullahi (27:34.509) Yes. Elena Vekilov (27:50.336) company, corporation, program, legal department, you see that one of the most powerful tools for that is a more formalized risk tiered governance framework. So something that lets innovation move quickly, right? Just as quickly as it was when you were smaller, but with the right safety checks in the right places. And, you know, as you noted, so astutely, Khullani, like sharing with people kind of upfront that they know what to expect. Khullani Abdullahi (27:53.752) Mm-hmm. Khullani Abdullahi (28:08.172) Right. Right? Elena Vekilov (28:19.798) where the risk tiers are, what we would care about, what we would be worried about. You know, not every project is a high risk moon landing, right? And so making more clear for people that certain projects might just be putting better wheels on the office chair. Useful, unlikely to cause existential harm unless you're, you know, racing down the hallway or something. So the whole point of having maybe a more formalized Khullani Abdullahi (28:29.357) Yes. Elena Vekilov (28:48.796) risk tiering is matching, formalizing the risk tolerance of the company, of the department, of your clients and matching the level of scrutiny that all should expect and be cognizant of to the level of potential impact as well, Treating every project like a high risk situation slows the business down, Khullani Abdullahi (29:01.987) Right. Elena Vekilov (29:13.334) And then, then treating no project like it's high risk, that's how you end up in the headlines that you didn't want to be in. So you, you know, I would say easier to be informal at the beginning. And then as you develop establishing for the organization, these, these more formalized structures, forums, and, and, and guardrails for how everyone or, you know, Khullani Abdullahi (29:19.224) Thank you again. Elena Vekilov (29:41.684) our entity distinguishes low risk from high risk. I think you have to have. Khullani Abdullahi (29:44.406) Yeah, right. Can I ask a question? So when I work with companies, there is a distinction, I think, in risk appetites for products that they're building. for products that they're just buying off the shelf, and then for products that they're buying off the shelf, and then fine tuning, upgrading, integrating, maybe it's like a deeper relationship. So as you think about these risk tiers and these risk categories, as a chief privacy officer in general counsel, do you find one bucket or more to have been top of mind in 2025? Elena Vekilov (30:26.134) I mean, yes, of course, right? So obviously, right, can't divulge anything for my own internal clients as their lawyer, but me personally, what we see in the marketplace, and I think what general guidance experts have given on this, I'll answer it that way, is your focus on this impact of who is it going to touch. if this is just an internal tool that... Khullani Abdullahi (30:52.577) break. Elena Vekilov (30:52.978) operates entirely within your company, uses well-governed, non-sensitive data, supports your internal workflows, has a very low chance of impacting individuals' rights. It's explainable, it's reversible, it's verifiable, it's monitorable. The AI that helps you do your job better, it just improves efficiency. They're not making decisions about people. These are the things that I think is we typically see are your lower risk, your lower risk considerations. And on the other hand, maybe a higher risk model or AI or concept might be something that is, you know, a high risk consumer facing something, something that touches personal data, that touches sensitive attributes, that maybe makes inferences about individuals that impact their legal rights or their financial. Khullani Abdullahi (31:39.118) Wait. Elena Vekilov (31:50.902) or access to healthcare, to housing might have ethical consequences. AI that interacts with real human lives, it has the potential for real world harm if the output goes wrong. That we know the laws then also require auditability, explainability, that the laws require higher level standards of it. Those are gonna be the headliners. Those are the ones that... that can shape these real outcomes for people and so they deserve a more structured, cautious approach. That would be how the risk-tearing comes out, how the EU AI Act thinks about it. As we're seeing these laws come out, that seems to be kind of the way the industry is thinking about things is focus on the impact. Khullani Abdullahi (32:42.636) I think that's great because then you can work backwards from those risks and those potential pitfalls and then identify what kinds of resources and governance structures need to surround this particular product before it's launched into the marketplace. So along those lines about third party products, internal product builds, et cetera, I want to shift gears a little bit into talking about contracts. Elena Vekilov (33:01.376) Mm-hmm. Elena Vekilov (33:12.49) Mm-hmm. Khullani Abdullahi (33:12.578) And one of the things that I am seeing companies generally struggle with is figuring out how do we protect our internal data, even as we race? to give it and upload it into the cloud so that we can have these Frontier AI companies give us better, greater insights. And so as you think about whether it's a Frontier AI vendor in particular or a downstream provider of a Frontier AI model embedded in some product, When it comes to privacy, when it comes to IP rights, when it comes to data residency, as you think about data, what are the issues that you are seeing enterprise organizations typically consider as they're looking at the nuts and bolts of these contracts? And has anything surprised you this year as you've dealt with these contracts? Elena Vekilov (34:11.06) Yeah, great question. if I may, I'd like to answer it in two parts actually, because I see friction from both sides of on the one hand being the buyer negotiating with GEN.AI vendors, but on the other hand, being a seller negotiating with clients who want to use our data inside their GEN.AI workflows. So both sides come with their own flavor of contract drama. Khullani Abdullahi (34:28.888) Yeah. Khullani Abdullahi (34:38.604) Right. Elena Vekilov (34:39.41) you know, first, right, to answer your direct question, the negotiating with GNI vendors when I'm the buyer, the biggest friction points, you know, I think fall into a few pretty predictable buckets, right, as you touched on, right? First, it's this often the data residency data movement question, you've got AI workloads that are bouncing between regions and clouds and sub processors. And so data residency becomes a game of figuring out like, where exactly is my data going? Khullani Abdullahi (35:07.842) Mm-hmm. Elena Vekilov (35:07.976) Why is it taking the scenic route? What laws might be implicated? And so, you know, it's not that as a client, we're asking a vendor to build, you know, a bunker to house my own data, but they should be able to clarify where are you processing the data? Where are you storing it? Who touches it? Does it leave the region that we agreed upon because that might trigger legal obligations for me and my client? And, know, when a vendor answers, well, it depends pins, like that's never a comforting answer in a privacy conversation. you know, so let me see. So then maybe, another thing that we see often is regarding IP ownership, the classic who owns what debate. So the IP conversation is often the headliner in these where, you know, we see vendors wanting broad rights to improve their models or their product. Khullani Abdullahi (35:52.654) Okay. Right. Elena Vekilov (36:05.13) But as a buyer, we of course want to make sure that our own proprietary data doesn't suddenly become a tiny part of somebody else's foundation model. This is my intellectual property. And so a lot of the negotiation boils down to getting clarity on, you as a vendor using my data to help me or to help everyone or to help yourself? The ambiguity. in that answer and not being certain of it on either end is how one can find themselves accidentally donating their competitive advantage to the cloud, which I'll leave that there. And very relatedly, something that comes up a lot is the security and model training and use discrepancy conversation, right? It's where the vendors are saying, we won't train on your data, but... Khullani Abdullahi (36:47.192) Yeah. Elena Vekilov (37:01.226) then you read the contract and it says something else entirely, right? Like where the marketing side will say, your data stays yours, but then the terms say, but we might use it to train our platform level features and insights and improvements. And so when the sales pitch and the contract don't match, you have to assume that the contract is the one that's telling the truth, right? So, but then, know. Khullani Abdullahi (37:25.282) Because the sales team wants its commission and they just want you to sign on the dotted line. Elena Vekilov (37:31.836) On that note though, being the seller, The seller of course has their own concerns that they're concerned about. And the friction points look a little bit different, but they're just as important to frankly just like the allocation of how these relationships work in the industry, right? mean, so right, that need to address the data leakage or the model contamination risk, right? That ends up being the number one conversation of, you so. Clients wanna take data from me, from you, from whoever and put it into a GNI model. So you have to make sure like, okay, but is the data gonna be used to train that model? Is it somebody else's model? Is it gonna be ingested into a shared environment? Who else can access it? Are we accidentally enriching a vendor we didn't mean to enrich and have no intent of enriching? Is it going to my competitor? So protecting against the... Khullani Abdullahi (38:06.104) Yes. Elena Vekilov (38:30.058) oops, your data is now part of some model's collective memory. We added a whole bunch of accidental roommates into this relationship. It's a key consideration on both ends of the relationship, as a buyer, as a seller. Know where it's going, where it's held, how it's controlled, who's using it, and be clear on that. so... Khullani Abdullahi (38:38.648) Right, nothing. Khullani Abdullahi (38:50.262) Let me ask a question because I know I have some listeners who are founders of technology companies that sell AI tools to enterprise. And so on behalf of them, I just want to drill down for a lot of companies, the improvement in their technology depends on better, greater training data and you get better training data from your clients. As an enterprise organization, is there any condition under which an enterprise organization would consent to usage data being used, anonymized, et cetera, cleaned up in training the future iteration and improvement of a consumer or a enterprise technology that you are subscribing to? Elena Vekilov (39:43.058) sure people do this every day, but it needs to be transparent and upfront and clear and both sides need to be aware of that, right? I mean, that's your typical data license agreement and it's part of the permitted use cases, right? So any organization can consent to whatever I give you, you can train off of cool, right? Whether you pay me for it, whether I benefits for it, know, give to get the cooperative models. We have consortiums out there. They're the, the, you know, the would they ever, of course companies do every day. Khullani Abdullahi (39:59.213) Yes. Khullani Abdullahi (40:04.397) Yep. Khullani Abdullahi (40:11.778) Okay. Okay. So that has changed in the gen AI universe, right? So like generative AI hasn't transformed how you think about willingness, enterprise willingness to do that. Elena Vekilov (40:13.246) It's a matter of being clear on that. Elena Vekilov (40:28.832) So I won't say that. I wouldn't say that. think there is maybe. Khullani Abdullahi (40:30.562) Okay. Elena Vekilov (40:38.434) What would I say? Maybe taking an extra beat. Because what happens with GEN.AI is that you say, I'm giving it to you to train your model 2.1, but then it becomes 2.2, 2.7, then it becomes now we can make videos out of it, right? So there's this aspect of GEN.AI where you don't know where it's going to go. And so I wouldn't say that it hasn't changed the consideration that companies are facing. Khullani Abdullahi (40:42.574) Mm. Khullani Abdullahi (40:59.725) Right. Khullani Abdullahi (41:06.339) Right. Elena Vekilov (41:06.902) I don't know that anybody could, right? mean, it's, that's, that's kind of an individual. Maybe if you're, you know, big consulting firm, and you've talked to thousands of different companies and how they're thinking about it, you could make the statement I certainly haven't. So Whether it's changed people's tolerance for that, I can't speak to, but I can say it always just comes down to put in the contract, be transparent. Like if you need to train off of it, then let's work out a deal, but like make it happen with everybody being fully apprised of what the situation is. Khullani Abdullahi (41:35.928) with the, yeah. Yeah, no, I love that because I think there's a lot of vendors and technology companies bolt on compliance and legal at the very end. So they'll go through everything, convert the whole team, go through the wholesale cycle. And then only at the end that legal gets involved. And I think in the same way that you're bringing product and engineering to the table earlier and often with legal, there's something to be set for this vendor. contract relationship and initiatives to bringing in legal sooner and waiting and not waiting until the end of the sales cycle. And that's particularly true for the vendor side to be more proactive because I think it shapes the velocity at which the deal closes, which impacts the velocity at which the company derives value from this AI implementation or adoption. And I think Elena Vekilov (42:27.232) Mm-hmm. Elena Vekilov (42:31.36) Mm-hmm. Elena Vekilov (42:34.814) Mm-hmm. Khullani Abdullahi (42:35.212) There's another area where you're thinking about how quickly our innovation and compliance moving. And I think something that you shared that's really possible that is really compelling is let's be transparent and let's work out a deal. If that is core to your business product and we want your technology, let's figure out what the terms are. I think it will make a lot of technology, particularly on the startup side, very happy. Elena Vekilov (43:00.064) Yeah, I mean, absolutely. Khullani Abdullahi (43:02.478) Turning to 2026, since there's 20 some days left until the end of the year, there have been one big theme, I think, that has been true throughout 2025 that will probably carry over into 2026 is this notion of innovation and compliance and risk, especially with some of the provisions of the EU AI Act coming online in August of 2026. potentially new state laws coming out in the United States, maybe a federal preemption, all sorts of things kind of changing. So I have a two part question. So on the one hand, how do you as a privacy and governance and AI risk leader think about innovation and compliance and what your philosophy for that would be in 2026? And then a second part is as you think about like, planning for the future, whether it's the next four years, the next five years, where do you see the innovation compliance, future-proofing scenario planning that leaders like yourself will be doing? What are those things that you can see on the horizon but that yet haven't arrived? And what's the current state of that balance of innovation and compliance in the short term for 2026, if that made sense? Elena Vekilov (44:29.0) It did. It's a big question. And I think I'm going to wrap up my answer all in one if I mix I think they're related. And I'll say like, if I knew what AI was going to be in five years, I would be a rich woman. So but look, I mean, I think it comes back to like our whole conversation. And you know, from the very start is, I see innovation and then compliance, privacy, compliance, a compliance, AI governance. I don't see those as opposing forces or like something that necessarily wouldn't fit together. Like if anything, Khullani Abdullahi (44:33.282) I love that. Elena Vekilov (44:57.654) privacy and governance are one of the strongest enablers of our sustainable AI innovation that we have. So a company that treats privacy like a checkbox is always going to feel like it's choosing between two competing priorities. Do we regulate and govern? Do we innovate? Right? But a company that looks at privacy is like this infrastructure that we've talked about as part of the design process. Excuse me, the design process. Not an afterthought. Khullani Abdullahi (45:05.122) Right. Elena Vekilov (45:27.286) it actually ends up moving faster and more confidently into the future. And there's several reasons for that, right? That we've seen industry wide play out again and again and again. Right? Like first is this idea of privacy creating the conditions for your innovation to scale. Like when privacy is strong, when the governance and the infrastructure and a core organization is strong, then the teams know what data they can use and how they can use it. Customers feel safe engaging with AI powered product. regulators see the company as a responsible actor, not a big risk they need to be focused on. Innovation is unslowed by uncertainty, by not knowing. It ends up being guided by the clarity that you've provided because you've taken the time to structure your system accordingly. And so it's like building a highway, right? It's like the guardrails don't slow your car down. They let you drive it full speed without worrying about flying off the cliff. So that's what governance and privacy does for AI as well. then keeping in mind also that you can't retrofit compliance. It's the only thing you can't retrofit later. You can always enhance a model, you can always upgrade an architecture, you can adopt a new tool or a technique, but you can't retroactively declare something ethical, responsible, or compliant. Khullani Abdullahi (46:25.998) That's it. Elena Vekilov (46:55.028) The trust foundation, it has to be there before the innovation ships out the door. And so the smartest companies, the ones that five years, six years from now are making it and are really winning in this AI race are gonna be the companies that aren't choosing between the two. It's the ones that are choosing the innovation that grows on top of their compliance infrastructure already. That's what's gonna be able to scale that. Khullani Abdullahi (47:11.779) Right. Elena Vekilov (47:23.318) privacy enabling the velocity of the company. Big word there, but right? Can we launch this conversations? We'll be able to happen faster because the rules are clear, the risks are understood, the teams have trusted the framework. So whatever it is that GEN.AI ends up being, we're ready to review what account for it, manage it, handle it, because we already took the time to do it today. Khullani Abdullahi (47:31.608) of it. Khullani Abdullahi (47:51.052) I love that. And it's so it's not a choice. This binary choice is a fiction and the great organizations, the great enterprise organizations where real innovation is happening, they've rejected this binary choice. I love. So I, I find that very compelling and I want to ask about blind spots. So whether it's the board. and the directors, whether it's the C-suite and the executives, whether it's your peers and your colleagues or the rest of the team, how are you thinking about enterprise-wide literacy and awareness of data and AI risk? And what blind spots do you think people still have at various levels that you can pick one or more to speak to? And then do you think that there is a a more proactive or enhanced role for legal in disseminating literacy about those risks and the blind spots that you'll share. Elena Vekilov (48:56.724) Yeah, absolutely. So if we're looking around at the industry, I do, I see several blind spots that think we consistently are seeing showing up and they are surprisingly universal, right? I think boards are getting more informed, absolutely. But as we talked about, the speed of AI evolution means that even well-briefed boards Khullani Abdullahi (49:02.637) Mm-hmm. Elena Vekilov (49:26.582) can find themselves asking, you know, 2023 questions for 2026 problems. so, you know, some some of the biggest blind spots to answer your, your, your direct question, that I'm seeing in the marketplace are, you know, the sense of, of, you know, AI is like a tech issue. It's a tech project. one and done. Khullani Abdullahi (49:35.278) Yeah. Elena Vekilov (49:54.967) instead of this big business model issue. So many boards we're seeing are like, or seem to be still framing AI as something that is happening in the IT department. You know, they're only talking to the technology team about it. Like it's a systems upgrade, a nice to have capability. You know, we rolled out a new software carry on, but it's not right. It's not a feature. AI is changing. Khullani Abdullahi (49:55.032) Yes. Elena Vekilov (50:22.326) how decisions are being made, how value is being created, how data is being governed, how risks are compounded exponentially and necessarily that results in what the company becomes over time. And so I think maybe boards are underestimating a little bit, might still be having a blind spot on how deeply AI impacts their overall strategy for the companies themselves, not just the software. Khullani Abdullahi (50:46.464) Yes. Elena Vekilov (50:51.968) That's one, I think, again, as we talked about coming full circle on it, I think another big blind spot is the overconfidence in an organization's data maturity. Organizations, boards, companies tend to think that their company has good data because the company has lots of data. And as we discussed, that's not the same thing. Having a lot of data is not the same as having high quality data, documented data, governed data, explainable data. data that AI can actually learn from. And that's the quiet risk, right? That the AI is going to amplify whatever it is you feed it, the Michelin dinner or the junk food. And that is something that there's still quite a bit of naivete around. Maybe also relatedly, right? This assumption that like the talent, that the leadership, that the boards, that the people can catch up later. So Khullani Abdullahi (51:39.501) Yes. Khullani Abdullahi (51:49.826) Mm-hmm. Yeah. Elena Vekilov (51:51.381) I think we're seeing that aborts throughout the year. I'm picking up on this being diverging now, which is great, but this underestimation of how much AI fluency and literacy is a leadership skill and one that they should be investing in and dedicating time for their people to develop. So, I don't mean like the technical fluency. I mean like the strategic fluency. Khullani Abdullahi (52:09.528) Yes. Elena Vekilov (52:21.394) not saying that your CFO should be writing Python code, but your CFO should know and understand what happens when a predictive AI model changes how the business forecasts. Because now that AI is going to require this new literacy for functions across risk, across operations, and governance, and ethics, and data strategy, and product design, and Khullani Abdullahi (52:33.848) Yes. Khullani Abdullahi (52:45.699) Yes. Elena Vekilov (52:46.248) And so the companies I think that are struggling the most right now, they're not lacking AI tools, right? We have an influx in the market, but we are I think seeing some of this gap a little bit of AI ready, AI literate leadership and brings us, I think the second part of your question in terms of the legal departments. I think there's a excellent role for the legal department, for a privacy department, for a department that Khullani Abdullahi (52:52.941) Yes. Elena Vekilov (53:13.79) whatever team it is, compliance, data governance, that within your company has established itself as a participant in the data flow journey. Whoever's sitting there mapping out the flows with the product, with the data owners, there is this opportunity to bring AI into that conversation there, to be the ones that are talking through it and explaining risk and explaining like, look, AI risk isn't linear. It's not controllable. It's not contained. It's interconnected and it's fast moving and it's deeply tied to the culture and the quality and the decision making that we're all doing here. And building on those established relationships, those governance relationships historically within a company, I think is a great opportunity for leaders in the governance functions and the control functions, helping to steer their organizations more confidently into 2026. Khullani Abdullahi (54:11.822) was fantastic. There's so much there. So much there. One thing that I think is helpful for people to just maybe walk away with, there's so much to walk away with. But I think one point that I want to highlight for the audience is the overestimation of your data maturity and data infrastructure. And the reason I think that is so critical is it impacts literacy, it impacts risk, it impacts compliance. But there is thinking about data from the perspective of cleaning up the data that already exists. But there is a lot of task set and process knowledge that exists in employees' minds that has never even been captured, has never been documented. And so I think to your point about the data maturity, I think the most, the... Elena Vekilov (54:54.496) Mm-hmm. Mm-hmm. Khullani Abdullahi (55:03.372) the most innovative companies that I think are tackling these issues, I see are the ones who, and there are very few, because it's still emergent, who take a beat to then say, what data have we failed to capture as an organization? What tacit process knowledge is so valuable and is just in the organization should we create? And so I think there is a data creation initiative trend that will Elena Vekilov (55:23.295) Mm-hmm. Khullani Abdullahi (55:31.278) in 2026 trying to capture tacit knowledge. With respect to your comments about the board and the delay in their AI literacy and the implications for the kinds of questions they're asking, their questions could potentially be out of date because there's that gap. AI literacy, and I think you're spot on in identifying legal as being a core. Elena Vekilov (55:47.53) Mm-hmm. Mm-hmm. Khullani Abdullahi (55:56.258) component of closing that gap and increasing the AI literacy across the organization from both a strategic and technical standpoint. And to that, I would add there are companies who are very intentional about creating these centers of excellence for AI in their organization that operate as a internal advisory. And it can create a lot of gravity, right? It can create a lot of weight in that organization and it can serve as this Elena Vekilov (56:04.608) Mm-hmm. Elena Vekilov (56:18.09) Mm-hmm. Yeah. Khullani Abdullahi (56:25.888) internal in-house advisory from the board on down. And I think what you shared was very spot on. So among your comments, I wanted to make sure that I drilled down on those too. I know we're coming up on time. So one thing I think we'll jump to the lightning round, because I want to be mindful of the time that you've blocked. In the lightning round, before we go in the lightning round, any final comments? I thought their last set of comments were Elena Vekilov (56:35.37) Yeah. Khullani Abdullahi (56:55.298) pretty comprehensive, but I wanna make sure there isn't one final thought that you wanna leave our audience with before we drop into the lightning round. Elena Vekilov (57:06.698) thought I think is just, you know, re-emphasizing the point that we've been making where, you know, I think what we're going to start seeing in 2026 and like as enforcement starts picking up, you know, when, as this area grows, I think what we're going to see is that the diverging paths will have to necessarily converge more, right? That the market is necessarily going to move towards that standard. And so the companies that are investing early in privacy and governance are going to weather 2026, 2030 much more gracefully than those that don't. And so I would just emphasize that, right? Like make your governance, your privacy, your compliance functions, make them all part of helping your organizations be a winner in this innovation market. Khullani Abdullahi (57:35.884) Okay. Khullani Abdullahi (57:44.515) Yes. Khullani Abdullahi (58:02.158) I love it. So AI governance and there's a lot of terminology responsible AI, for the AI. What is the one overused phrase in your industry that you do not want to hear after 2025? If you could just fix a phrase or more, what are you not wanting to hear people use next year? Elena Vekilov (58:19.126) Hmm Elena Vekilov (58:26.646) I love, I love, love, let me say it this way, my sarcasm meter goes off the charts when I hear the model is completely unbiased. And I'm like, that's the AI governance equivalent of like, my toddler never lies. Like, okay, sure. Or we're building AI responsibly, period, full stop. And it's like, great. Khullani Abdullahi (58:42.83) Anyway, this is not true. Khullani Abdullahi (58:53.454) Thank you. Elena Vekilov (58:55.072) with like vibes, with affirmations, you got scented candles in there, like how? that full, like those two, we are. Khullani Abdullahi (59:00.873) Wow! And lady, I can hear the renders cringing. Elena Vekilov (59:05.364) We are past that, man. I want to see it, show me the proof, show me the infrastructure, show me the data flows. Like, no scented candles if I vendor pitch this. Khullani Abdullahi (59:09.334) Yes, don't come to me. Okay. God, a gauntlet throne. There might have a whole chart that we build around that because you're like, where's the model card? What version? Are you on AWS? Is it EC? Where in the world are you? Okay. All right. So one privacy regulation that you think is underrated or misunderstood that people just forget to emphasize maybe. Elena Vekilov (59:20.15) Ha Elena Vekilov (59:29.536) Yeah Elena Vekilov (59:43.511) I love it. So I'm going to say I stand behind this one, like the GDPR concept or I the privacy concept at this point of purpose limitation, right? Like people think of it as this annoying constraint, but it's a brilliant design principle, right? It goes back to like these upfront guardrails. If you know why you have the data and why you're using it, and then you know what you can do with it. So this clarity being underrated idea, I think people Khullani Abdullahi (59:54.22) Mmm. Khullani Abdullahi (01:00:03.117) Yes. Elena Vekilov (01:00:13.76) Don't give purpose limitation, it's due credit. It's a good thing. Khullani Abdullahi (01:00:16.558) I love it. We'll have to call that out specifically. I may have to do a whole PowerPoint on these answers, Okay, so going into 2026, what is the AI use case you are very bullish on as a chief privacy officer? Elena Vekilov (01:00:33.118) Yeah, straight up just AI is a workflow simplifier. So, you know, not the decision maker ones, but like the unglamorous stuff, the auto tagging, the summarizing, the document drafting, the compliance prep, like, let's go. This isn't the stuff that's going to make headlines, but it will make tens of thousands of people's work days just less painful, less annoying, less grunt work. Let's use machines that actually people want to be using. Technology, infrastructure, whatever, I don't know. Khullani Abdullahi (01:00:37.186) Yeah. Khullani Abdullahi (01:00:45.58) Yeah, I love that. Yes. Khullani Abdullahi (01:00:59.267) Yes. Elena Vekilov (01:01:02.762) fill in the blank here, but that will make life easier for people. Let's go. Khullani Abdullahi (01:01:07.252) Okay, work well. All right, Chicago restaurant or neighborhood that best captures your AI governance risk leadership style. Yes. Elena Vekilov (01:01:19.136) Kalani. Hang on, you cut out for me, I'm sorry. What was the question? Khullani Abdullahi (01:01:23.63) Sorry, let me read the question. What is the Chicago restaurant or neighborhood that best captures your AI governance risk privacy leadership style? Elena Vekilov (01:01:35.485) Ooh. West town. It is where grit meets creativity. Polished where it matters, relaxed where it can be, always evolving. You know, I think that's how I lead. Khullani Abdullahi (01:01:40.715) Yes? Khullani Abdullahi (01:01:44.96) Yes. Yes. Khullani Abdullahi (01:01:50.382) Yeah. Khullani Abdullahi (01:01:57.752) I love it. I love it. That's such a fantastic answer because I live a block away from the West Ham bakery. So I'm so biased and yes, I was going to save my street, but then I realized this is a podcast. I was like, people where you live. They already know where I live. Elena Vekilov (01:02:08.554) We used to live right there. my God, we were neighbors. I love that. Elena Vekilov (01:02:16.8) Don't do that, don't do that. No, my God. Kalani, their chicken pot pie. Have you had it? Ugh. Khullani Abdullahi (01:02:23.15) Yes, especially this time of year. It's so it's like, so yeah, I love it. That's such a great answer and such a great neighborhood. Vinyl question in the lightning round. If you had a billboard facing every AI founder in 2026, what would it say? Elena Vekilov (01:02:28.042) Mm-hmm. Mm-hmm. Elena Vekilov (01:02:49.95) AI founders, build AI that people trust, want, and will actually use. Khullani Abdullahi (01:02:59.47) Hey, okay. You hear that Sam Altman? I'm just kidding. If you ever want to hire us for OpenAI, we'll take jobs. No, but for real. Elena Vekilov (01:03:07.926) Did you hear the metaverse has 900? 900, period. Users, 900. Khullani Abdullahi (01:03:13.607) No, no, no. my God. After Zuckerberg renamed the whole company. Elena Vekilov (01:03:22.87) 900, 900 people want to hang out in the metaverse. Khullani Abdullahi (01:03:25.477) Well, you and I will never be getting Facebook offers. Thanks, Elena. Or Meta. We're to have to delete this. Just kidding. This was such a refreshing conversation. And I think you did such an excellent job making legal and privacy and AI risk leaders more accessible and personable. And I imagine that there's going to be a number of people Elena Vekilov (01:03:31.914) Cut this, cut this part, cut this part. We're gonna get sued. Khullani Abdullahi (01:03:53.806) who are gonna go ask for their legal leaders, their legal in-house teams for coffee and to start building those relationships so those feedback loops will get faster after they listen to this podcast. So I really appreciate you taking the time to be so generous with your insights, to be so candid and to share both your expertise and laughter. I really appreciate you taking the Elena Vekilov (01:04:03.198) I hope so. Elena Vekilov (01:04:07.349) I hope so. Elena Vekilov (01:04:17.752) Of course it was a pleasure. Thank you so much for having me on. Khullani Abdullahi (01:04:20.92) Thanks so much, everyone. You can go to ChicagoPodcast.ai to listen to Elena Vakulov discuss the latest in AI governance, risk, and enterprise. Until next time, thank you.