Podcast Ep 375: Dell privacy chief Lavonne Burke warns AI governance is struggling to keep pace as businesses deploy autonomous agents at rapidly growing scale.
Tech giant Dell is one of Ireland’s foremost foreign direct investment (FDI) businesses with close to 5,000 people employed here. There is hardly a business in the land, or the world for that matter, that is not using its technologies in some way, from personal devices to high-end server and storage technologies.
That’s why when Dell’s head of privacy has a viewpoint on the arrival of AI agents – whether it is within the global business or how they are deployed by its customers – it’s worth sitting up and paying attention.
“Shadow agentic AI is probably one of the scariest things that I think people have to worry about”
Lavonne Burke argues that companies deploying autonomous agents are accountable for them and should govern them as software, but concedes that oversight teams are already being outrun by the volume the business wants to release.
The executive responsible for the guardrails on artificial intelligence inside Dell does not expect her team to catch up with the business. “I don’t think we can move fast enough, and I don’t think I can have a team big enough to be able to keep up with the scale that is emerging,” said Burke, who also holds responsibility for its AI compliance.
We spoke with Burke recently when she visited Dublin as part of the Irish Government’s AI Summit. Burke began her career as an intellectual property lawyer for high-tech clients, before moving into data protection and cybersecurity, then privacy and AI.
Why agents are different set of problems
-
Listen to the ThinkBusiness Podcast for business insights and inspiration. All episodes are here. You can also listen to the Podcast on:
-
Spotify
-
SoundCloud
-
Apple
We are effectively at the transition point from generative AI which is now in use across most businesses around the globe, to a new epoch of agentic AI where users can deploy their own AI bots or agents to do a myriad of tasks. Think of it as individuals now having their own virtual workforces and the complexity that brings with it.
The pressure comes from a change in how AI arrives inside a company. With generative AI, Burke said, use cases came in sequence, “a couple at a time”. Agents are different. “I think with agents, business functions are coming with hundreds of agents at a time, if not thousands, that they want to release.”
👉 No tech background needed to bring your business into the AI age! Secure your Google AI Professional Certificate to complete the certification at no cost. Apply now and get started!
That shift raises the question now facing every organisation handing real tasks to AI: whether the controls companies already apply to software can govern systems built to act on their own. Burke’s answer, given on the ThinkBusiness Podcast, holds two positions at once. She argues that existing software disciplines apply to agents. She also says agents demand a different level of oversight, and that governance policies are often overtaken by events before they are implemented.
Accountability rests with the company that deploys
Asked whether responsibility for an agent that goes off script sits with the developer, the deploying organisation or the person overseeing it, she said: “I think governance would assign responsibility to each of those. Right? There’s a piece of that. It’s like a shared liability across all of them.”
For a business, though, the deployer carries the load. “When you are responsible for deploying that environment, kind of at the end of the day, you’re accountable for what you are deploying in your environment,” she said. That means checks from the vendor through to implementation, including security and vulnerability testing.
Her starting point is that agents are not a separate category of technology. “I think the thing that I tell everyone is AI is software, so a lot of times people don’t realise that the same controls that you would have for deploying any kind of software in your environment need to also be utilised here,” she said.
She qualified that in the same answer: “But it’s going to be probably a faster turnaround. You have to be more vigilant because of the way that it has the autonomous ability to be able to act.”
Elsewhere she put the difference more strongly. “The way that you govern generative AI and machine learning use cases is not the same way that you govern agentic AI, due to the autonomous nature of it,” she said, adding that agents require “a different level of visibility and human oversight”.
Policies written for risks that have already arrived
The difficulty Burke describes is one of timing. When her team identifies a new risk and drafts a policy or standard to address it, the risk has often surfaced externally by the time the policy is in force. “I thought I was ahead of the curve, but then something happens,” she said, describing the cycle. Scaling a governance and compliance function to deal with agents “quickly and reliably and consistently” is, in her view, “a challenge that all organisations will have to face if they haven’t gotten there already.”
She said that Dell tries to anticipate trends to buy time. “But I will tell you, regardless, we’re never going to move fast enough for the business.”
For a chief executive or board in Ireland beginning to deploy agents, the safeguards she sets out start with ethical guardrails and an inventory of all AI in use, which she called “easier said than done.”
From there she listed traceability, an identity for each agent, and knowledge of every type of data an agent accesses and the applications it runs on. Agents running on trusted platforms and models that have already passed security reviews make it “a lot easier for you to be able to govern and enable your business to move at scale”, she said.
Shadow IT, she noted, was still on the agenda at risk conferences she attended over the past five years, and shadow AI now sits on top of it. “Shadow agentic AI is probably one of the scariest things that I think people have to worry about,” she said, describing an unmonitored agent as “almost like a vacuum that you may not know is running”, with consequences for both cost and unintended outcomes.
The final safeguard is human oversight scaled to risk. “It’s really important to understand what levels of human oversight are required for the level of risk of the AI system and AI agent,” she said.
She drew on a story she had heard at the conference she was attending, about the arrival of fast cars: speedometers were fitted, but stoplights, street signs and roadside guardrails followed.
Companies, she said, have to think “externally about the guardrails that you need to have, as well as the guardrails that you deploy internally.”
The token bill joins the governance agenda
Cost is a newer front. Burke works with Dell’s chief AI officer on governance strategy, and one part of that is tokenomics: evaluating and monitoring token usage and detecting errant agents or processes that drive up spend.
Here, too, the incentives conflict. Companies want developers and knowledge workers to adopt AI tools for productivity, she said, while “you’re also at the same time asking them to monitor token consumption. And so some of those things can kind of be counterintuitive.”
Developers have a better grasp of tokens because many have used coding assistants for longer, she said, while “the average worker is not going to know anything about tokens.”
She said that Dell has added a section on tokenomics to the governance training it runs when launching new models or technologies, alongside trust, security and privacy. Its finance team built a process that lets individual businesses and individual users see their own consumption.
Much everyday use is transactional, which gives users more control, she said; agents and assistants running continuously in the background are another matter. She compared the risk to a legal research service she used in law school that charged by the minute, where leaving it running overnight could produce a bill of $4,000.
“The financial governance of it is equally as important as security and privacy and legal governance,” she said. “We’ve heard lots of stories of companies almost bankrupting themselves for token usage.”
Ethics set early, then revised
Dell’s ethical framework for AI was one of the first policy documents Burke worked on with a cross-functional team, several years ago,. It has since been revised. “Things that may have been idealistic in the very beginning, we now realise what they need to be, how they need to be tweaked to actually implement in practice,” she said.
The reason for setting ethics out explicitly is that staff at a multinational arrive with very different experience of legal, compliance and bias questions, and without clear rules fall back on learned behaviour. The same holds in cybersecurity, she said. “Your people are your weakest link, unfortunately, in many circumstances for what they will choose to do, and so you have to mitigate against the weakest link.” Technical controls are part of that, she said, and education is a big part.
On regulation, Dell chose a single anchor. After reviewing forthcoming regulation globally and finding that much of it was risk based, the company built its AI compliance and governance framework on the EU AI Act and “the AI risk management framework”, layering on requirements from other jurisdictions. Burke said this mirrored the company’s approach to privacy, which aligned to “the high watermark of GDPR”.
The aim was stability for engineers and product teams, so the company would not have to say: “We told you this, and now we have to change it.” “So I think building compliance in early is critically important,” she said.
That approach assumes a regulatory base steady enough to build on. Her message to Ireland’s emerging AI regulators, some of whom she said she has met, is that the rules must also move. Regulations put in place several years ago have “got to also keep up in a dynamic way with innovation”, she said. “Regulating in a vacuum without industry insight is not in the best interest of anyone.”
Dell, which Burke notes has been in Ireland for more than 35 years, wants that relationship to work in both directions. “I think we are looking for guidance and information,” she said. Visibility and monitoring of agents, she added, “are going to get more and more important” as companies deploy them.
👉 No tech background needed to bring your business into the AI age! Secure your Google AI Professional Certificate to complete the certification at no cost. Apply now and get started!
-
Bank of Ireland is welcoming new customers every day – funding investments, working capital and expansions across multiple sectors. To learn more, click here
-
For support in challenging times, click here
-
Listen to the ThinkBusiness Podcast for business insights and inspiration. All episodes are here. You can also listen to the Podcast on:
-
Spotify
-
SoundCloud
-
Apple
