How to Build an AI Governance Career Without Writing Code ( Lawyer -> AI Architect POV) - w/ Aashita transcript

So, my L-1 was almost coming to an end and H-1B was not picked up. That's when I came across O-1. That's Ashita Jain, a lawyer who became an AI governance architect. And by the end of this episode, I promise you will know exactly how she pulled it off and how you can walk a similar path. Me as a lawyer, I know that sometimes flood can come. So, I'm helping you build that boundary around that house so that you can enjoy your house peacefully. She also broke down her exact O-1 strategy and shared what worked. And spoiler alert, it's not the thing that everybody preaches. I learned that it's not about quantity. It's more about putting your idea out and it should just resonate with the right people. Plus, the one thing she'd tell every engineer trying to break into this field. field. People try to chase certifications, but

play with it. Unless you build something or not build something, you won't be able to understand both sides. Please join me in welcoming Ashita Jain to the Ready Set Go podcast. Without any further ado, let's get into it. Ashita, welcome. Navin, thanks for inviting me to your podcast. podcast. I want to jump off with the fact that you're a lawyer who became an AI governance architect. So, when just when you look at that sentence in isolation, can you just talk through what comes to mind? And of course, as you will do that, I'm sure there'll be some snippets or anecdotes from the journey that you've had that will come up. But, how do you reflect on your own journey that, you know, that you've been on over the past years or past few years? I think uh the hook that you've given me, I think that itself summarizes governance is very dynamic.

And that journey, uh I feel, you know, you're each time stepping into a new stone, learning what is coming, and that's how my journey been. Learning and exploring what is coming next. That's how I pivoted to AI governance. governance. Got it. So, when you first started your career, I know you were a lawyer, you were doing like lawyer stuff. Can you kind of take us back to the Ashita of that time? You know, kind of set the stage for us in terms of what it is that you were planning to do? So, was the plan always to move into the tech side of things when it pertained to still being around or being a lawyer and just being around the law? Or was it just more open-ended and it just kind of fell into place for you? Yeah, there was no plan. I'll be very honest. Uh, in terms of uh, I was very fascinated uh, from the law field uh, growing up

uh, because of the environment. I had my cousins uh, who were uh, pursuing law. And as well as I was uh, like growing up, I had the family of engineers. So, I had a tech background also. My own uh, interest was more in law law uh, that time, more in the corporate law, AI uh, I'm sorry for the AI part uh, M&A and commercial transactional. That was something that really intrigued me. I wanted to just explore what it is. And I know uh, the environment in law firms and companies, very corporate stuff that I was drawn to. to. Yeah, so that makes sense. Can you kind of bring us then up to speed in terms of the bridge that appeared between when you were just, you know, being purely a lawyer, doing law stuff, and then the first time you saw a bridge get extended into kind of what you do now, which is super heavy into

AI, LLMs, all of that type of thing which first of all we will get into that. But I'm I'm just curious in terms of how that one, you know, connection occurred for you. So, I was not very conversant with the idea of with tech law. During my law school, I I'm a very experimental learner. So, during my law school, I was just open to anything and everything that was coming in. So, saying if you're going to law firms and they're practicing say IP laws or tech laws laws or even civil laws, criminal law, I would just go and put myself out there in those rooms. And that's how the idea of privacy fell into my lap. I was a very active student in terms of these conferences to just get get going in the another opportunity. So, IAPP as an organization, they have a knowledge net chapter in Bangalore. And during my

third year of law school, I volunteered there with all the industry professionals. I was interacting with them. And I think one of them offered me that position with emphasis. He was from and he guided me that this is something an area that you should really explore. It I did not drop everything since then, but I kept in touch with privacy since then. then. Interesting. And then so when did the move to US happen {slash} how did that come to be through, you know, your journey as I'm just trying to kind of put myself in your shoes and you know, go through the steps {slash} motions one by one. So, how did the move to America turn to turn out to be?

I moved to America pretty recently. I moved in 2023. This was more of a personal need move. Uh uh Okay. And I had uh my company transferred me. I was working in Ireland and then they transferred me to my first stop in US was Boston. Got it. [snorts] And so, for those of us, right, which is literally all of my listeners and that includes me cuz I'm my first listener, we're all Yeah, can you just kind of help us understand from like a really layman point of view exactly what IP entails when it comes to LLMs or AI or those sort of things cuz I feel like so a lot of my audience are super heavy into AI. We're like tinkerers. We're constantly building, breaking things, literally on the cutting edge. And often we find or I find that these are important discussions that we should be having in the circles that I

come from that we just don't. And a lot of it is just not I mean, obviously it's ignorance, of course, 100%, but also Yeah, we just don't have access to folks such as yourself that are doing such important work in this field. So, one of the many goals of me reaching out to you for this episode was kind of to, you know, have the other side come into picture. What does governance {slash} guardrails {slash} you know, all of these important things that you're doing, what does that look like? And before we get there, obviously it's important to understand what it is that you do. So, can you help break down kind of Maybe just you can go about a day in the life or any other approach that you, you know, think would be most helpful, but just trying to understand what it is that you do when it comes to uh you know, just us out here breaking

Claude or using Codex or what have you. So, one of the biggest myth I'll if I'll understand your question uh clearly, you're asking A that what is this uh guardrails, controls, and governance that means on folks to the legal side. I'd put it Exactly. Exactly. Yep, that's exactly right. Yep, yep. So, uh first let's break down the idea of governance. Governance is very um much taken as a taboo that oh law has put some stop checks and they are asking us not to build this. How do we uh get to this innovation? Uh uh as lawyers, uh sometimes that is a tricky part that we navigate as day-to-day because to if I am part of a corporate or if I'm part of an enterprise, of course we are not innovation hours. Our job in day-to-day is to make sure what you are building goes uh and ships smoothly and it runs and as intended or revenue that you are

trying to achieve without lot of stoppers from regulators. So, governance is something uh which is not law, but it is more about anything that could break. So, if say if I have to explain it in layman language, say you as an engineer, you are building a house and me as a lawyer, I know that you know, sometimes flood can come, something can come. So, I'm helping you build that boundary around that house so that you can enjoy your house peacefully. Now, this is not a breaker. This is more like a complimentary thing where we both are building together. I'm making sure that you're what you're building is growing with you. So, if you say you start with a say small house with like simple plain things, then you might me as a legal person, I'll help you, okay, let's add a door to it. Mhm. And then, um I'll say, "Okay, now house

is getting bigger. We have kids in the house. Let's add a fence to it." So, that is what governance is, and it grows with you. Interesting. Yeah, I mean, when you put it like that, it Yeah, I agree that it does seem to be less of a you know, adversary type relationship and more of a complimentary one. So, but I am curious, so when you say governance, who do you work with, I guess? So, do you work with like the frontier model companies, or is or do you work with the companies that are implementing the models? Does that make sense? sense? Yes. It depends what your like if I am with a company in-house, so all their clients would be my client. So, I work and based on their uh product, what they are building, so everything would be part of the scope.

Um and with law firms again and consulting, it depends on the startups and what they are building becomes part of our scope. Interesting. So, how deep into the weeds do you have to be with the tech to do your job? Cuz I guess where I'm coming from is these are these two things are seeming really intertwined in my head. So, firstly, is is that right? And so, did you have to like undergo any sort of actual, you know, full-blown tech learning, or was that just something you learned on the job?

It is part of something that we learn on the job. I like a lot of my day-to-day job uh includes interacting with engineers and specifically product managers, reviewing their architecture diagram, and making sense of it that how the data is flowing and generating a data flow diagram with it. it. And I can write a risk in a document saying something and claiming something until I know that that is actually somewhere in the code. So, So, with them, sitting with them, learning more about the tech, how we deal, like uh it's a common joke and I think uh internally we get a very simple thing and it's like, "Oh, uh when GDPR came we started saying that encryption, but for GDPR this is not what we're saying." And a lot of engineers would give us looks like, "In encryption is secure." And this is a very candid joke I'm saying. Sure.

Sure. But that's not what I can say to the regulators. I need you to help me how I can sell your story better. Interesting. I'm so fascinated by this. Um so, this can be a totally made-up example, right? Cuz obviously I understand that some of what you do is, you know, you can't talk about publicly. So, again, feel free to just make it up, but where I'm trying to go and what would be incredible for our listeners is can you just give an example of let, you know, let's say maybe a toy case where an engineer was trying to do something, they had an architecture, you know, and maybe we can even brainstorm something very quick and dirty here together, but then like the following was the risk that that that engineer probably, maybe they flagged, maybe they didn't, but it's not something they care about, but you were

able to flag that because of, you know, your job title and your expertise, and then you were able to be like, "No, we can we cannot do that. Instead, let's do that." Does that make sense? Cuz I feel like that would really help us fully understand and contextualize where it is that, you know, you you come in and like your profession comes in. Does that make sense? sense? Yes. Um I think a lot of the times what we are building, uh not in B2B, but it's easier to understand in B2C context. Okay. Okay. Consent architecture or consent models, uh Got it. is something that is our day-to-day uh friction and also partnership with engineers. So, um in B2C models, whenever they are building say e-commerce site, they would need uh and they are running ad personalizations.

So, they need to build consent architecture. Now, how that consent and that data or that leads are generated is different compared to uh US. It's more open. Uh but, when you go to Europe, it's very strict and specifically some countries in uh European Union. So, that's where we really need to have that uh have this partnership that if we can just open and get a lot of that data which you don't even need and you're not even sure, specifically with marketing teams also. Uh marketing I'm talking about adtech. That we might need in future, then we can turn on. I think as a feature, we can add that capability.

But, as of now, why do we just place it and just get it? What are our pivots? If the cost of fine is cheaper, why not uh then placing those controls within I I think our more uh solution or recommendation is mostly into building a way that you can collect that data when you need it, but architect that consent that when there is an inquiry, we can go back or track it. it. Got it. So, if if I'm understanding what you said correctly, you you're saying that there could be the same company that has a certain, you know, let's say they have a rollout in the US versus Europe, but obviously because of the jurisdiction differences, they can't have the same rollout. Like they have to have different It's the thing where I just skip to the end and just be like I agree.

You're saying that the stuff that goes in there needs to be checked by somebody so that it's not just being predatory or, you know, harmful and such. Is that roughly am I catching that right or am I just way off? Yes, you are. Um like I can give you some real-life examples. Yeah, that'd be great. Yeah. So, if you'll see uh Apple Card capability that is in US, that's not actively available to Europe users. And reason being it's very hard the way that capability capability or consent model is designed, it's very hard to provide the European users. Wow. So, they came up with a solution where let's activate and test it out with the US consumers with the kind of data and the partnerships that needed compared to the EU users. Another example would be their mom Twitter Twitter and these American Airlines how they connected. So, Twitter

there's like a big work that has done that they also moderate the content, the consent models, what they need. I'm not fully able to recall the cookie placement, but there was a big work that was done to actually categorize and classify cookies when you see those functional cookies and necessary cookies. That's like an active partnership partnership which each company works as a big massive project. Wow. I mean, it almost feels to me like you're more like a technologist than a lawyer at this point. Do you get that?

Would you say there's any truth to that or not really? I think with AI it's becoming a little bit ground reality. Yeah. Because if we say can you cannot do that, that is not enough. We need to find solutions. We are working actively in ideating that features how we can achieve that. So, yeah, sort of. That's so cool. So, what if I'm just curious, right? So, what if the tables were turned? So, let's say we have a technologist technologist that is not a lawyer, right? That does not have the credentials, at least formally, formally, that is trying to work with or do similar work. Of course, they cannot do the exact work that you are doing cuz that needs obviously the years of training that you've had as a lawyer.

But, if they were to maybe work on your team or maybe be an analyst on your team, have you seen jobs like that evolve over the past few years? And would that be something that you recommend to somebody that's, you know, like our listeners that are mostly engineers that are that care about governance, right? That have a keen eye for detail and that want to do work in the same field that you are in. So, can you speak to that piece at all? Yes. In fact, to your question, in Infosys, when I started my work, there was a separate independent department called data privacy office. And And that was my best year because the team was so multidisciplinary. Like you said, we had technologists who were building solutions, and we had lawyers working together. And working then going to the business with the solution together. So,

how field has evolved, and we have now designations like data privacy architects. Lot of privacy engineering has evolved as a field which uh bridges this gap where it trains engineers with the principles of privacy law and interpretation and help them also come up with solutions and architecting those solution in the CI/CD pipelines or productize that. Wow. Yeah, I feel like that just opened a new door that I did not know that was a thing that happened. What are these roles called? So, if somebody were to seek them out specifically, what would be maybe a couple of search terms that could put somebody on their way when it comes to exploding stuff like this in terms of job titles, I mean.

I think we it's it is still similar titles uh principal engineer, analyst, uh sometimes leads. It's not very different what we have as a designations today. I suggest this these are more specialized fields and also companies really invest in these engineers because you also have to keep upskilling yourself with certifications and with building and what is coming with the new laws. So, that is also part of it. it. Got it. So, um just while preparing for this episode, I I've noticed that you're the recipient of the O-1A. Um so, are you able to by chance share a little bit about that particular experience cuz obviously a lot of my audience is also looking to looking at how to you know build their profiles for visas such as that. So, is that something that you're willing to shed any light on by chance? Yes. So, um

O-1, I started my journey in 2025. Um I was my L-1 was almost I was on L-1 visa. So, my L-1 was almost uh coming to an end and H-1B was not picked up. That's when I came across O-1. But then um one of the things that I've noticed in the O-1 journey, a lot of the people they focus on quantity, have uh scholarly articles, 10 articles. What helped me was I approached it as like we all see oh we want to be successful and then this is how I want to build my thought leadership and authority. I looked at it uh from that lens that somebody gave me a guided starter kit that I have to start with. And these credentials. So, the way I approached my O-1 was way beyond then just for the visa part.

Interesting. Can I ask why? Like cuz it just goes against the grain of everything I've heard about, you know, profile building. It's almost like a grind. You're doing reps. It's like working out, right? You have to do the thing, do a lot of it, and then hope and pray for the best. It sounds like you did not have that approach. So, why was that? I guess who was your coach/where did you learn how to do this so effectively? Cuz clearly it worked. So, you did win in the end, but can you share why/how? I mean, uh as part of my law school LLM, I did have research papers. I always was scared of putting that idea out. So, that is now needed. I tested out with one article. It was uh cited a lot like 13 times, and that was very surprising to me. Uh in in in a very candid way because I learned that it's not about quantity.

It's more about putting your idea out, and it should just resonate with the right people. I And those right people will automatically uh uh will be willing to write about your work and independent expert letters uh is that criteria. So, that really gave me a lot of insight. So, I chose my profile and projects that is intentional, and uh uh since O-1, I also approached it as thought leadership. So, I would always evaluate uh on a very side note, I would search myself on Google, and I would see how it's coming and how my thought leadership and now we have AI tools. So, I would search myself that what AI is picking up about me and how I want and that helped me to very intentionally carve out how I want to be known.

That's so interesting. Yeah, I I I mean, I have Googled myself in the past, I won't lie, but I haven't uh AI'd searched myself. So, I am curious what that might uh unearth. So, thanks for that tip. Um I'm sure a lot of those watching {slash} listening will be keen to do that or maybe it's just me. Maybe I'm just the only one that does not do this. Um jumping gears a little bit, something that I've seen discourse around, especially on Twitter and such is this notion that um Europe, right, as a legislation legislative unit, turns to be or is at least, again, as it's portrayed and again, I don't know the first thing about any of this, but they're almost positioned to be this, you know, like extremely um a like anti-progress, you know, like don't be doing anything, we won't allow innovation, anti-innovation even, right?

At least compared to America, where things are almost flipped, at least from what I gather. And then somewhere in the mix, we have India as well in terms of Indian laws, in terms of where we stand in terms of, you know, just like innovation and deals with tech {slash} governance stuff. So, if you had to kind of big picture this, right, for folks like me and my listeners that are not super dialed in to these things, but would trust the authority of somebody like you, um how would you go about doing that?

Like in terms of contrasting those three units, so to speak, when it comes to uh AI innovation specifically? So, when I started my career, I worked in all these three countries technically. So, I feel that first from the legal side and the way law or legislative aspect of going uh uh is not about technology or innovation. It is about more like a cultural shift. So, if I have to sell uh privacy in India my or AI governance in India it's not that Indian culture are not aware of it. But users are more open there and they are and in US also compared to Europe because Indian culture is a very community-based culture. culture. Yeah, I think It's influence. So, they do not consider privacy as a thing. What they if I have to sell AI governance, what they are more focused about that it is a safe environment for our community to thrive and we are

developing so we should be able to contribute. contribute. And that's the culture and AI governance part. part. Europe and US population is quite mature. But Europe is a very socialistic economy and culture. So, it's very right-based. Lot of my work there uh now I think it's pivoting as a discussion in AI governance also was about the rights. Where is my data? How are you using my data? Users would uh be be received lot of request how to access even in like an employee leaving a company, they would ask to delete my request. Uh how my data outside uh like how am I monitored within a workplace organization? All of this was very part of the culture there. there. And your US is very innovation focused, tech focused, development, and it's very entrepreneurial entrepreneurial real in approach. So, in my day-to-day job, when I have to

discuss the same thing with my American lawyers compared to my European counterparts, it's more high-risk focused. They would focus on oh, this is high-risk. How the focus would be this impact, how we curve that. Whereas Whereas it's not that those thoughts are not there in US law or with American counterpart, but the way the problem is approached to solve is more about that we have to sell this product and we have to get this there, but we want to make sure that it is done aligned with the laws like in a tech part. And plus again, because you you US being now you are also in US for so long, so you're aware that how you can receive the calls, do not you receive so many spam calls, and the audience is also very open about it.

Okay, it's coming. There will be spam calls. calls. It happens. Yeah. We just learn to live with it almost. Yeah. And they are used to hearing different rights, and the audience is open. So, yeah, let's slow. It's So, I think I would I advocate more is privacy and AI governance it's not absolute. It grows with you. It is as much as innovation, that's why I go with AI governance and privacy as a product and influence. And as culture evolves, people's mindset evolves, and that's how it evolves with you. So, you need to ship out products and features of privacy every time. It's not a activist or a which is a taboo that it will it is stopping innovation. That is not the piece. piece. I think the most fascinating part about what you just said was the notion that it is not purely objective in terms of, you know, like zeros or ones, but it's

just a function of the culture that it's supposed to protect. Yes. Yes. Which I mean, that almost feels like a duh now that you say it, but it it's just not something that I'd ever considered and I think I mean, I Yeah, I feel I have thoughts around that, but I guess Do you think that like I Yeah, I guess how do you go about that? Like Do you think it's okay for it to not be purely objective? Like is this something that, you know, is fine according to you or do you think that if you could wave a magic wand and change things, would you change anything about this aspect of what you just underlined? underlined? I would first like to hear your thoughts before answering this question. So again, my just like uh really left-brain engineer heavy, you know, decision-maker type thing makes it almost feel like

these should be universal, right? So if it's bad in Europe, it should be bad in America, it should be bad in India. Just across the board, right? I can understand some sub-bullets here and there being more or less flexible, but I don't fully understand. Like it just feels really like we're muddying the waters by applying, you know, different bars to to different Yeah, like geographies, right? But then again, you have to keep in mind that I'm purely looking at it from an outsider perspective and I lack the nuance that of course you have. But yeah, that's mostly what I'm coming It's I'm just looking at it like code, right? If if you pass a test case in India, it should also pass test cases in Europe and US.

It It shouldn't be like, oh, seven here is fine, but three here is fine. Do Do that make sense? Yes. Yes. Um so if I have to answer this from the engineering piece of it what if you pass test seven test cases, you put all the cost and revenue to say something and it will not be sold, people won't use it. What's the point? Yeah. Yeah. It's you're facing much more backlash and then there will be studies around it. If I have to my own personal take, if you have to ask that is it objective, I never believed believed when I started my career that privacy is absolute. Privacy is objective. Um Wow. Wow. Constitution of India clearly says that it is not absolute. There are certain exceptions. They give you that right, but it is not an absolute right. Um I think part of it is also in Europe, but if you remove that full lens of law or what is

tech, how it should be I again go back to the same point, cultural. cultural. Mhm. Yep. Yep. Yep. AI was designed to uh be human intelligent form in the mimic the human mind, so you have to guard it like humans. You have to also take personal cultural preferences. So I treat if it is mimicking human, it is building a second brain, so I treat it as my colleague. And we have now AI colleagues as agents. True. Yeah, literally.

In we are in that era, so think of it as another machine economy and machine culture and then you have to take the cultural influences into account. That's awesome. Yeah, I I feel like yep, that is so good. It literally like it's like you or you know for not for the first time in this conversation but opened the door like to an entire universe that I'm very excited to dig into but I yeah I just straight up did not even know that these considerations or this entire you know sphere of work slash you know things to think about existed so that's awesome. Final segment here before I let you go.

For those that are trying to walk your footsteps maybe that are just a couple steps behind what would be some of your you know what would be some things that you would like to share with them for those that are trying to build a career in this space that are maybe you know maybe like five or seven years behind where you are today. Well I think one of the things that I I noticed that people try to chase certifications. I feel that's good as a starting point pick your certification as an overlap that gives you a ground finding but play with it. it. The best way to learn around privacy and AI is play with it play with the privacy solutions play with the laws the only way you can thrive in it if you can give engineers a solution or brainstorm with it.

And then you also need to understand the nuance so you unless you play with it unless you build something or not build something you won't be able to understand both sides. I just love it when organically something a guest says is just bar for bar one of the core philosophies of this show of this podcast which in this case what I'm referring to and this is literally on the website today if you go there but the I like one of the things I you know hills that I will die on is the only way to learn is to do you know which is basically what kind of what you just said. So, yeah, I just really love it when that happens organically, but um yeah, Ashta, this has been so cool. Like genuinely, I I have a bunch of like, you know, this is episode number 120, give or take. But seldom is it with a person {slash} a person in a field {slash}

niche that's just completely raw and uncharted territory for me and I suspect a lot of our listeners. And every time I have one of these, it's like really nerve-racking for me cuz, you know, even though I do my research, it's still just hard to able to match, you know, just kind of the guest and where they're coming from and such, but I really want to commend you for making it so easy for, you know, not just me to follow along, but I'm sure anybody listening has been able to just really, you know, relate to what you're saying and truly understand where you're coming from. And maybe you get this a lot, but it is not a quality that many people have. So, I just, you know, really want to commend you for being so transparent, so cool, so open, and lastly, for, you know, taking the time here today to share with

us your journey, your experiences. This has been so so incredible. Thank you so much. much. Thank you, Naman. Thank you for inviting me to your podcast. It was really fun chatting with you. Awesome.