CZ and FriendsS1 E28
Risk Is Never Where You Expect It: Binder and McNaught on How General Counsel Manage Risk
Sarah Binder
General Counsel and Corporate Secretary, BetterUp
Sophie McNaught
Managing Director, Silicon Valley Bank
Episode Overview
General counsel manage risk by tying it to the business's objectives: name what could stop the company from hitting its goals, get analytical about how likely each threat is, and mitigate the ones you can control. The threats that blow up are the ones in a dark corner of the business, a small team you have never met, a regulator nobody has heard of.
On this episode of CZ and Friends, Sarah Binder, General Counsel and Corporate Secretary at BetterUp, and Sophie McNaught, Managing Director at Silicon Valley Bank, join GC AI co-founder and CEO Cecilia Ziniti to map where risk hides in fast-growing companies, why the biggest risk at seed stage is not existing in a year, and who is setting AI standards while regulation lags.
About Sarah Binder and Sophie McNaught
Sarah Binder is General Counsel and Corporate Secretary at BetterUp, where she oversees legal, compliance, and regulatory functions.
She brings more than 15 years of in-house experience: General Counsel and Corporate Secretary at Lime, leading legal, trust and safety, and insurance across 30 countries; European General Counsel and Chief Development Officer at Pizza Hut, covering 28 markets; and Head of Privacy Law and Data Protection Officer at BT Group and EE. She came up through M&A work in the UK before going in-house.
Sophie McNaught is a Managing Director at Silicon Valley Bank, covering strategic investors, corporate development teams, and venture funds. Before SVB, she led the AI and enterprise practice at Vouch Insurance, where she advised hundreds of tech companies on AI risk and insurance.
She also advises founders and investors on AI policy and risk at Primary Venture Partners. She is Australian, which Cecilia credits for the global perspective she brings to a Silicon Valley problem set.
Key Takeaways
- Risk hides in the corners you haven't mapped. Sarah's worst crises came from unfamiliar teams and regulators, so she runs a 90-day plan on any new role to get ahead of the surprise.
- Risk management is analytical, not instinctual. The job is scoring likelihood, controllability, and business impact; truly uncontrollable risk is rare.
- Risk scales with company stage. Pre-Series B, Sophie says the real risk is running out of runway before you can sell; legal exposure comes downstream of that.
- Embedding a lawyer in engineering pays off in sales. It surfaces security, indemnity, and model-training objections early, the exact issues that block enterprise deals.
- Enterprise buyers, not regulators, are setting AI standards. One customer's security demand becomes the industry norm within a deal cycle.
Where Does Risk Show Up for a General Counsel?
Almost never where you are looking. Sarah’s rule is to stop asking “what could go wrong” in the abstract and start asking what could stop the company from achieving its business objectives, because the downside scenarios that derail growth are the ones nobody thought about until late in the path.
Sarah said:
It’s not that something could happen. Anything could happen. It’s being incredibly data driven and analytical to reach a conclusion as to how likely something is going to happen and the extent to which you can control that or at least mitigate that.
The uncontrollable risks exist, and they are rare. The rest can be managed in advance, which is the whole argument for treating risk as a forward-looking discipline rather than a cleanup function.
Sarah’s stories back the rule. The crisis that sticks with her involved reporting to a regulator she had never heard of, learning what that regulator did and how to report to it at speed, all at once.
It’s always the thing that you knew nothing about,” she said. “It’s always the thing in a dark corner, a small corner of the business, of people that you’ve never met or even heard of. And suddenly you’re pulled into a crisis involving them.
Her countermeasure is the 90-day plan she runs in each new role: get your arms around the business, work two or three levels below management, and keep asking broad, open questions until things stop surprising you. Cecilia matched the story with an audit from one of her own startup GC roles, where a new CFO discovered that the corporate card of each employee in the company was configured with a $1 million limit.
What Is the Biggest Risk for an Early-Stage Startup?
Not existing in a year. Sophie spent years at Vouch watching thousands of tech companies handle risk decisions, and at seed through Series B, the person sorting out insurance or legal process has usually never done it before and is not thinking about lawsuits at all.
Sophie put it plainly:
Definitely seed, A, B, the biggest risk is that you don’t exist in a year because you couldn’t figure out how to sell to your customers. … Mostly in this land, risk is how am I being slowed down from getting a dollar in the door?
Sarah agreed and widened the frame. Not existing is the viable-business risk itself, and protecting against it counts as risk management. Companies that see risk narrowly, as a legal bucket or a finance bucket, spend energy on the wrong problems.
Cecilia has made the same point about GC AI itself. The risk that consumes an early-stage company is whether it is building the right things fast enough, and legal risk is real but downstream of that one.
Sophie also flagged a second-order shift she is watching from the banker’s seat: a reckoning in venture capital, where near-zero interest rates pulled enormous capital into funds, companies raised at peak valuations, and AI arrived at the same moment. The shakeout is hitting the funder level too, and it is moving fast.
Should Legal Teams Embed Lawyers With Engineering?
Yes, when the relationship supports it, and the payoff can show up somewhere unexpected: sales.
One of Sophie’s later-stage Vouch clients, around Series D, hired a legally trained person with product experience and placed them full-time inside the engineering team while keeping them on the legal org chart. The role worked like a PM, translating between engineering and the people wrestling with security and risk.
The embedded lawyer’s insights flowed straight to the sales team, because across Sophie’s client base, the biggest blockers to closing enterprise deals were legal objections.
It’s all these objections that are like legal issues,” Sophie said. “It’s security stuff. It’s how does this indemnity work? How on earth have you trained the models? All the things that your legal team would bring out.
She has since shared the model with other general counsels, who carve out 20 to 25 percent of an existing lawyer’s time for engineering exposure. Her conclusion for in-house lawyers:
The best way to be valuable as a legal person in a tech company is to genuinely understand the technology.
That is a skills question as much as a seating-chart question; GC AI’s free, CLE-eligible legal AI classes exist for exactly this reason. Sarah’s version of the principle predates AI entirely. Know thy product, know thy customer.
At British Telecom, employees in any function were expected to understand what the engineers did. At Pizza Hut, nobody started a corporate job before spending two weeks working the front line in a restaurant.
Cecilia added her own: the best corporate training she had at Amazon was picking orders in a fulfillment center, and she recalled a public finding from the GM ignition-switch era, from her time at Cruise, that housing legal in a different building from engineering was itself part of the problem.
Why Relationships Beat Being Right for In-House Counsel
Because a technically correct answer that ignores what the business is trying to do changes nothing. Sarah learned this in her first GC role, where a junior web developer rewrote her terms and conditions, cutting the notice period from 28 days to 14, because he did not think her version served customers.
It’s not enough to be right. You’re the lawyer and you’ll probably be right. That’s really not actually enough,” Sarah said. “You may well be right on a technical point of compliance, but that’s got absolutely nothing to do with what your business is trying to do.
She won the terms and conditions back, and she kept the lesson. The developer’s question, “how is this helping our customers,” was the right one, and the lawyer’s job is to connect the law to it. The mechanics of that connection are relationships.
Information is just power,” she said. “The more people tell you, the more information you have access to, the better you are going to be able to forecast where issues might arise. … Make friends with everybody. I’m always like, we’ll come to any party we’re invited to.
Cecilia recalled Danielle Sheer, Chief Legal and Trust Officer at Commvault, making the same point on her episode: do you want to be right, or do you want to be effective?
Then she told on herself. That morning, a competitor had run Google ads against the GC AI name, and a customer flagged it.
Cecilia forwarded the email to the competitor’s GC with two words, “see below,” copying GC AI’s own general counsel, Laurel. Laurel answered with the technically correct analysis of Google’s ad policy and Ninth Circuit case law.
Before the analysis mattered, the competitor’s GC had taken the ad down.
Sophie had the same instinct from her Vouch days. When a young startup copied Vouch’s website copy wholesale, the alarm-bells option was a legal letter, and the effective option was a phone call.
“Hey, FYI, you guys are going to get fined by these people and these people and these people. Maybe put it back in your sandbox.” They took it well.
What Does Duty of Care Look Like When Something Goes Wrong?
Go sit in the living room. Early in Sarah’s GC career, a series of errors at her company caused serious emotional trauma to a family, and she went to their home to explain what went wrong and apologize in person.
Imagine that you’re going to go and sit in their living room and tell them what you got wrong,” Sarah said. “When those errors happen … you have a really deep ethical responsibility to make sure that you fix those things so those things can’t happen again.
The instructive part beyond the ethics is the CEO’s role. He told her: you are closest to this, you understand the issues, go do what you think is right.
That trust was built long before the crisis, and it is what made the repair possible. Sarah’s summary comes down to one idea. When in doubt, do the right thing, and build the businesses that create moments of compassion and professionalism when things do not go as intended.
Making risk feel real to executives is part of the same job. Sarah’s observation from years of advisory work:
Any senior executive who’s ever been deposed tends to rethink how they feel about legal risk or litigation. It feels much more real.
For everyone who has not been deposed, the risk advisor has to make it real anyway: how significant is this, how seriously should I take it, what are the consequences.
Sophie added that questions like the incident Sarah described are surfacing more in VC diligence conversations, because so much of what is being funded is AI for regulated, high-duty-of-care industries: healthcare, government, aviation, surveillance. Investors lean on executive expert networks to understand the ways it can go wrong, and skepticism about AI raises the bar further.
Who Sets AI Standards When Regulation Lags?
Enterprise buyers. Federal AI regulation did not arrive; what exists is patchwork state legislation, and lawyers are used to handling patchwork.
The standard-setting, Sophie argued, happens in deals.
It’s the buyers that are really dictating what standards these companies are expected to uphold,” Sophie said. “The standards for making a transaction happen end up being the standards we abide by.
The mechanism is one anecdote traveling fast. A major bank’s CISO says a deal falls over unless a control gets figured out by tomorrow, and within a cycle, AI companies everywhere are solving that thing before it becomes a problem.
Buyer requirements become product strategy. And the companies that treat them that way hold the one asset Sophie says the market punishes you for losing:
Trust is so quickly lost in this current world because there’s another company just to your left and just to your right who says that they can do it. The barrier to entry right now is so low.
Handed a magic wand for AI regulation, Sarah chose principles over prescriptions: “The best legislation is outcome and principle based rather than something extremely directive.”
She pointed to GDPR as an imperfect framework whose principles genuinely help shape conclusions, and she is watching the innovation in AI regulation across states and national entities with some optimism that safety and innovation can balance.
Recommended Reading
- Why Judgment Is the New Superpower for In-House Lawyers in the Age of AI: the same human judgment call Sarah Binder describes making in a family’s living room, the argument this piece makes for why AI cannot replace it.
- How Great GCs Think About Growth, Risk, and Crisis Management: more general counsel on the same discipline Binder and McNaught describe here, sizing risk against the business’s real objectives.
- AI in the Legal Field: How In-House Teams Use It in 2026: where AI now handles the routine work McNaught says frees embedded lawyers to focus on the objections that actually block enterprise deals.
Transcript
Sarah Binder0:00
It's not enough to be right. You'll get the lawyer and you'll probably be right. But that's really not actually enough.
Cecilia Ziniti0:13
Welcome back to CZ and Friends, where we talk with legal leaders, operators, and technologists shaping how modern companies work. I'm your host, Cecilia Ziniti. Today I'm joined by two dear friends who sit at the intersection of risk, judgment, and scale. Sarah Binder is a General Counsel at BetterUp. She's led legal, risk, and trust and safety across some of the most complex global businesses in the world. From Lyme to Pizza Hut to British Telecom. Sarah advises companies when the stakes are high, the answers aren't obvious, and there's lots of people and lots of risk involved. Sophie McNaught is the managing director at Silicon Valley Bank, covering strategic investors, corporate development teams, and venture funds. She also advises founders and investors on AI policy and risk at primary venture partners. And previously, she led AI and enterprise risk at Batch Insurance. She also is an Aussie and Sky has a global perspective that she brings. And Sarah, of course, as you'll hear from their fabulous competing accents, came from the UK. They are also literally the idea for this podcast came from a brunch that we had, and I said it would be so much fun to actually talk work with uh dear friends and get into some of the themes we get into on the show around AI, risk, legal, where business is headed. Sophie has a rare view into capital risk, technology collision. She's entrepreneurial. So we are gonna have so much fun this episode. Together, the two of them see what happens when companies move fast and they also move slower and when they get risk right or wrong. Let's dive in. Sarah, Sophie, welcome to the show. Thank you. I'm very honored to be here. Yeah, I'm excited. Let's go. All right. So both of you are work at fast growing companies, but from different seats. So first question is for you, Sarah. Sarah is the general counsel of Better Up. Where does risk show up versus where people think it shows up? Right. And so maybe tell us a little bit about your business and then dive into that question.
Sarah Binder2:06
Sure. Yeah, absolutely. I think the the short answer is it's normally never where you expect it. And what you need to do in any kind of, quite frankly, just as a senior leader in your business, regardless of your function, is you need to be thinking about where risk could really impact your ability to be able to achieve your business objectives. It sounds incredibly basic, but it's extraordinary how many times those kind of like downsides, potential things that could throw obstacles in your wake don't get thought about until much later down the path. And that just it slows you down. It slows you down from growing. And that's why it's important to always be thinking about risk and thinking about how you're managing it, whatever your role is in a business.
Cecilia Ziniti2:49
We had uh a guest recently. Um, we had Danielle Shear of Commvault, and she had a similar view where she said, you know, now she she's involved in a public company board, and she says essentially what you said, that when she gets a lowdown from the general counsel or from whomever on what's going on in the business, it's more like, hey, what's gonna happen if all the phone lines go down or if we have another COVID or what happened? And it's literally like she said, she said it was just like, tell us what you're going to do. So, like, is that your experience? And, you know, how do you do that without being a nervous Nelly? Because that's what we don't want to, we don't wanna do that. And I mean, I don't say that's derogatory. Sorry if your name is Nelly, but just like without being the white blanket.
Sarah Binder3:34
Yeah, I mean, I think one of the things that risk is such a it's such a kind of it's not a controversial word, but it is a controversial word. And I think it means so many things to different people. And there's a lot of really interesting thinking about how people think about risk. Um, Nate Silver has a really interesting book on it out at the moment. But I think one of the things is that you need to be thinking about it in terms of, as I say, what would like slow you down from being able to achieve your risk perspective, you know, from being able to achieve your business objectives. And I think that can get really lost. And so I think it can be very basic, but you really have to be looking at like what your key objectives are and being like, what realistically could could impact it. And like it's very like doing risk well and thinking about risk management. Sophie, you'll have a perspective on this. It's not that something could happen. Anything could happen, anything could happen. It's being incredibly data-driven and analytical to reach a conclusion as to how likely something is going to happen and the extent to which you can control that or at least mitigate that. And there are just uncontrollable risks that you can't mitigate, right? And there's nothing you can do about those. But they're quite rare. And it's more just thinking, looking at your business as a whole and being like, what are the challenges? How do we get ahead of them? Because ultimately that just can enables you to grow faster and on a more steady trajectory than if you have to do rail off and deal with like a significant, um, a significant issue.
Cecilia Ziniti5:00
Sophie, uh, that was a pretty good kick to you. So insurance is obviously literally about analysis of risk. You're not, you you know, I've I've met you a bunch of times. We're friends. You're not, you don't seem like that much of a quant. Like, is it a quant exercise? And if it's not, what what what is it? Especially when you're doing it at scale.
Sophie McNaught5:20
Well, it is for the actuaries, but it's not for the decision makers in the business, which is going to be your CFOs and your general counsels. And this is, it's there's an interesting thing here. Again, when we say the word risk, it depends so much on the stage of the company. Like most of the companies that we actually work with in tech, like the vast number of them are seed, series A, series B. At that stage, and to be honest, in this day and age, even CDE, but definitely seed A and B, the biggest risk is that you don't exist in a year because you couldn't figure out how to sell to your customers. Even when we're having conversations with whether it's the founder, whether it is the ops person who's been handed the role to sort out insurance, or someone's being told they have to go and figure out how to put a process in place that they've never done done it before. Most of the people who are making these decisions are not experienced at it. And then not thinking about it in terms of, I'm worried I'm going to get sued and let me put something in place to not get sued. Like that's a real big company professional person's perspective. And it takes a fair while for any kind of tech company to get to that point. Commonly they'll maybe they'll hire a a someone with a legal background when they're at that BC point, or maybe earlier if they're in a particularly regulated industry. But mostly in this land, risk is how am I being slowed down from getting a dollar in the door?
Cecilia Ziniti6:54
Love that. Sarah, back to you. You've been at so British Telecom is literally probably one of the oldest companies. It's literally like the phones. And then, you know, through the line, which was this new category, urban mobility, and then now it's um you made the wise decision to go to software, it seems like, or at least uh services. But um make that real, right? So Sophie said the biggest risk that you face is that you don't exist. Have you do you have any stories around that? And how is that question different for something like a British telecom versus the more recent attendance you've had?
Sarah Binder7:29
Yeah, and I think just to to pick up on Sophie's point, that's that's a viable business risk. Like it's a ri it's a ri it's not like not existing. Like that is, have you achieved your aims as a business if you're not operating in a year? Well, obviously you haven't. And so how you protect against that is actually really important. I think that's like just seeing risk as just in a much broader kind of concept. So I really agree with Sophie there. I think that to your point, because of that, every industry and every business, however long they've been around, whether you've been around since, I don't know, 1860 or something for British Telecom or whether you like when I was at Lyme, which had been created in 2017, you have to keep moving with the industry with in the market that you're in and the dynamics as they shift. And obviously, like I love that I'm the first person that has taken us a whole like 15 minutes, maybe, to talk about AI. But AI is an example of like it's literally tipping every almost every business model, every operating model upside down. It's tipping it all on its head. It's a huge opportunity, but it also is risk if you don't move kind of smart enough. And so I think like it's always, I think a lot of it is always just always looking forward and thinking like two, three years ahead, what are the things that could realistically or conceivably happen that would impact your ability to be able to operate and succeed in a way that you're wanting to do so. And it doesn't, whether that's a potential competitor you didn't see on the scene or it's a complete rethink of an operating model that is gonna like completely transform your margins. It can be all of those things. And so I think it gets it out of this idea of like it's a pure legal risk. But I mean, I think every industry and every business, you always have to be on the front foot. What is around the corner? Because there are so many businesses that we could all name that you didn't expect to be where they are. Like 10 years ago, you thought they were gonna do brilliantly and they're not where they are now. And so it it happens that fast. And I think what you see really in like since in the tech era, even since like the dot com era, that happens faster. Like I think companies become become less relevant much less quickly. And so being ahead of things, really thinking about the future and how you continue to be relevant to your to your customers and your stakeholders is more important than ever.
Cecilia Ziniti9:40
So by that logic, it seems then Sophie, if you spent, you know, a few years developing an AI insurance program, the next logical step was actually going into AI investing. Is that what you're doing now? Like it sounds to me like this is really more just market scanning where it's it's something where you know, for example, the example a lot of folks use is Stack Overflow, is a website where you can ask coding questions and it was sold to private equity for two billion dollars. And I believe it was in 2021 just before ChatGBT. And that is something that like the acquirers, let's say, I don't know who it was, but whoever the acquirer was, I think it was one of the big global funds that acquired them. What what are you advising them as a banker now, Sophie? Like how how do you go from this, like what Sarah explained, which is like this is happening faster than ever, the risk is irrelevance. What what do you make of that and how does it affect your practice as a banker now? What do you mean the risk is irrelevance? The risk of irrelevance, sorry. Oh the risk of irrelevance. The risk of literally like something happens like an AI, like happened to Stack Overflow where this asset that they had is suddenly worthless because of AI. Or you know, pick your business, right? You know, you're making saddles and the car comes out. Have you seen that? Like did the insurance experience make you a better business person?
Sophie McNaught11:05
Um I think any kind of role where you end up with an amazing vantage point across a full industry is obviously very good for you. I think in my seat at Vouch, we had I I don't know, I want to say I can't remember how many thousands of customers we had that, you know, hundreds that were advising across all verticals. So it's more for me, it was more just highlighting this speed at which it was changing, being having being across those board level conversations. But I don't I don't think it's that different now, like from an investing perspective to a few years ago. Everyone knows that this is the the game that everyone is playing, which is put in your bet for the VC's perspective, put in your bet and hope it's the winner. And most of them won't be. There's like five companies that uh have managed to suck up about 25% of all the AI dollars, and that's kind of representative of almost at this point all the the VC dollars. And then there's another 24,000 companies that have the remaining 350 billion or so. So I don't know, I do there is, and this is a little separate, but there is a broader reckoning that is occurring in the venture industry right now as a result of what is happening with AI. And that is a real difference. So it's it's not just the big companies who are having to face various existential risks around their business not being relevant because if they don't adopt the technology quick enough, then their customer won't buy it. That's obviously a big issue. That's the classic innovators' dilemma that we've always had in innovation. We have a somewhat separate problem that is more relevant to the market cycle that we're in, which is more related to interest rates, where we had interest rates that were near zero. We've had an enormous amount of capital that have has flown into venture capital because of the returns that they anticipated we'd be able to get. The benchmark for those returns now is so high. We have an enormous number of companies who raised at high valuations in that land in that era a few years ago. And then AI came in right at the exact same time. So the tumult that we are feeling is not just at the big enterprise level where it feels like we're going to have this shakeout of winners. It's also very seriously on the funders level, where you've got these very big venture capital funds for whom a lot of them are spinning out. People want to then go into corporate. There's maybe not enough deals for the number of venture funds that there are. And so there's a real changing of the tide that's happening extremely quickly that we haven't seen before.
Cecilia Ziniti13:54
Sarah, you have been at Venture Black Companies and been on the other side of this, raising from people like Silvia. What's been so as a general counsel, you don't necessarily, you know, drive that. It's it's really a founder's thing. How do you advise founders on that? And I mean, I don't know if it comes back to risk, but like you're literally seeing AI coming, you're seeing these things at Lyme. You know, I think it wasn't Lyme, it might have been Bird, which is a competitor, but it was like they raised a billion dollars, then they raised it two, then they raised it five, and then not. But what what's your advice? Like, what's the takeaway there?
Sarah Binder14:29
I think it kind of comes back to the theme that we're going, which is you always have to be on the front foot and you never quite know what's around the corner. And I think so I think there's that. I think that you know what you see with with the best founders is that they really, particularly ones who've have kind of category created or helped create an industry, is that they know that industry almost better than anybody else. And it allows them to really have the best perspective on what is going to happen in the industry and how it can develop and how it can change, particularly if they've been in it a while. And so, I mean, like my general guidance, like it's very base, is do the right thing for the company. And it's I it's a very useful kind of thing to like keep coming back to. It really kind of keeps you often like on the path of like what is going to work out best for the company. So I think you don't ever know quite what's around the corner, but there are an awful lot of things you can do to kind of just mitigate when things you we all know we've done these types of roles in the kind of sort of broader kind of like risk mitigation space long enough to know there is going to be something that comes up that you are not expecting. And, you know, making sure you have enough cash on hand, making sure that there is nothing absolutely egregious that is really going to impact your reputation or impact you from a liability perspective, or is in any way going to materially detract from you being able to deliver, you know, the business that you and, you know, the services that you're trying to trying to deliver. And I think that's why I'm so focused on trying to get ahead of where issues might come from. They slow you down from the business that you're all trying to build. And I think that's why like it can be like, oh, you know, the problem staff, it sits with legal, it sicks with finance, it sits with, you know, insurance. It doesn't. I think we all do this and we love it, is because we're enabling businesses to be able to grow faster and further than they otherwise would, and trying to bring that experience to bear on that.
Cecilia Ziniti16:19
I mean, we had you're reminding me of I had a boss at my first startup, and he was like the VP of operations, but it was really sort of legal insurance and the GNA. And he went by VP of darkness. We got him like a little thing, and but let's make it real. So you said things are always gonna happen that you can't predict. So this is COVID is obviously the obvious example. You must have crazy stories that you can generalize. Give us a story of something that happened, and you're just like, oh my God, there's no way we could have known that. Or maybe conversely, something that you came into the business and were like, Yeah, I knew that could happen. Maybe an audit. I'll share one. I had an audit once where I started at one of my startups and the CFO started the same week. And he goes, now there's a ramp and BREX and other startups that do this, but he goes and figures out that everyone's ramp card was configured to a limit of a million dollars. So every employee in the company could have charged a million dollars. And that was just like, it was like, oh, it doesn't take a super deep audit to figure that one out. But what were any kind of head smackers or fun stories you can share, Sarah?
Sarah Binder17:21
I think it's always the thing that you knew nothing about. Like it's always the thing in a dark corner, a small corner of the business of like people that you've never met or even heard of, and suddenly like you're pulled into a crisis involving them. I recall one issue with that I ended up having to report to a regulator that wasn't a regulator that many people had ever heard of. And sort of the speed at which you have to move of like, oh wow, okay, this is what this regulator does. And right, this is how we need to report. And like you're trying to like pull it all in at the same time. And like, so I think like it's the things that you never see coming. And it's what I've always like, one of the things that I always do, like that 90-day plow and you get in, is like I always talk about this about getting your arms around the business. And like that's your first year in a new role. You're trying to get your arms around it. And it means that you know you're sort of getting there is when you're not surprised when things happen. Things will always happen. But you get to this point where you're like, I know that where I'm gonna be surprised more or less, is the ones that like hit you like out of nowhere, and you're like, We do that, do we? Like, and it's it sounds, it sounds like almost like sort of dereliction in the duty, but like it is so hard to understand, particularly as companies get bigger and bigger and more and more complex, all of the pieces of the threads that are flowing and how they're all pulling together and what is accessing what and like how that all works, you're never gonna catch all of it. But learning, I think, really broad-based, open questions, really like getting deep into teams. I actually quite like it when I join businesses and I don't have a big team, or actually I have no team, because you get to do all the work yourself directly. And it means you're working like often two, three levels down from management and you're really doing the doing, and you get to just know like where things might not be quite right, where a system may not be as mature as it it may need to be. So, yeah, um, the the mystery regulator that I'd never ever heard of um was definitely one that I did not I did not see coming.
Cecilia Ziniti19:19
Sophie, any any stories to echo or anything to say on that?
Sophie McNaught19:23
Something that legal teams obviously have struggled with in the last couple of years is figuring out all the ways that their own employees are using AI andor what on earth their engineering team is building, and also how on earth the sales team is pitching it. And all these things, again, that are kind of normal, but because there's such it's such new technology, this is always going to be somewhat of a challenge for legal, but it's not that normal in tech for there to be a new technology that comes with such a risk. And there was one client of mine, they were a little bit later stage. I think they maybe had raised like their Series D, but they did this somewhat genius thing, I thought, where they went and hired someone who was trained as a lawyer but had some product experience. And this person wanted to move a little bit further into the product land. And they put them full-time in the engineering team, but they were part of the legal team. And so they were, it was kind of like what the role of the PM has always been, like to be that translator between the engineering and the business. But now, because risk was so important to this business, it was being that translator between engineering and the people who were trying to figure out all these security components and whatnot. And then the interesting thing that came out of that is they ended up with all of these insights that they were able to translate to sales. Because actually the blocker, and this is consistent across most of my clients at vouch, the biggest blocker for their sales team to closing a deal was it's all these objections that are like legal issues. It's like security stuff. It's how does this indemnity work? How on earth have you trained the models? It's all the things that your legal team would bring out. Talk to me about your insurance. How, what are your cyber controls? All these things that are very technical. Um and they ended up, yeah, this legal person that was kind of playing this role. And I've shared this a number of times with other general counsels who've then sort of attempted to do that with a headcount that they had, where they could be like, all right, we're now going to assign like 20% of your time or 25% of your time to get that exposure, which I'm sorry, is an absolute dream for a legal person. Like as we have continued discussing, the best way to be valuable as a legal person in a tech company is to genuinely understand the technology.
Cecilia Ziniti21:47
What's your reaction to that, Sarah?
Sarah Binder21:48
Well, yeah, when Sophie was talking, I was just thinking like another like absolute sort of like guiding principle for me is know thy product. Know thy product, know their customer, like know it, like know it as well. Really lucky when I was at because I started in-house at big consumer companies, it was very important to both companies that you really, really knew what they were selling. And so it didn't matter what your job was at British Telecom, you were expected to kind of understand what our engineers did. And when I was at Yum Brands, Yum Brands is like, and there are a couple of other number of retail brands and like hotel brands and restaurant brands that do this really well. You can't start any job at these companies until you have spent two weeks working on the front line in a restaurant. So you spend two weeks.
Cecilia Ziniti23:06
And you can't you cannot be disengaged. And it reminds me a little bit back to the insurance thing. Reminds me a little bit, I was at at Cruz, which is the Division of General Motors, and at the time, I think it was maybe the late 2010s or something like that, there had been the ignition switch basically issues. And one of the findings, this was public, was that having the legal team in a different building than engineering was actually like an issue. So what do you think of that? So this embedding. So is so what is the takeaway then for a GC try to embed? And then how do you get invited to be embedded? Like Sophie, that client, you said it's like a dream, right? Did the PMs just be like that? Did they just find the right lawyer, or were the PMs like, who is this person? Or how how did it happen?
Sophie McNaught23:48
I think that came down to having a good relationship with the engineering team. I think ideally it comes because there's some kind of positive relationship and they want to achieve something positive together. The other way I could see it occurring is, you know, in a lot of instances we had engineering teams who were being slowed down by legal and were getting fed up with not being able to ship things as quickly as they wanted to. So then it becomes an executive level problem of why aren't we shipping fast enough? And they say, well, because legal isn't saying we can do this stuff. So this is a good solution if you find yourself in one of those conversations potentially. But that's a bigger cultural thing, which I think we might end up talking about it later anyway.
Cecilia Ziniti24:33
Yeah, let's talk. So Sarah, yeah, you uh so Sarah has a you have a brand as being a GC that moves very fast and is, you know, very effective. That's why you're on the pod. Um, I mean, also because you're my friend. Other people that vouch for that too. So how do you how do you do how do you not how do you do the job effectively? Because presumably there are things that you gotta say no to, there are things that you gotta take a beat and review, or you know, that are a you know kind of requiring of a capital P policy. How do you do it? And if you were giving advice to a brand new GC that hasn't done that kind of hug process that you talked about, getting to know the business, I mean maybe that's the advice, but what what's the key advice there?
Sarah Binder25:11
It's I it it's it's very cliched, but I think what I'd say is it's not enough to be right. You're the lawyer and you'll probably be right. That's really not actually enough. And so, A, it's not enough because you may well be right on, you know, a technical point of compliance, but that's got absolutely nothing to do with what your business is trying to do or what their objectives are. So if they're not aligned, it doesn't really matter if you're right. And you will have a very short lifespan if you just want to be right, and you probably shouldn't be in-house. But I think it is an art, it really is an art, and it is all about building relationships. It really is. Like when I was so my first two roles that I did as a general counsel, I was the first ever general counsel, and people had no idea what my job was. I mean, people like had no idea what my job was. I still remember a web developer in my first job rewriting my terms and conditions, and he said, thanks to your terms and conditions, I've changed them because I don't feel that they're in like the company language, and I didn't really like this idea that we needed to give people 28 days' notice, so I've changed it to 14. And so I went and found this web developer and I was like, Hi, this is what I do. And he's like, Yeah, that's really nice, but that's not what's right for our customers. And I was like, but it's the law. And he was like, Yeah, but it's not what's right for our customers. And it was like, it was such a good education. Need just to say, I did triumph and we did actually get terms and conditions, but it was like a very, it was very grounding. I had been to like, you know, a top university. I had gone to a top law firm, I had been like an MA attorney in like a big public corporation. I was doing a lot of very top-tier work, and then I'm in this company, and there's this very junior person being like, Yeah, I don't like your terms and conditions. And I'm like, no, no, I'm the lawyer. And he's like, and it was very educational. Like he was like, What's your back? He was basically like, Well, how is this helping our customers? And I'm like, Well, it's protecting their rights. And he was like, but is it? And wow, like it really forces you to think. And I think like really being open to new perspectives and different ways of looking on the world. Like, I think that's why those of us who go in-house, that's why you do it, because you want to understand the business more closely, be able to use the expertise you have to be able to drive the business forward. So, yeah, don't try and be right, it won't work. Build relationships. You just keep the hardest ones or the most important ones because you never, you as a general counsel, information is just power. And so the more people tell you, the more information you have access to, the better you're going to be able to forecast where issues might arise and you're going to be able to manage them thoughtfully and more sensitively and proactively. So a lot of advice in there. But yeah, make friends with everybody. I'm always like, we'll come to any party we're invited to.
Cecilia Ziniti27:59
Let's go. Let's go. Yeah, so many great themes in there. Danielle Shear, again, same thing, said, Do you want to be right or do you want to be effective? And I do think that is a scenario. I have a great example from this morning, and we'll see if it recalls. The terms of use point is just is lovely. So terms of use are my hobby horse. I try to be customer obsessed about them. But no, the the story I had this morning, we had a literally this morning, a competitor use our the GCI name in uh Google AdWords, looked at it, really did was confusing where it would look like it was GCAI. And so I get the I I get an email from a customer saying, Hey, this competitor is using your keyword. Um, you know, you should make them stop. And as a business person, formerly a GC now list a a CEO, I took it and I forwarded the customer email to the GC of that company, who I had met at some GC event, and I said, Hey, see below. I was literally all I said, hey, see below. And I CC'd our general counsel now, Laurel, she's amazing, hi Laurel, if you're listening. And, you know, I think Laurel responded to me doing the right thing legally. And I, you know, I'm not I'm not picking on Laurel, but this is just an example, saying, Hey, you know, by the Google AdWords policy, we really are beholden to Google here. There's case law in the night in the Ninth Circuit and so on and and a whole thing. And Laurel was in point of fact correct. And I said, you know what, I bet she takes it down anyway. We don't need to worry about that. I bet she takes it down. Time it took me to reply to that, the GC had said it's been taken down by cool. Sorry, you had to do that. And it was just that two-liner of like see below. How do you get to that level of jumption? And I like for me, I when I was a GC, I'm not sure I would have done that. I do feel like that maybe as a CEO boldness. Like, what do you how do you do that? And like for you as an insurance, you know, somebody came up in risk, Sophie. You know, helping clients make a call like that where you're deciding, all right, just just go. Or I think that's just experience.
Sophie McNaught29:54
Yeah, what it where does that come from? I think that's just experience. You start to realize that like at the end of the day, like most people don't most people want to do the right thing. Like we I had an interesting example when I was at vouch where, and it's even more so the case now, a lot of smaller companies that went, oh, we want to do insurance for startups as well. And in fact, specifically we would like to build AI insurance products. And, you know, the classic YC thing is that you should just build the minimal viable product and get it out there and test it. And, you know, unfortunately in regulated industries, it doesn't work quite so well. But we had an one instance, this happened a few times, of a website going up, someone taking essentially all our copy and making it look like they were building this business and they were soliciting customers and there was some it was a very odd situation. But I knew the founders. And same thing. We ended up just initially the alarm bells were all going off, but then we ended up just calling them and saying, Hey, FYI, you guys are going to get fined by these people and these people and these people for doing these things. Maybe just put it on, like put it back in your sandbox. Like you probably shouldn't have it out there right now. And they were they were fine with it because they had the foundamentality of like, okay, we tried that, didn't work. Did the wrong thing, guess we've now learned that we've done the wrong thing.
Cecilia Ziniti31:16
Um I had a that reminds me, I was I have a friend who's uh in the chief of staff, uh Phoenix Norman, and he I he's worked with CEOs for a long time, he's been in the valley forever. He put it that sometimes you gotta let the founders and CEO burn their hand. Like where it's like your stove is hot, hey, it's hot, you let them burn their hand, and then like, okay, next time they're gonna not do that.
Sarah Binder31:43
Does that resonate, Sarah? Yeah. Um, I think any senior executive who's ever been deposed tends to if they if they haven't before, tends to rethink how they feel about legal risk or litigation, it feels much more real, I think. And I think it's the same, you know, if you it depends sort of the path that you have come along as as a as a general counsel or an attorney, right? Like if you've spent your time in litigation and you know what it is really like when you are prepping for court and you are like having to do disclosure through, you know, 80,000 slacks, you have a different perspective. So again, it's just it's just all context and it's kind of what you've experienced. But I think that, you know, as risk advisors, it is our job to be able to do that, whether that person has experienced that or not. You have to be able to make it real for them and you have to be able to make it feel relevant to them so it you can uh they can understand like how significant is this, how seriously should I take it, what are what are the consequences. So I think I think that's good. I always find that the the story about cell phone messages in I think the Uber Waymo case from like a long time ago, that always seems to freak out uh exactly.
Cecilia Ziniti32:54
What's the story? Tell tell us the story.
Sarah Binder32:56
I think the story is that the inner dispute, it was a it was a pretty significant trade secrets dispute between I think Uber and Waymo. It was like, and basically I think one party in the litigation demanded all like access to all kind of text messages of like personal cell phones. And I think, you know, it's just a reminder, anyone who spent time in litigation, it happens, and you really look at you really need to look at everything you have in the cold light of day. And again, it just it just reframes your perspective in terms of like how you think about what you're putting out there, what you're saying. You know, I think it just I think you know, sometimes as you say, reality that's just reality, and when you've seen it happen, you have a different perspective on it.
Cecilia Ziniti33:40
My uh I had a colleague who's a former US attorney, and she did not like Slack. She did not Slack anything. And in fact, the company I was at at the time, they went to a 30-day Slack retention policy because they wanted Slack to just be musty, and that's all it was. And I personally can't, you know, cannot imagine now as a CEO. We're very Slack forward. I can't imagine 30-day Slack blowing up. Crazy. But it is definitely that that perspective of you know, this this person has prosecuted drug dealers and have death threats and all these things. And so you can see why they would be super measured about about communication. Amazing. So that actually gets us to some of the not con stuff. So person safety in some of your businesses, I mean, at Lyme, obviously, and then now at at at Better Up, it's you have a lot of users, it is consumer, and you know, you could be considering issues of life and death, right? I mean, presumably your your insurance program had personal injury and other things. That's a different kind of risk than most um general counsel deal with. Does that experience teach you that working in other environments doesn't? And is the toolkit different?
Sarah Binder34:43
Don't think the toolkit is different because I think, you know, if you're in any business where you're serving customers, whoever those customers might be, you're always thinking about what is the right thing to do by the customer. And so I think you always have to hold that true. I I had an early experience actually, like a long time ago, in a fairly early general counsel role of a where what we did wouldn't typically cause real trauma to anybody. And due to a series of errors, we caused huge um emotional trauma to a family. And so it was a very and I I had to go and and meet the family and sit in their living room and apologize for the errors that we that you know had been had caused this trauma to them by the company. And it was a really very important early lesson in, you know, if in doubt, do the right thing. You know, I was very lucky to have a an amazing CEO who was like, we should just tell them that we're really sorry and we've got this wrong and what do they need from us to make it better. And with that space, and he was like, You do, he was like, Sarah, you're the closest to this, you've understood the issues, you'd figured out what's happening, go do what you think is right. And it was a really, and yes, you need to protect the company, and he knew that I would do that. But I think having the space to think like creatively about how could we solve the the issues that we had caused for this family is is really good. And like, yeah, imagine that you are gonna go and sit in their living room and tell them what you got wrong. And it was complicated to explain to them and like it was really, it was a very good early lesson in that ethical business and responsible business, they can sound like their words and they're not. They're really important. And you know, at the end of the day, like we all want to be working in businesses and doing things that make a real difference to people's lives. And I think that comes in both of like creating moments of joy and success, but it also comes in creating moments of compassion and professionalism and empathy when perhaps d things don't always go as you as you intend. And the only thing I ever take from that is how do we make sure we don't do that again? And how do we, you know, how do we learn? So I, you know, when those errors happen, you hope very much that they don't, but when they do, I feel like you have a really deep ethical responsibility to make sure that you fix those things so those things can't can't can't happen again and you can't cause that type of impact again, whatever the issue might be.
Sophie McNaught37:05
Sophie, anything to add there? I just think it is an interesting time, potentially. We talk so much about how the the you know, the technology is moving so quickly. And the maybe it is just because of my vantage point from thinking about risk for the last three years in relation to AI. These kinds of things, like the incident that Sarah just described, I'm finding that they are coming up more in diligence conversations amongst VCs in a way that maybe they weren't before. I'm not sure. Like I said, it might just be my vantage point, but I think it might be to do with the fact that a lot of the technology that is being built is it's AI for the enterprise in every vertical. And so the investors themselves are very reliant upon their executive expert networks to really understand all the ways that this could go wrong, does work, doesn't work, whatever. And that's always been true with technology. Um I think there because there's so much opportunity for innovation in regulated industries, that's where a lot of money is going into innovating. And the reason that they are regulated industries is because that there's a zillion things that can go wrong. Anything in healthcare, working in even in dental, in surveillance, supporting a government agency, aviation. It's you know, people are skeptical enough about AI. So you start applying them to human anywhere where there's an elevated duty of care somewhere with someone providing services. And so of course that's being considered in the way that the technology needs to be created and designed. I mean, it'll be the same for you even in building your business. It's the reason that you have the edge that you have because you're coming at it from the angle of you are you've done this forever. You you know the ways it can go wrong. If someone just comes in and tries to build some kind of legal technology and they haven't done it and they don't understand the edge case, that's you know, they're not going to be as successful. But also, trust is so quickly lost in this current world because there's another company just to your left and just to your right who says that they can do it. Like the barrier to entry right now is so low.
Cecilia Ziniti39:26
What it's pretty interesting for me is like that these human problems, right? That's like the medium is new, but the problem is not, right? So you think about you hear of like, you know, these super sad stories of people conversing with Chat GPT and then you know dying by suicide. And you know, you think of like this was the same thing but on every form, right? You know, TikTok or even like Adobe, you know, and any kind of technology, if you've got humans using it, can go in that direction. I mean, I think of KAPA, the Children's Online Privacy Protection Act. It came out because one of the things I think it was uh like a mutual fund company was sending emails to kids being like, Do your parents have a mutual fund? And it was kind of that, and then sort of like the creepiness. And then now you think, okay, it's being applied to everything, and our lives have shifted to be online. How do you even regulate that? I think the other thing that this brings to mind for me is like you've worked in a dozen regulated industries, Sarah, and it's like, I think Sophie's point is a good one, which like it's regulated for a reason. So, so what is your relationship with regulated industry? For me personally, I'm like, I will not be a regulated industry GC again, although here I am in AI. But anyways, that was my I swore it off after I was GC of an education company. What's your relationship with regulated industry? And when you're working in that, how do you convince business people about it or bring it back to that human element?
Sarah Binder40:47
I actually think that's maybe a bit of a controversial take. I think what's harder is being in an industry where there is a very clear duty of care and the regulatory framework is not defined, it doesn't exist, or it is patchwork or unclear. Because then it's much harder. And most of us, if we're working in Silicon Valley, you are normally at the forefront of tech for which the law has not yet been written, or certainly not comprehensively. So actually, if you're in a heavily regulated industry, yes, you have to comply, but at least like the rules, the playing field, the rules of the playing field, they're clear. It's much harder when they're not, and you're having to piece it together and know that three years down the line, someone is going to look back on the decisions that you made and the policies that you decided, and that will kind of form the basis of like the regulation or a litigation decision or whatever it might be. So um, I actually was thinking as we were talking, like the duty of care exists kind of regardless of whether you're in a regulated industry or not, but it's a hell of a lot more complex when those lines aren't clear.
Cecilia Ziniti41:50
Sophie, have you had one of your uh tell the story of one of your either clients on the insurance case or others that you've worked with before, where you got to that point that Sarah's describing where three years later somebody's looking at your stuff and it's like, okay, what was your judgment right? So I have had a case litigated, of course I did check transactions, have you had a contract litigated, and you kind of do your best. But any stories to share there?
Sophie McNaught42:17
I mean, that's literally every single company. That's your job when you come into a new role to come in and explain why the person before you made the mistakes that they did, and now thank goodness you've arrived and you can save the day. So I don't have there's not a particular one that comes to mind where they're then being scrutinized. I think it's uh the more interesting thing to me is how we as an industry will be scrutinized and who gets to set the standard for what we are and we aren't doing. And a really interesting thing about my seat at Vouch with seeing so many companies is where is the for what forces are pushing us into the direction of a standard? Because we thought it was going to be some kind of AI regulation and the Biden administration was going down that path, but that is not where we've ended up. And so we we don't have there are is a course that leaves you leaves you in a position of having patchwork state legislation. But again, lawyers are used to handling that. That's okay. And so instead, where we are is that it's the buyers that are really dictating what standards these companies are expected to uphold. And I mean that in terms of the vendors who are purchasing the software or the technology themselves. And of course, they often end up being the acquirers as well. So the standards for making a transaction happen end up being the standards we abide by. We the um I think there's an insurance piece to that, and there's a security piece to that. Um, and they kind of go hand in hand. But it was it's a lot of execs coming to their lawyers, like to their outside counsel. Or to their insurance person and saying, hey, we're doing this, is this what everyone else is doing? Like, is this gonna be enough? And or it's the up the what is it, the cart pulling the horse? What's that saying? Where they're saying, hey, our head of sales just called and they're meant to close this deal. And if we don't get this thing done, we're not gonna close the deal. And the CISO of JP Morgan has said that if we don't figure this thing out tomorrow, this is falling over. And it only takes one anecdote like that to get around a few AI companies to all of them to be figuring out how to solve that thing before it becomes a problem.
Cecilia Ziniti44:35
Sarah, you have a magic wand and you can decide how AI should be regulated. What are you deciding?
Sarah Binder44:40
I think it has to be outcome-based. I think the best legislation is kind of outcome and principle based rather than and so it it needs to have, it needs to be a framework rather than something extremely directive. Whilst there are bits that I'm sure we all don't love about GDPR, I actually find that when you actually are working through the principles of it, it it really it can really help shape how you think about conclusions. So I think, you know, actually, you know, a lot of where the EU has gone in terms of how they're thinking about AI from a principles base is is not unhelpful. That said, part of me doesn't like wants to watch to see where it goes because I think the innovation that you will see in AI regulation is quite exciting. And so looking at the different approaches that different states and different national entities might take on it, I think we'll really, you know, if we do it well, we'll really bring out the best in creating a framework that is actually really safe, but also really drives innovation. And that is the balance that I think everybody is is trying to find. It's a bit of a nirvana, but I actually feel pretty optimistic that it can be achieved.
Cecilia Ziniti45:45
Amazing. Well, with the note on nirvana, I'm thinking let's go to let's go to the lightning round. So a book idea, a mentor that shaped how you think, Sophie.
Sophie McNaught45:54
I feel put on the spot. I know this is meant to be a lightning round. I want I'm always going to look at my bookshelf. You know what, actually? This is gonna be the most embarrassing. I actually hope you cut this out. This is gonna be so embarrassing, but I'm going there. There is a book that I was gifted when I was 14 called Girlosophy, a soul survival kit. And it is this beautiful book that is designed for teenage girls to basically help them understand how to live a life in a way that's principled. And it is still beautiful. And I pulled it off the bookshelf the other day.
Cecilia Ziniti46:29
I have a lot of teams. I can I I I can relate. I love that. All right. Um, Sarah, a piece of advice to Liner that you would give your earlier career self.
Sarah Binder46:39
That's easy. Don't worry about the titles, forget titles. Someone gave that advice to me when I was junior, and Larry, I say it all the time now. And I remember at the time them saying it and me being like, well, it's fine for you because you know you're like, you know, a chief legal officer, and you know, well, of course you say that from there. And now I understand it. So like, don't sweat the titles, focus on the work.
Cecilia Ziniti46:57
Sophie, how about you? What's one piece of advice you would give your earlier career self? Just enjoy it a bit more. Awesome. That was my conversation with Sarah Binder, General Counsel at Better Up, and Sophie McNaught, the managing director at Silicon Valley Bank on AI risk and advisor at Primary Venture Partners. Follow CZ and Friends wherever you get your podcasts. To learn how legal teams are using AI and managing risk to lead with impact, visit gc.ai. Thanks for listening. We'll see you next time.
