AI Governance and Why Legal Bottlenecks Start Upstream With Suzy GC Rachel Harris

Cecilia Ziniti0:00
If legal is a bottleneck, something upstream is broken.

Rachel Harris0:03
Have we not integrated ourselves into this workflow appropriately?

Cecilia Ziniti0:11
Welcome back to CZ and Friends, where we talk with legal leaders, operators, and technologists shaping how modern companies work. I'm your host, Cecilia Ziniti. Today, my guest is Rachel Harris. Rachel is the general counsel and AI governance and privacy officer at Suzy, a high growth AI company in the market research space. She started her career in multidistrict pharma litigations, then was appointed by a federal judge to a national steering committee, and then she pivoted into privacy and governance, building those functions from the ground up at companies that didn't have those functions. Let's get into it. I'm so excited to talk with Rachel. We know each other through the GC community and I've admired her online since. So excited to dive in. Rachel, I'm glad you're here. Thank you. Thank you. I'm so excited. All right, let's go. So I want to start with um, so literally the term MDL, I'm not sure you know, non-lawyers know it, but it's an example of like really gnarly legation. So, first of all, what is a pharmaceutical MDL? And um, how did you get your start there?

Rachel Harris1:15
Yeah, you know it's so funny. Anyone that knew me in law school, I'm one of those people that whatever I say into the universe, you know, some people can really manifest things. I tend to manifest the opposite. So in law school, I swore up and down that I would never end up in private practice. And then lo and behold, my first gig right out of law school, I was litigating pharma MDLs, right? So how I got there was I had a really great evidence professor who had sat on the other side of the table from some of the lawyers at the firm I joined. And he said, Hey, if you just want, if you want to go on and get trial experience, you couldn't learn from anybody better. So I ended up at the firm, ended up in their pharma MDL practice, which is a gnarly sense of litigation. You have class actions, you have multi-district litigations. And I always like to say, in a class action, you have a bunch of plaintiffs eating out of one pie. In MDLs, you have a a hundred different plaintiffs with a hundred different pies. They're all baked in the same kitchen, but there's a hundred different pies. So yeah, got my start there, learned a heck of a lot, got a lot of really good experience.

Rachel Harris2:22
And I look back on it now, considering from there to here, and think, well, it's been a little bit of a roller coaster ride in my career. So you were plaintiff's side.

Cecilia Ziniti2:31
Most I'll say most of our guests, and there is a little bit. Um, so I was in big law, I was at Morrison and Forester. There is a little bit of defense side snobbery. Also, you're from St. Louis. So my other good friend from St. Louis, Mark Boyko, he's plaintiff's side ERISA litigator, has literally been before, you know, the Supreme Court on these issues. And I think that like plaintiff side is kind of a hack to get a lot of experience. So tell tell me about being plaintiff's side.

Rachel Harris2:56
That and then now that you're on the company side, how that how that works it's so funny that you say Mark, because Mark and I worked at that first firm together. He was in Arissa and I was in Pharma.

Cecilia Ziniti3:06
Amazing. Yeah, no, literally, when I think about like the most successful lawyer from my past, like we went to high school together and he literally he said he had to stop going to CLEs because on ERISA because they were all his cases and he learned nothing, which is like fascinating. So yeah, so tell tell me more about the the plaintiff, the plaintiff side journey and should people, should law students or you know, what can a GC today learn from, you know, or or what do you take into being a G C from having been plaintiff-side?

Rachel Harris3:34
Yeah, you know, it's when I think back, I had someone recently asked me, uh, because you know, um a little bit of dis defense side snobbery, there's also a little bit, let's be honest, in tech, there's a little bit of tech in-house, kind of where our own little vibe and once you're in, you're in, but sometimes it's hard to break into it. And I think back to what if anything could have prepared me for life in a very high-growth startup, and it wasn't working at a big law defense side firm. It was hands down working at the plaintiff's firm. There are so many analogies between the vibe and the speed at which you have to work and make decisions in the ambiguity and take big, bold bets and you know, nights where you're sleeping under your desk to get something across the finish line. There's such an analogy between plaintiff's side, especially complex litigation work, and tech startup life. So it's always fascinating to me on that. But thinking of Mark Boyko, I'll never forget when I was interviewing with this firm, they had three main practice areas. One was Arissa, one was Fila, so essentially railroad litigation, railroad injury, and pharma. And the partner for the former two was talking about we do a lot of trials, great depositions, we traveled to Oklahoma, da-da-da-da. And then the the other partner was this phenomenal uh female lawyer. She was a partner at the firm, and she looked at me, she goes, Rachel, and pharma, we traveled to Amsterdam and we try cases in Europe. And I just I always remember thinking, yeah, I I want that one. Between Oklahoma and Amsterdam, I'm picking Amsterdam.

Cecilia Ziniti5:10
Yeah, no, it's funny. I read that uh because of Ozempic, Ozempic is like a third of the GDP of the Netherlands or some like crazy thing because of Novo Nordisk. But yeah, that's awesome. Um, so what's the craziest case you ever

Cecilia Ziniti5:23
worked on? Give us a story. Or the craziest thing, like you know, deposition where you know guns were pulled or something like that. You must have a crazy story.

Rachel Harris5:32
Not one that I sat in on, but there was a crazy story where both sides were screaming at each other, middle deposition, judge had to get called, right? Probably most interesting case I worked on. I was a the the fun thing about MDLs, I guess I'll say also for, I don't know, any law student listening to this, on the plaintiff's side, because you tend to be a small firm yourself on plaintiff's side, so you partner up very closely with other plaintiffs' firms throughout the country. So as a fresh out of law school girl from St. Louis, I got to travel to New York City all the time and essentially be shipped out to be of service to another plaintiff's firm that we were working with on an MDL. So I got to work with a female partner at a firm in New York who had a nurse nursing background. We were working on a very complicated testosterone medication case. Her background as a nurse got us through a deposition of a like a high-ranking former FDA official. And she was able to sludge through 3,000 med watch reports, right? Where consumers submit to the FDA, they may have had an adverse reaction to a medication. And I'll just never forget sitting in in New York, and it was just an entire week of us sludging through med watch reports, trying to find essentially a needle in a haystack, and because in her background we're able to do it. It just was not sexy, but also at the same time incredibly exciting when you finally get to that point where you find it.

Cecilia Ziniti6:58
Love that.

Cecilia Ziniti6:59
So you mentioned before that this experience of, you know, the fast-paced, a lot of pies, a lot of people you're suing, complex interrelated cases was an incredible prep for startup land. How is that the case? And so analogize the job, because I on the external, it's hard for me to imagine how, you know, a lot of discovery and all those cases equate to the startup GC job, which I've had a few times. So I how did you adjust and what did you how are they actually related?

Rachel Harris7:33
Yeah, probably the closest analogy is dealing with, not dealing with, but learning to work with high operating, high risk tolerant owners. So on the startup side, think CEO, right? On plaintiff's firm side, it was one of the founding and also owners of the firm who in a plaintiff's firm environment, they're often having to take out first, second, third lines of credits on their own home just to finance a potential litigation that could stretch on for 10 years. A lot of these cases aren't a big bet that pays off in the next six months. They're a big bet that might not pay out for a decade. And so you get that similar mindset, especially in VC-backed startup life, right? Where you have to make really, really big bold bets and you have to get really, really comfortable with a higher risk tolerance that then you might have as an individual person and understanding that you might not even see the return on that for the next five, 10, whatever years it might be. Or it's a big bet you make and you've got to be ready to pivot hard left on a moment's notice in order to see five steps ahead and figure out this is actually where my ROI is going to be. Right. We all felt that when Chat GPT hit the market. You know, there are a lot of companies that were operating in traditional SaaS space, ChatGPT hit, and we all had to pivot hard, pivot fast to go in the new direction to really stay not just relevant, but successful in the in the new age.

Cecilia Ziniti9:00
You know, it's it's interesting you should say that. I had um a guest a few episodes ago, Michael Jacobs, the former chair of Morrison and Forrester. And, you know, I I made the observation that when I became a general counsel, the idea of litigating or certainly becoming a plaintiff, deciding to bring suit, was something that I discouraged quite a lot more than of course when I was paid to litigate. And he made the point that for a corporation, let's say Apple suing Samsung or Oracle suing Google or these like big, very billion dollar litigations, said that when he meets with the clients, as sort of like intake of deciding whether the firm will even take the case, that he he tells the the GC or the CEO or the relevant stakeholder that starting a new litigation is like opening a new line of business. Like you gotta decide like that that this is this is what you're gonna do and you know, fund it properly, manage it properly, set expectations properly, understand your odds of success properly. But what you're saying is actually even the next level of that, which is as the uh, let's say chair of a plaintiff's firm deciding whether to take on an MDL or to take on a particular case, you're deciding whether to actually found a company, is is sounds like what you're saying. Yep.

Rachel Harris10:19
Yeah. Because litigation financing, especially back when I was practicing it, there were no options. There's a there's a a bit more options on the market today for some of these plaintiffs' firms. But back then, I it it was really my first exposure to founder mentality and and in how a business owner runs a business. That the the partners at this firm were phenomenal lawyers, don't get me wrong, but they were equally great owners of a business, a small business in a lot of respects. And they understood the gambles to make and what it actually meant for the employees at that firm as well as themselves and their in their personal life. And so that that I think gave me the best translation into how to work with and communicate with my colleagues once I entered the startup space. And don't get me wrong, I love my time in big law on the defense side too. But what when you work in big law, it's a different uh mentality and pace of life in some respects. You're the you're the billable, you're almost like the seller when you're at a big law firm. So you're you're like, I don't know, I'm keeping the lights on. In even in a plaintiff's firm, you're not billing. So, in a lot of respects, until the payoff happens at the end, in some ways, you're a you're an overhead, you're a cost center, you're doing the work, but there's no guarantee the outcome is going to be worth that time and investment on the upfront.

Cecilia Ziniti11:42
So um, tell us about your journey into Susie. So you you do all that, then you go to Thompson Coburn, which is, you know, a big law out of St. Louis. What inspired you to make a change and go go be a GC and work at a startup?

Rachel Harris11:55
There's a little bit of an evolution. So it started at the first plaintiff's firm. I loved being there, but it was almost odd because I came out of law school and I became immediately niche, right? MDLs are already niche. Pharm MDLs in particular is even more niche. And there's a lot of people who've worked their entire careers and they want to become that specialist and go into that niche. And, you know, all of us do. I do too. But coming right out of law school into it, I wanted water exposure for my long-term career. And so I actually made a at the time a sort of a weird transition to a small firm because I wanted non-litigation exposure. I wanted just general corporate work exposure. And so I got it there. And at the time, around 2018, what hit everybody's favorite? GDPR. It was the mad dash to help all, you know, the small, medium, and large businesses we represented to get all of the privacy notices up to speed, et cetera. And then at Thompson Coburn, it sort of cemented this lingering feeling I had that while I loved litigation, while in some respects it came naturally to me, and I particularly loved e-discovery. That was always my bread and butter. I loved it. I loved being in the trenches with the tech teams on it. All parts of e-discovery I loved, right? You had ALML starting to roll out on relativity and others. But in the back of my mind, I always thought litigation is a little bit too reactive for my own personal views and personality, I guess. I wanted to be part of the team that was helping the company before it ever got to that state, right? Something that was more proactive. And I was very, very fortunate. My predecessor at Suzy, Jen Healy, she's phenomenal. She took a big gamble on me because I was someone coming from not the particular background she was looking for. I was coming from a law firm. I didn't have background in in-house space, in the tech space. I was in Missouri and she took a gamble and it was phenomenal because then I was able to join Suzy. I was able to build the privacy for program from the ground up. I still had mentors from my old firm who would let me start to move into the privacy and data protection practice area, even though my anchor was in commercial litigation. And so I was able to tap them for additional resources, able to tap into the Tech GC community for additional resources. And yeah, the r the rest, as they say, is history.

Cecilia Ziniti14:24
What's the put us in your head, your first week, month on the job? What did you do to set yourself up for success? And knowing what you know now, what would you tell someone in your shoes going from a you know kind of different background to in-house?

Rachel Harris14:41
Yeah, I first week and first month, let's be honest, first year, probably would all of us feel imposter syndrome, terrified, terrified and excited all at the same time. I think what I got lucky with in some respects is my predecessor, Jen, who welcomed me and also just completely empowered me. She was like, You're you're the privacy counsel, you own privacy. Your clients at Suzy are the product and engineering teams, and also our head of security. Go become best friends with them. And that's what I did. I spent the first 30 days just talking, doing a lot of talking. Our head of security, Andrew Croft, was his name. He was phenomenal. He taught me a lot because there's knowing privacy and cybersecurity in private practice when you're the outside counsel advising it. And it's very different when you're in-house. And what does it actually look and feel like practically on a day-to-day basis to navigate those nuances? You you spend a lot of time, you have to get to know the company's tech stack, right? If you're cloud-based SaaS, are we Azure? Are we AWS? A lot of those nuances you you have to give yourself time and permission to learn. And then I think if I was telling somebody who was making a similar pivot, there's there's no great playbook. The best playbook is don't doubt yourself and make friends.

Cecilia Ziniti16:04
Don't doubt yourself and make friends. I love it. So let's talk about um about

Cecilia Ziniti16:09
make friends. I think you're you're talking a little bit about influence. You said in the past that if legal is a bottleneck, right? So the department of no and oh, you know, there is sometimes a perception that that's the case. But you you use a term that is a systems thinking term called something upstream is broken. So pull the thread, go upstream. What does that mean? And then give us a very real example, if you can, of that in practice.

Rachel Harris16:36
Yeah, I think it it starts with acknowledging that legal. I also oversee security and privacy. So I'll talk a little bit about that in the same analogy, but we're never our own flows in-house. We are never our own work stream end to end by ourselves. We are always at some point, directly or tangently, in the workflow or stream of one of our other partners in the company, whether it be sales, whether it be procurement, we're we're fitting into that. And so a lot of times when you start to hear feedback of legal, I'm feeling you're a bottleneck here. The real question becomes have we not integrated ourselves into this workflow appropriately to where once it gets to us, it feels like a bottleneck. And I guess an easy example would be we'll do an easy fun one for the first one for my in-house friends that may be listening on customer sales, close one cycles, right? Hey, legal, why are we taking three turns or or why why are we taking so long uh to return leadlines on this? And then you you start to dig in and you start to see oh, my colleague, my my contracts counsel, is having to spend an exorbitant amount of time going back and forth with sales in the other side to say, hey, you're sending me your professional services agreement, but we're we're SaaS. The base, we're SAS. And so what you really start to figure out is the trickle-down effect from the moment the sellers start having conversations with prospects. We're missing a we're missing something there in that they weren't trained properly to understand our fundamental business model and the way to have the initial conversations with can you work from our paper? No, you can't. Let's work from your paper, send it over. Let me open it up and see if it actually says SaaS. If it says professional services agreement, here's how I go back and have that conversation. It also allowed us to identify, and I there's gonna be gasp when I say this. We quickly identified, oh, some of this could be cured if, you know, there was a CLM. But at the time, plot twist, if you work in a small company with limited and no budget, there's not only not a CLN, there's no appetite for it.

Rachel Harris18:40
So what do you do? And for us, it was starting to identify how do our sellers flow through the process. We use Salesforce end-to-end, beginning of identifying an opportunity all the way to closed. And we figured out we can't buy a CLM, but barn it, we can build one into Salesforce ourselves. And so we did sort of a hacky workaround, but by enabling us to do that, there's now a central source of truth for our sellers to always go to and reference and for us to leave notes if there's a particular nuance for that particular customer relationship. Hey, we know they prefer to work from their template, they don't, et cetera, et cetera. And it's it's slow, it is almost completely removed the notions of bottleneck or why are we taking three turns? We've got it down to two turns max. Love that.

Cecilia Ziniti19:26
So many good threads to pull there. Basically, what you're saying around in-house is part of the process. Like you literally, with a Salesforce example, so you diagnose the problem and then you went to where the clients are. Did you consider any alternatives? And when you're making that judgment, I mean, I happen to agree with it. I think in-house is a fundamentally different practice than anything else, and you have to be where the clients are. Do you see, like, are there worlds where legal is parallel? And is there any reason you might do that? Obviously, the CLM thing, CLM is a real business, but sounds like you solve the problem without it. I mean, give us a little bit more on that contrast. I agree with you so hard, I can barely ask the the steel man or whatever straw man argument, but but uh what is the what is the straw man or or what what is the other side of this of like oh keep being legal independent? I did have, I did have someone, a podcast guest, say he thought, okay, legal lawyers were not business people. He his spicy take was that we needed to lean into more being lawyers.

Rachel Harris20:29
Interesting.

Cecilia Ziniti20:30
Tell us tell us about that. Tell us about either that contrast or what would legal look like otherwise. Like it's what you're saying is so obvious. Like, what was the alternative?

Rachel Harris20:37
Right, right. And you know, I love that you say you're saying the same thing, meet meet your clients where they are. And I can't I can't even take credit for like identifying that myself. My predecessor beat that over my head. She was, oh, anytime I came to her and was like, hey, I want to improve this process, great, you got to meet the sellers where they are. They live in Salesforce, go meet them there. You know, don't pull them out and make them come over, let's say, into Jira to open a ticket. No, that's gonna delay things, meet them where they are. It's it's interesting. I can't think of a scenario in which I would operate and not an asilo. I know that's not what you're saying, but where I'm not operating and going out of my way to meet my cross-functional partners where they are versus the opposite. But I'm gonna put a big caveat on that, and that I work for a small high-growth startup, right? We have a hundred employees. I think it looks very, very different once you cross the threshold and you start having 500, 1000, et cetera, number of employees. And yes, I concur with your other guests. At that point, legal starts to operate more as an independent function within the broader community and less ingrained every single day where other folks are. I look forward to the day when I get a CLM budget. I can't wait. I'm gonna do a happy dance. It's gonna be the best day of my life.

Cecilia Ziniti21:56
That's amazing. That that's usually not a I guess budget and happiness. Usually are heard in the same sentence, but CLM and happiest day of my life, usually not. All right. So uh so we're you're a startup GC. What's the how have you obviously meeting them where they are is one strategy. How else have you been effective or worked to be effective at your job?

Rachel Harris22:19
I've been so excited from last night till today because I want to get into like a juicy topic with you and I want to see what you think. But I guess I should probably just say I feel I'm even having imposter syndrome right now because I don't you're way cooler of a guest to have on this very own podcast to pick your brain based on your experience. But, anyways, I was thinking yesterday a lot about what does the future of an in-house high growth GC look like?

Rachel Harris22:48
It's changing crazy fast as is. And there's so I I have so many um friends in the on LinkedIn and my algorithm. We're all doing really cool things and building here and there, whether it's leveraging Cloud Co, whatever the case may be, for tools and skills and artifacts to improve our day-to-day operations. And I almost had an aha moment last night as the future of a product council. And I'm I might like belabor this point. So make me shut up if I do. But traditionally, as product council, you're working with your product and engineering teams, and they're thinking of, hey, I want to go to market with this new product launch. Are there any legal nuances I should be aware of? They go consult the lawyer. The lawyer's like, yeah, GDPR, this or that, da-da-da-da-da. And then the product manager has to almost repackage that into product specs that they can get delivered to the engineers. You have to turn that into something they can actually build into the code. And last night I had a moment where I went, you know what? Let's bypass this as much as we can. And so I actually just built out an MD file, an MD file of, hey, I think let me think about how much specifics I can get into. There was a feature on our platform that used to be missing. And if we could bake it in, it would unlock potential new use cases on our platform. And that feature related to uh consents and the ability to capture consents outside of just like a digital checkbox, right? Like, what about the situations in which you might have to get an actual signature? We've sort of talked about the idea for years, but what this new technology allowed me to do last night was actually, you know, go back and forth, get the concept down, create an MD file of here is how it would conceptually look from the legal perspective, conceptually of like in these jurisdictions, consent might look a little different. You're gonna need to understand if it's under a certain age, is it in, you know, Europe versus the US, et cetera, what information is involved? The sort of detailed nuances that we like to geek out about, but might be kind of boring to the product manager. I wasn't able to take that MD file and go directly to our head of product and our head of engineer. And I was like, I don't know, this might be horse poop, or maybe it's helpful. I don't know. And they were able to immediately download the MD file, plop it into their agents, and say, start building me a prototype. And that's where we are this morning. And I just wow. Yeah. Robert, I don't, I don't know where your thoughts are on that, but it was almost a it goes back to we will always be our knowledge and expertise will always be needed. I think the delivery of it is just what might change.

Cecilia Ziniti25:35
Yeah, so this is exactly like you're spot on in terms of the future of legal. So product counsel, you know, it really is product managers with a legal skill set, particularly in regulated areas. You're in AI. I was um when I was on Alexa, you know, a shining moment we've talked about on the pod before was getting invited out to the product management offsite as one of the product managers. And that was fantastic. But what you're saying we're seeing across the business and is really the promise of AI, which is you can not only advise on the thing, but now you can do the thing. So it's similar to designers, right? So designers you used to do your mocks, and then you know, you'd send the mocks over the wall to engineering and they would do them. Now there's this sort of like, you know, standoff between product management, engineering, and um design, where it's like all of them think they can do the other's jobs or can do the other's jobs with AI. So what's left? And there's this concept of taste. But in this scenario, just to break it down for the audience a little bit, so what Rachel had was MD is a markdown file. It's basically a set of text, really, just natural language that you can give to the AI. And that's what she did. So she had basically what she ideally would want from a regulatory standpoint in the product, gives it over to engineering, and basically is able to create this sort of consent form in the product using her natural language instruction. So that is exactly where the future is going. So at GCAI now, AI has obviously started where it's like, okay, answer questions for me, be my assistant. But then as you add functionality, as AI gets more powerful, Claude is adding the ability to actually do things. We're adding that as well in GCAI, where it's like, okay, don't just tell me what to type in my email, send the dang email. And so, like what you're explaining is absolutely the future. This is also why, from an AI standpoint, you know, I push legal teams so hard, is like you are closer to these workflows that the business needs. You can actually get in there and do the thing in a way that, like, I've worked with outside counsel on disclaimers or things like that, where, you know, literally we had a client, so one of our customers is operates basically point of sale machines where it's like uh where you put your credit card and there was a disclaimer associated with CCPA with the California Consumer Privacy Act that essentially would have been way longer than the screen. And the outside council sends it over and it's this long disclaimer. And our our customer was working with the actual engineering to be like, no, no, it's like tap to consent, and it was like maybe five words that you could actually fit. And that idea being so practical and so embedded actually gets back to what you're saying. So I think my view is that AI is better placed in-house

Cecilia Ziniti28:22
than at law firms for this reason. Would you agree with that?

Rachel Harris28:26
I would agree with that. And the opportunities are endless because when you are in-house, there's so many different functions that you advise. So, like, think about the opportunities. That wasn't an example with product, but marketing. Marketing wants to go to market and they want to do it fast. Maybe they've already built out their own skills. I'm using clawed terminology, but it could be anything, a custom GPT, whatever. They've built out their own. But I'm gonna use a phrase that my CEO used when I sent this over it. But can you infuse the brain of Rachel into the thing that you've built? So rather than marketing having to come to me and be like, hey, review this new go-to-market collateral for marketing law review. Instead, boom, you've already got an MD file from me. Put it where you already are, right? You can do versioning control on these markdown files. Once you get an update, you just send them a fresh one. Now it's marked version two. They upload that one, it overrides the previous one, et cetera. But isn't that just so much more efficient? I love it. I don't want another Jira ticket and another queue I have to monitor. Like if I can just take a piece of my brain, hand it to you, and we we update it as things evolve, great. It makes all of our lives easier.

Cecilia Ziniti29:34
I love that. Wow. I mean, it's literally like it's it's so fun to hear you explain the future as literally I see it and our customers see it, where, you know, the the nexus of the legal need, like, like as you said at the top of the call, you're not trying to sell an hour of legal work. You're trying to, you're, you're, you're gearing towards an outcome, which is the growth of the company and the success, you know, at the right level of risk of the company. And so you're happy when that happens. I I love it. Any um fun AI stories? So the markdown one, I'm not sure we're gonna top that, but any other either AI wins or AI moments that you've had?

Rachel Harris30:11
That's a tough one. I think because I was on such a high from last night, the markdown file was probably my most favorite. I will say though, and this is not, this is not you at you did not, you're not asking me to say this, but for anyone listening to this, my my second win is a favorite moment was when I signed up for GCAI. And let me say why. Let me say why. Because when ChatGPT first hit, I will never forget I was speaking at a lot of different conferences, talking to lawyers about starting to use Chat GPT. And even at that time, there was rumblings of this new company called GCAI, etc. And people were still trying to feel it out. And I kept telling everyone, hey, y'all, right now there's a free version. It's a light version of GCAI, but it's a custom GPT in ChatGPT. If you just want to get a flavor for the thinking behind it, go experiment with it. And I even patiently, but like almost confidently waited, watching you guys, waiting to pull the lever on when I was gonna go because in the back of my mind, what I was waiting for was the integration award. And I was like, oh, I just know. I know they're gonna get they're gonna figure this out. And it was the day you all announced it. I immediately, I'm gonna say ran, but it was like a one of slack because I'm fully remote. I ran slacked my sleep CFO and I was like, do I have approval? Can I get this? And I was immediately in there. And my my favorite moment, and I will always remember it in my career, is the day I was able to leverage AI directly in Word to apply red lines and generate commentary to the opposing party in real time in Word. It seems so not sexy now in hindsight, but at the moment, I mean, that is crazy. It was crazy.

Cecilia Ziniti31:52
Love that. Oh gosh, you know, you are just making my day. This is so much fun. Um, so let's talk about the compliance

Cecilia Ziniti32:01
side. Um, so you're certified in ISO 40 2001, um, just the AI management system standard. You have some real advice and chops around AI compliance. So let's put on our product council hat. So, what is the SUSE platform? And then in terms of advising on AI, we have a lot of um listeners who do that. How do you do it?

Rachel Harris32:23
Yep. Um, so Suzy platform, I guess, if uh uh in a nutshell, we evolved from way back in the day. We were a platform essentially for influencers. What was that was day one of SUSE, way back in 2018? It later evolved into recognizing that there were a lot of Fortune 100 brands that need to be able to talk to their consumers to figure out feedback on, you know, new product design, new prototypes, what have you. And so they evolved from influencers to building that into essentially a consumer survey platform. And that was the B2C side of the business. And then they separately developed a B2B side of the business, which was enabling a platform to where those brands could come in and launch the surveys directly to the consumers. It's evolved again since then to where it's it's a lot more of a data orchestration and data intelligence layer, but that's fundamentally where the roots were. So two things. One, I always consider myself lucky that my first gig was at Suzy because I got exposure to not just B2B, but also B2C. And the former tying it back to the plaintiff's discussion, I always had a part of my heart that will forever love B2C because there's just a part of me that will always want to kind of protect the consumer, you know? So I loved that component of it. And so when ChatGPT hit, what was really, really important to us was rolling out AI on our platform in a way that didn't surprise either our B2C members and our B2B customers. Because at the time in tech we were and are a lot more AI tolerant than what big corporations might be. Because we're small, because we're nimble, we have a much different risk profile, we can move faster than other companies, but we had to be cognizant of that. You know, our massive customers might not be ready for that. So, how do we go through and have those conversations? And a lot of it is just almost thinking about what would you want if you were a user of the platform? Do you do you want to at least know generally when you're clicking on something that it might involve an AI? Okay, cool. Product team, design team. Let's put a little visual that a normal person can recognize as associated with AI. Let's add a little language at the bottom of, hey, this is AI generated. Make sure you review it, right? It doesn't have to be legal ease, but just think about what you as a user would want. And I think that's always the best place to start. And then the second place to start is get in the room with your engineers and start having the very, very technical conversations. When we say AI, what do we mean? Are we developing the massive LLM? Chances are no. So if no, how are we stacking on top of it? Are we wrapping around it? Are we improving it by virtue of fancy word retrieval augmented generation to add context? Are we just doing prompt engineering? If all these words sound like foreign language, pull up ChatGPT and ask ChatGPT what it means. ChatGPT is really good at explaining those things. And I think all of that is more important than the actual sitting down and checking the box that you've met ISO 42,001 Section A145. They need the base before anything else. Otherwise, it's all just theater.

Cecilia Ziniti35:39
I love that you said that about theater. So you said that sometimes there's a risk of compliance theater, things that look like compliance, but don't move the needle or don't build the trust. You know, it's tough. I think there is, you know, particularly in privacy, you know, a whole industry sprang up. There is some, there was an economic analysis of GDPR that found that the biggest winner was compliance companies, something to that effect. What is that concept and how do you avoid it?

Rachel Harris36:08
I think it plays out the most, at least what I've seen, it plays out the most in security and privacy, wherever those functions might sit. Sometimes they sit in the legal, larger departments, sometimes they might not. And these are all incredibly intelligent and well-intentioned individuals who are doing their best to navigate the ever-growing, not sludge, but the ever-growing volume of things that regulators are saying should happen. And we generally all agree and are aligned that those are really great intentions and things that, yes, are great for protecting privacy, for security, all of the things. But translating that into how does it actually look and feel every single day across industry verticals, across company sizes, across jurisdictions, that's that's what makes our jobs fun. But that's that's the rub, right? Translating it into

Rachel Harris37:01
the day-to-day. And so I guess one example I could give. I also sit on the procurement side of Susie. So I I'm on the legal review and the DPA review on all the procurement tickets that are going through potential vendors we want to vet. And part of that is our security team tends to send out security review questionnaires. Anyone who's in-house has probably been on the receiving end of those. When you sit in procurement, you're also on the sending side of it. And we started to realize wow, it's taking a it's it seems like it's taking a while for vendors to get these back to us. And so it was an exercise where we put ourselves in a room and we forced ourselves to go one by one back through every single question we asked in the questionnaire and really a microscope to do we actually need this? What is the purpose of this one individual question? What is it asking for? Can we ask it in another way? Or even better, can we make it a dynamic questionnaire? To where if you answer one thing this way, the rest falls away. If you don't do those exercises, you will end up in compliance theater, to where you are just putting words in a questionnaire for the sake of having the words in the questionnaire. But I think what is most important and what the regulators really intend is what is it capturing and why? And can you can you ask it in another way to where it's clearer for the end user, so that it's easier for the end recipient to answer, and so that both sides of the table have a better understanding of what's actually happening with the data involved.

Cecilia Ziniti38:30
Yeah, it's it's interesting you say that. I had a privacy governance, risk and compliance manager at one of my jobs who had come from Accenture, one of the big consulting firms doing that. And it was interesting because at the time, the job I was in, we were debating whether to get SOC II certification or something to that effect. And I said, you know, that I didn't quite get it. Like, why do we have to get the certification? And he made a point similar to what you said, which is actually that if the stand that standards actually serve a commercial function, which is if the question is, you know, we're all gonna wonder how secure you are, and we're gonna send a thousand different questions, then, you know, let's just have a standard where if you meet it, someone in the case of SOC 2, uh, the auditor, someone has determined that you have met these particular standards, that should be enough. But I actually think it maybe has over-rotated where now SOC 2, we have SOC 2, but yet we still get all those questionnaires. So are you saying you streamlined the actual ones that you sent then down from a thousand, or you push back when you have your customers asking you for them, or both? What's the what's the practical takeaway?

Rachel Harris39:44
Yep, both. And I am so glad you said that. I 100% agree. I almost feel like, and it's maybe it's not contrarian view, but it I almost feel like at this point some of it has become diluted, I guess is what I would say. The pendulum has swung the opposite direction. Um and I do agree that there can be a commercial purpose served by the likes of SOC and the ISOs, right? You got security, privacy, AI governance, the different ISOs, but I think it also can become theater if you don't actually map that commercial impact. Meaning I know when I first joined Susie, there was there was some rumblings amongst others of like, oh, we should get this certain, this certain, this certain. And I would always go, why? Has a customer contractually required that? Or informally there's just a lot of interest in us having that? Because if not, we're just jumping through the hoops for the sake of jumping through the hoops. And so you have to be very strategic in where you're investing those dollars because those audits are not cheap. Each one is expensive to procure because you you have to engage the independent third-party auditor, but it's also a headquarter, a headcount strain for your team that has to sit in the, you know, SOC can go on for 45 days. You have ISOs that if they overlap, you could be sitting in audits for six months. And so you you really have to do that one-to-one on or live. But then also to your point, we keep a we keep a very detailed record on even with four different audits, how many 500 plus question questionnaires are we still receiving? And I think it would surprise most people how many we still receive. And it tends to be from the same verticals you would expect, the highly regulated financial verticals, financial services, healthcare, insurance. Um and and I always try to place myself in their shoes and go, okay, there's a person on the other side who's a well-intentioned, meaning GRC person who is doing their best to do their job today. And for better or for worse, they might be sitting in a massive company that either has to or has become accustomed to checking the box. And so they have 500 questions in their questionnaire because they need to check the box to say that they've done that. Okay, respect. Now on our side, we need to be agile enough to figure out how we can get through those questionnaires faster. And that's when you start looking at either building out your own custom GPT based off of a knowledge base or procuring a tool like a Vanta. I'm trying to think of the other one, Vanta, Drata, yeah, Drata, thank you. Um, Listic's another one, and leveraging those knowledge bases to help your teams get through them faster. Because when you start talking security questionnaires, that's not security in the silo. That has direct impact on your sellers, your CSMs, you're trying to get through renewals, the overall closed one cycle. You're all in those trenches together.

Cecilia Ziniti42:26
I love that. Let's see. Um,

Cecilia Ziniti42:29
you were told you should have been a product manager in another life. I hear it. I hear the commercial forward, but with the legal skill set. I hear the thinking about the future of the industry. What um have you thought about making leap officially? My CFO tells me this almost daily.

Rachel Harris42:45
You know what's funny? I can see it. I could totally see it. But I also think the modern age GC is that. It's one of the hats we wear. We are a product manager, whether we know it or not. Um, we're we're product manager, project manager, all of the things. And as we talked about with the markdown files, we're also starting to tread into the territory of being able to directly hand to our engineers things that they can add into the GitHub repository, right? Depending on what accesses you have, how comfortable you are. But people are gonna get to that point where the handoff is more one-to-one and direct. And so I wouldn't have it any other way. There's parts of the legal profession that, oh yeah, I mean, if I never do that again in another day, I'd be fine. But there's other parts that I wouldn't give up for anything. And one of the parts, you probably feel this too, is just the legal profession, while we can be confrontational and it can be contentious at times, especially those of us who've come from litigation. At the end of the end of the end of the day, our colleagues in the profession will go out of their way to help you. If you have a question for a career path or Tech GC is a great example, you have a question and you're like, I don't know how to navigate this, I'm a solo GC or whatever. Can you help me? You'll get 15 to 30 people responding to your post, giving you helpful tips and feedback or resources to leverage. So So I wouldn't change that for the world. I wouldn't change navigating the fun legal complex complexities for the world. And I sure as heck wouldn't change getting to be a GC right now in the age of AI and how fun and crazy things are.

Cecilia Ziniti44:13
Yeah. Yeah. See, it's rare to have someone as excited about being a GC and AI and the future. It's just, it's so lovely to hear that. So let's move to the lightning round.

Cecilia Ziniti44:24
We've had an amazing, amazing time together. What is a book or concept that has shaped how you think?

Rachel Harris44:30
Not legal. I read the book Simple Path to Wealth, and that's shaped sort of how I view my own personal finances.

Cecilia Ziniti44:36
I love that. And what is two-line advice that you would give your younger self? Two-line advice I'd give my younger self.

Rachel Harris44:44
It's tough. Uh be kind and make friends. Be kind of fun. Come back to that one.

Cecilia Ziniti44:50
Always universal. I love that. Awesome. Thank you so much for joining us. Anything else you'd like to leave listeners with?

Rachel Harris44:58
No, I guess I would leave it with experiment, have fun. I was always jealous of lawyers that got to navigate, you know, the advent of the internet and all the fun that came with that. And if you're a new lawyer starting out, or if you've been practicing for 30 plus years, we have this awesome opportunity to navigate essentially kind of the same. And we just we get to navigate the murky, messy, but also fun and exciting world of AI.

Cecilia Ziniti45:27
I love that. Wow. Thank you so much for being here, Rachel. Thank

Cecilia Ziniti45:31
you. That was my conversation with Rachel Harris, the general counsel and AI governance and privacy officer at Suzy. If today's conversation got you thinking about how to be a great lawyer for business and tech teams, that's exactly what we're building at GC AI. Learn more at gc.ai. Follow CZ and Friends wherever you get your podcasts. Thanks for listening, and we'll see you next time. Have a great day.