Neha: Hello dear listeners! A warm welcome to a new episode of our mini-series about Rahul's key achievements as Senior IT Counsel since 2010. Today we're focusing on international AI governance – a field requiring deep cross-border expertise. Rahul, you collaborated with teams in Germany, India, and the USA to shape global AI governance. What makes this cross-border collaboration so complex?

Rahul: The core lies in the extremely divergent legal frameworks, Neha. Compare just the EU with its strict AI approach, India's data protection laws still emerging until 2023, and the fragmented US regulatory environment. A prime example: WhatsApp's challenges in 2021 – the EU enforced privacy policy changes while Indian regulators questioned the same policy. Genuine collaboration can cushion such divergences.

Neha: Fascinating! You mentioned sharing knowledge through company-wide GDPR implementation. How does this create a unified foundation?

Rahul: By establishing GDPR as a global benchmark – even for India and the US. Another key issue: Data transfers post-"Schrems II". We formed task forces to manage EU-India/US transfers via Standard Contractual Clauses. That's lived legal collaboration.

Neha: This extends beyond pure legal aspects, right? You mentioned cultural differences, like employee involvement.

Rahul: Exactly! German works councils must be consulted for AI monitoring – not required in India. I ensured German requirements like employee notifications were respected worldwide. Similar to how Microsoft extended GDPR rights globally.

Neha: Let's explore your practical example. At your former company with customers and stakeholders in Germany and the USA – how did you structure AI governance?

Rahul: The Bi-national "AI Governance Council" with legal and technical experts from both regions was crucial. Together we developed a unified policy aligned with the strictest standard – GDPR plus the upcoming EU AI Act as baseline.

Neha: What advantage did this offer regions with more lenient laws like India at that time?

Rahul: Even the Indian office followed high privacy and transparency standards – though not locally required. This prevented fragmentation and prepared us for new laws like India's DPDP Act 2023.

Neha: How did knowledge exchange work concretely in the council?

Rahul: The German team shared DPIA methods for AI, and the US team shared NIST risk management practices. This ensured AI models were built to GDPR principles from inception – no retrofitting needed.

Neha: Practical benefit during problems? Say, a bias incident in Germany.

Rahul: Precisely! If bias was detected in Germany through an AI audit, the global team used these findings for preventive correction in all regions. This avoided potential US lawsuits or Indian regulatory proceedings – global synergy instead of silos.

Neha: Which legal foundations support this approach?

Rahul: No direct "collaboration law," but: GDPR became a de facto global standard. OECD AI Principles and GPAI promote international ethics consistency. We leveraged these "soft laws" to create internal policies meeting Germany's strictness while influencing India/US early.

Neha: How do you respond to different supervisory bodies – EU Data Protection Board, India's new Data Protection Authority,or US’s FTC?

Rahul: A unified global policy is key here! It demonstrates we apply high standards worldwide. Also regarding employee rights: We reduced disparities between German co-determination and US regulations – minimizing conflict risks.

Neha: So fundamentally: Leadership through proactive harmonization?

Rahul: Yes! We smoothed regulatory differences and were prepared when laws caught up in more lenient jurisdictions. This forward-looking risk management builds trust with regulators – potentially even milder sanctions if issues arise.

***

Read German text here:

https://docs.google.com/document/d/1oEspwKpwMcjlN5BkId5-KTNIs7pywqDbp8g1lYnU2fg/edit?usp=sharing

***