EP 57: Responsible AI Starts Here: A Practical Framework for Governance

Josh Green: Welcome to Sustainable Intelligence, where we discuss all things sustainability in the private markets. I’m Josh Green, co-CEO and co-founder of Novata, and today we’re joined by Adrienne Wong from Novata’s Metrics and Regulations team. As organizations continue to accelerate their adoption of AI, questions around responsible use, governance, and oversight are becoming increasingly important. Today, we’ll explore the Responsible AI Essentials Framework, what it is, who it’s designed for, why AI governance is gaining momentum, and how organizations can think about building responsible AI practices into their operations. Adrienne, welcome to Sustainable Intelligence.

Adrienne Wong: Thanks, Josh.

Josh: So we’ve seen growing interest in AI governance over the past year. I think the Novata 2026 metrics guide showed a startling increase in the percentage of firms that were asking questions about AI. What’s driving the increased focus on responsible AI as a governance question right now?

Adrienne: Well, AI is all around us, and it’s all anybody seems to want to talk about. The OECD released a report that in 2025, investments in AI made up sixty-one percent of all global venture capital funding. Gartner just released a report that GenAI model spending for end-users is going be up by 117 percent in 2026.

And despite all of this activity, there’s still no federal legislation, comprehensive legislation in the United States. Now, we’ve seen it at a state level California, New York, Illinois all come to mind but at the federal level, that’s lacking. And so we think that people are just trying to play catch-up in light of there being a lack of external regulation kind of leadership.

And now things are certainly different abroad. The EU has its EU AI Act, which is quite comprehensive, and it categorizes AI systems by risk level. And then South Korea has its Basic AI Act. But yeah, that’s what’s happening in the United States

Josh: All right, let’s start with the basics. Walk us through what is the Responsible AI Essentials Framework, and what was it designed to help organizations accomplish? Who is it intended for? Give us the basics.

Adrienne: The Responsible AI Essentials Framework is a group of 20 metrics that were developed by the Metrics and Regulations team at Novata. The purpose of it is to give organizations a starting point into looking at their investments and, within their company to how responsible AI is being governed and managed.

Josh: And walk us through a little bit about how this was developed. How did you and the team create the framework?

Adrienne: Yeah. So we looked at several leading frameworks and resources on responsible AI. The National Institute for Standards and Technology’s AI Risk Management Framework and Playbook, of course, is a primary one. The OECD AI Principles, ILPA’s Responsible AI Quick Guide for Asset Owners, the World Economic Forum’s Global Risk Report, GDPR’s Article twenty-eight.

There’s more, but we also talked to our internal Novata experts. Experts from our legal team, information security, as well as executive leadership to ask them from their knowledge what they believed companies and investors should be looking at in managing AI risks.

Josh: And why was it important from your perspective to develop this framework and offer it to our customers? And how do you think it fits into that broader landscape of frameworks that you just described?

Adrienne: Yeah. As you mentioned, we saw this huge uptick in interest in our AI-related metrics from last year to this year. AI is arguably the most consequential technology of our time, and so we just wanted to make sure that we could meet this moment and make sure that our customers and clients felt really confident in where to start, and that would be grounded in leading expertise as well.

Josh: Let me push you on this a little bit. So in that there are so many frameworks out there, what made it necessary to have this framework in particular, and what makes it unique or particularly valuable?

Adrienne: There are other responsible AI governance frameworks out there. We looked across those and thought that a lot of them are pretty technical. They’re maybe a little less approachable for the everyday person or you know, also maybe not so industry agnostic.

So that’s the real purpose of this RAI, Responsible AI Essentials framework is to make it industry agnostic. It doesn’t matter what industry you’re in. You don’t need to be an AI specialist. You don’t have to be an information security expert. We wrote the questions to be very approachable.

And I can give you some examples if that would help.

Josh: Yeah, sounds like this is gonna be useful for mere mortals. So very helpful to understand the why and would love some examples in terms of types of questions that are in there so we can get a feel for it.

Adrienne: So some examples. Like has your organization designated responsibility for AI policy and governance, and to whom? For the AI systems your organization uses, do you know if your data is being used to train the provider’s models? And does your organization use AI in any customer-facing products?

So those are three examples

Josh: Got it. And you have to care about how AI is being used inside your organization, but you don’t have to be a subject matter expert to incorporate this into the governance of either your own company or companies that you’re investing in. So, makes a ton of sense.

Adrienne: Mmhmm Yeah, we also added a bunch of guidance based on all this expertise and these resources to make sure that users would feel very confident in being able to answer them.

Josh: So Adrienne, the framework works for people, businesses, investors that have made the determination that they care about AI being deployed responsibly. But if you’re new to this subject, why should you care about how AI is deployed? Why should this be something that’s top of mind for a business leader?

Adrienne: There’s a really good case to be made that national legislation in the United States is coming. State laws are piling up. As I mentioned, New York, Illinois, California, Rhode Island. But then at the same time just in June, a bipartisan duo from Congress just released a draft proposal of the Great American AI Act. And again, this is very, very early days, but we’re seeing a lot of echoes of what’s in the state-level regulations that are out there. But though at the same time, there’s quite a bit of controversy because there’s also a preemption. So that means that states their laws would kind of be overridden,

Josh: I see.

Adrienne: And then they wouldn’t be able to write any new laws for the development of AI. Compliance risk is out there, and it’s coming, and it’s probably gonna grow. But then on top of that, there’s also just the everyday risks that most companies might face in their use of AI.

Those can be seen in what the EU AI Act says or other regulations, but misinformation, intellectual property violations, discrimination, mental health impacts, and privacy concerns.

Josh: So regulatory and substantive concerns. It’s interesting as you’re talking about the regulatory piece, I do find myself thinking you could make the argument that you should just wait and see how things play out from a regulatory perspective. But on the flip side, I feel like we’ve seen this in the world of sustainability, where if you’re waiting for regulation to be finalized you’re gonna be waiting and you’re gonna find yourself flip-flopping on a regular basis, that it’s probably best to find your true north as an organization and steer in that direction, and then you’ll be well-positioned wherever the regulatory winds blow. Does that feel consistent with how you think about the choice to either move on something like this now versus wait?

Adrienne: Yeah, I mean, AI is on everybody’s minds, and so I think it can also be a differentiator with stakeholders and with customers to show that you’re on top of it. So it’s not just compliance, but it’s also building trust.

Josh: So looking a little bit into the future as AI adoption continues to accelerate, what are the governance practices you think every organization should have in place? I can intuit from the questions you asked that having somebody who’s responsible for it feels like a no-brainer. But any other kind of key practices that you think every organization should have in place regardless of industry or maturity?

Adrienne: At the very basic levels of maturity, a responsible AI policy is always useful. It’s helpful to get in the room with everybody and get consensus and build shared terms and definitions, state some goals, maybe build in some guardrails.

That was one of the most popular metrics that we had related to AI in the past year. Also, doing an assessment of how is AI being used at our organization: Who’s tracking it? Is there a review and approval process, and who owns that?

That can be really helpful and can feed back into the policy. And then third, knowing what regulations are actually in scope for you. We’ve seen kind of these sta-state level regulations building up and building on, that can be important, and those are just the starting points.

Josh: Let’s keep the crystal ball out. Looking ahead, what trends do you expect to shape AI governance over the next few years, and what should organizations be thinking about today as opposed to putting off to the future?

Adrienne: It’s a big question because AI is so many different things. The way it’s being used and the impacts that it’s having really are changing from minute to minute. So it’s important that AI governance should be dynamic. Things are going to change.

I mean, even with our own Responsible AI Essentials Framework, even though we feel like we have a really good foundation, we’re gonna have to revisit those regularly just to make sure that we’re up to date. Just a few weeks ago, we decided to add another metric that had to do with independent safety audits because that’s what we saw in Illinois’ SB 315 regulation that that was a key feature.

And so we think that that’s probably going to be further coming.

Josh: Yep. Makes sense. That’s the direction that like most things that matter go in, is ultimately needing to be audited in some way. Makes sense.

Adrienne: Yeah, we’ve seen it before.

Josh: Yeah. Couple questions stepping away from AI in particular. Curious if you have any advice for people in our space. As I’ve noted on the podcast before, we’ve gone through this cycle of people being really enthusiastic about sustainability to feeling like there are these ferocious headwinds over the last year and a half. Advice do you have to people a- as they attempt to navigate this moment that feels so volatile in the world of sustainability?

Adrienne: My advice would be to find the opportunity wherever you find yourself. This is a tough time for the sustainability industry, but we know that these problems aren’t going anywhere. It doesn’t have to be a wildfire to the industry. It can be a controlled burn where we come back stronger.

So, if you have an opportunity to build up a skill that you’ve never needed before, it could serve you later. This is the time to build bridges with allies that maybe you didn’t need before or define your impact in a way that you didn’t need to previously.

My path certainly wasn’t linear. I think few of us have that experience. But even in the unplanned periods, there’s still ways that you can build skills and experiences, and you don’t know how they’re going to serve you later. And then secondly, I’d say build up and foster your network before you need it.

Josh: Good advice and well said. Anything you’re reading or have been reading that you would recommend to folks?

Adrienne: So I did read the Pope’s encyclical Magnifica Humanitas on AI.

Josh: That’s awesome. And was this part of the research for the AI framework?

Adrienne: No, I mean, it was kind of part of work, but then I had to really do it in my own time as well because it is 42,000 words. It’s a novella of a document and it’s also a 400-year-old papal tradition.

Josh: That’s really cool. Anything that jumped out at you as you read it?

Adrienne: Oh my gosh. Yes.

Josh: That you expect to see in a encyclical?

Adrienne: Yeah, so many things. It’s really hard to boil it down, but it was very powerful to have this very traditional mainstream leader say, like, “Look, at this pivotal moment in human technology, we should be taking humanity, all of its beauty and significance, and putting it really at the center of this new world that we’re building with AI.”

And humanity should be served by technology and not the other way around. But he also had some really good concrete policy things that we’ve seen in regulations. For example, when AI is used in decisions related to employment or access to services or credit, those decisions should be understandable, transparent, subject to oversight, could be appealed.

He advocates for protection of children because we’ve seen how negative those impacts can be through social media on youth. There’s a lot there, really. It’s surprising how enjoyable a read it is. And yeah, fun fact, he also quotes Gandalf.

Josh: There you go. Well, Adrienne, thank you for reading the encyclical on our behalf. Thank you for the time today. Certainly recommend that people check out the Responsible AI Essentials Framework that you and the team developed. So that’s all for this episode. Until next time, let’s keep building sustainable intelligence together. As always, you can find out more about Novata at Novata.com.