InformationWeek Podcast: CTOs on How They Use AI in Regulated Spaces

Why It Matters

Regulated companies must embed robust AI governance to protect data and meet compliance, or risk costly breaches and lost customer trust while falling behind competitors adopting AI responsibly.

Key Takeaways

• Shift toward building AI in‑house to meet compliance and security.
• Both firms enforce strict human review before AI‑generated code reaches production.
• Enhanced third‑party risk programs now assess AI maturity and data handling.
• Regulatory focus on CIA triad: confidentiality, integrity, and availability of AI outputs.
• Future AI strategy blends dedicated teams with integrated production‑cycle governance.

Summary

The InformationWeek podcast explores how CTOs and CISOs navigate AI adoption in highly regulated sectors such as payroll and personal finance. Guests Mike Tria, CTO of Gusto, and Joshua Folultz, CISO of NerdWallet, discuss the tension between AI’s speed and the strict compliance guardrails that govern their industries.

Both leaders describe a decisive shift from buying third‑party AI tools toward building internal solutions that can be tightly controlled. Gusto now runs a dedicated team to re‑evaluate vendors, insisting on human sign‑off before any AI‑generated code reaches production. NerdWallet has bolstered its third‑party risk management framework, adding checks for AI maturity, data segregation, and learning restrictions. Across the board, the classic CIA triad—confidentiality, integrity, availability—guides every AI risk assessment, with Sarbanes‑Oxley requirements demanding non‑human identities be logged and accountable.

Concrete examples illustrate the new rigor: Gusto refuses to let AI push code directly to live environments, while NerdWallet treats any AI that accesses customer data as the highest‑risk tier, applying HIPAA‑level controls. Both firms stress role‑based access, audit trails, and the need for agents rather than humans to interact with AI services, a concept that could reshape vendor offerings.

The discussion signals that regulated enterprises will increasingly embed AI governance into their core development pipelines, balancing innovation with compliance. Vendors that fail to provide transparent, auditable AI models risk being sidelined, while firms that invest in internal AI capabilities gain both security assurance and competitive advantage.

Original Description

In this episode, Mike Tria, CTO of Gusto, and Joshua Foltz, CISO of NerdWallet, discussed how they navigate the use of AI as their companies operate under regulatory oversight.

They talked about how they tailor their AI use to comply with guardrails in their sectors, their vetting process before putting third-party AI to work, and whether they develop in-house AI resources designed to meet compliance.