Workiva's CIO: How to Check Your AI Compliance Won't Fall Apart Next Year

Kim Huffman, Chief Information Officer at Workiva — a company that itself builds enterprise reporting and compliance software — explained how to build an approach to AI that won't collapse after the next round of regulation or a switch in model vendors. Over more than two decades in technology leadership, she's watched the CIO role shift from "order taker" to full strategic business partner, and AI adoption has become one of the biggest drivers of that change.

The first and, in her telling, foundational piece of Workiva's AI program is employee literacy and awareness: making sure everyone in the company understands how AI works, what its risks are, what happens to data sent into a model, why sensitive information needs to stay in-house, and how to use AI responsibly in the first place. Without that baseline understanding, any more elaborate compliance policy simply doesn't hold up in practice.

“You can sniff out pretty quick if they've thought about AI being embedded in the process versus a bolt-on, and where their capabilities are as far as data security, certifications, things like that.”

— Kim Huffman, CIO, Workiva — on evaluating vendors' approach to AI

That's why vendor evaluation is its own strict step: Huffman directly asks partners how they approached AI development, rather than taking their marketing claims at face value. Ignoring that kind of check has a real, expensive price tag: one bank's AI agent quietly leaked internal pricing to customers for three weeks because of a single cleverly worded question — exactly the kind of scenario that compliance built on understanding risk, rather than after-the-fact checks, is meant to prevent. More on Huffman's approach is available via AI Magazine.

Nothing here should be taken as financial advice — just information to consider.