Ashley Taylor, Gurkan Ay, and Andrew Coles unpack why it is critical for risk, compliance, and legal exposure to distinguish among the three primary "flavors" of AI: predictive, generative, and agentic.
In this episode of Regulatory Oversight, co-host Ashley Taylor, co-leader of Troutman Pepper Locke's State Attorneys General team, kicks off a multipart series on artificial intelligence (AI) with guests Gurkan Ay and Andrew Coles of Resolution Economics. They unpack what people really mean by "AI" today and why it is critical for risk, compliance, and legal exposure to distinguish among the three primary "flavors" of AI: predictive, generative, and agentic. In practical terms, they explain how predictive tools that score, rank, and classify individuals rely on historical data, how generative AI enables natural-language interaction but introduces risks like hallucinations, and how emerging agentic AI can autonomously plan and execute complex, multistep workflows, creating new governance challenges.
The conversation then turns to how existing legal frameworks are being applied to these technologies, and how regulators are beginning to grapple with different AI use cases without a one-size-fits-all rule set. The guests discuss whether AI truly creates new categories of legal risk or primarily amplifies existing ones through scale, speed, and accessibility, and they highlight the growing role of "regulation by litigation" as courts and enforcers apply long-standing laws to new tools. They close with practical themes: organizations must understand their specific AI use cases, align them with existing legal and consumer expectations, and build defensible, consistent governance and compliance programs to manage legal and operational risk.
Regulatory Oversight Podcast — AI State Regulatory Frontiers: Predictive, Generative, and Agentic Risk
Host: Ashley Taylor
Guest: Gurkan Ay and Andrew Coles
Aired: 4/15/26
Ashley Taylor:
Welcome to another episode of Regulatory Oversight, a podcast dedicated to delivering expert analysis on the latest developments shaping the regulatory landscape. I'm one of your hosts, Ashley Taylor, the co-leader of our firm's nationally recognized State Attorneys General practice and a member of our Regulatory Investigations, Strategy, and Enforcement, or RISE, practice group. This podcast highlights insights from members of our practice group as well as commentary from our guests, from industry leaders, regulatory specialists, and current and former government officials. Our team is committed to bringing you valuable perspectives, in-depth analysis, and practical advice from some of the foremost authorities in the field today. Before we begin, I want to encourage all of our listeners to visit and subscribe to our blog at RegulatoryOversight.com to stay current on the latest in regulatory news. Today, we're kicking off a multi-part series on one of the most pressing issues facing companies and regulators alike, artificial intelligence. Over the next several months, we will examine how states in the country are emerging as the primary regulators of AI, focusing on the growing role of state attorneys general, the surge of state-level AI and pricing algorithm legislation, and the diverse and sometimes conflicting approaches states are taking.
Today, I'm joined by Gurkan Ay and Andrew Coles from Resolution Economics to discuss what people really mean when they say AI, why it's important to distinguish between different types of AI tools, and how those differences can help shape risk, compliance, and legal exposure. We'll also talk about what is new at this moment, how existing legal frameworks are being applied to AI, and what organizations should be doing now to use these tools responsibly, reduce legal and operational risk, and build defensible governance programs. Gurkan is a director at Resolution Economics based in Washington, DC. He's also an economist who designs and manages advanced data analytics, statistical modeling, and regulatory compliance assessments in high-stakes legal disputes, including employment discrimination, wage and hour class actions, pay equity, housing bias, AI bias audits, and financial fraud investigations across industries such as healthcare, fintech, and telecommunications. He also leads clients through AI governance and compliance initiatives, helping them understand and manage the risk of automated decision tools.
Ashley Taylor:
Andrew is a partner at Resolution Economics and a CPA and Certified Fraud Examiner. He has more than 15 years of experience providing forensic accounting, investigations, and risk and regulatory consulting services to boards, audit committees, counsel, and senior management, usually involving matters in the white-collar crime area, anti-bribery, and anti-corruption, often including complex disputes such as global compliance or including global compliance programs. Andrew brings a deep analysis background to his work, developing data-driven, defensible solutions and serving as an expert in cases involving financial fraud, damages, and the effectiveness of internal controls and compliance frameworks. Gurkan and Andrew, thank you both for joining me today to talk about AI, its risk, and how organizations can navigate this rapidly evolving landscape. Let's begin. Gurkan, when people say AI today, what are we actually talking about, and why is it important, if it is, to distinguish between predictive, generative, and agentic AI?
Gurkan Ay:
Ashley, thank you. First, it's a pleasure to be part of this podcast and to join you and Andrew for this discussion. The AI term is very generic these days, and it's an umbrella term. Usually, when we talk about AI these days, most people mean that it's generative AI, the ChatGPT or Gemini. But from the analysis perspective, or from my perspective, when I talk about AI, I like to distinguish between different types of AI technologies, especially as you mentioned, predictive AI, generative AI, and agentic AI. They are different animals. Predictive AI basically refers to machine learning algorithms and statistical and other analytical tools that we used to have in the olden days. Now, those tools are on steroids, doing many things all at the same time, using massive amounts of data. The key feature of predictive AI tools is they rely on the past data, identify patterns, and make predictions in the form of a score or a ranking or a classification. For example, you can imagine a tool used to identify fraud in loan applications, or you can imagine a resume matching tool that sifts through thousands or millions of resumes and identifies the most qualified individuals that would fit best for the organization and creates scores for them.
These tools rely on the past data sets, understand the patterns, and try to predict the most qualified person or a loan that fits a certain criteria to be flagged as fraud. So when I think about the predictive AI tools, the key risk areas that come to mind usually are biases in the training data that these tools use, those historical data, or imbalances in the input data that feed into these tools. How success is defined, for example, in the resume matching score. How do you define a person, or what kind of skills would define a person that will be productive when they're hired? Or how do you define a fraud in that example? Predictive AI was a very popular term before 2023, until ChatGPT came.
ChatGPT came in 2023 and basically changed the entire discussion, the entire AI narrative. ChatGPT is a foundational model. It's a large language model. It generates basically output in the form that you would like to have. For example, you can ask ChatGPT to write a poem, and then it's going to put whatever analysis that you have done in the form of a poem. Generative AI basically allowed us to communicate with data or with the documents in plain language and create the output in the format that we would like to have. Another example for the generative AI tools is chatbots. For example, HR chatbots are very common these days. They can answer questions on benefits, attendance policies, remote work policies, or they can let job candidates know about their application status. So these tools allow us to communicate with the existing systems using just plain English. There are common risks associated with the generative AIs. One of the most common ones is the hallucination. Everybody's familiar with the term, I'm guessing, but these problems or the key risk areas are evolving as the technology behind the generative AI and other AI tools are changing. Now, this year's buzz term is the agentic AI.
Until agentic AI, the AI tools mostly automated a single task, like a skill assessment test or a sentiment analysis of a conversation with your bank's customer representative. Agentic AI has fundamentally shifted what we were able to do. It basically shifted the focus from assisting people to autonomously acting on behalf of people. Agentic AI automates a series of tasks and workflows. And these agentic AI systems can pursue a goal, map out the necessary steps, and carry them out by themselves. These systems operate like a network of mini agents or mini tools orchestrated all together. If I were to give an example on the agentic AI, you can imagine an AI system basically automating your talent management. An AI tool scans your talent pool, accesses your organization's applicant tracking system to identify the potential candidates who would be interested in and qualified for a position. Another tool reaches out to these potential candidates and invites them to apply for a position. Yet another tool schedules the interviews. And finally, an interview tool comes in and conducts the interviews and ranks the individuals and provides a feedback to the human recruiter to make a decision whether to hire or not hire a specific individual. There is an agentic AI system. You can imagine an agentic AI system that combines all these steps in a workflow, recruitment workflow, and packages them as a single AI system.
Andrew Coles:
Just to jump in here quickly, because I think what you're saying is really important to understand that there are, when we say AI and someone talks about AI, that there's many different flavors and shapes and sizes of AI, and that AI isn't new. It's been here forever. It's just how we're using it has changed rapidly. And I think you had said something that resonates with me, and Ashley, I'd love to get your thoughts on it too, is that it's now on steroids, right? Everyone has this capability at their fingertips. And while that can be great, right, there's lots of amazing use cases, unfortunately, what we're seeing now is that it can fall into the wrong hands, or it can be used for things that maybe it shouldn't be used for, or the intended consequences of using it aren't what we thought they would be, right? Whether things like you alluded to, Gurkan, is bias in the results or hallucinations when you search for something, it's making up the results to give you the best response.
And I think we've all become very accustomed, and maybe I'm speaking for myself, but we've all become very accustomed to, instead of the old Google searches that we've done of tell me about X, Y, and Z or help me plan a vacation to Greece, I now go to those ChatGPTs of the world, and it's right at my fingertips. So it makes everything seem a lot easier. And the reason I bring this up is because the distinctions in what you're talking about matter in the sense that there are different implications depending on what you're using.
Ashley Taylor:
So, Andrew, let me pick up on that question, and Gurkan, I'd like you to comment on this as well, and that is, if we can now begin to articulate the distinction between predictive, generative, and agentic AI, are those distinctions being recognized by regulators relative to assessing risk as they require certain controls? And are the legal implications different, or have we started to see a difference in legal implications when we see the various flavors of AI present themselves in the marketplace?
Gurkan Ay:
I can answer that from the employment-related AI tools, especially the predictive AI piece. So currently, there's only one employment-related AI-related regulation. It's the New York City's Local Law 144. It says if you are using an AI tool to make hiring decisions or promotion decisions, you are supposed to do a bias audit. So by the very nature of the tools used in hiring and promotion decisions, it is basically a predictive AI, and the law is designed in a way to address the issues related with the predictive AI, basically the adverse impact. So it looks at the past data. The AI tools used in hiring and promotion decisions are usually designed in a way that they look at the past data sets and predict who is the most likely candidate, who is the best qualified candidate. So the New York City's law, I can say that it's basically the predictive AI-related law. Now, there are other laws, like the Colorado's and California's laws and regulations, that address the generative AI and the deepfakes and all the new models related to the new technology. But I don't think there is any regulation at the moment that addresses the issues related to agentic AI directly. The privacy laws and consumer protection laws are addressing the issues that can rise due to use of agentic AI, but they are not specifically saying, "Oh, this is an agentic AI issue, and let's try to regulate that."
Andrew Coles:
Yeah, I think picking up on that, and Ashley, I'd be interested in your perspective as well, is that it doesn't feel like there's going to be, at least at this point in time, a one-size-fits-all regulation. This is how you have to use it, or this is what you shouldn't do. And I think all of us, especially in my background related to mostly anti-bribery and anti-corruption, is that we've had the government say, "Here's how you should set up your compliance program. This is what we're looking for." But I think we're still scratching the surface in terms of what we're even using AI for. And I think we're still a little bit a ways out, and I could be wrong, obviously, but we're still somewhere away from, like, this is what it should be. And I think we're using this regulation by litigation. What's coming up in these cases, right? What are we seeing other people getting in trouble for? How are other people using it? How are they being careful? How are they assessing their risk and putting in controls to make sure that these things aren't happening to them? But unfortunately, until people start to get in trouble for these things or make mistakes that we can all learn from, I think it is going to be difficult to say, "This is the rule of the land," or, "This is the best way to do it."
Ashley Taylor:
Andrew, I think one example of what you're describing to me is the lack of rules around privilege and AI for attorneys. So there's an open question, right, as to whether or not information you put into an AI system retains privilege. And there aren't any prospective rules, there aren't any regulations in place right now, there's no real guidance, but the issues are surfacing in cases. Right. And so you can see the guidance in this area being developed through case law and common law rather than regulations. That's just one example I was thinking as you were describing the lack of a framework, prospective framework, but a framework being created through actual cases. And that's one instance of it. I wonder, gentlemen, we all acknowledge that AI is often described as new, but in another sense, it's not really new. What makes it feel new? What's happening now that it feels new to so many people if it's not, in fact, a new development?
Gurkan Ay:
Well, one thing that allowed AI tools to become so popular, or even practical, plausible tools to use nowadays, is first is the big data. In the past, we were generating a certain amount of data, but it was all manageable. It was in relational data sets. Advent of the smartphone, the internet, and the technology used on a daily basis, we start to generate so much data everywhere. We are taking pictures on our smartphones, we are watching Netflix, and everything is our choices and our watch trends are being recorded. We are shopping online, everything that we search being recorded. Our actions are also being recorded. So there's a massive amount of data that we generate, and all of that massive amount of data is being recorded. The technological advancement that allowed to record this massive amount of data, create this massive amount of data, record it, and then use it is the computing power. The computing power, the development of chips, and the computation power that is now possible is amazing. Your smartphone right now is more powerful than the combined computing power of the entire Apollo 11 mission, including the computers on the shuttle as well as the supercomputers that are used by NASA on the ground mission. So presence of or creation of massive amount of data plus the computing power allow the AI tools of today to be possible.
Andrew Coles:
Yeah. You know what I think it correlates really well to, guys, is that we live in a generation now where time is of the utmost essence. I don't know about you guys, but time for me is sort of the most valuable commodity. And the ability for me and my colleagues and friends and family to quickly search and find out the results of something almost takes precedence over a lot of other things.
And the ability for us to now leverage this technology Gurkan's talking about in terms of the processing power allows not only us, but our companies, our clients, to harness that power as well and start to automate tasks and start to roll these things out internally to allow them to be more efficient. Allow them to potentially save costs, allow us to do some of the work at the front end that used to take hours and hours to research certain topics or certain concerns that we have, whereas now we can focus a lot more of our time on the actual analysis. What really matters for the client? Do they really care that we need to spend a week researching some tax code or some sort of historical law when AI is now here to be able to help us do that? And I think to answer your question, Ashley, is it's really about the powerful technology at our fingertips that has made it more mainstream versus historically, where we were probably using AI, but we didn't really know we were using AI. If anyone has ever filled out a will or done some sort of trust where you're filling out some prompts online historically, and it automates the next question, so on and so forth, that was a form of AI, right?
But now it has drastically evolved to be able to do these very dynamic and thoughtful searches about whatever you really want. And I think that brings in the ability to harness this power to accomplish a number of different things.
Ashley Taylor:
So what you're talking about is a dynamic created by a new scale, a new speed, a new level of accessibility, and the integration of these systems to create new opportunities and new risk. And as you were describing that, Andrew, I was thinking about some of our work in the public record space. So criminal records have always been public records, but 80, 90 years ago, you had to go down to the courthouse, talk to the desk clerk, right? And you would have to write down and then ultimately maybe take pictures of a police report or criminal file. Once that information became automated, the scale was different, right? The accessibility became very different. The speed with which that information could be distributed and used became very different. And it created an entire new risk paradigm and legislative restrictions and/or guidance, not because there was a new document, but because the information became suddenly at everyone's fingertips. And I sense a similar dynamic here where folks like you all who are technical experts hear folks like me talk about AI as if it's something that just appeared yesterday.
Andrew Coles:
Well, you know, what's interesting is that when we talk to clients a lot, and Gurkan, I'd love your perspective on this, is that maybe 10 years ago, we'd ask a question about like, okay, well, how do we get the data? And it was always so difficult, right? For a lot of clients, it's like, well, this is stored over here, and this piece is in a data table over here, and there's no linkage together. How do we link them together? What we're now seeing is in some cases the opposite, right? We have too much, and it's how do we hone in on what we actually want? But I think with the rollout and the technology at our fingertips, it now allows us to curate it much more efficiently and effectively to get it to a spot that we want it versus fighting tooth and nail to even get pieces of the puzzle. Now we can put the puzzle together much easier with the help of these tools.
Ashley Taylor:
So I want to turn now to an area that I know our listeners are going to be interested in, and that's the legal and regulatory perspective on AI and ask you all to opine on a couple of questions. In fact, does AI really... Does it create new risk or does it simply redefine existing risk? I want to get you all's opinion on that.
Gurkan Ay:
From the labor and employment law perspective, I think I can say that the existing laws still apply, whether it's the human making the decision or the AI is making the decision or supporting the decision. That's usually been the stand by the regulators in the previous administration as well as by the practitioners like ourselves. So what we tried to do in our analysis was to understand the existing frameworks and see how these new tools can be analyzed using the existing frameworks. Now, having said that, the technology is evolving so quickly and the issues that we just talked about, the speed with which data is being processed now and the amount of the data that the AI tools nowadays touch and use and create, it is so massive. So there have been attempts to create new regulation to address these aspects of the AI tools. In terms of the general flow or general decisions that the AI tools are designed to help or to automate, I think the existing laws are still there, but as you all know, the new regulation is facing a resistance from the administration, or there's the regulatory trend at the moment so that the focus is incentivizing the innovation rather than putting the broader safeguards in place.
Andrew Coles:
You know, what's interesting is that you're talking about new risk or evolving risk is the way I think about it. I don't think the risks really have changed that much. I just think that they've evolved. And I don't think it's too indifferent to when there is some type of litigation and we look at the facts of the case and we apply them to our company or our clients and we say, "Well, do we face that risk? How are we solving for that?" And I think a lot of it comes back to common sense, right? When we're leveraging AI internally or externally when advising clients, a lot of it is asking yourself, "Should we be using this?" Or, "Is this the right use case?" Or, "What could go wrong?" or, "How do we solve for these?" I think the risk has just changed. But the same thing applies in the sense that just because we're using a tool and we're calling it AI or it leverages AI, I don't think has moved the needle much. But what I do think it now forces us to do is saying, "If you are going to use AI, how does that existing framework of laws and rules and regulations apply to it?"
And furthermore is that if we are going to use AI, God forbid we get in trouble or someone comes asking, we need to be able to defend our use. And part of that, I think, is what becomes more difficult is that, well, what data was being used and leveraged to help or within that decision that the AI was helping make? Or who's ultimately impacted? Who could face harm? And I think that is not that indifferent to what we've always done, but it just makes it a bit more complicated when AI to a lot of us is this black box. We don't know what goes on inside that black box. We just really like the output because it makes our lives easier.
Ashley Taylor:
It also creates a dilemma in the sense that if companies are using AI in a creative way, but the regulator is saying, "We recognize that companies may use it in new and evolving ways, but is that the expectation of the consumer? Is that the expectation of the applicant?" And so you have a lag between a company's creative use of AI, the public's expectations, and what regulators perceive as being fair or unfair relative to a consumer's expectations. And that gap is where we see the enforcement matters arising as expectations change, but the parties haven't had that conversation in a legislative context where all constituencies are sitting around the table and there's a meeting of the minds as to the risk and rewards and the balancing of those harms. But it occurs in an enforcement context, which is often a first-case scenario. And so we see more of that. And the better companies can anticipate when that lag occurs, the better they can anticipate how we think the use of AI in a certain case can be understood and anticipated from the regulator's perspective.
Andrew Coles:
And I think this is part of the hard part as we develop these use cases going forward, is that I don't think anyone wants to curtail the creativity that has become possible with AI. It's at our fingertips now. But what we do want to make sure is possible, as you talked about, Ashley, is making sure that the expectations align with the intention, right? And I think the big piece there is just thinking through proactively, like we would with any risk, of what is the potential harm, the risk, anything related to those decisions. It's just being careful, right? And that goes back to my common sense point of is this something that we should be doing, and is this something that we're okay taking the risk on? And if we are okay taking the risk on these decisions and deploying these tools and making the better decisions for us and our clients and our customers, is how do we make it defensible, right?
Do we know what's going on? Is it replicable? Right? I think a lot of people probably have experienced this in the past of searching ChatGPT and you say, "Give me X, Y, and Z," and then you search it, someone else may search it and say, "Give me X, Y, and Z," but the results can be different. But why? Right? Especially when you're dealing with a tool that's either internal or rolling out an internal enterprise-wide solution, you want to make sure that you're driving consistency like you would with any decision.
Ashley Taylor:
Yeah. Well, Gurkan and Andrew, I want to thank you all for joining us and participating in today's conversation. And I want to encourage our listeners to tune in next time as we continue this conversation focusing on how AI is actually being regulated today and what practical steps companies should be taking now to manage AI-related legal and operational risk. Again, thank you both for joining me today, and thank you to our listeners for tuning in. Remember to subscribe to this podcast via Apple Podcasts, Google Play, Stitcher, or whatever platform you use, and we look forward to having you join us next time.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
---------------------------------------------------------------------------
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided “as is,” with no warranty as to the accuracy or reliability. Please listen to the podcast for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.