As organizations increasingly adopt AI technologies, governance and legal teams face mounting pressure to harness these innovations while maintaining robust oversight and compliance. With 

Diligent's Modern Governance Virtual Summit

 quickly approaching, we had the opportunity to speak with Deisha Thomas, Legal Operations Consultant at Kailera, about the challenges and opportunities AI presents in the governance landscape.

Q. Hi Deisha! Can you tell us a bit about yourself and your background in legal operations?

A. Hi! My name is Deisha Ling Thomas, also known as Deisha Ling Vazquez. I have over 25 years of experience in the legal industry, and I currently support an in-house legal team at Kailera as Legal Operations Professional. Kailera is a clinical-stage biopharmaceutical company, where I provide strategic advice on initial contract process improvements, legal technology and vendor selection. I’m also standing up the company’s contracting function by creating standardized processes and automation. Additionally, I serve as Head of Community for Legal Operators, which has given me a broad perspective on how different organizations are approaching legal operations.

Q. What are the most significant challenges that legal and governance teams face when adopting AI, and how can they overcome these hurdles?

A. From my perspective, some of the biggest challenges when adopting AI are data privacy and security, navigating regulatory issues, especially in highly regulated industries like healthcare, biopharmaceuticals and financial services, and stakeholder buy-in. To overcome these challenges, it’s crucial to have proper training in place, establish clear AI policies and governance that outline risks, risk management processes, and define roles and responsibilities. Cross-collaboration between different departments is also vital. This includes working closely with compliance, data privacy and operational business functions to address potential risks and ensure a cohesive approach.

Q. How can growth-stage companies leverage AI-enabled reporting and workflows to enhance their governance and legal operations?

A. Leveraging data and analytics from AI-enabled reporting and workflows can significantly enhance governance and legal operations for growth-stage companies. A good starting point is contract automation, which can help reduce time spent on low-value tasks and costs while providing a single source of truth. Utilizing AI-enabled board governance automation dashboards and reporting can also streamline processes and improve decision-making.

Q. How can organizations ensure compliance and manage risk when adopting AI technologies in their legal and governance processes? What best practices can you recommend?

A. It's essential to create and implement a comprehensive AI code of conduct, AI governance framework and complete regular risk assessments. Organizations should establish clear policies around incident management, data privacy and security. Once these policies are in place, it's crucial to have clear auditing procedures and updates as AI continues to evolve rapidly.

I also recommend investing in extensive training and upskilling programs for teams. Bringing in AI experts for hands-on training can be particularly valuable as it allows teams to gain practical experience with AI tools and technologies, understand how to apply them effectively in their specific context and learn from experts who have real-world experience implementing AI solutions. Additionally, having clearly defined roles and responsibilities, along with an established committee comprising representatives from different departments, can help ensure proper checks and balances.

Q. For lean teams, what are the most effective ways to implement AI solutions without compromising on compliance and professional standards?

A. The key is focusing on human-AI collaboration, where AI is used to enhance the work of people, not replace them. It's about creating an environment that encourages exploration and testing within clear guidelines, policies, and governance. Providing basic training in a psychologically safe environment can help teams feel comfortable using AI tools. It's also important to have a strategic plan and governance framework in place. And remember, it's okay to start small and iterate over time.

Q. Looking ahead, how do you envision AI continuing to shape the future of governance and legal operations? What steps should organizations take now to prepare for these changes and stay ahead of the curve?

A. I think AI is going to continue to free up time for more strategic tasks and initiatives. As it evolves at a rapid pace, organizations need to foster a culture of continuous learning, training, and demoing products to stay ahead. Establishing a dedicated person, department, or committee for AI oversight will be crucial in navigating both the benefits and challenges that come with AI adoption.

Diligent Q&A - Navigating AI in Governance with Insights from Deisha Thomas 

FedRAMP 20x is the first major update to the program in more than a decade. The goal isn’t to reinvent the wheel, but to modernize how compliance is demonstrated and maintained. Instead of relying on static paperwork and point-in-time evidence, 20x is shifting toward continuous validation and risk-based prioritization. 

Right now, there are three areas generating the most attention: 

Each one changes the way organizations prove and maintain compliance. Here’s what’s different, what it looks like in practice, and what the impact will be. 

In the past, proving compliance meant submittingartifacts: screenshots, policies, and narrative descriptions. Under 20x, compliance will hinge on machine-readable metrics — Key Security Indicators — that provide real-time validation instead of static evidence. 

Previously, to show that multi-factor authentication (MFA) was in place, you might have uploaded a screenshot of your identity provider settings and a copy of your access policy. With KSIs, you’ll need to demonstrate through automated data feeds how many active accounts exist, how many have MFA enabled, and where exceptions remain. 


This doesn’t eliminate the need for policies or oversight, but it fundamentally changes how compliance is proven. Organizations must ensure their tools generate data at the right level of detail, and their GRC platforms can ingest and analyze that data in real time. Continuous monitoring becomes the baseline expectation. 

2. Risk-Based Vulnerability Management (POA&Ms) 

 
Remediation timelines are no longer one-size-fits-all. Critical vulnerabilities will carry shorter deadlines, while other findings may be assigned more flexible windows depending on context and exploitability. 


A scanner flags 200 vulnerabilities. Under the old model, “highs” had to be closed in 30 days and “moderates” in 90 — regardless of where they sat or whether they were realistically exploitable. With 20x: 

An internet-facing flaw with a known exploit must be closed quickly. 

A high-severity issue buried behind two layers of authentication may have a longer remediation window. 


The total workload isn’t reduced. Every vulnerability still has to be addressed. What changes is that timelines are now tied to actual risk rather than scanner ratings alone. That allows teams to move faster on what matters most, while still relying on patch management and configuration management cycles to handle the full volume of issues. The challenge is proving — with evidence — that you are prioritizing effectively. 

For actionable insights from industry experts on integrating AI into your cyber risk management and governance strategy, download the Cyber Leadership Playbook. 

Get the Cyber Leadership Playbook 

3. Significant Change Notifications (SCNs)


SCNs are being reworked to bring more structure and predictability to how system changes are reported and reviewed. The goal is to reduce ambiguity while maintaining oversight. 


Today, adding a new system component or changing your authorization boundary often triggers lengthy back-and-forths with an agency sponsor. Under 20x, the SCN process will be standardized, with clearer definitions of what counts as “significant” and more consistent handling of reviews. 


This doesn’t remove scrutiny. Agencies will still want to understand how changes affect your security posture. But a more structured SCN process means fewer delays, less confusion, and a smoother path for organizations making necessary updates to their environments. 

These three changes point to a bigger truth: FedRAMP 20x raises the operational bar. Organizations will need platforms that can: 

Normalize it into evidence that maps to KSIs 

Provide analytics to show compliance in real time 

Support structured processes like SCNs without derailing operations 

Not every GRC platform can handle that scale, and not every stack is ready to feed data at the depth required. That’s why early preparation — and the right partners — matter. The same urgency applies to defense contractors navigating the newly finalized CMMC rule; 

It’s tempting to wait until 20x is fully rolled out before making changes. But by then, the gap between prepared and unprepared organizations will be wide. Preparing now means: 

Reviewing your vulnerability management process

who already have FedRAMP authorization and experience navigating these requirements. 

FedRAMP 20x doesn’t change the mission: protecting federal data in the cloud. What it changes is the method. By tying compliance to KSIs, risk-based remediation, and structured change management, the program is demanding evidence that security is real, continuous, and measurable. Organizations that start adapting now — with the right tools and partners — will be the ones ready to succeed in this new FedRAMP era. 

FedRAMP 20x is raising the bar for cloud compliance. Find out how Diligent helps organizations stay ahead with real-time evidence, structured workflows, and FedRAMP-ready solutions 

FedRAMP 20x: What’s actually changing and why it matters 

This article originally appeared in our September 11, 2025 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe

Governance leaders feel more confident about AI these days, if the findings from our latest 

We asked GCs their key areas of risk right now, and only 8% mentioned technological disruption. This calm was a little surprising to me, given the current frenzy to integrate AI and see results as soon as possible.

AI risk perceptions among governance leaders

recent episode of the Corporate Director Podcast

 particularly timely. We talked to Beena Ammanath, Global Head of the Deloitte AI Institute and a faculty member for Diligent’s AI Ethics and Board Oversight Program. Ammanath’s literally written the book — 

 — on navigating tech disruption, and I always find her take on things very thoughtful, nuanced and reassuring, as you’ll see in these expert tips for AI strategy and adoption. 

Sticking with our GC theme, the paralegals who support them have typically followed an established career path. Early on, they spend a lot of time looking up statutes and contracts and reviewing documents. The information they learn along the way equips them for more senior roles.

But now AI has automated the whole process, transforming the team’s workload and profession’s overall pipeline and career trajectory. It leaves paralegals understandably worried — especially when they hear promises that AI will take away the boring parts of their work and make their jobs easier.

“Leaders have a responsibility to go beyond the clichés,” Ammanath said. “What happens to the workday when organizations make the job easier? If AI is going to create new jobs, what are those roles?”

“I think leaders have a huge responsibility to proactively think about that,” Ammanath said, citing the need to create organizational structures for new career paths and provide both targeted upskilling and general AI training to build fluency across the workforce.

Then there’s the matter of the human/machine relationship. “How can leaders thrive and succeed in this era of AI where humans and machines are working so closely together?” Ammanath asked. “To work in the best possible way, where can we get the maximum benefit with the minimum side effects?”

We’ve all seen cautionary tales about students outsourcing the entirety of their coursework to ChatGPT. This should go without saying but: Don’t do that in your organization.

In the podcast, my cohost Meghan Day and I talked about studies of what people’s brain waves look like when they use AI at different levels. The heaviest AI use showed the lowest brain function — almost like people were asleep. More optimal EKG activity happened when AI users started a task with their brains and then added ChatGPT.

“Personally, I’ve been most successful embracing AI in my job in areas where I already know what good looks like,” Day said. “And AI is able to speed my work along.”

AI also promises big potential for board members. You can train different agents to have different personalities and perspectives so they can frame problems in new ways for you, for example. But you’ll still need to oversee them and evaluate their output with your own human expertise to ensure accuracy and nuance.

3. Make continuous education — and hands-on use — a cultural norm

Navigating AI’s risks and rewards requires knowledge of AI itself.

This doesn’t mean dropping everything to become an AI expert (although those nine-figure job offers make it tempting). It means having a basic understanding of core AI principles, like machine learning, deep learning and computer vision — and what these principles look like in action.

“As corporate directors, it's important to focus the time and energy to not only learn about AI, but start using AI tools in your job,” Ammanath said.

AI is changing the way we work and the way we lead. For practical strategies and insights from Beena Ammanath,

listen to the full conversation on the Corporate Director Podcast: AI leadership strategies for a changing world.

This article originally appeared in our August 28 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe 

My colleague Josh Black, Vice President of Editorial at Diligent, doesn’t use words like “eventful” and “unconventional” lightly. So, when I saw them front and center in the editor’s forward of this year’s Proxy Season Review, which Diligent Market Intelligence prepares in association with Olshan Frome Wolosky and Campaign Management, I paid even more attention than usual.

“It is difficult to recall a more eventful or unconventional proxy season since the first year of the pandemic,” Black declared. 

Relentless market volatility is only part of it

. Activists have beena dopting new tactics and advancing stronger director candidates to achieve their desired objectives, especially in the U.S. “It feels very much like an inflection point,” Black added.

Proxy season 2025: Evolving shareholder engagement strategies

In this year’s review, his team examines this inflection point, connecting the dots between what we’ve seen in this year’s proxy season and what these trends mean for boards and advisors right now. Here are a few key takeaways, starting with shareholder engagement.

You’ve probably observed a noted decline in proactive communications by institutional investors lately. Regulatory developments, like revised guidance on Schedule 13D/G eligibility, are a big part of this.“ Norms have unmistakably evolved,” Campaign Management CEO and Founder Michael Fein pointed out in his analysis. “Institutional investors paused outreach, reassessed compliance exposure, and pulled back from dialogue just as several proxy campaigns were gathering momentum.”

Shareholders still care deeply about board structure, accountability, and transparency — critical contributors to strong corporate performance in uncertain times.

In the first half of the year, 33 governance-focused proposals passed with majority support. Board composition has been a common target, with director shuffles at Phillips 66 and Penn Entertainment far from isolated anomalies. We’ve also seen a significant increase in withhold campaigns for driving director changes and other demands.

2. Make real-time data and shareholder sentiment a board priority

Amid this perfect storm of new tactics, heightened scrutiny and radio silence from institutional investors, it’s harder than ever to anticipate vote dynamics and activist positioning.

Is a withhold campaign targeted pressure for governance enhancements, or a prelude to a full-blown proxy fight? Your company’s future depends on answering questions like these quickly and well. And this means moving beyond historical data, guesswork and ad hoc interpretation to real-time intelligence.

Now is the time to invest in systems and processes that deliver accurate, actionable data on investor sentiment, proxy trends, and governance benchmarks.

It’s time to look beyond business as usual for shareholder engagement as well. This means rethinking how your organization interacts with institutional investors. What new touchpoints can you leverage to fill in communication gaps? How can you proactively share your governance story — especially future-focused strategies and positive milestones — in a way that responds to current trends and sentiment?

Think about harnessing all of the data collected in the steps above, like 

 and proposal outcomes, to shape your narrative. “The 2025 proxy season made clear that activists will not sit on the sidelines waiting for more ideal economic conditions,” Andrew Freedman, Chair of Olshan Frome Wolosky’s Shareholder Activism Practice Group, warned in this year’s review. And here’s what he recommends: “Stay prepared to respond to well-crafted demands and sharp strategies, underscored by an unwavering focus on performance and accountability.”

Keep reading for more on the 2025 proxy season

Dive into our full analysis — AI, ESG, 2025’s wildest campaigns and much more — in the full report: The Proxy Season Review 2025.

Want regular access to original research in the field of GRC? Bookmark our 

 for the latest surveys, podcasts and reports.

Diligent

Blog

Diligent Q&A - Navigating AI in Governance with Insights from Deisha Thomas

FedRAMP 20x: What’s actually changing and why it matters

Your Data Matters