Kathy Kay has run technology at two Fortune 500 companies, PG&E and, now, Principal Financial Group. Both sit in some of the most heavily regulated, highest-stakes sectors in America: utilities and financial services.

She did it not by mandate, but by opening the technology up to the entire company, attorneys and compliance teams included. Formal governance came later.

In a little over a year, she took Principal from roughly 800 active AI users among its 20,000 employees to more than 17,000. On any given day, 8,000 to 10,000 employees are using the company's AI tools.

In a conversation on the Earn The Right Podcast, Kay talked about how that rollout happened and why she thinks "regulated industry" is often used as an excuse not to innovate. She also spoke about the genuinely unresolved questions, like build versus buy and how to price AI agents, that she says nobody, including her, has fully figured out yet.

Edited excerpts below.

I've been following your journey with the AI transformation, and I want to know how you make it happen at a large enterprise that's highly regulated.

I have the luxury of the support of our CEO. I don't want to underestimate the impact, the responsibility that we have in terms of governance. I've been in regulated industries. I think that that is an excuse for not innovating... You can still be very innovative and still comply. We've drawn the line to say, you know what, we're not going to touch this space right now because we're all still learning, we can't guarantee certain outcomes... Principal has historically been known to be a very ethical and responsible company. We've been around for 145 years. I think we're 18 years in a row the most ethical company. And so it is part of our DNA... I do think it's a bit of an excuse that because you're in a regulated industry, you can't possibly use these things. As long as you're making sure you understand the risks and you're putting in the right guardrails, I think you can leverage these things effectively and get some really good outcomes.

How have you brought AI transformation within your group, and what are some of the things that weren't automated even 3 years ago but now are?

I'll start by saying it wasn't I, it was a lot of us... I'm a huge proponent of giving people an opportunity to try innovating. So when ChatGPT first came out, we started what we called a study group. We basically opened it up to the whole company and said, whoever's interested in learning, trying, join the group... It wasn't just open to technologists, but we had a lot of business people, we had attorneys, risk, compliance, security, everybody joined, and we were learning this all together. Then people started coming up with use cases... What it enabled us to do is learn quickly as a company versus just a few. It allowed us to figure out we've got to get governance right early on, because we are a regulated organization... By trying all this and including everybody early on, we developed governance really early, because then you don't have attorneys and the compliance teams or security being the 'no' people. They want to enable us to leverage these things.

We have 20,000 employees. At the beginning of last year, we had about 800 employees that we would say are using AI. By the end of the year, everybody had been trained. We had 17,000 active users... And by active, what I mean is they are using AI within 30 days... On any given day, there are at least 8 to 10,000 employees using some form of AI, our AI tools." Getting there took real infrastructure: "We also trained the whole company: there was about eight hours of training for everybody that taught them what generative AI was, what a good prompt is, what your responsibility is with data, and what good governance is." A new CEO helped accelerate it: "I had the luxury of her being very, very bullish on the impact AI could have... I don't think we would have moved as quickly" without that top-down advocacy.

As you look at the transformation, what are some of the other use cases where you've applied AI, and how has that grown over the last few years?

Kay pointed to underwriting, claims, and contact centers: "If we could give them an AI to do that part for them, they can handle the harder things... we've been able to teach them new skills and move them into a different role." She also described tools that help distribution teams respond to RFPs faster, assist advisors so they can spend more time with clients, and support asset management researchers: "So that the investment teams have data much more quickly and effectively." But engineering, she said, is where the model matters as much as the tool: "We found that when we first gave them all a GitHub Copilot, while we would see a little lift, it's those teams that really started working differently with AI that we got our biggest lift."

Now that your employees are using this technology and coming up with ideas, not just for productivity but maybe an application that could help Principal grow its topline... How do you think about build versus buy?

That line is very gray right now. And I think anybody who says they have it figured out, I don't think they do, because it keeps changing... Anything that we view as differentiating, we want to build that... On other things, it's a bit of a debate right now, because there are things that could be easily built, but you always have to look at the tail. So the one-time cost to build I always say is the cheapest part of a program, right? [The real cost is] how much does it take to run and keep updated, and maintenance." She also noted a shift in vendor commitments: "You don't have to make a five-year decision, right?... Maybe we don't make a three-year commitment, we make a one-year commitment, because we don't know how different things are going to be a year from now."

On where AI fits versus where a human still has to close the loop: "As agents or AIs do more things, the importance of when there is a human engagement becomes much more critical... Even if you think it's a simple call, what we've learned is with our customers, if they are making what they consider an important financial decision, they might go through the entire digital experience, but right at the end will still want to talk to a human. And so we don't necessarily view that a contact center is a commodity. It is the experience... You can automate away the simple questions, you can automate away those things that don't really require a human interaction. But when it becomes this moment of truth for a client, you want it to be the right experience.

How should we think about pricing and packaging, especially when you're buying from a third party, a startup, or another company?

It's really based on both of our ability to understand the true value creation. It's an outcome-based sort of contract, if you will... I think gone are going to be the days where companies feel comfortable paying for 100% of the capabilities, but you're only using 20 or 30%... The thing I don't want our teams to do is try and take advantage of, let's just get the cheapest price we can. That isn't sustainable for anybody." She was candid that outcome attribution is genuinely unresolved: "We even see it with some of the things we've built internally... there starts to be this debate of, who's getting the credit. And what I will always say is, does it really matter who's getting the credit? Now that's easy to say internally, but when you're trying to leverage something externally, it's hard... I wish I knew the exact answer, but I'd be lying to say that.

Rapid Fire

A mistake you now share openly to build trust?

Early in my career, I was running this big program. We were building one of the biggest customer data warehouses in the world at the time. And there was just some weird political things going on, and my boss called me on it. He actually took me off that project and said, 'You've lost your objectivity. I still believe in you, so I'm going to put you on something else.' Sometimes you get so focused on delivering something that you have these blind spots. Make sure you have people you can trust who are willing to call you on it.

What's the most common mistake startups make when pitching to a CIO?

Don't think you have to go around IT... Even though it might be easier to create that relationship with a business partner, also try and create that relationship with somebody in IT. It allows us to understand early on what it will take to help enable it.

A leadership phrase you never want to hear again?

This is non-invasive, or it's not going to impact our users at all. It's never seamless. There's always a change involved.

An AI use case that's overhyped right now?

The fact that everybody's jobs are going to go away. I think if a company truly believes that their people are their strongest asset... then automating them all the way is going to be a bad plan.

An AI use case that's underappreciated right now?

Saying that because you're in some sort of regulated or critical role or industry, you for sure can't use AI. I think it's underappreciated, the true impact you could really have even in highly regulated environments.

Kay's advice to other leaders in regulated industries considering their own AI rollout: bring HR in early, involve legal and compliance from day one rather than at the end, and resist the urge to lock into long vendor commitments in a market that's still changing month to month.