AI Compliance Risks in Proposals: What Financial Services, Healthcare & Life Sciences Teams Must Know ✹ RocketDocs CEO Perry Robinson

Christina Carter (00:08) Stargazers, if you are in a regulated firm and you're worried about implementing a new proposal management tool or AI or automation, you're probably worrying about the wrong risks. The real risk is going to be a lot simpler. It's where is your data going? Can you prove what you said three years from now, and are you making your firm sound exactly like your competitors? So in today's episode, I am joined by Perry Robinson, CEO of Rocket Docs, and he works with teams across financial services, healthcare, life science, environments where compliance, record keeping, and data governance are not optional. So if you work in a highly regulated industry and you are evaluating proposals or AI tools, this conversation will sharpen how you think about that risk, defensibility, and that long-term strategy within your proposal team and within your career. So let's get into it.

Christina Carter (01:02) Hey Perry, thank you so much for being on today. I really appreciate it.

Perry Robinson (01:05) Yeah, thanks for having me.

Christina Carter (01:06) It's interesting because for the people who aren't super familiar with you and Rocket Docs, you're talking to teams who are working in healthcare, asset management, financial services, so really highly regulated markets. So I'm curious, if you're seeing a common thread throughout all of them when you are speaking to them and what their worries are, what their issues are in general with proposal management systems.

Perry Robinson (01:30) Yeah, it's interesting. We get different groups. We get the folks that they're regulated. They know it. They get it. It's an absolute requirement. And for them, the trend is definitely of late, how can we make use of AI and still maintain all of our regulatory obligations and not have any places where we trip up down the line? There's also, oddly enough, the group of folks that are very highly regulated. And I think sometimes the folks that we're talking to inside these, what are typically pretty large organizations, don't necessarily know about all of the regulatory impact that comes from using any type of technology solution, let alone one that's incorporating AI. And so we have interesting conversations with those folks because oftentimes you can have a very long interaction with them, especially folks that are new customers coming in the door. And then they'll be like, we just found out that there's a whole bunch of folks in compliance, privacy, legal, regulatory, folks, they want to know whether you guys are able to meet our standards. And so far, we've had some problems with the other vendors we're talking to. We usually have good answers.

Christina Carter (02:40) When you are talking to these highly regulated industries, you just talked earlier about how you have people who are already really excited about all the new proposal tech that's out there, with automation, with AI. But when you start talking to these teams who are excited about it, when does that excitement turn into hesitation or fear or worry?

Perry Robinson (03:01) Yeah, again, so for the folks that already are in the know, they're kind of coming in. And I think our reputation precedes us for being a specialist in that area for the folks that are already looking for a solution that they know is going to meet regulatory requirements. For the other folks, it's when they start having their gatekeepers—I don't mean in a pejorative way. I think that it's an important function that people in compliance, privacy, legal, and the like have. And they'll all of a sudden have somebody say, hey, can we actually use this? There's a lot of times when the technology solutions aren't available. At that point, they may have invested a lot of time. The key technology that tends to raise the issue today is generative AI.

Christina Carter (03:45) Okay, so I have two questions that go along with that. What shouldn't they really be worried about that you hear them being really worried about, and what should they be worried about that they're not really that worried about?

Perry Robinson (03:57) Yeah, the first one just kind of comes in with, I'm not sure we're supposed to use this or that we're able to use it. And there's been a change where people have become much more informed about some of the potential scenarios. I will say that it's a bit confusing as to the issues that people end up really diving in on. Most of the time, they're worried about things like hallucination. And hallucination is a real issue with generative AI. But it's gotten a lot better. With each iteration of AI technology, it's gotten better and better. What they tend not to be thinking about, and I think are much more important issues to address, are where's the information going to?

We work with people on competitive sales processes, and they utilize some information which is public information that they're happy to have other people know about. It could be their corporate address or who their leadership are. Could even be particular things that they publish in terms of performance. But there's a lot of sensitive information in there. And what we've found is that there hasn't been as many questions from people asking about, so I'm potentially using an RFP provider, I've got a solution provider that I'm looking at. Where is my information going? How is it being used? And it's odd to me because this is not something that's happened just with US companies. It's happening with companies in the UK and Europe as well. And in the UK and Europe, we have existing data protection legislation that says that we have to go through those activities of knowing what the information flow is. But because that's relegated to sensitive personal information, people aren't thinking about their confidential corporate information in the same context, but they should.

A second major one really comes down to generative AI is a great tool, but it should only be seen as one tool. And one of the big challenges is when it's used on its own to create an answer, even if it's securely sourcing and not sharing the information of third parties, if you're constantly just using generative AI to produce new answers to questions, you don't really have controls over whether that information and that answer is the approved one that's going to maintain your regulatory compliance. Because you're not making a misrepresentation even in the small subtlety of words. It's also going to be a scenario where you become less and less competitive over time because you're diluting each one of those answers that you have that make you different from the other company that's also competing with you. If they're also using generative AI, everything's converging on a common point where the answers become more and more aligned with one another. And as a result, think about it, an RFP is designed for a person who's your prospective customer to understand what's different about you versus about another business. And so if you're all putting together the exact same generative AI based solution, you're going to come out with answers that sound a lot alike.

Christina Carter (07:03) Yeah, that's so huge. I feel like until you're really used to using AI tools just for responding to RFPs, you don't realize how much you sound like everybody else. And it's pretty intense how much that can be a possibility if you're not working on that.

Okay. So when you're working in these companies and they are looking to evaluate a proposal software or proposal platform to help them respond to these RFPs, who tends to be the person in the organization who's like, yes, let's adopt this new tool, let's use it? And who tends to be the person in the organization who is that gatekeeper who says no? And is there a common thread throughout or is it different every time?

Perry Robinson (07:48) I think it's a little bit different each time. Inside of businesses where there's an RFP team, we know who wants to utilize a tool. And then for them, it tends to be budgetary issues a lot of times. And so for us, that comes up because we're not the cheapest solution on the market. We're certainly not the most expensive either. But we provide a product that is a bit more advanced, a bit more capable, a bit more designed to meet these regulatory obligations. And we charge a little bit more money for that. So sometimes they bump up against the purse strings. The person who's holding the purse strings is saying, do we really need to use that? Now, we've got great ROI calculators and lots of them to be able to go into deep detail so people can explain why financially it makes sense.

There are these other scenarios though, there's the gatekeepers. There's two other scenarios. One is this person is like a status quo person. And oddly enough, sometimes that status quo person is actually the person inside of the teams that are responsible, whether they're actually an RFP team, or it's a smaller organization, or one that just doesn't have a dedicated team. So it could be their sales ops leader. And they say, well, what we're doing right now, that seems to work just fine.

So I had a great discussion with a guy. He's got this incredible background. He's the CEO of a company. It's a mid-sized company. And he previously held some pretty big leadership positions inside of heavily regulated pharmaceutical life sciences companies and pharmacies. And so he's in this role as CEO. And we're talking about some of the challenges. And I'm just getting to learn about different parts of the business. And I said, well, how about—you guys do a lot of vendor qualification questionnaires, right? Because in the process in life sciences, it's not just RFPs. So request for proposal are part of the sales process. But part of the qualification of whether you can do business in life sciences under the regulatory requirements requires all these other ones. So there's vendor qualification questionnaires, information security questionnaires. And they're critical parts of the sales process, but they're also a lot of work and they're kind of a pain, which is why we have this great solution.

And so I'm thinking naturally in this discussion, he's going to say, aha, this would be great. And he didn't. He said, I'm not sure we actually need any changes there. It seems like everything's working fine, but let me go ahead and have you talk to the person on my team who's responsible for that.

So basically, the no came initially from the CEO, who's ultimately responsible for the P&L of the business, and really is also responsible for making sure that his team members have a strong culture and are engaged in their work. They feel like the work that they're doing is valuable. So I get the introduction, and I talk to this person. And the first thing out of their mouth was, oh my god, I'm so glad you spoke to Josh. Because we're literally doing so much work, and we're being told, create all this inside of a database. And just manually copy it and paste it each time. And go and try to find and get approvals. And they're like, it's like quarterbacking an entire football game, or it's like running an entire play and being the production manager in the play. I'm literally having to go out and orchestrate each of these different subject matter expert groups to have them answer specific areas and sections, which is what you guys just showed me looks like it can do everything all in one. And what I love about it is that it's purpose built for us as a life sciences company as well. So we know that that part's there.

So the CEO was initially the person who was saying, hey, status quo seems fine. You don't need to change anything. But he didn't realize how much time was being taken out of his teams. And these are people who are hired to do other things. It's the chief scientific officer. It's the person who's responsible for data submissions. They're all supposed to be focusing on other areas of the business.

Christina Carter (11:37) Yeah, it's really—I feel as though a lot of leadership just know these things are getting done. They just know these things are getting submitted, they're going through. And of course, why would they know the background work that goes into them? Especially in the highly regulated industry, whenever I speak with RFP teams specifically, they're doing things in the most difficult way possible because they don't have much of a choice. It's so time consuming in a way that it doesn't have to be. And I also feel like the way they do it because it is so manual, it actually introduces risk in how they're doing things.

When you do go and you have those conversations with them, are there security things that they're worried about? Are there other things they're worried about—guardrails or introducing risks when their teams do want to purchase RocketDocs or a similar tool to bring into their process?

Perry Robinson (13:20) Yeah, I think it's an interesting point to bring up. Yeah, we get the same challenges on that side. I just think it ends up being a different conversation towards the end. But I'll give you a quick example. So large multinational bank, existing customer. And we launched our generative AI solution a little bit later than some of the other folks that are in the space. And we did that because we wanted to be purposeful and intentional about making sure that it worked for our customers before we did so. But that also meant that they'd already been pitched these solutions by other folks in the market before we got there.

And so the security folks right off the bat, having already been pitched on these other solutions, the first thing they said was, look, we're already a customer of yours. We're just not going to be able to use your AI because it's gone through and it's been reviewed in these other solutions. And it's just not a solution for us. So I said, well, let us just go ahead and have a conversation with them and ask them what their concerns are.

So the security team comes on and sure enough, the first things out of their mouth are, these are reasons why we can't use a generative AI solution. And we had to take each of the questions one by one. Now for us, the answer is different. And so we get a different overall response. But I do think that they're appropriately looking at these questions. And when these businesses do have their security team doing reviews, they're getting to the right result.

Again, I'll go back and say that there are scenarios where I know that sometimes solutions will not make their way all the way through a full review in their first year. And then as part of a normal internal audit review, it was found that we didn't follow the right processes and get sign-off from information security in these other areas. When information security did a review, they said, we've got to stop using this immediately. There's literally an exfiltration of confidential information going from us to a third party with whom we have no contractual relationship whatsoever.

I won't name the large AI provider, but there are a number of other businesses out there that when you look closely at their AI technology, you'll find that it's not their technology stack. It's actually powered by one of the large AI providers like OpenAI or Anthropic or whoever it is. And again, nothing wrong with their businesses. You make your own decision on whether you want to work with them and look at it, but if you don't have a contractual relationship with them, then you have no way to know whether your information is actually going to be trained on or to receive notice when they decide to change terms.

And just as a quick example, Anthropic made a decision not that long ago to take paid accounts and to start training on the data again unless you opted out. And they gave all their customers an opportunity and notice. But if you're not the direct customer, you did not get that notice. So then you're relying on this other business that you're working with to go out and to make that decision on your behalf. And sometimes they're going to get that right. But if you decided to opt out in that circumstance, you're going to have reduced capabilities to use the AI powered by Anthropic, which may mean that the functionality that you signed up for becomes limited or just stops working.

So the great part for us is when we're in those conversations, whether it's information security, whoever it is, they're able to ask the questions directly of us and we're able to provide them with direct answers about what we do with our technology. And that's the big difference—ultimately they know that when they're talking to us, they're talking to the business that's actually providing that security or providing those assurances and there's no one else they have to go to down the line.

Christina Carter (16:51) Then if you—maybe this is too specific—but if you are evaluating a proposal management tool or response management tool and you are in one of these highly regulated industries, is there a top two or top three questions that you should be asking while you're in that sales process to immediately eliminate ones that are just not ready for a highly regulated team?

Perry Robinson (17:12) For sure. Yeah. The first one is, if they have an AI component, do you own the technology stack for the AI? And if you don't, who does? And how is that information that I'm putting into your system end up getting processed by the AI? And then it's a simple question, but you really want to look at the data flow. So where's the data going? Even map it out and see.

Again, if they do own the AI, then you want to know how are records being maintained around that. Because just because a company owns its own AI doesn't mean that they're necessarily maintaining records the right way. So the new EU AI Act, as well as existing regulations that sit for most healthcare, insurance, life sciences, and financial services companies, whether they're in Europe or they're in the UK or the United States, there's record keeping requirements. You have to maintain records about representations that you've made as part of the marketing process. And so that means that when you have an answer generated by AI, you need to understand where that information came from that supported creating the answer to know that it's factual at that point in time. You need to have an audit trail around it. So you want to find out whether or not there is an audit trail and there's record keeping that allows you to meet your obligations.

And then again, I think this is now expanding out to almost everybody because with the EU AI Act, we want to know how is AI being utilized? Is it processing any sensitive information at all? How is it doing so?

There are a number of good responsible companies out there that actually own their own AI stack. But some of them still have made decisions that we can all make along the way. Like, I'm going to keep these records, but I'm only going to keep them for 12 months. Well, if you have a three-year statutory requirement, then you have to have somebody to maintain the records for three years. So for us, we actually act as a system of record for our customers. And so we've got three, five, seven, whatever it is. You want to find out, are they able to act as your system of record for the purposes that you're using the information.

Christina Carter (19:20) No, those are so good. I want everyone to write those down and use them because it's really tough to know just based on marketing material what is the right tool for you to use. Because of course, you don't want to do 15 demos with proposal tech teams. You want probably three or four with ones you've already shortlisted out based on just basic requirements, like the ones you just mentioned.

Perry Robinson (19:38) You can use an RFI and find out all the answers and then narrow down the group.

Christina Carter (19:45) That's the thing. I think it's tough because actually I've seen quite a few RFPs for these and it's tough. It's really interesting because you can see that there's a mix of what they're trying to look for and that they don't quite know what they're looking for yet. Because they don't know, but I guess that's the point of an RFI.

Okay. Let's say you're advising a proposal leader, a VP of proposals, director of proposals, or an RFP team, and they want to progress their career. Where would you tell them to start? What would you suggest they focus on? And is that within RFPs and proposals or would you suggest that they branch out? Because I know that you speak to so many teams and you probably have seen some career progressions.

Perry Robinson (20:28) Yeah, the career progression side, if they're wanting to branch out, I think today's an exciting time for that, for folks that are in the space. Because really, a lot of what people who've been in the role for a long time know is that they actually are keepers of information. I don't want to say that it's the chief information officer—it's a different functionality. But it's almost like being a cross between the CIO and a reference librarian. You know key pieces of information about the business, which is actually a really powerful tool to be able to put to work inside of the business.

So if I'm really wanting to branch out and think about career development, I want to think about that and the new technologies that are coming out. Any generative AI technology today—let's step outside of just the use and set of RFP responses—but all of businesses today, I think Gartner said 80% of businesses are being directed to use AI. Now only 20% of them may trust it at this point in time, but 80% are being told kind of board level down, let's figure out how to go and make this work for us.

And there's a lot of really great AI solutions. There's a lot of great LLMs out there. But AI is only powered by the information that you feed into it. So for a lot of solutions, they're just going to the internet in general, and they're finding pieces of information. And if I'm looking for the best pizza restaurant in New York, that may be an incredible way to source the information.

But if I'm somebody who's wanting to go through my career progression, I actually want to start thinking about how can I take what I've been doing, which is curating information about my business, and understanding whether that information is accurate and up to date. And how can I take those skills to be able to manage information that's then utilized by AI to give better results? Because the better the information and the data is, the better the results are going to be, regardless of whatever the AI use is.

So if I'm taking financial reporting data, if I have financial reporting data and I'm in finance and I want to know how many of our departments are operating under budget, one, let's have it just think about it. If it just goes to the internet, it's not going to get that answer right at all. It's going to pull things generically and it's going to get a lot of stuff wrong. Likewise, if I have it look at 10-year-old data, that's not really going to give me very good context. Now, if I want to look over 10 years and I say all the way to current and it's got access to the current information, it's different. But if I want to know in 2025, how many of our departments were actually under budget or over budget, they don't want to look at old information. And that's what RFP managers have been doing for their entire career. They've been figuring out ways to understand whether the response to the question has the most current up-to-date information possible. And the only difference is they've been taking that and they've been using it to answer a specific question.

If they want to branch out, they can start thinking about how can I start being one of the people that helps to take all this knowledge that we have and to make it available in other parts of the business.

And I think maybe that goes back to—maybe does end up going into the chief information officer's office as a progression path for a different department to maybe look at reporting into. There are a number of businesses though that have also created AI committees. And so there may be the capability to actually stay in your current department and just start expanding the work role. But now you're going in and talking to folks in leadership positions that are part of that AI governance committee. And that can get you visibility all the way up to the board level.

Christina Carter (24:05) That is so insightful, Perry. That is such a good response. I'm with you. I think even before AI, moving into a CIO or similar role has been a really smart career progression, but not one that I've seen very often. But it's just an obvious one. But then in terms of the AI and management of the AI and the content that it pulls from within your organization, I think those roles a lot of times don't exist yet. And so I'm wondering if there's a use case for proposal people who are willing to branch out outside of what they're doing. It's almost like make the case to be a part of that team or create that team. I don't know if you have any thoughts around that at all.

Perry Robinson (24:50) I think you can put together a business plan for it. There's so much value in the information that companies have at their own fingertips that's just not being utilized today.

Christina Carter (24:54) No, I completely agree. That was such an insightful answer. So thank you. But then even stepping outside of those roles, obviously you are talking to legal partners. You're talking to CEOs and CROs all day, every day. And so, and of course you're talking to them about their RFP and just response functions. What are you hearing them say about these teams? When have you heard them say good things about their teams? What are those teams doing right? And when they're maybe not speaking the best about those teams, what are those teams maybe doing wrong or the perception of them doing something wrong?

Perry Robinson (25:30) Isn't it interesting how much of almost a sibling-like relationship that SMEs have to the RFP teams? It's very much really, really hot and then really cold sometimes. Love-hate. Yeah, because I hear both, honestly. And I think it comes down to, RFP teams work on tight timelines. They have an obligation to do very, very critical work, which oftentimes I think just doesn't get all the value that it should get.

But they're also effectively tasked with going out and chasing down responses from subject matter experts inside of other departments. And how they do it is something that I think really changes that dynamic a lot. So if we go back to the scenario where you have a team that's working just out of SharePoint or a spreadsheet, they're by necessity going to be going to those SMEs if they're doing their job right and getting approval on content, they're going to be going and getting that approval on a continuous basis. Which means that they're going to somebody that maybe—I don't know, let's make it the Deputy General Counsel—and they're asking them to sign off, or it's somebody inside of the finance department to say, hey, is this reporting correct? Or something on the product side to say, is this the way that this product actually works?

And those folks all have different jobs. They didn't get hired and part of their job description, I can almost guarantee you, doesn't say acting as a subject matter expert to answer RFPs. Nobody really budgeted that part out when they were thinking about the time that's spent. And the bigger the business gets, the more active it is. The more it happens. Now what's really crazy is that any RFP is a sales opportunity for that business to grow. It's like we chase down and pay lots of marketing money to get people to that point. But by the time it gets there, everybody's like, oh my God, that's the last thing that I want to spend time on, and particularly the SMEs.

So the more that the RFP teams figure out ways to automate that process and to reduce the burden on the SME, the more that the relationship goes from that cold—oh my God, I want to avoid that person's email—to this person's making my job easier. So periodically they'll have me go in and they'll have me do a review of this information. And then I don't get asked all the time.

And so what's been really incredible for me, both as a practitioner—being a person who's been writing the RFP responses, having been the SME, and then talking to these folks that are in each of those roles—is when you hear this magical part where somebody says, oh my God, do you remember when it was so much harder? You used to have to chase me down by email. And the person's like, yeah, it was like the seventh email, I didn't want to bother you anymore, but I needed to get you to approve this.

And now what happens is, I just go in and I keep my information and my knowledge base up to date and I can go to the control panel myself. And the RFP team manager is like, yeah, and what's great for me is they can actually see where everybody's at and they only need to ping you if I'm finding out like, hey, too much time's passed. And so the system basically brings everybody together and it makes it a much healthier relationship.

Christina Carter (28:45) Yeah, absolutely. And I'm wondering if—let's say I am worried about taking on a tool that does these things, that helps me with those things. Like you just said, I am using emails with SMEs. I am keeping all my content in Excel. I'm tracking validation through Excel, all that fun stuff that we know so many teams are doing. What do you think is the biggest risk for those teams who aren't going to adopt, whether it's AI or non-AI type platform, versus ones that are just staying the same, doing what they have always done?

Perry Robinson (29:20) Well, I guess it depends a little bit on the system that they've got in place. But no matter how good the system is, we're talking about what's likely—it's not backed up. It doesn't have an audit trail. The one person that's maintaining that or the team that's maintaining it is going to change over time. And so you end up a lot of times with people going, okay, so when I came in, we had this Excel spreadsheet, and we kept this information here. And then I made some improvements to it, and I saved my version over here. And so then the question becomes, when somebody else comes in, which one do they rely on?

And so there's just a lot of risk in there that you're going to lose the information that actually gives you the efficiency. You're already missing out on the efficiency to start. But let's say you're comfortable with it. You're going to lose the efficiency even more. There are significant challenges in not having it to where you know how current and how recently approved that information is. So you could be giving wrong information.

I mean, look, we have a lot of asset manager customers. If they grab the wrong data on the returns that they're able to deliver, the actual performance of their investments, that's very, very large fines, if not potentially prison time, all depending on whether you knew about it or whether you didn't. But it's a very dangerous area to play to have information off by even just a little bit.

You want to be able to answer an RFP fast. That's the easy part. But you need to have the right answer be provided. And you need to be able to attribute where that correct answer came from. And you need to be able to maintain those records to be able to demonstrate it at a later point. And those parts don't exist inside of an Excel spreadsheet without a tremendous amount of work. Which again, all it takes is one person deciding to start the next one and then somebody deleting the old record and it's all gone poof.

Christina Carter (31:16) Yeah, which I have heard of happening. Don't let that happen. Yeah, no, definitely. And this was incredibly insightful, Perry. So thank you so much. Let's say someone listening from a highly regulated industry is really interested, wants to talk to you, where can they find you? Where can they find RocketDocs?

Perry Robinson (31:32) Yeah, well, www.rocketdocs.com. And feel free to reach out to me at probinson@rocketdocs.com. It's my email. It's the actual one. I gladly look for your email and respond. You can also find us on LinkedIn as well.

But we're happy to talk to folks, even if they just want to trade, if they want to have an information exchange and just pass by some ideas about things that are going on. We're definitely a service provider. We're in it to be able to sell our services. But you'll find that whenever you talk to a RocketDocs team member, they're also interested in what's going on inside your business, what's going on inside the industry. Our folks are very dyed in the wool folks on the questionnaire and RFP side. So they like their jobs, they like to know what's going on, and we're very happy to connect.

Christina Carter (32:19) Yeah, and I can say that that is true about your team, that they're wonderful. And we'll have all those links down below in the show notes. Thank you so much for being on, Perry, and we'll talk again soon.

Perry Robinson (32:28) Thanks so much.

Christina Carter (32:30) Thank you for listening, Stargazers. If you found this conversation useful, please share it with somebody on your team or somebody who you know is thinking about the things that we talked about. Governance, defensibility, long-term differentiation in our highly regulated proposal and RFP teams. If you want more conversations like this, make sure that you are subscribed. And if you're listening on Apple or Spotify, a quick rating or review helps people in the right industries find Stargazy. So thank you for listening and we will see you in the next episode next week. Bye.