**Kristian McCann:** Hello and welcome to UC Today. I’m Kristian McCann, and today we are looking at the security considerations that organizations really need to address as AI starts to become embedded within their contact center. Um, obviously if you’ve stuck with us, you’ll have known why AI can help businesses improve their customer experiences, support agents, and automate routine tasks. But as it connects to customer data and contact center platforms and wider business systems, it can also introduce new risks that organizations need to understand and manage. And for leaders, that is not simply deciding where AI can add value — it’s making sure that the technology is introduced with the right security controls, oversight, and accountability from the start, as well as keeping it on track as it evolves. Um, so there’s a lot to unpack in this episode, and luckily I’m joined by Matt Kamish, Solutions Executive for Customer Experience at New Era Technology, who will be able to tell us all about what considerations you should be taking before you deploy AI into your contact center. Matt, it’s a pleasure to have you with us today.
**Matt Kamish:** Yeah, Kristian, I’m happy to be here. I’m happy to be representing New Era, and it’s an interesting topic — one that probably many companies are looking into as AI explodes across the customer experience landscape.
**Kristian McCann:** Absolutely. And with AI, it seems to be everywhere, and within different parts of businesses, different operations. So some people may just be listening thinking, let’s get a grounding — what security considerations are the most important when it comes to putting AI into a contact center?
**Matt Kamish:** Yeah. I mean, I think when you first start and you’re getting up and running, the biggest consideration always remains your customer data. I think that’s the most important. We’ve all heard about breaches and things that go on. But if you look at the three points I would point to right out of the gate, they’d be: protecting your customer data, enforcing strict access controls — so who gets that data — and then, obviously the obvious one, preventing the threats that happen. And the question always is, well, how do you address those? How do you handle those? The first one I’d say is there are practices out there around data minimization — put in practice things that restrict where AI can go and explore, and really limit what AI can get to. So when you talk about things like least-privilege access, that means only letting AI get exactly what it needs to answer that question or handle that transaction. Those are the rules you can put in place about where AI can play. You can put in safety nets like redaction, so PII information like names and account numbers never gets through. Then I’d also add implementing strong identity access management — that’s very key, so who can actually look at what. And the final piece, on that overarching bridge, is the security of the pipeline — make sure you have encryption in place so that whether at rest or in transit, the data is always fully encrypted.
**Kristian McCann:** Okay, well you mentioned loads of great takeaways there for companies to deploy. Let’s say they’re looking at these kinds of systems to integrate — how can they be sure that they’re picking the right tools, the systems, or the integrations that are meeting these security standards?
**Matt Kamish:** Yeah, that’s another good question. I think it starts with, as you just noted, assessment of your vendors. When you start implementing AI, especially in the contact center, you need to look at all the touchpoints, all the back-end systems that will ultimately have data flowing in and out of those interactions — which you already have with human interactions today. Now, when you’re layering AI into it, you need to be even more diligent about what those are. So I’d say put strict rules in place around security, encryption, access controls — you’ll hear me use the word “guardrails” a lot in this discussion — but make sure you have guardrails around continuously monitoring and aligning with things like SOC 2, ISO 27001, GDPR, and HIPAA as well. When you talk about preventing issues, or making sure you have your ducks in a row before you go forward, it’s really about doing strict vendor reviews, making sure the data handling practices are buttoned up. Again, I use the phrase “least-privilege access” a lot — making sure only the right people have access, only the right AI interactions have the right access. And even with your partners, make sure you have contractual guardrails in place around data usage, storage, and ultimately model behavior. And again, one of the things you’ll hear me say a lot is continuous monitoring of what’s going on — I can’t stress enough that it isn’t something you just turn on and walk away from. You have to continuously look at it.
**Kristian McCann:** Well, you talked a lot about guardrails and model misuse. I think we’ve started to see some contact center chatbots go famous recently for, you know, offering major discounts or perhaps spilling over some customers’ information from a past conversation. That’s one way a lot of people might see AI being misused or manipulated. So I was wondering — how can organizations really prepare for that in their contact center?
**Matt Kamish:** I think really, when you look at it, this kind of bridges from how I finished the last question — it’s real-time and regular management. One of the biggest things I’d say is make sure you segment all your AI systems and databases. When you start hearing about those tragic situations, breaches, whatever have you, you’re trying to reduce the blast radius, if you will. So keep segmentation at the forefront of everything you’re doing. You need to put in guardrails around prompt injection — there are bad actors out there, we see it all the time. Prompt injection is where someone comes in and tries to manipulate and fool your AI systems into allowing them to get data they’re not supposed to have. You can put guardrails in place for that. I think you also look at guardrails for restricting API calls — only let the AI system make calls into the specific APIs it’s allowed to, obviously to grab data it’s allowed to access. So in short, it’s really putting a lot of structure and guardrails around the data, and that prevents bad actors from getting in there and manipulating the system.
**Kristian McCann:** Absolutely. Well, it’s really important — you mentioned only allowing AI to connect to the right API to get the data it needs. But how can an organization really understand what is needed versus what isn’t, and how can they segment it so that AI is really only drawing what it needs for that conversation within a customer interaction?
**Matt Kamish:** Yeah, that’s the big thing — and this is going to sound simple, but it’s not. I kind of look at it as three things: limit what AI can see, limit what it can retrieve, and also what it can retain. So, control what AI can access — again using data minimization protocols, not letting personal data get out, redaction of personal information, tokenization, where you can implement or inject sort of “false” information but still allow the AI to gather the data it wants — and then role-based access as well. As humans, we all know that when we’re logging into a laptop or gathering information, we have single sign-ons or multiple authentications. You can do the same for AI — you need to set up rule-based access to make sure it only gets what it can get, when it needs it. And then the last point is retention — block AI from storing raw customer data, enforce those retention policies, make sure you’re on top of them, and you can use techniques like differential privacy to prevent model memorization. There are techniques out there you can implement within your practice that will not allow AI to remember critical data elements or people’s personal information.
**Kristian McCann:** Okay, well these are great ways to really bring AI in with a nice layer of protection. However, as we all know, models drift — things change, especially in a big tech stack. You might not always know if your AI is staying true to how you originally planned it. So how can you monitor your AI in your contact center once it’s there, and what would an effective monitoring system look like?
**Matt Kamish:** Yeah, that’s a huge part of this. In one word, I’ll say: continuous. That’s a simple word, but it’s not something that, once you implement AI, is a one-time event — it’s continuous. You have to have continuous policies in place. Real-time behavior monitoring — track AI’s decisions and actions, flag anomalies that come up, use your tools to detect signs of manipulation or attempts to bypass the rules. Monitor every data request AI makes through logs and transaction logs, validate what it’s searching for, go back and look at what it’s asking for — that’s the auditability and compliance part of it. Make sure you’re reviewing the data it’s pulling so it’s not pulling critical information it shouldn’t. Finally, model performance and drift — test for accuracy, test for biases, test for misbehaviors. There are things you need to continuously monitor as AI is operating in your system. So the one main message I’d give is: it’s not a one-time event, it’s continuous, and you need to continually look at, monitor, log, and track how AI is responding in your environment.
**Kristian McCann:** Wow, absolutely. Well, you really said it’s not a one-time event, not a “one and done.” So when AI is within a company’s contact center, how should they really start thinking about governance and accountability, especially as they deploy or expand beyond their initial AI deployment?
**Matt Kamish:** Yeah, I’d tell you that effective governance — as a company starting to implement AI, you’re going to want a group that owns AI governance. That’s about putting strong controls in place, transparent oversight, and a culture that treats AI as a supervised system, not a tool. So: ownership, guardrails, oversight, risk management — and I’d just sum up the whole thing as: build a culture of responsible AI usage. We all use AI today, and when you start talking about agents in a contact center, develop safe AI rules, be transparent with your customers that AI is involved. That’s one thing I think is very important today, because your customer base has varying ages calling into contact centers or trying to self-help. Make sure you’re communicating with your customers that you’re using AI now as part of your core communication methods, to help them self-help and provide better, more delightful customer experiences. But I think it’s important that you communicate that with your customers, so they feel comfortable knowing they’re dealing with an AI tool as they try to solve whatever problem brought them to the call center.
**Kristian McCann:** Yeah, absolutely. And as we’ve seen in the EU, the new EU AI Act is in fact making some of these things mandatory. So there’s a lot to keep in mind when deploying AI in your contact center on the governance side — but you’ve given us a really great rundown. So, Matt, thank you for joining us today.
**Matt Kamish:** It’s been a pleasure. Thanks for having me, Kristian.
**Kristian McCann:** And thank you to our audience. If you’ve enjoyed this discussion, don’t forget to like, comment, and subscribe to stay in touch with more great videos like this. I’m Kristian, from UC Today, and until next time, we’ll see you then.
Click Here For The Original Source.
