Session description

Every organisation now has AI inside it, whether or not anyone approved it. In this session I will focus entirely on governance: the policies, controls, and decision points that determine which AI systems get adopted, on what terms, and who is accountable when they fail.

I will start with policy. I will walk through how an enterprise AI use policy actually gets written, reviewed line by line, and pushed through to approval inside a regulated utility, and how frameworks such as OVIC and OECD translate into something operational rather than aspirational.

Next, vendor risk. Before any AI tool enters the business, someone has to answer whether it can be trusted with company data. I will cover how a third party AI risk assessment framework works in practice, how findings are grounded strictly in official vendor documentation, and what a completed assessment looks like when it lands in front of a decision maker.

I will close on the gap which is usually ignored. Organisations maintain application registers for cyber and AI risk, yet teams keep using free websites, browser tools, and low code agents that never make it into any register.

By the end, the audience will have a clear picture of what AI governance looks like when it is actually operating at enterprise scale, not just written down.