Privacy, copyright and AI governance. One room, one day.

The UK remains one of the only major economies without cross-sector AI legislation, relying on a principles-based approach that places no binding obligation on regulators to act. Lord Chris Holmes sets out why he believes that gap needs closing, and what binding rules on transparency, independent auditing and data rights would look like under the AI Authority his Bill proposes to create.

Max Schrems and noyb are currently pursuing GDPR complaints against ChatGPT over fabricated personal data and against Clearview AI over biometric scraping, the latter now escalating toward personal criminal liability for executives. Schrems examines what these cases reveal about AI's collision with data protection law, and why he believes the EU's proposed "simplification" of GDPR would strip away protection at the exact moment AI makes it more necessary.

Traditional data protection assumes a fixed map of what personal data exists and where. Agentic AI breaks that assumption, moving data across tools and workflows with limited human oversight and creating "shadow agents" that governance teams don't know exist. This panel examines what the UK ICO's early guidance means for DPOs in practice, and how privacy teams are rebuilding data governance for systems that never stay still.

The UK's National Cyber Security Centre expects AI to make cyber offence more effective within the next two years, and the same underlying tools are just as capable of powering next-generation defence. This panel examines what the AI-driven threat landscape looks like over the next three years, from automated exploit discovery to AI-generated social engineering, and why strong AI governance, not just stronger security tooling, is fast becoming the difference between organisations that keep pace and those left exposed.

AI systems introduce a security problem existing controls weren't built for: training data that can be poisoned, outputs that can leak information they were never meant to reveal, and models that can be manipulated through the inputs they're designed to accept. This panel examines what securing the model itself requires, distinct from securing the infrastructure around it.

A growing share of AI vendors are not disclosing the AI sub-processors sitting behind their own products, and employees are adopting AI browser extensions, coding assistants and embedded SaaS features faster than procurement can review them. This panel examines what genuine third-party AI risk management looks like when the vendor relationship itself is only the first link in a much longer, largely invisible data-processing chain.

Security agencies including the NSA, CISA and the UK's NCSC have confirmed that adversaries are already archiving encrypted data today, betting on tomorrow's quantum computers to decrypt it. This panel examines what that means for personal and sensitive data with a long shelf life, and what privacy and security leaders need in their cryptographic migration plan before the harvesting window closes.