Agenda

With AI systems processing vast amounts of personal data, is the current GDPR framework still sufficient, or does it need a reboot?

Moderator

• John Byrne, CEO & Founder of Corlytics

Panelist

• Dr. Nathalie Moreno, Partner, Data Protection, Cybersecurity & AI at Kennedys
• Gillian Cossey, Data Protection Officer, Virgin Atlantic Ltd
• James Robson, Data Protection Officer, The Labour Party
• Eleonor Duhs, Barrister, Partner, Head of Data & Privacy, Bates Wells LLP

The year 2027 is increasingly seen as a potential inflection point in global politics, security, and economics. This prospective shock could be the 'perfect storm' of geopolitical risk, driven by a convergence of great power rivalries, national-level political instability, economic fragility, and thematic risk accelerators. During this session, Sibylline's founder and CEO, Justin Crump will delve into the current trajectories and risk indicators, examine the drivers, possible scenarios, and discuss mitigation strategies business can consider.

Speaker

• Justin Crump, CEO, Sibylline

Moderator

• TBA

Panelist

• Sarah Gee, Group DPO, Revolut

The UK Government’s plan to roll out a national digital ID — the so-called “BritCard” — by the end of this Parliament has reignited one of the country’s most polarising debates. Ministers argue it will streamline access to public services, cut fraud, and curb illegal migration. Supporters see it as the missing link for modern, tech-enabled governance and smarter digital services. Critics, however, warn of mass surveillance, privacy erosion, cybersecurity risks, and exclusion for vulnerable groups.

With more than two million citizens signing a petition against the scheme, and even potential contractors like Palantir refusing to participate, the question remains: can digital ID be implemented in a way that builds trust rather than fear? This session brings together voices from government, technology, privacy advocacy, and digital innovation to debate whether BritCard represents progress or overreach — and what a truly trusted identity system should look like in the UK.

Moderator

• Eleonor Duhs, Barrister, Partner, Head of Data & Privacy, Bates Wells LLP

Panelist

• Alexander Iosad, Director, Government Innovation, Tony Blair Institute
• David Rennie, Chief Trust Officer, Orchestrating Identity
• Elizabeth Anderson, CEO, Digital Poverty Alliance
• Mark Anderson, Insightful Technology
• James Baker, Platform Power and Free Expression Programme Manager, Open Rights Group

What distinguishes organisations that respond well when a real crisis hits - the kind that’s fast, messy and deeply public? This year’s events have served as reminders of the fragility of established, highly trusted organisations – from international airports to national retailers – to major disruption. System failures and their handling can hinder the ability to continue operations and undermine trust of stakeholders including customers, employees, suppliers, governments and regulators, leading to financial losses, public scrutiny and a decline in brand reputation in a matter of days. Crisis doesn’t arrive neatly - it disrupts leadership, exposes assumptions, and accelerates organisational risk. The businesses that respond best are those that have trained for the real thing, and can respond in the moment, dynamically, not just written plans for if they may need to do so. Andy and Claire will show that real resilience is a capability that can be taught, drilled and deployed. They will present an approach that draws on decision-making models developed in high-risk environments (incl. military, emergency services, aviation), which are designed to force clarity, coordination and accountability under pressure, providing leaders with a logic for action when information is incomplete, time is limited, and consequences are long- term.

This session will explore:

• How risk boards and senior leaders become underprepared for the speed of required decision-making in high-profile crises - the predictable failure modes and what to fix first.
• How corporate leaders can adopt models used by high-risk environments - incident command translated for the board.
• How teams can be trained - build muscle memory for crisis response.
• How systems are tested and strengthened - crisis audits, realistic war-gaming, playbooks, regulator and stakeholder interface testing, and capability metrics to track progress.
• Analysis of real-life examples against effective crisis response models

Keynote Speakers

• Claire Davidson, Founding Partner, DRD
• Andy Roe, Former Commissioner of the London Fire Brigade

The threats are faster and smarter. How can you build fraud detection and anti-money laundering frameworks that keep up?

Moderator

• Mateo Jarrin Cuvi, Global Manager for Partners & Media, The Associate of Governance, Risk & Compliance

Panelists

• Gira Bhatt, Anti Financial Crime Specialist, China Construction Bank Corporation (UK)
• Amy Cleall, Commercial Director EMEA, Flagright
• Luke Louca, Ambassador, Managing Director - Chief Strategist - Suisse Hedge Fund, Non-Executive Director and Advisory Portfolio

As AI reshapes the financial and corporate landscape, senior risk professionals face a new frontier: harnessing its power responsibly while ensuring organisational readiness under the EU AI Act. The future of effective risk management won’t be defined by who adopts AI first, but by who governs it best — and who empowers their people to use it confidently. In this session, Gary, Managing Director EMEA at Protecht, explores how a governance-first approach, underpinned by AI technology, can transform every employee into an active participant in managing risk. Attendees will discover how combining robust AI guardrails with tools like Protecht’s Cognita enables safer, smarter, and faster decision-making across all levels of the organisation.

Gary will share practical insights into operationalising the EU AI Act, embedding AI into GRC frameworks, and creating a culture where AI becomes a trusted virtual partner — not a compliance threat. This is the roadmap for turning governance into growth and automation into empowerment.

By the end of the session, CROs and Heads of Operational Risk will:

1. Bridge Regulation and Innovation
2. Understand how to align AI governance with the EU AI Act while enabling agility, accountability, and transparency
3. Operationalise safe AI adoption
4. Learn how to apply frameworks and guardrails that let teams harness AI’s benefits responsibly — including continuous monitoring, explainability, and human oversight.
5. Empower every employee through AI technology
6. See how tools like Cognita embed AI insights directly into GRC workflows, guiding decisions and improving engagement “in the flow of work.”
7. Build a sustainable, risk-enabled culture
8. Discover how AI can elevate risk awareness, support human judgement, and turn compliance into a driver of performance and trust.

Speaker

• Gary Lynam, Managing Director, EMEA, Protecht

How organisations can break down silos and manage intersecting risks across data, digital threats, and illicit finance.

Moderator

• Frank Brown, CEO, GRR Consulting

Panelist

• Asim Khwaja, Cyber Risk & Policy, UK Gov (*all views personal, attending in personal capacity)
• Anish Amin, Management Liability Innovation Leader, Marsh
• Mike O’Keefe, General Manager, Corlytics

By January 2026, UK-listed boards must make an explicit annual declaration on the effectiveness of their internal controls under Provision 29 of the revised Corporate Governance Code. More than a box-ticking exercise, this represents a governance tipping point—shifting the focus from whether controls exist to whether they actually work, are monitored effectively, and backed by credible evidence.

This presentation explores how to move from policy to proof. Stefan will examine the “dress rehearsal year” of 2025, how to define and prioritise material controls, map them to enterprise risks, and build structured assurance plans. Stefan will also consider how boards can avoid information overload by distilling reporting into a clear “approach on a page” view.

Speaker

• Stefan Gershater, Head of Risk and Governance, Co-op

From workforce shortages to patient safety, this session examines the top risks healthcare providers face and how governance models are evolving to manage them effectively, particularly with increased digitalisation and AI in clinical settings.

Moderator

• Richard Harrington, Counter Fraud Expert, Researcher

Panelist

• Jonathan McKee, Head of Information Governance, Moorfields NHSFT
• Aung Tun, IG Manager/IG lead, St George’s University Hospitals NHS Foundation Trust

Global disruption, cyber threats, and geopolitical instability have pushed supply chain resilience to the top of every risk leader’s agenda. This panel explores how organisations can move beyond traditional, inward-looking risk management to build end-to-end visibility and agility across complex supplier ecosystems. From mapping critical dependencies and managing third-party cyber risk to fostering trust, transparency, and sustainability, our experts will discuss how to strengthen supply chain resilience in an era of constant uncertainty.

Moderator

• Alex Hindson, Partner, Head of Sustainability, Crowe UK

Panelists

• Cameron Brown, Head of Cyber Threat and Risk Analytics, Ariel Re
• Oliver Cronk, Technology Director, Scott Logic

Growing geopolitical instability increasingly affects businesses in a widening range of ways, but risk governance and management approaches in many firms have not evolved to deal with this. In this session, Derek Leatherdale will explore the challenges risk teams face on this agenda, what better approaches entail and offer insights into how risk & resilience leaders in other firms are reinforcing their strategic influence by driving work on geopolitical issues

Speaker

• Derek Leatherdale, Geopolitical Risk Adviser, Sibylline & Former HSBC Risk Pioneer

Donald Trump’s return to power is not a single-issue shock - it’s a compound risk event touching trade, finance, public health, climate, human rights and the very institutions that enforce rules. Beyond headline tariffs, rapid deregulatory moves and weakened enforcement can leave markets, consumers and vulnerable populations exposed; rollbacks in environmental and public-health safeguards threaten cross-border cooperation and long-term resilience; and shifts in foreign policy and sanctions posture can destabilise alliances and supply chains. Recent trends - from falling regulatory enforcement to reported retrenchment in anti-trafficking efforts - show how policy choices cascade into economic, social and geopolitical harm.

This session will trace those interconnected risks and ask the hard questions: how do businesses, regulators and civil society defend against rapid policy drift and political unpredictability? We’ll examine practical scenarios — market shocks from trade measures, regulatory vacuums in finance and healthcare, erosion of anti-trafficking programmes, and the spread of misinformation that undermines public trust - and surface tools for resilience, from contingency planning and cross-border cooperation to legal remedies and reputational risk management. Expect frank debate about what Europe must do now to hedge, respond and hold partners to account.

Moderator

• Claire Penketh, Senior Policy and Public Affairs Manager, BCS, The Chartered Institute for IT

Panelist

• Sacha Deshmukh, Chief Executive, Amnesty International UK

• Ziya Meral, PhD, Lecturer, Consultant, Research & Programmes, Defence, Security, Global Trends, Risk; Visiting Fellow, Royal Navy Strategic Studies Centre

• Oliver Sawbridge, Senior Manager, Trade and Geoeconomics, The Economist Group

• Aaron Kalvani, Independent Global Advisor on AI Ethics and Governance

In this keynote, Jesse Tayler — inventor of the App Store and founder of TruAnon — traces the evolution of digital trust, from protecting app and music rights in the early internet to today’s challenges in identity and fraud prevention. Drawing on decades at the intersection of technology, security, and innovation, Jesse connects the dots between consumer tech, anti-fraud principles, and the frameworks that now protect our data, users, and systems.

Speaker

• Jesse Tayler, Founder & CTO of TruAnon, Inventor of the App Store

In an era of instant news, social media amplification, and rising stakeholder expectations, organisations face relentless scrutiny. From public data breaches to employee activism and customer backlash, reputation can be damaged overnight. This session explores how governance frameworks, transparent communication, and strong data controls can help leaders anticipate risks, navigate crises, and safeguard trust in the age of radical transparency.

Moderator

• Marilia Aires, Legal Counsel and Data Protection Officer, Nova Compliance Lab

Panelist

• Dan Rhodes, Senior Director, Legal and DPO, Granicus
• Alistair Cole, CEO, Privacy Culture
• Erika Eliasson-Norris, CEO of Beyond Governance, Author and Governance Assessor to the Post Office Horizon IT Inquiry

The global hospitality sector prides itself on service and discretion - but those same traits can make hotels and franchised brands unwitting hubs for organised crime. Across Eastern Europe, trafficking networks are exploiting legitimate hotel and rental infrastructures to move victims and launder profits under the guise of ordinary business. From opaque ownership structures to minimal staff oversight, the intersection of human exploitation and financial crime is becoming harder to detect - and harder to deny. This panel brings together investigators, compliance experts, and industry insiders to expose how the business of comfort and convenience can mask coercion and corruption. We’ll examine recent cases linking franchised hotels to trafficking rings, the red flags of money laundering in hospitality, and the compliance blind spots that let abuse thrive in plain sight. What responsibilities do brands, regulators, and financial institutions share — and how can transparency and technology help shut the door on this hidden economy?"

Moderator

• Simran Bharaj, Economic Crime (Pro Bono Consultant), STOP THE TRAFFIK

Panelist

• Quetzalli Cruz Sosa, Advisor - Human Rights in Supply Chains, Hope for Justice & Slave-Free Alliance
• Neel Chakrabarti, Co-Founder, The Praetorian Global
• Sam O'Reilly, OSINT Investigator, Canada Anti-Human Trafficking Consortium

This keynote introduces the Enterprise-wide AI Risk Management (EW-AiRM) framework — a groundbreaking evolution of traditional Enterprise Risk Management (ERM) principles for a world increasingly shaped by Artificial Intelligence (AI).

Focusing on practical implementation, the session explores how EW-AiRM can be applied, adapted, and tailored to meet organisational needs in today’s rapidly evolving, AI-augmented business environment. Building on established ERM methodologies (COSO/ISO), EW-AiRM integrates the MIT AI Risk Taxonomy and its seven risk domains, providing a comprehensive structure for identifying and mitigating AI-related risks. Attendees will also gain insight into effective mitigants for each domain to help reduce residual AI risk to an acceptable level.

Speaker

• Prof. Markus Krebsz, UN/UNECE, Project Lead for AI and other Digital Technologies, The Human Ai Institute, Founding Director