Session speaker's abstract

---

"The AI Governance Readiness Gap: Why Risk Registers Aren't Enough"

Organizations are rapidly adopting AI governance frameworks, publishing responsible AI principles, and establishing risk registers. Yet many struggle to translate those governance artifacts into meaningful operational practices. The result is a growing AI governance readiness gap: organizations have documented what they intend to do but have not built the capabilities, processes, and organizational structures required to execute it.

This session examines why governance programs frequently stall after policy development and explores the organizational, operational, and cultural barriers that prevent effective implementation. Drawing on lessons from regulated and mission-critical environments, attendees will learn how governance must extend beyond oversight committees and compliance activities to become embedded within security programs, technology operations, and business decision-making processes.

Participants will leave with a practical framework for assessing organizational readiness, identifying implementation gaps, and moving AI governance from documentation to execution. Rather than focusing solely on compliance, the session will provide actionable strategies for building governance capabilities that support both responsible AI adoption and operational success. 

Key Takeaways:

Assess whether your organization is truly ready to operationalize AI governance.

Identify the most common implementation failures that cause governance programs to stall after policy development.

Apply practical strategies to embed governance into day-to-day operational and decision-making processes

"Governing AI Agents That Take Real Enterprise Actions: Controls, Auditability, and Human Review"

"Why Most AI Fails—and How CIOs Make It Stick"

"Designing and Sustaining an Effective AI Governance Program"

---

"Navigating the New Reality: Over-Permissioning and Copilot Implementation"

The arrival of Microsoft 365 Copilot has transformed "security by obscurity" into a major liability. Because Copilot respects existing user permissions, it can instantly surface sensitive data—from payroll spreadsheets to HR files—if they are improperly shared across your tenant. This session explores the technical and cultural "new reality" of over-permissioning and provides a battle-tested blueprint for a secure rollout.

We will walk through a real-world case study of a "Zero to Copilot" implementation, detailing how to identify "Everyone" group sprawl, implement sensitivity labels, and move from a risky open environment to a governed AI-ready enterprise.

Key Takeaways:

Proper permissioning

ROT cleanup

Content classification are key to AI preparedness.

"From Exposure to Enterprise Governance: Building an Information Strategy That Scales"

When a risk assessment revealed significant gaps in how Consero managed and governed sensitive data across its enterprise, the company faced a choice: patch the problem or transform the practice. They chose transformation.

In this joint case study, Valora Technologies and Consero Global share how they partnered to gain full visibility into enterprise content, classify and remediate sensitive data exposure across platforms including Google Drive, and establish a durable governance framework designed not just for compliance, but for competitive advantage.

Attendees will hear how data discovery at scale informed a practical roadmap for governance maturity, how Consero Global is preparing its data environment for AI-driven use cases including sentiment analysis, and how a planned migration to SharePoint fits into a broader modernization strategy.

Join Sandy Serkes, CEO of Valora Technologies, and Tyler Nelson, CIO & Chief Corporate Development Officer at Consero Global, as they share the lessons, the trade-offs, and the tangible business impact of turning a risk moment into a governance blueprint. 

Key Takeaways:

Standing up an IG program

---

“AI Program Blueprint:  The Artifacts”

"AI Workforce Readiness"

This will be an interactive lecture and style presentation which will engage the audience via active participation (gesture and ask/response). The session begins by clarifying what organizational change management is, and how AI introduces new dynamics by shifting roles, disrupting workflows, and creating capability and trust gaps. We then explore the value of workforce readiness assessments in identifying baseline required knowledge and skills, trust levels, communication needs, and training requirements. Finally, the session covers practical change management elements for preparing staff such as early engagement, clear WIIFM messaging, tailored training, and continuous monitoring—while highlighting common pitfalls such as weak governance and unmanaged resistance that can undermine successful adoption.

Key Takeaways:

Why workforce readiness is foundational to successful, responsible and ethical AI adoption.

Why workforce readiness assessments are critical in uncovering the people related skill, process and governance requirements and gaps prior to implementation.

How preparing employees in advance can build trust, increase adoption and reduce risk.

"Mixing Your IG Mission and Message for the Crowd, OR How To Get Your Vocals Heard Across the Roar!"

In numerous organizations, the mission and messages of the information governance (or records and information management) program may not be effectively communicated to staff, leaders, contractors, and other stakeholders. There are many reasons for this including the priority, or lack thereof, given to your program, IG staff skill in communication, budgetary constraints, you name it. This presentation will provide the attendees with a wide variety of ideas and potential tools and methods to seek out within their organizations that can be used to improve their odds of having their IG voices heard above the roar of the crowd, thus raising awareness of your IG mission, vision, methods and resources. In addition, in today's political climate where many regulations may be rolled back, the orientation of IG, and RIM as well, may need to become more oriented on mission of the organization, and making sure your IG mission (and communications) focuses on making, or keeping, operations more efficient and effective, as opposed to a focus on compliance. This imperative has always existed within the RIM and IG spaces but focus on it may be increasing soon.

This presentation will provide the attendees with a wide variety of ideas and potential tools and methods to seek out within their organizations that can be used to improve their odds of having their IG voices heard above the roar of the crowd, thus raising awareness of your IG mission, vision, methods and resources. In addition, in today's political climate where many regulations may be rolled back, the orientation of IG, and RIM as well, may need to become more oriented on mission of the organization, and making sure your IG mission (and communications) focuses on making, or keeping, operations more efficient and effective, as opposed to a focus on compliance. This imperative has always existed within the RIM and IG spaces but focus on it may be increasing soon.

Key Takeaways:

Find and use the communications tools that your organization may already have, including how to build a broad network of IG stakeholders that will help spread your program's messages.

You may need to ask leaders across the enterprise how you can help them improve IG in their business units. You may not be the only source of IG information for staff.

The business of your enterprise is not likely to stay the same, why should your program be any different - Keep it Fresh!

Joint session: "Sought, Fought, or Forced: which industries are embracing AI Governance and Readiness? A Consultant and Counsellor’s observations"

As organizations race to adopt artificial intelligence, many find themselves at a crossroads: some run toward AI Governance and Readiness as a way to accelerate adoption with confidence, while others run away from it, viewing governance as a barrier to innovation. This session offers a candid, practitioner‑level look at how organizations are navigating that tension, grounded in real‑world consulting and advisory experience across industries.

The presentation begins with an accessible overview of the core concepts of AI Governance and Readiness, including what it means to develop, deploy, and use AI systems that are free of bias, explainable, interpretable, transparent, and supported by meaningful human oversight. It then examines the rapidly evolving regulatory landscape, highlighting emerging U.S. federal and state requirements, industry‑specific obligations, and global frameworks that are reshaping expectations for responsible AI.

Drawing on client observations, the session explores which industries are seeking out governance as a strategic advantage, which avoid it as a constraint on innovation, and which are being forced by regulators to adopt governance programs. Attendees will gain insight into which governance concepts—such as anti‑bias controls, explainability, interpretability, transparency, and oversight—are gaining traction and which continue to present operational and cultural challenges.

The session concludes with a discussion of the forces driving organizations to “run toward” responsible AI, including regulatory pressure, ethical commitments, reputational concerns, and the recognition that governance is essential for sustainable, trustworthy AI adoption. 

Key Takeaways:

A better understanding of how real-world industries are doing “responsible AI”

Attendees will leave with a clear grasp of the core elements of AI Governance and Readiness—bias mitigation, explainability, interpretability, transparency, and human oversight—and how these concepts translate into real operational practices.

Insight into how different industries face different AI governance pressures

Participants will learn which sectors are embracing governance as a competitive advantage which view it as a constraint, and which regulators leave with no choice.

A grounded view of the forces shaping AI adoption today.

The session will clarify the cultural and operational factors driving those differences, looking at how different regulatory, ethical, and reputational structures lead industries to seek out, or resist AI readiness and governance, while others are left with no choice.

"Guardians of the State: How We Built an Air-Gapped AI Fortress for Consumer Data"

As financial fraud accelerated and criminals began using AI tools to generate synthetic identities, voice clones, and high‑velocity scams, the California Department of Financial Protection and Innovation faced a defining question: Can a government harness advanced AI without exposing some of society’s most sensitive data to the internet?

This session tells the inside story of how a state regulator built a fully air‑gapped, sovereign AI platform capable of analyzing massive evidence files, detecting fraud patterns, and accelerating investigations—all without allowing a single citizen record to leave the building. Drawing on real production lessons captured in the DFPI keynote materials, participants will see how the team confronted the “no‑internet paradox,” where powerful AI requires constant context but government cannot risk external exposure. 

Attendees will learn how DFPI engineers designed a multi‑layered fortress architecture that includes structured ingestion pipelines, identity‑blind reasoning, open‑weight models, hardware‑enforced one‑way data diodes, and strict human‑in‑the‑loop oversight. The talk also highlights a core principle echoed throughout internal drafts: trust is not a policy—it is an architectural property, achieved through verifiable constraints, not vendor promises. 3

Finally, the session moves beyond technology to explore the psychological and organizational transformation: how investigators went from drowning in paperwork to receiving same‑day leads, and how a system designed for security became a platform for renewed public trust. This is not simply a story about AI adoption—it is a blueprint for sovereign, high‑integrity AI systems in government agencies where failure modes affect real people’s livelihoods.

Participants will leave with actionable design patterns, governance frameworks, and architectural strategies for building AI that is fast, private, trustworthy, and resilient—an AI infrastructure worthy of the citizens it protects.

Key Takeaways: 

Trust must be engineered, not assumed.

The DFPI’s experience shows that trust in government AI cannot rely on cloud contracts or compliance labels. It must be enforced through architecture—air‑gapping, one‑way diodes, identity‑blind processing, and full auditability. 

Sovereign AI is essential for protecting the public. Government agencies increasingly require AI systems whose intelligence runs entirely inside their own walls. Open‑weight models, internal inference, and zero‑telemetry design enable high‑performance AI without ever surrendering consumer data. 

The real future of government AI is infrastructure‑level intelligence. Agencies won’t just use AI—they will build it as part of their core civic infrastructure. As highlighted in your materials, the AI era is transforming not just workflows but the very foundations of public governance, allowing institutions to evolve into resilient, self‑reliant, intelligence‑driven systems that protect society at scale.

"Between Systems Lies the Risk: The Missing Control in Data Governance"

Mortgage institutions operate some of the most complex data ecosystems in financial services. Loan origination systems, servicing platforms, capital markets infrastructure, regulatory reporting environments, analytics platforms, and AI initiatives exchange data continuously across hundreds of integrations. For years, most governance programs relied on policies, stewardship structures, metadata catalogs, and data quality monitoring to manage this complexity. While these tools improved transparency, they did not address the question regulators, risk officers, and boards increasingly ask:

Can the institution prove that the data used to make decisions is correct across systems?

In large financial institutions, inconsistencies frequently emerge as data moves between systems through integrations, transformations, and replications. These inconsistencies can propagate silently across reporting environments, risk models, analytics platforms, and AI pipelines—creating operational risk, regulatory exposure, and uncertainty around enterprise decision making. This case study examines how a large mortgage bank addressed this challenge by implementing cross-system reconciliation controls and enterprise data feedback loops designed to continuously validate data integrity across its architecture. The initiative embedded automated comparison controls across critical operational and analytical systems, enabling continuous validation of data consistency, automated exception detection, and workflow-driven remediation processes. Governance metadata was integrated to prioritize high-risk data flows tied to regulatory reporting, risk management, and AI-driven analytics. From the perspective of the Chief Risk Officer, regulators, internal audit, and board oversight, the program transformed how the institution managed enterprise data risk. It strengthened regulatory defensibility, reduced operational risk, automated previously manual reconciliation processes, and provided leadership with transparent evidence of data integrity across systems. Participants will see how continuous reconciliation can transform fragmented data validation practices into a scalable enterprise control architecture capable of supporting AI-ready governance, regulatory accountability, and risk-informed decision making.

Key Takeaways:

Why traditional governance programs often struggle to satisfy regulators and audit when proving data integrity

How governance metadata helps prioritize critical regulatory and risk data flows

How boards and regulators gain transparent visibility into enterprise data integrity risk

---

---

---

"Generative AI: It's All About the Prompt."

---

---

"Your AI Passed the Bar Exam. Your Governance Didn't: What Legal Teams Must Do Before AI Agents Inherit Their Privilege"

Your organization's AI agents are already inside the building — pulling contract data, running document review, drafting memos, and touching privileged communications that took decades of case law to protect. The question is no longer whether legal teams will adopt AI; it's whether they'll govern it before a court, a bar ethics inquiry, or a data breach forces the issue. In United States v. Heppner, a federal judge ruled that using a consumer AI tool destroyed attorney-client privilege — not because AI is inherently incompatible with privilege, but because the data wasn't protected. This session maps the legal obligations that attach the moment your AI tools touch client data: what the 2026 case law actually says, where ABA Model Rules create personal exposure for counsel, and what "defensible AI governance" looks like in practice — before the audit, the breach, or the motion arrives.

Key Takeaways:

Privilege isn't automatically lost when AI touches client data — but in Heppner, it was lost because the tool wasn't governed, not because AI itself is incompatible with privilege. The fix is architectural, not aspirational.

ABA Model Rules (1.1, 1.6, 5.1/5.3) attach personal exposure to the supervising attorney, not just the firm — so "the vendor's AI policy" isn't a shield if counsel can't show they understood and controlled the tool.

Defensible governance means being able to answer "which agent touched which privileged file, authorized by whom" in hours, not weeks — that evidentiary readiness is what separates firms that survive a bar inquiry from those that don't.

---