Programme

AI governance in practice is rarely the clean, framework-driven exercise the textbooks describe. Organisations typically deploy AI tools before governance structures are fully established. Drawing on her experience building governance across EMEA, Telma explores how to identify existing AI use cases, assess jurisdictional risks, engage stakeholders, and create governance approaches that enable rather than impede business operations — the messy, difficult, necessary work of building the plane while flying it.

Policies and documentation alone do not create compliance. Organisations need to build systems and processes to ensure privacy actually functions in practice.

Agentic AI acts independently: executing code, calling APIs, modifying databases, and making operational decisions with minimal human intervention. As organisations move toward autonomous AI systems, they must adapt their risk management and data protection approaches accordingly. This session equips privacy, AI, and security professionals with practical strategies to govern, monitor, and secure autonomous AI systems in enterprise environments.

Data protection and AI governance teams are often working with the wrong tools or on shaky infrastructural foundations — inherited systems, vendor lock-in that limits flexibility, or off-the-shelf solutions that were never designed for the job. This session examines the technological and organisational trends that lead to these challenges, as well as the practical consequences: where the mismatch between infrastructure, tools, and goals creates friction, gaps, and compliance risks.

Alexander Hanff will present the findings of his research into website tracking based on a forensic audit of 100 of the top 200 global websites. His work highlights issues around consent and the ubiquitous surveillance taking place across the majority of the web despite laws designed to prevent it. This session is a preview of his upcoming white paper which will be published the same day.

How does the NIS2 Directive relate to GDPR’s principles of integrity, confidentiality, availability, and accountability? As NIS2 is implemented into national law and cybersecurity authorities gain expanded powers, this will significantly affect both GDPR compliance efforts and enforcement activities across organisations. Koen examines the regulatory interplay and what it means in practice.

AI governance is not a single policy or a one-time audit — it is a stack of tools, processes, and decisions that must work together. Tea Mustać draws on her experience at the intersection of law, regulation, and technology to walk through how organisations can build a practical, coherent AI governance stack that holds up under scrutiny and scales with the business.

The DPO role can be an isolating one — but it need not be. Drawing on her own experience, Audrey examines the value of professional networks, trusted friendships, and having people you can turn to when you don’t have all the answers. A candid account of how professional connections have helped her overcome imposter syndrome, build confidence, and recognise that this work is better done together.

Magnifica humanitas is the first encyclical of Pope Leo XIV, concerned with “safeguarding the human person in the age of artificial intelligence”. It was published on 25 May 2026. Rogelio will be sharing his perspectives on reading Magnifica Humanitas from a data protection vantage point.

Being a Data Protection Officer means sitting at the crossroads of legal obligation, organisational pressure, and interpersonal conflict — often with little support of your own. Drawing on mediation and risk management, Paula shares practical strategies for managing conflict with opposing parties and difficult personalities, while protecting your own wellbeing and self-preservation in a role that so rarely protects you.

Ethics is the process of justifying the best reasons for action. It asks us to step back and consider: of all the ways we might act, which is best and why? This process is often challenging and confronting, requiring diverse inputs, rigorous thinking, and the courage to take action in alignment with the values we hold most dear. But it need not take weeks or cost a fortune. Nate Kinch shares a practical approach to AI ethics that can be done usefully in as little as 15 minutes.

A discussion on which practices are necessary to uphold legal compliance and, at the same time, which activities actually do the job of getting an overview and being able to work on AI governance in practice.

Eirik gives real-life examples and reflects on what worked, and what didn’t, when building data protection structures from scratch in an unprepared and complex organisation.

Data protection law did not emerge from a regulatory committee. It grew from the wreckage of war, persecution, and the systematic abuse of personal information by states. Corné traces the historical foundations of privacy law, examining how those circumstances made privacy a fundamental right and shaped the legal framework practitioners work within today — framing data protection work as meaningful protection, not mere regulatory compliance.

Too often, architecture and security are seen as controls that slow change. This keynote challenges that perception by showing how they can become powerful enablers of innovation, customer trust, and competitive advantage, accelerating digital transformation while protecting what matters most.