UK AI Security & Data Protection Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

The Information Commissioner's Office has signalled clear enforcement priorities around AI, automated decision-making, and children's data . This keynote examines what recent regulatory actions and guidance reveal about where UK organisations are most exposed, and where the ICO is likely to focus next.

• What recent guidance and enforcement activity signal about the evidence and safeguards the ICO expects organisations to have in place before deploying AI in decisions affecting individuals.
• How the Code's requirements are being tested by AI-powered products and services, and what organisations are getting wrong.
• Practical lessons from recent ICO actions on what "reasonable" AI governance looks like in the regulator's eyes, before it becomes a formal requirement.

UK consumers have shown particular sensitivity to AI transparency and data use, shaped by high-profile controversies over algorithmic decision-making in public services and financial products. This keynote explores how that public trust deficit is influencing how UK organisations design and communicate AI-driven products.

• What UK organisations across all sectors are learning from high-profile missteps in algorithmic decision-making within government and public services.
• How UK consumer sentiment is pushing organizations toward explainability and disclosure practices that exceed current legal minimums.
• Practical lessons on communication, opt-out design, and human oversight that are proving effective at maintaining consumer confidence in UK markets specifically.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorized AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organization before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI too.

A hands-on, interactive session working through a real AI security and data protection scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritize spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organizations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real AI security and data protection challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritization so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

As the UK updates its own critical infrastructure cybersecurity requirements in the wake of the EU's NIS2 framework, operators of essential and important services face materially higher expectations for risk management, incident reporting, and supply chain security. This keynote unpacks what's changing and what it demands operationally.

• How an increased range of sectors and organisations are being brought within critical infrastructure cyber requirements, and what that means for organisations newly in scope.
• How new obligations are forcing operators to formally assess and manage cyber risk across their vendor and supplier networks.
• What tightened reporting windows mean for detection and escalation processes, and how organisations are building the internal capability to meet them.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behavior go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

The Information Commissioner's Office has signalled clear enforcement priorities around AI, automated decision-making, and children's data . This keynote examines what recent regulatory actions and guidance reveal about where UK organisations are most exposed, and where the ICO is likely to focus next.

• What recent guidance and enforcement activity signal about the evidence and safeguards the ICO expects organisations to have in place before deploying AI in decisions affecting individuals.
• How the Code's requirements are being tested by AI-powered products and services, and what organisations are getting wrong.
• Practical lessons from recent ICO actions on what "reasonable" AI governance looks like in the regulator's eyes, before it becomes a formal requirement.

UK consumers have shown particular sensitivity to AI transparency and data use, shaped by high-profile controversies over algorithmic decision-making in public services and financial products. This keynote explores how that public trust deficit is influencing how UK organisations design and communicate AI-driven products.

• What UK organisations across all sectors are learning from high-profile missteps in algorithmic decision-making within government and public services.
• How UK consumer sentiment is pushing organizations toward explainability and disclosure practices that exceed current legal minimums.
• Practical lessons on communication, opt-out design, and human oversight that are proving effective at maintaining consumer confidence in UK markets specifically.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorized AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organization before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI too.

A hands-on, interactive session working through a real AI security and data protection scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritize spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organizations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real AI security and data protection challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritization so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

As the UK updates its own critical infrastructure cybersecurity requirements in the wake of the EU's NIS2 framework, operators of essential and important services face materially higher expectations for risk management, incident reporting, and supply chain security. This keynote unpacks what's changing and what it demands operationally.

• How an increased range of sectors and organisations are being brought within critical infrastructure cyber requirements, and what that means for organisations newly in scope.
• How new obligations are forcing operators to formally assess and manage cyber risk across their vendor and supplier networks.
• What tightened reporting windows mean for detection and escalation processes, and how organisations are building the internal capability to meet them.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behavior go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!