Last week, after attending back-to-back conferences, I shared my takeaways from IAB Privacy Compliance Salon. As promised, this week’s newsletter focuses on my notes from the IAPP Privacy.Security.Risk + AI Governance Global conference. Since I only got to attend Day 1, I’m sharing some social posts I find interesting from fellow privacy pros I follow.
Between the keynotes, panels, and coffee cart conversations, I noticed there are a lot of people working very hard to make privacy and AI governance programs work in their companies.
The Future Has a PR Problem
Andrew Yang opened the keynote lineup by sharing what he’s learned from talking with the public about AI. His read: when you poll Americans about the future, the future doesn’t come out looking good.
His message to the room was blunt. People are anxious about where technology is taking them. Those of us working in privacy and AI governance have a tough assignment ahead. We know this, and I hear it time and again when I talk to companies. Laws are changing SO fast it’s hard to keep up. Business teams want to forge ahead, but they don’t always want to change their ways to meet compliance obligations.
All hope is not lost. There ARE companies that want to do the right thing. These companies are spending months reviewing processes and new vendors before they move forward.They want consumers to have good user experiences for consent and privacy rights request submissions.
We privacy pros know that trust isn’t a given. This is what excites me about our job – we’re helping companies keep and earn customer trust. Privacy pros are impacting millions of people, one well-governed decision at a time.
We Have a Seat at the Table. Let’s Use it Well.
A popular session with Ashley Casovan, Barbara Cosgrove, Joe Jones, and Simon McDougall discussed how AI’s place in the headlines has changed the work of AI governance.
Simon offered a helpful reality check. At a conference full of governance professionals, it’s easy to feel like everyone is moving at the same pace. Back at the office, business leaders are still under pressure to get AI out the door quickly. Privacy and AI governance pros influence comes with responsibility, and we need to use it thoughtfully.
Barbara and Ashley pushed further, encouraging the audience to bring this discussion to the boardroom, as boards are responsible for the company as a whole. With AI speeding up competition in every industry, boards and leadership teams feel real pressure to move fast, but one wrong move can be costly. That’s exactly why they need their privacy, compliance, and legal teams in the room to help them make informed decisions.
Executive-level dashboards that track privacy and AI governance program progress, as well as needs and anticipated risks, are what leadership needs to see.
From Policy to Proof
Several sessions kept circling back to the need to have an evidence-based privacy and AI governance program.
- Leadership and accountability: Decision by committee doesn’t move programs forward. These programs need an executive leader and someone who is completely responsible for the outcomes.
- Policy and process: Programs need documented policies and processes that bring the program to life.
- Training: Without hands-on training, policies and processes are just files buried in a digital folder. Work hand in hand with teams to create role-based training.
- AI can help govern AI: Use AI in the governance and compliance areas (and vet it just like any other AI use case).
- Assessments: Privacy and AI governance pros like assessments and for good reason. They are an organized set of questions that help companies evaluate different areas of risk like privacy, security, third parties, AI, etc.
Privacy: Start with the Data Map
Amanda Witt, Celeste James, Christina McCoy, and I closed out Day 1 with a panel on Implementing Guardrails for Agentic AI in HR. I loved the feedback on how practical it was, which was our very mission!
My main theme stressed the importance of mapping the data in the agentic workflow – it’s just like in privacy processing activities. Without it, you can’t figure out the risk, document a risk assessment, identify your vendors or know how to evaluate them, or determine what contractual provisions are needed.
Pre-Conference Workshop: U.S. State Privacy Laws
David Stauss, Founder of Stauss PLLC, led a pre-conference workshop on U.S. state privacy laws, “Your New Compliance Playbook: State Privacy Laws, AI Rules and What to Do Next.”
He shared a great to-do list, and I’m listing a few highlights:
- Review your CIPA exposure. Audit the trackers on your website and confirm your consent management platform is working properly.
- Update data processing agreements to reflect the CCPA regulations and Delaware’s third-party transfer and due diligence requirements.
- Update privacy notices for new state laws taking effect in 2027 and 2028 (Louisiana, Oklahoma, Alabama, and Vermont), and double-check applicability thresholds.
- Confirm whether your company is a data broker under diverging state definitions, and whether New Jersey’s “data collector” rules apply to you before the March 2027 registration deadline.
- Get started on CCPA privacy risk assessments and cybersecurity audits now. Both are due by the end of 2027, with certifications due April 1, 2028, under penalty of perjury.
- Build and refine DSAR responses for new and existing states, including automated decision-making rights like access, opt-out, and human review.
For the full list, check out David’s LinkedIn post.
Stay Human
Journalist Jasmine Sun closed the conference with advice on staying relevant as AI changes how we work. Her point: what sets us apart is being human. Invest in relationships, show up for your community, and be someone people enjoy spending time with. If AI is part of your job, your value has to go well beyond passing along whatever a chatbot produces.
Caitlin Fennessy joked that plenty of attendees had already done their homework the night before at the LGBTQ+ Allies in Privacy party and other gatherings.
Your Five Step Action Plan
- Do the Data Inventory. Data inventories help you comply with privacy laws and are foundational for AI governance too.
- Documentation is your evidence … show your work.
- Collaborate with business teams. Ask: “What could go wrong with a ‘fill in the blank’ project?”
- Create a regular review cadence. Whether that’s reviewing a privacy notice, consent software, product or marketing teams, or whoever is processing the riskiest data in your organization.
- Keep telling the story of why privacy & AI governance matters. Everyone in the organization at all levels needs to keep hearing why privacy and AI governance matters.
That’s a Wrap
Time and again in SO many IAPP post-event posts, people share how great the privacy reunion, running club, after-hours karaoke, and hotel lobby conversations are. That’s also where you might meet your next employer, teammate, client, or privacy or AI governance phone a friend lifeline.
Plan now for your next in-person privacy event. There are local IAPP chapter events, Bar Association Events, Privacy Day in January, and of course one of the biggest reunions out there – IAPP Global Privacy Summit in March in Washington, D.C.
For now, I need some serious rest as Seattle was book-ended by my daughter’s Bat Mitzvah, an out of town family wedding, and my birthday. Pics to eventually come!
Jodi
💡 When you’re ready, here’s how we can help:
⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.
⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.