Essays and briefings on privacy, data, AI regulation, board governance, incident response, and regulated-business risk.
PII is an IT security concept; personal data and personal information are legal concepts. Confusing them weakens privacy, data and AI governance.
AI governance tests whether privacy, data, vendor and risk controls can reach weak AI pathways before the business starts depending on them.
Boards can mistake framework adoption for changed behaviour. The harder test is whether the business now makes different risk decisions.
AI governance cannot be solved by hiring one specialist role. It needs existing privacy, data, risk and technology capability to work together.
Boards miss privacy risk when reporting preserves internal boundaries. Stronger governance gives directors one usable picture while the response can still be shaped.
The 2026 automated decision-making rules will test whether organisations know where consequential decisions are made and who controls them.
Privacy, data and AI governance are still managed as separate programs long after the risk stopped behaving that way.