Agenda Day 2

The term "Shadow AI" is used everywhere, but often without precision. It is not just unsanctioned use of public tools. It spans a spectrum, from casual employee usage to internally built applications calling external model APIs, to semi-approved experiments that never pass through full governance. Some of it is visible, some of it is tolerated, and some of it is completely unknown. What matters is not the label but the condition: AI capability operating without clear oversight, consistent controls, or full visibility. This panel focuses on making that condition manageable and on where Shadow AI actually sits in the enterprise, how to detect it in practice, and how to bring it under control without slowing delivery or relying on bans that do not work.

Robin Schoss

Regional CISO
Olympus

See Bio

Sheikh Mahbub Habib

Head of Product Cybersecurity and Privacy Innovation
AUMOVIO

See Bio

In this case study, Abantika Chatterjee, Associate Director, Head of AI Capability, EBRD, shares how the bank established its AI Centre of Excellence, vision, strategy and operating model from the ground up, bringing together business, technology, governance, and security teams to support innovation at scale. James Jackson, AI Security Lead, EBRD, then examines the cyber security challenges associated with deploying new AI capabilities, developed in-house or procured off-the shelf, and the approaches being taken to identify, manage, and mitigate emerging threats. Together, they offer practical lessons on embedding security into AI programmes from day one rather than operating in silos.

• Building an AI Centre of Excellence from the ground up. 

• Embedding security into AI operating models from day one. 

• Addressing cyber risks across emerging AI capabilities and tools.

Abantika Chatterjee

Head of AI Capability
EBRD

See Bio

James Jackson

AI Security Lead
EBRD

See Bio

Standards for AI are moving quickly. The EU AI Act, NIST frameworks, and Cyber Resilience Act are starting to define expectations. But inside most organisations, these standards have not yet been translated into clear internal rules or enforceable controls. At the same time, agentic AI introduces systems that act, decide, and adapt in ways those standards only partially address. This panel focuses on the gap between policy and practice. It addresses how to turn emerging standards into something usable, define what is acceptable inside your organisation, and evidence control when regulators ask.

Dimitris Tsapogas

Global Head of Privacy and Data Protection
DHL Supply Chain

See Bio

Michael Gerhard Schneider

Principal Expert Product Cybersecurity & Privacy
AUMOVIO

See Bio

Hannah Liu

Research Engineer, AI Policy and Governance
Responsible AI Institute

See Bio

• Defining a business-focused certification scope.
• Avoiding common compliance implementation mistakes.
• Building continuous resilience across the supply chain.

Eric Martinez Cancela

CISO
Serunion

See Bio

A single cyber incident can now trigger obligations under several regulations, including NIS2, DORA, the Cyber Resilience Act, GDPR and the AI Act. In this session, Agnes Bade, Vice President Group Head AI & Digital Law at The Adecco Group, explores the increasingly complex regulatory landscape surrounding cyber incidents and how multiple regulatory regimes can intersect when something goes wrong. As organisations deploy more connected technologies and AI-enabled systems, understanding where regulatory requirements overlap has become increasingly challenging. This session examines the compliance, reporting and governance considerations that arise when a single incident falls under several regulatory frameworks at once, and the practical implications for legal, risk, security and compliance teams.

• Navigating overlapping obligations across NIS2, DORA, GDPR, CRA and AI Act.
• Understanding regulatory accountability when incidents trigger multiple frameworks.
• Managing compliance, reporting and governance requirements from a single incident.

Agnes Bade

Vice President Group Head AI & Digital Law
The Adecco Group

See Bio

As organisations rapidly deploy LLMs and agentic AI systems, attackers are discovering new ways to exploit them. In this session, Ioannis Agrafiotis, Senior Research Associate at the University of Oxford and former cybersecurity expert at the European Union Agency for Cybersecurity (ENISA), will explore the most significant security threats facing AI today, drawing on real-world incidents including the EchoLeak attack targeting Microsoft Copilot and the compromise of McKinsey's Lilli AI assistant. Through audience discussion and practical case studies, the session will examine how these attacks work, the risks they expose, and the controls needed to build secure and resilient AI systems.

• Understanding emerging attacks against LLMs and AI agents.

• Addressing critical AI governance and security risks.

• Applying practical controls for secure AI deployment.

Ioannis Agrafiotis

Senior Research Associate and Expert in Capacity Building
European Union Agency for Cybersecurity (ENISA)

See Bio