From hallucinations to deepfakes: Four real AI failures and the governance gap behind them

Ask any SaaS organisation who owns the risk if their AI feature goes wrong. Watch the room go quiet.

This is the accountability gap, and it is one of the most consequential governance failures in the current threat landscape. AI is being treated as a product feature rather than a regulated system. Security teams are excluded from AI deployment decisions. Product teams ship AI capabilities without risk assessments, documented ownership, or governance checkpoints. The result is an organisation that cannot defend itself when regulators, courts, or customers come asking.

The consequences are no longer theoretical. AI-powered SaaS tools have already triggered class-action lawsuits targeting vendors, not just the organisations that deployed them. The EU AI Act carries penalties of up to 35 million euros or 7% of global revenue. Australia's Guidance for AI Adoption is in effect, ASIC has flagged AI governance gaps directly, and the OAIC is actively investigating AI-related privacy breaches. Regulatory accountability stays with the SaaS provider. Not the model vendor.

78% of organisations use AI. Only 24% have a formal governance programme in place. That gap is not a technology problem. It is an accountability problem.

ISO 42001, the international standard for AI Management Systems, provides the structural answer. This session cuts through framework theory and focuses on what actually matters for security practitioners and governance professionals: how to establish clear AI risk ownership, what the AIMS accountability structure looks like in a SaaS product lifecycle, how it integrates with existing ISO 27001 posture, and how to position your organisation for regulatory requirements already in force globally and intensifying across ANZ.

If your organisation is shipping AI features without a clear answer to who owns the risk when something breaks, this session is for you.