AI compliance basics: Moving from policy to real-world implementation

Artificial intelligence is moving faster than governance.

Across industries, organisations are already using AI in meaningful ways, from internal productivity tools and copilots, through to customer-facing features and decision-support systems. Yet when it comes to compliance, most are still operating at a conceptual level: drafting policies, discussing principles, and waiting for regulation to catch up.

The gap is clear. Organisations don’t need more theory. They need a practical way to operationalise AI governance.

This session focuses on what AI compliance actually looks like in practice, drawing on emerging standards such as ISO 42001 (Artificial Intelligence Management Systems), and the realities of implementing these frameworks inside organisations that are already using AI today.

Rather than focusing on future risks or abstract ethics, this presentation will walk through how organisations can structure and manage AI usage in a way that is auditable, defensible and aligned to business objectives.

A key starting point is recognising that organisations rarely play a single role in the AI ecosystem. For example, a business may embed AI into its own platform (producer), while also relying on third-party tools such as Microsoft Copilot or generative AI models (user). Understanding these roles is critical, as each carries different responsibilities and risk profiles.

From there, the session will explore the concept of AI impact assessments, as outlined in ISO 42005. These are not theoretical exercises, but structured mechanisms for understanding how AI systems operate, what data they rely on, how they may fail, and what the potential impacts are, both at an organisational and societal level. The presentation will break down how these assessments can be scaled from lightweight reviews through to more comprehensive analyses, depending on the complexity and risk of the system.

Importantly, the session will move beyond documentation and into implementation. It will outline how organisations can:

• integrate AI risks into existing risk management processes
• extend incident management to account for AI-specific failures
• adapt existing security and governance controls to accommodate AI usage
• incorporate AI into business continuity planning

The session will also address a common misconception: that AI compliance is a standalone activity. In reality, it must be embedded into existing governance structures, particularly where organisations already operate under frameworks such as ISO 27001.

Ultimately, this presentation is about helping organisations move from reactive, fragmented approaches to AI governance, toward something more structured, consistent and sustainable.

As expectations around AI transparency, accountability and risk management continue to increase, the organisations that succeed will not be those with the most advanced AI — but those with the most practical and well-governed approach to using it.