Your SaaS product just grew an AI attack surface - here's how to govern it

In 2022, Air Canada's chatbot hallucinated a non-existent bereavement policy, giving a grieving customer incorrect advice that cost the airline a tribunal ruling, global reputational damage, and the decommissioning of its chatbot entirely. The following year, Samsung engineers inadvertently leaked confidential source code and meeting notes by pasting them into ChatGPT in three separate incidents in under three weeks. In 2024, Arup lost US$25 million when a finance employee was deceived by a deepfake video call impersonating the company's CFO and senior leadership. Also in 2024, Workday faced a federal class-action lawsuit and EEOC intervention after its AI hiring tools were found to have systematically discriminated against applicants based on age, race, and disability.

Four organisations. Four entirely different AI threat vectors. One common thread: the absence of formal AI governance.This session presents a forensic analysis of four documented AI incidents, examining root cause, impact, and critically, the specific ISO 42001 AI Management System controls that were absent in each case and would have materially reduced both the likelihood and impact of each failure.

Each incident represents a distinct AI threat category that security and governance professionals now face. Air Canada illustrates an AI output integrity failure where AI produces plausible but incorrect outputs, creating legal liability. Samsung illustrates uncontrolled AI tool adoption where absent acceptable use policies and data classification controls expose intellectual property. Arup illustrates AI-enabled adversarial threat where deepfake technology defeats verification controls built for a pre-AI threat model. Workday illustrates algorithmic accountability failure where AI embedded in consequential decisions operates without bias testing, explainability, or human oversight.ISO 42001 provides specific, auditable controls that directly address each failure mode. 

This session maps each incident to the precise clauses and Annex A controls that were missing from AI impact assessments and output accuracy requirements, to human oversight obligations, fairness testing, and adversarial threat assessments.

Attendees will leave with a clear understanding of the real threat landscape AI creates, the governance gaps these incidents expose, and the practical steps ISO 42001 provides to close them before the incident, not after it.