The DPO Centre

Most of the EU AI Act’s provisions now apply, with high-risk obligations taking effect from December 2027. The extended timeline gives organisations more time to prepare, but AI Act compliance shouldn’t be looked at in isolation. Where AI involves personal data, existing data protection obligations also need to form part of the plan as well as compliance and audit processes.

AI is also starting to support your GRC areas, such as policy reviews, control assessments and ongoing compliance monitoring. This makes the choice of technology, and how it is used, increasingly important, especially where accuracy, context, and professional judgement matter.

Join experts from CoreStream GRC (former Big 4 leader) and the DPO Centre to understand how data protection should fit into your EU AI Act compliance planning. This session will connect regulation and day-to-day governance, exploring how technology can be used effectively in GRC and wider business operations, without losing sight of accountability and oversight.

The discussion will explore:

*   What the EU AI Act means for existing data protection and compliance programmes
*   Where the AI Act and existing data protection obligations overlap
*   How NIST AI RMF can support AI risk assessment and ongoing governance
*   Where AI can support privacy teams, and where human judgement remains critical

The session will finish with an open Q\&A, where you can put your AI governance and data protection questions to the panel.
