AI governance starts with your data: Building the evidence the EU AI Act and new U.S. rules expect
Contributors:
Fahad Diwan
CIPP/C, CIPM, FIP
Director of Product Marketing & Management, Privacy, Data Governance
Exterro
Brought to you by Exterro
Broadcast date: 8 Dec. 2026
Time: 08:00–09:00 PST, 11:00–12:00 EST, 16:00–17:00 CET
Artificial intelligence (AI) regulation keeps moving. The European Union (EU) has pushed its high-risk AI obligations to December 2027. Colorado repealed its AI Act and replaced it with a narrower law that takes effect January 1, 2027, the same day California’s rules on automated decision making technology (ADMT) begin to apply. A federal push to preempt state AI laws continues, but those laws remain enforceable.
The deadlines move, but the underlying work does not. The EU AI Act requires providers of high-risk systems to govern their training, validation, and testing data, including where it came from and whether it is relevant, representative, and as free of errors as possible. California now requires risk assessments before a business processes sensitive personal information or uses ADMT for significant decisions. Neither obligation is achievable if you cannot say what data you hold, where it lives, and what sensitive information it contains. For many organizations, the inventory that should answer those questions is a survey that went stale years ago.
This session examines what the EU AI Act and U.S. state laws require of the data behind AI, and why AI governance programs stall without a current, classified data inventory. You will also see how agentic data governance with Exterro OptiX360 maps, classifies, and governs enterprise data in place. With that foundation, your teams can decide which data sources are fit for an AI program on evidence rather than assumption.
Key takeaways:
- Where the EU AI Act, California, Colorado, and other U.S. rules now stand, and which dates still hold.
- Which data questions regulators and AI review committees will ask, and what evidence answers them.
- How to build an AI-ready data foundation, from inventory and sensitive data classification to defensible disposition of data you should no longer hold.
If you registered for this sponsored web conference and subsequent related follow-up emails, you submit your registration information to the IAPP and the co-host and sponsor for that particular web conference, which includes attendee names, titles, organizations, countries, state and email addresses.
This web conference is co-hosted and sponsored by Exterro and free of charge to you. The IAPP and the sponsor will use your registration information each in compliance with its own privacy notices.
If you do not wish to submit your information to the web conference sponsor(s), you should not sign up for this free, live web conference. You can access the recording of the web conference without providing information to sponsors.
The co-sponsor's privacy notice is available here: Exterro Privacy Policy
You may contact the sponsor directly in order to express your preferences with regard to direct marketing communication at privacy@exterro.com
You may also contact the IAPP’s data privacy officer at privacy@iapp.org with any questions about the IAPP's processing of personal information or the IAPP's privacy notice.
Eligible CPEs: AIGP, CIPP/A, CIPP/C, CIPP/CN, CIPP/E, CIPP/US, CIPM and CIPT.
1.0 CPE credits
