"Areas of discussion:

What changed for you in the last 12 months?
What AI-related security or governance issue went from theoretical to very real?

Where is AI already happening outside your governance?
Shadow AI, engineers using models directly, SaaS features suddenly becoming AI-enabled, data leaving expected boundaries, etc.

Where have your controls become unrealistic?
Which policies look sensible on paper but people routinely work around because they make AI too difficult to use?

What’s one governance decision you still don’t know how to make?
This is a great closing round because it exposes the unresolved questions rather than forcing artificial consensus."