"Checkbox Compliance Is Better Than Nothing" | AI Governance From The Trenches
Source: YouTube · GRC Engineering Club · published Aug 8, 2026 · 55:42
Chris, a privacy practitioner turned AI governance advisor, emphasizes that practical, lightweight compliance frameworks are essential because unchecked AI development creates "governance debt" that becomes impossible to unwind 6:20.
Key Takeaways:
• Data clean rooms enable insights (e.g., 3x faster conversions) through encrypted calculations without exposing personal data—countering the US narrative that privacy and insights are mutually exclusive 3:06, 8:01
• The EU's "regulate first" approach mirrors the GMO debate—slower initially but potentially better long-term outcomes than the US "move fast, break things" mentality 11:57
• Chris's framework prioritizes data minimization first (especially for minors), then retention/deletion handling, followed by policy alignment—reflecting practitioner sequencing over textbook theory 29:06
• With AI integrations processing sensitive contracts, organizations must establish clear trust boundaries with vendors since you're relying on "blue eyes"—an even greater concern with open-source agentic workflows from GitHub 47:06, 50:49
Effective governance balances ethics with pragmatism—extreme positions like blocking all data use help no one, but ignoring governance entirely creates unsustainable risk.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Compliance & GRC. Commonly maps to: Security and Risk Management, Asset Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome friends to another edition of the GRC anti-checkbox podcast. I'm excited. We have This has always been one of my like weaker areas. I'm cyber guy, privacy's you know, kind of like a a sister area, but I never try to say, "Hey, this is my thing." I know some cyber people like to just assume. I don't think that's fair to the privacy realm. Joining us today, we have a special guest. Chris, introduce yourself. Let the people know who you are, what you do, and let's get into it. >> Yeah, thanks a lot. So, yeah, I'm Chris. I've been a I'm a Dutch Dutch person, 39 years old. Originally from the Netherlands. Living in Malta at the moment. Moved here a few years ago after a few years of of travel. Since I was working in technical positions before I started this company. During COVID period,…