Agenda

►Beyond Compliance: From Regulation to Resilience and Trust

Timo Arndal, VP, Digital Risk & Cybersecurity & CISO, Finnair

• What have you learned from implementing Part-IS, NIS2, and DORA?
• How are you preparing for emerging cyber threats and future regulation?
• How can cybersecurity move beyond compliance to focus on meaningful outcomes and stakeholder trust?
• What role should executive management play in cyber oversight and decision-making?
• Which metrics best demonstrate cyber resilience and support effective board-level decisions?

►Governing the Agentic Workforce: A CISO's Playbook for AI Agents

Humayun Khan, Principal Cybersecurity, Cloud & AI Architect Lead Hempel A/S

• Why AI agents should be governed like a new class of identity, with an owner, a sponsor, least-privilege access and a defined lifecycle from creation to retirement
• How to get visibility into the agents already running across the organisation, including 'shadow' agents built by business users, before agent volume outgrows your controls
• A practical layered control model: who can build agents, what data and tools they can reach, and how their actions are monitored, audited and stopped when needed
• How to position security as an enabler of safe agent adoption, aligning CISO, CIO and business makers and mapping controls to NIS2, GDPR and the EU AI Act

►Conformity Will Not Save You: AI Risk Beyond the EU AI Act

Geoffrey Taylor, Information Security Officer, Nordea Asset Management

Your assessment said Low Risk. Is it really?

• The EU AI Act requires organisations to classify their AI systems and demonstrate conformity. Conformity is similar to compliance — it is binary, a yes or a no at a point in time. It cannot calibrate impact when the unexpected occurs.
• On 24 April 2026, an AI agent deleted an entire company's production database in nine seconds. It was running the best model available, configured with explicit safety rules. When asked to explain itself, it produced a written confession: "I violated every principle I was given."
• This session applies the Assume. Design. Test. framework to AI governance — shifting the question from "are we compliant?" to "how could we be impacted?" — and gives attendees a practical lens for assessing where their governance ends and their exposure begins.