Agenda

Presentations already confirmed include:


►How agentic AI is changing the PCI DSS scope boundary

Christabel Oderele, PCI Lead, Checkout.com

  • Why AI agents don't stay inside the PCI DSS scope boundary you drew, and where they already touch cardholder data in payment systems
  • How to scope an agent by what its tools can reach, not by what it has done, and why a prompt is not a control
  • Why full PAN should never reach an AI model, and how persistent tokens keep it out
  • Leave with a three-part scoping framework to apply in your organisation and take into your next QSA conversation

►What’s New in PCI Security: Latest Updates and Insights from the Council

Úna Dillon, Regional Director Europe, PCI Security Standards Council

  • Latest PCI SSC priorities and initiatives
  • Key updates to PCI Security Standards
  • Strengthening compliance and future readiness

►Post-Quantum Cryptography: Why Payment Security Needs to Act Now

Simon Turner, Head of Security Governance and Compliance, BT Group

  • What PCI standards currently say about post-quantum cryptography, alongside UK NCSC guidance and the milestones for 2028, 2031 and 2035.
  • Understand the business and security rationale for addressing PCI platforms early, including sensitive payment data, cryptographic dependencies and third-party risks.
  • Lessons from BT’s PQC journey and practical steps organisations can take today to assess cryptographic exposure, prioritise investment and build a realistic migration roadmap.
     

►Nobody Buys Anything Because You’re PCI Compliant

Stuart Golding, PCI DSS Program Manager, WHSmith

  • Beyond the annual PCI tick-box exercise: Why merchants need to shift from simply passing PCI DSS assessments to building sustainable, year-round compliance.
  • Engineer compliance into your payment environment: How smarter architecture, operational decisions and everyday processes can make PCI compliance a natural outcome rather than an annual scramble.
  • Lessons from the merchant frontline: Practical, real-world insights from lived merchant PCI compliance experience — what actually works, what doesn't, and how to balance security, compliance and business priorities.

►Panel Discussion: PCI DSS and Beyond – The Future of Compliance

Simon Brady, Event Chairman (AKJ Associates)
Simon Turner, Head of Security Governance and Compliance, BT Group
Dr. Ravinder Singh, Head of Digital and Systems Team, Cabinet Office - GCF

  • PCI DSS v4.x – Progress or Pain? Has it improved security or just added complexity and cost?
  • Compliance Expectations – Are We Aligned? Where do acquirers, card brands and QSAs agree, and where do they clash?
  • The Future of PCI – What’s Next? Is PCI fit for purpose, and what needs to change?

Education seminars