AI, data and security: Key insights for in-house lawyers and business leaders

As artificial intelligence rapidly transforms how organisations operate, the challenge isn't simply whether to adopt AI, it's how to do so safely, compliantly and strategically. 

Our recent Ascensus event in Birmingham brought together experts from across regulatory, compliance, cyber security and employment law to talk about the complex AI, data and security questions businesses are grappling with. 

From managing supplier risk and navigating emerging regulations, to embedding AI and data governance into organisational culture, the event highlighted a crucial message: successful AI adoption requires more than technical know-how. It demands a holistic approach that identifies security risks early, involves the right stakeholders and moves organisations from reactive crisis management to proactive, confident decision-making. 

Below are some of the key takeaways from the event.

Preventing and bouncing back from cyber attacks

Francis Katamba, data privacy and cybersecurity lawyer, outlined the three critical phases organisations must address: 

• Prevention and mitigation
• Responding to incidents
• Recovery

Data protection officers and cybersecurity teams must work together, not just to stop attacks, but to bounce back fast if they happen. It's important to plan for recovery, not just rely on prevention.

Here’s what organisations should action now:

• Check if they are in scope of current and anticipated cybersecurity legislation.
• Manage supply chain risk using due diligence, contractual terms and other legal controls.
• Update internal and external facing policies and other legal documentation.
• Review current levels of cybersecurity and build a holistic governance framework that looks at cyber related risks across the different phases of the data lifecycle.

The Data (Use & Access) Act 2025

Richard Nicholas, commercial lawyer, discussed the wide-ranging impact of the Data (Use & Access) Act 2025 (DUAA) and how it will alter how the UK manages data. 

The DUAA act, which aims to ensure the secure and effective use of data, revises the restrictions on fully automated decision-making from Article 22 of the UK GDPR, and will allow automated decisions, including those determined by AI and algorithmic processes.

Organisations should consider:

• Updating privacy notices if necessary.
• If online services are likely to be used by children, age verification will be required.
• Ensure all marketing is compliant and in line with regulatory requirements.

Policies alone are not enough: The key role of in-house lawyers 

Rachel Lyne, regulatory lawyer, emphasised the importance of the in-house legal team in embedding effective governance, risk and compliance policies that avoid a business operation in constant ‘critical response’ mode.

"Policies are only as good as your understanding and training," she noted. Enabling the legal team to be involved in decision making through a compliance lens helps to:

• Create a competitive advantage.
• Deliver stakeholder confidence.
• Position the legal team as an integral part of the business, helping to deliver success.

From an employment perspective, Maz Dannourah, focused on the latest updates on the Employment Rights Bill which will require businesses to continue to keep its policies front of mind and remain prepared and agile. 

He highlighted that the challenge lies in keeping pace with AI-driven workplace changes whilst protecting employee rights.

AI and the in-house lawyer

Our panel discussion between Lauren Webb, Principal Lawyer, Data & AI at BT, Victoria Hustler, Executive Director at Quotient Sciences and Oliver Geidel, Associate Director, Research Contracts & Compliance at University of Bristol reinforced a clear message: identifying risks early and involving the right stakeholders is vital to allow organisations to enable safe AI use. 

As one panellist put it, "Keep your legal hat on and stick with your gut feeling. There will be bias."

What next?

We understand the implications of AI adoption on your business, and we're here to help. If you're navigating AI, data and security challenges and have questions or concerns, please get in touch. 

For more details on our Ascensus events, please contact our Client Programme Manager, Khara Rogers, at Khara.Rogers@brownejacobson.com.