Featured Resource
Organizations comparing RadarFirst and OneTrust are usually trying to answer a practical question: do we need a broad governance platform, a purpose-built incident decisioning platform, or both? The short answer: OneTrust is designed as a broad privacy, data, and AI governance platform. RadarFirst is purpose-built for regulatory decisioning, incident management, and configurable compliance workflows that … Continued
Healthcare organizations are adopting AI faster than many governance programs can keep up with. When employees, departments, or vendors introduce AI outside approved processes, organizations need more than an acceptable-use policy. They need a repeatable way to investigate what happened, assess risk, coordinate the right stakeholders, and document a defensible response. This challenge is already … Continued
RadarFirst perspective on closing the response gap behind agentic AI An AI incident does not become actionable simply because someone reports it. The report must reach a responsible owner, contain enough context to begin an investigation, and trigger a coordinated response while the evidence still matters. A recent Lowy Institute analysis illustrates the gap. According … Continued
Executives at major AI companies are reportedly planning for what could follow a catastrophic AI event. Axios describes scenarios involving cyberattacks that disrupt financial services, internet access, electricity, or water. OpenAI says its preparedness exercises cover a range of potential scenarios and do not treat those events as inevitable. Read the original reporting. The reporting … Continued
At IAPP Privacy. Security. Risk. + AI Governance Global 2026 in Seattle, one question captured the challenge facing organizations today: How can governance frameworks keep pace with the speed of AI deployment? The question came up following “Harm or Hazard? When Your AI Event Becomes an AI Incident,” a session led by Alex Layng, Vice … Continued
An Episode II recap of The Alex Exchange AI agents can retrieve information, use tools, access connected systems, and take actions with real consequences. When an agent exceeds its authorization or causes harm, the organization operating it still needs to detect the event, contain the activity, assess the impact, and decide whether notification is required. … Continued
Privacy should bring Security into an AI incident when the organization needs technical facts or controls to understand what happened, contain the event, or support a defensible regulatory assessment. That includes questions such as what data the AI system accessed, where the data went, what permissions the system had, whether information was exposed, what actions … Continued
That distinction sounds simple. In practice, determining whether an incident is reportable can be one of the most consequential decisions a privacy team makes. Because discovering that something happened is only the beginning. The harder question is: What are we legally required to do about it? Is Every Security Incident a Reportable Data Breach? No. A … Continued
What the latest privacy incident data reveals about volume, risk, speed, third parties, and AI. Privacy teams are moving faster than they were just a few years ago. But the job isn’t necessarily getting easier. Incident volume is rising. Malicious activity is growing. Third-party incidents are more likely to become notifiable breaches. And even as … Continued
A structured intake begins by identifying the AI system and the organization’s relationship to it. The first report rarely contains enough information to explain what happened. It may mention an inaccurate chatbot response, an unexpected automated decision, exposed information, or unanticipated behavior. But it may not identify the system configuration, business process, owner, or third … Continued
