Ken Johnston

Vice President of Data, Analytics, and AI

Envorso

For three years, "responsible AI" was a poster on the wall. In 2026, it becomes a question with a deadline.

The EU AI Act's high-risk obligations become enforceable in August. The NAIC's AI Systems Evaluation Tool moves toward nationwide adoption in November. The Bartz v. Anthropic settlement has put a floor on training-data exposure. And the SEC has already moved from civil AI-washing cases against private advisers to criminal charges against a public-company founder in roughly thirteen months—a trajectory that is not reversing.

The regulator, the insurer, and the plaintiff have started asking the same question: not what you believe, but what you can demonstrate. Most enterprise AI governance programs cannot answer it. The frameworks are documented, the principles are posted, the review boards are scheduled, and almost none of it touches the systems being shipped this quarter.

This session is the executive case for running AI governance the way modern engineering already runs: principles become testable controls, reviews become automated gates, opinions become evidence with a name and a timestamp on it. We walk through the three operating disciplines every AI program now needs—getting to yes before code ships, staying at yes once it's running, and recovering to yes when something breaks—through cases the audience will recognize from headlines. We then map those disciplines to the four-part operating model (People, Process, Platform, Proof) that every program needs to produce evidence on demand.

We will close with what a CIO, CDO, or CAIO can be doing in the next thirty days to move one system from intention to evidence.

Topics Include:

• The 2026 inflection: EU AI Act, NAIC, Bartz, and the SEC's AI-washing escalation from civil enforcement to criminal indictment
• The three questions every enterprise AI program now has to answer and the failures that show what happens when they can't
• The Four Ps operating model—People, Process, Platform, Proof—and where each typically breaks
• The 30-day starter move: what to do on Monday to begin producing audit-ready evidence