WHY THIS MATTERS NOW

The questions organisations are being asked are changing

Whether the scrutiny comes from regulators, auditors, boards, customers or internal risk teams, organisations are increasingly expected to demonstrate accountability, visibility and control over AI-assisted software development.

That's already playing out in regulatory guidance, APRA and ASIC have both issued strongly worded direction on AI use, with a specific focus on the risk introduced when AI writes code. Neither is legislation yet, both are a clear signal of where scrutiny is heading, alongside emerging obligations under the SOCI Act and comparable requirements overseas.

Expect a direct conversation with peers navigating the same shift, not a product pitch.

• Development teams are already using AI agents to write, test and review code, often faster than governance processes have adapted to.

• When an AI agent contributes to a change that causes an incident, accountability doesn't automatically follow, it has to be designed in.

• Most organisations can't yet say, with evidence rather than assumption, exactly what's running in production.

• Segregation of duties, built for human-only development, doesn't automatically hold up in an agent-driven SDLC.

• The gap between "we have controls" and "we can prove they worked" is where operational, reputational and regulatory risk actually lives.

WHAT THIS DISCUSSION WILL COVER

Four areas the room will work through together

1. Where accountability sits
When AI agents write, review and deploy code, who's actually accountable when something goes wrong, and how that answer changes as agents take on more of the workflow.

2. Segregation of duties in an agent-driven SDLC
How a control built for human-only development teams needs to evolve when some of those "team members" are autonomous.

3. What's actually running in production
How mature your software supply chain visibility really is, and whether you could identify affected components within hours of a critical vulnerability, not days.

4. Evidence over assumption
What it actually takes to give a regulator or auditor a evidence-based answer, rather than a confident one, when they ask what's running and why it's trusted.

WHAT YOU’LL TAKE AWAY

Leave with more than notes

A clearer view of where accountability actually breaks down
How governance built for human-only development holds up, or doesn't, once AI agents are writing and reviewing code.

A sharper read on where scrutiny is heading
What regulators, boards, and customers are increasingly expecting organisations to demonstrate about AI-assisted software delivery.

Perspectives from peers
How other regulated organisations are actually approaching software supply chain visibility and evidence-based governance.

A benchmark for your own maturity
How your organisation's software supply chain visibility compares with peers facing the same regulatory pressure.

A sense of what "audit-ready" actually requires
Beyond having controls on paper, what it takes to prove they worked when a regulator asks.

WHO WILL BE IN THE ROOM

A curated group of senior security and technology leaders

The value of this discussion comes from hearing how peers from highly regulated and digitally-led organisations are actually approaching the shift to AI-assisted software delivery, not from a single point of view.

Drawn from across Australia's most regulated and digitally advanced sectors, including:

Security Leadership
CISO · Principal Security Architect

Application Security & Engineering
Director of Application Security · Director of Application Engineering · Director of Security Engineering

DevSecOps & Platforms
DevSecOps Director · GM, Platforms and Engineering

Participants are selected to ensure a high-calibre, peer-level discussion, held under Chatham House Rule.