Intro
I see a lot of eagerness and a lot of proactivity from folks in the area: to go to webinars, to write articles, to do research, and to really understand. Because if you're a Privacy professional, you don't have all the skills you need to tackle the challenge of AI governance.
Hello, my name is Tainá Baylão. I work for Roche as Global Privacy Counsel, advising the business on Privacy matters all over the world in both our divisions: pharmaceuticals and diagnostics.
What can make or break a good governance program?
I think the key word here is collaboration. People cannot work in silos. We have so many different laws overlapping: we have the GDPR, we have the EU AI Act, and we have the Digital Services Act and the Digital Markets Act. In many ways they merge into a lot of the same requirements, but in duplicate. So it's very important that we get everyone to the table.
Map out who the important stakeholders are—who actually needs to provide input here. Then let's all sit together and make sure we don't have the same thing in different policies. Otherwise, I update a policy, you don't update yours, and suddenly there's no harmonization anymore.
What is an underrated skill when managing Privacy and AI?
I think the most important skill for a Privacy professional—and also for an AI governance professional—is translation, which is a kind of communication skill. There are a lot of lawyers in this profession, and we tend to use a lot of legal and technical language. That doesn't translate very well to the business: to someone in IT, in Communications, or in Marketing.
It may be understandable to you and your peers, but not to the people on the other side of the organization. So having the skill to break down what Article 36 says into "this is the feature you need to implement in your code"—that's the biggest asset you can have.
Lawyers tend to answer "it depends." It's very common, because risk is very subjective. But that's not how it works for software developers. You can still say "it depends," but you have to say it differently: "If this happens, then that should happen." For them, that's just logic. If you keep steering toward "it depends," they won't get it.
But if you change the way you speak and explain—"If you do this, then this happens, and these are the three different scenarios that can happen"—I think that's extremely helpful in the conversation.
What do you look forward to when delving into AI governance?
The technology is moving at a very fast pace, and it feels hard to stay on top of all the new developments and features. If you're out for two weeks, it feels like the whole world has changed. But I feel that people are also pacing themselves to catch up. I see a lot of eagerness and a lot of proactivity from folks in the area: to go to webinars, to write articles, to do research, and to really understand.
Because if you're a Privacy professional, you don't have all the skills you need to tackle the challenge of AI. You have a piece of it, because it's such a multidisciplinary topic. You have the AI piece, but you also have to look into intellectual property, cybersecurity, sustainability, and bias—so many different topics you might not have thought about in the past, because you were just doing privacy.
But I do see people in the industry moving to catch up, upskilling themselves, and getting the right knowledge. Because it's hard to say in 2026 that you're an AI expert or an AI governance expert—it's a new topic.
Of course, AI was already there in the past, but not with this many new technologies arriving every day. Not with such a big wave. It really is an AI summer, like nothing before. This changes everything, and I think people are really paying attention.
_HighPerformer_HighPerformer.svg)
