AI, Data and Digital Regulation in Practice

The development of artificial intelligence has created a regulatory challenge for organisations: technological deployment can happen considerably faster than internal governance structures adapt to it.

Businesses may introduce AI through dedicated products, integrate models into existing software, procure AI-enabled services from third parties or allow teams to use general-purpose AI tools in everyday operations.

Each scenario can raise different questions.

Who is responsible for approving the technology? What information is being processed? Where does that information go? How are model outputs reviewed? What happens when a third-party system changes? Which legal requirements apply when the technology is deployed internationally?

The practical challenge is therefore broader than understanding individual AI laws.

Effective AI governance is about translating legal requirements into operational decisions.

That may involve identifying AI systems across the organisation, categorising their purpose and risk, allocating internal responsibility, understanding data flows, establishing procurement controls and maintaining appropriate human oversight.

The emphasis on implementation rather than regulation in isolation is also reflected in the World Tech Legal Annual Summit 2026. Its AI, data and digital regulation panel is intended to compare practical approaches to governing and scaling technology products across jurisdictions.

For technology businesses, the question is increasingly moving from what does AI regulation say? to how should governance actually work within the organisation?

An effective AI governance framework should reflect how an organisation actually uses technology.

For some organisations, AI governance will principally concern third-party tools used internally. For others, AI may form part of a product or service supplied directly to customers. Technology companies developing AI systems may face a different set of responsibilities again.

Governance therefore needs to begin with visibility.

Organisations should be able to identify:

• which AI systems are being used or developed;
• what purpose each system serves;
• which individuals or teams are responsible for the system;
• what information or datasets the system processes;
• whether third-party models or infrastructure are involved;
• how outputs influence decisions or services;
• what human oversight exists; and
• which jurisdictions are relevant to the activity.

From there, legal, technical and commercial teams can assess which controls are proportionate to the particular use case.

Responsibility is particularly important.

AI governance can become ineffective where accountability is dispersed between technology, legal, compliance, security and operational teams. Different functions may legitimately own different aspects of the risk, but organisations still need clarity on who is authorised to deploy systems, who monitors them and who responds when something goes wrong.

This also means that governance should not be static.

AI systems can change through updates, new datasets, altered functionality or different business use. A system considered relatively limited at procurement may subsequently be integrated into more consequential business processes.

Governance therefore needs a lifecycle approach rather than a single approval point.

AI governance and data protection are closely connected, but they are not interchangeable.

Where AI systems process personal data, organisations must consider how established data protection principles apply to new technical environments. Questions around lawful processing, transparency, data minimisation, retention, access, security and individual rights can remain relevant irrespective of how sophisticated the underlying technology becomes.

The practical complexity often lies in understanding the data journey.

An organisation procuring an AI-enabled system should consider what information users submit, whether prompts or inputs are retained, where processing occurs, whether information is used for further model development and what access the technology provider may have.

For organisations developing AI systems, the questions can extend further into training datasets, model development, testing and deployment.

The risks can also arise through informal adoption.

Employees may use publicly available AI tools to summarise documents, analyse information, generate content or assist with decision-making before the organisation has established formal policies governing those tools. Confidential, commercially sensitive or personal information can consequently enter systems in ways that were never contemplated by existing information-governance procedures.

For management, the practical challenge is therefore not simply documenting an AI policy. The organisation needs to understand where AI intersects with its existing data, privacy and information-security architecture.

AI introduces new capabilities, but it can also alter an organisation's technology risk profile.

The relevant cybersecurity questions vary depending on whether a business develops its own technology, integrates a third-party model or procures an AI-enabled service.

Third-party dependency deserves particular attention.

A business may control its own application while relying on external infrastructure, models, datasets, APIs or hosting. An incident elsewhere in that technology chain can consequently affect the organisation's security, service availability or regulatory position.

This makes supplier assessment and contractual allocation of responsibility increasingly important.

Contracts involving AI technologies may need to address issues including:

• permitted use of data;
• security responsibilities;
• confidentiality;
• intellectual-property rights;
• use of customer data for model improvement;
• service performance and availability;
• audit and information rights;
• incident notification;
• subcontracting and third-party dependencies;
• regulatory cooperation; and
• limitations and allocation of liability.

The correct allocation will depend on the technology and the commercial relationship.

An organisation purchasing an established software product will have a different negotiating position and risk profile from a company commissioning a bespoke AI system. Similarly, a developer supplying technology to a regulated customer may encounter contractual requirements extending beyond those imposed directly on the developer by legislation.

The practical objective is therefore not to transfer every possible risk contractually. It is to make responsibility, information rights and risk allocation correspond as closely as possible to who actually controls each part of the technology and its deployment.

As AI becomes more deeply embedded in businesses and products, it also becomes relevant to transactions, investments and commercial partnerships.

Traditional technology due diligence frequently examines intellectual property ownership, software licensing, data protection, cybersecurity, material contracts and regulatory compliance.

AI adds another layer.

An investor, acquirer or commercial partner may need to understand which AI systems are fundamental to a company's products or operations, whether those systems are developed internally or supplied externally, what datasets are involved and whether the company has appropriate governance arrangements.

Depending on the transaction, relevant questions may include:

• What AI systems does the business develop or use?
• Who owns the underlying technology and relevant intellectual property?
• What third-party models, software or datasets are involved?
• What contractual restrictions apply to their use?
• How was relevant data obtained and processed?
• What governance procedures apply to development and deployment?
• Have material AI or data-related incidents arisen?
• Which regulatory frameworks may apply across the markets in which the technology operates?

The significance of these questions extends beyond regulatory compliance.

Dependence on a particular model provider, uncertainty regarding intellectual-property ownership or restrictions affecting the use of critical datasets can have direct commercial consequences.

For companies preparing for investment, the result is similar to other forms of technology due diligence: AI governance can become part of investment readiness.

AI, Data and Digital Regulation at the World Tech Legal Annual Summit 2026

Regulating technology across borders requires more than understanding individual pieces of legislation. Businesses also need to determine how legal requirements can be translated into technology development, procurement, contracting and day-to-day governance.

These issues will be examined at the World Tech Legal Annual Summit 2026, hosted by Chetcuti Cauchi Advocates in Malta under the theme“Global Innovation & Tech Investment in the Age of Disruption.” The wider programme connects founders, investors, academics and advisers with practical questions concerning capital, international scale, digital regulation, mobility and innovation.

The panel AI, Data & Digital Regulation in Practice will focus on practical experiences advising technology businesses operating across jurisdictions. The programme describes the session as a comparison of practical approaches to governing and scaling technology products internationally.

Based on the updated panel scope, the discussion will address:

• AI governance;
• emerging AI regulation;
• data protection developments;
• cybersecurity obligations;
• contractual allocation of AI risk; and
• AI-related due diligence.

The international discussion will involve:

• Dr Danielle Mercieca, Senior Associate, Chetcuti Cauchi Advocates, Malta;
• Dr Susanna Grech Deguara, Senior Associate, Chetcuti Cauchi Advocates, Malta;
• Paul Eastwood, Partner, Contracts & Technology, Ireland; and
• Prof Kenneth Scerri, Associate Professor in the Department of Systems and Control Engineering at the University of Malta.

Bringing together legal, technical and academic perspectives, the discussion will consider how organisations can translate rapidly developing rules into governance that works in practice and how those governance arrangements need to evolve as technology is developed, procured and deployed internationally.

Particular attention will be given to the interaction between AI governance, data protection, cybersecurity, contracts and technology due diligence. Rather than treating these as independent compliance exercises, the discussion will examine how the different disciplines interact throughout the lifecycle of a technology product.

The discussion will remain centred on the broader challenge of responsible technology governance rather than individual jurisdictions or contributors. This approach reflects the Summit's wider aim of connecting legal and commercial questions around scaling technology internationally.

This publication may be updated following the Summit to incorporate verified observations arising from the discussion.

For organisations deploying AI, the challenge is increasingly one of execution.

Regulatory requirements need to influence decisions being made by product teams, developers, procurement functions, information-security specialists, management and boards.

That requires governance which is sufficiently robust to identify and manage risk without becoming detached from how the technology is actually developed and used.

A practical approach can begin with several questions:

1. What AI systems are we using or developing?
2. What data do those systems access or generate?
3. Who is responsible for approving and monitoring them?
4. Which third parties and technology dependencies are involved?
5. Which jurisdictions and regulatory frameworks are relevant?
6. Do our contracts appropriately allocate responsibility and risk?
7. Can we demonstrate the decisions and controls surrounding important AI systems?

The answers will be different for every organisation.

What should remain consistent is the connection between legal interpretation and operational implementation.

This is particularly important for internationally active technology businesses. A governance model designed around one jurisdiction can become difficult to maintain when products, users, employees and technology providers are distributed across several markets.

The objective should therefore be to establish governance that can accommodate regulatory change while remaining sufficiently practical to support responsible innovation.

That theme sits at the heart of the World Tech Legal Annual Summit 2026 discussion: not regulation in isolation, but what responsible technology development and deployment look like when legal, technical and commercial realities meet.

Chetcuti Cauchi's technology lawyers advise businesses on the legal and regulatory issues arising from the development, procurement and deployment of emerging technologies.

This can include AI governance and compliance, data protection, cybersecurity, technology contracts, intellectual-property considerations, technology procurement and transaction due diligence.

Where a technology business operates internationally, these questions may also intersect with corporate structuring, investment, tax, employment and international expansion considerations.

This multidisciplinary relationship between technology, legal risk and commercial implementation also reflects the approach being examined through the World Tech Legal Annual Summit 2026, with the AI, data and digital regulation panel positioned as the Summit's principal technology-law, AI, data-protection and cybersecurity discussion.

[question]What is AI governance?[/question]

[answer]AI governance is the framework through which an organisation oversees the development, procurement and use of artificial intelligence. It can include responsibility and oversight, risk assessment, data governance, procurement controls, documentation, monitoring and procedures governing how AI systems are approved and used.[/answer]

[question]How does data protection apply to artificial intelligence?[/question]

[answer]Data protection requirements may apply where an AI system processes personal data. Organisations should consider what personal data enters the system, why it is processed, where processing takes place, how long information is retained, who has access to it and whether it is used for additional purposes such as model development.[/answer]

[question]What should businesses include in an AI governance framework?[/question]

[answer]The appropriate framework depends on how the organisation uses AI. Common considerations include maintaining visibility over AI systems, allocating responsibility, assessing risks, governing access to data, reviewing third-party providers, establishing procurement controls, maintaining appropriate human oversight and monitoring systems after deployment.[/answer]

[question]How should AI risk be addressed in technology contracts?[/question]

[answer]AI-related contracts may need to address data use, confidentiality, intellectual-property ownership, cybersecurity, model or service performance, third-party dependencies, regulatory cooperation and liability. The allocation of these responsibilities should reflect the technology involved and the degree of control exercised by each party.[/answer]

[question]What is AI due diligence?[/question]

[answer]AI due diligence examines the legal, technical and commercial issues associated with AI systems used or developed by a business. Depending on the transaction, this can include technology ownership, data provenance, third-party models, intellectual property, contracts, regulation, cybersecurity and internal governance.[/answer]

[question]Why is AI governance important for businesses operating internationally?[/question]

[answer]International businesses can encounter different legal requirements, regulators, technology providers and data environments across their markets. A scalable AI governance framework can help the organisation apply consistent internal oversight while identifying jurisdiction-specific legal and regulatory requirements.[/answer]