Oliver Patel, AIGP, CIPP/E, MSc
![Oliver Patel, AIGP, CIPP/E, MSc is an influencer]()
Head of Enterprise AI Governance @ AstraZeneca | Trained thousands of professionals on AI governance, AI literacy & the EU AI Act.
Greater London, England, United Kingdom
51K followers
500+ connections
About
AI governance leader with a decade of experience at the intersection of responsible AI, data privacy and digital technology policy.
Lead the Global Enterprise AI Governance team at AstraZeneca, a global pharmaceutical company with over 80,000 employees and a deep AI ecosystem.
Passionate advocate for the safe, trustworthy and responsible development and use of AI. Translator between the technical and non-technical worlds.
Leader, educator and public speaker, with experience working in academia and research at University College London, in public policy and digital diplomacy for the UK Government, and as a media commentator and political analyst on outlets like BBC, Sky News and CNN.
Activity
51K followers
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisBREAKING NEWS: EU leaders agree to amend the EU AI Act Just this morning, the EU announced it has reached a political agreement on the EU AI Act amendments. Although the law has not yet been formally amended, today's announcement is a clear signal that it is overwhelmingly likely to happen. There is a now a race against the clock to get the official regulation passed before the 2 August 2026 applicability date. Here are the key elements of the provisional agreement: ➡️ Delay of enforcement date for high-risk AI systems: from 2 August 2026 (in law today) to 2 December 2027 (for AI systems listed in Annex III) and 2 August 2028 (for AI systems covered by Annex I). These dates will be fixed, irrespective of the availability of standards and guidelines. ➡️ AI systems capable of generating non-consensual sexual and intimate content or CSAM added to the list of prohibited AI practices. ➡️ Registration in the EU's public database continues to be mandated for providers of "exempted" AI systems that are deemed to not be high-risk (due to a derogation)—but less information needs to be registered. ➡️ Postponement of enforcement date for generative AI output detection and watermarking obligation (stipulated in Article 50(2)) to 2 December 2026. ➡️ Broader scope for when organisations can lawfully process sensitive personal data for bias detection and correction—but it must still be "strictly necessary" and only to address specific types of biases. Although the timeline changes are headline grabbing, the core structure and logic of the AI Act remains broadly intact. Organisations should not use the delays as a reason to deprioritise. In certain areas (e.g., registration), some of the initial Commission simplification proposals have been curtailed by the European Parliament and Council. Interestingly, no information was provided on what was agreed regarding AI literacy—the Commission and Council originally wanted to remove or significantly lighten the obligation, but the Parliament disagreed. Please note that this summary is based on the official reports from the EU institutions. It is non-exhaustive as the full text of the political agreement is not (yet) available.
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisThe EU's trilogue negotiations to amend the AI Act hit a wall this week To grasp the contours of these negotiations, check out my EU AI Act Amendments Cheat Sheet: Comprehensive Mapping (link below). Various media reports indicate that, following 12 hours of intense negotiations, the talks stalled early on Wednesday morning, with no agreement reached. Luca Bertuzzi reports that the key sticking point regards how to treat the high-risk AI systems covered by the existing EU product safety laws listed in Annex I (Section A) of the law. At present, providers and deployers of such AI systems, including medical devices and toys, must follow the EU requirements for high-risk AI systems in full. However, this could be adjusted and streamlined, depending on how the negotiations progress. The talks stalling this week is not the end of the story, as follow-up negotiations are planned for mid-May. Substantively amending the AI Act so soon after it was enacted was never going to be a walk in the park. Moreover, the EU is no stranger to last-minute, late night deals. Arguably the most important consideration for businesses relates to the applicable date for high-risk AI systems. This is currently set for 2 August 2026—just 94 days from now! However, all three institutions agree that it should be delayed to 2 December 2027, although the Commission has a slightly unique position that links to applicable date to the availability of standards. My EU AI Act Amendments Cheat Sheet maps and compares the negotiating positions of the European Commission, Council of the EU (member states), and European Parliament on the AI Act amendments. It distils 180+ pages of dense legislative complexity into one accessible graphic. You can download the high-res pdf for free at Enterprise AI Governance (link below). It's best viewed as a pdf on a large screen. This Cheat Sheet covers 8 key domains: ➡️ Prohibited AI practices ➡️ Timeline for high-risk AI compliance ➡️ Timeline for transparency-requiring AI compliance ➡️ Registration of "exempted" AI systems that are not high-risk ➡️ AI literacy obligation for providers and deployers ➡️ Processing sensitive data for bias detection and correction ➡️ European AI Office and oversight of general-purpose AI systems ➡️ Proportionality for small mid-cap enterprises (SMCs) An important caveat: this mapping is based on the official published proposals of the three institutions, which is inevitably evolving as the trilogue negotiations advance.
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisI've just updated my Agentic AI Governance Resource Guide This is the most comprehensive list of agentic AI resources you will find, with 80+ authoritative publications. Most of these resources have been published in the past 18 months and are grouped into 9 categories: 1️⃣ Agentic AI: technology foundations and capabilities 2️⃣ How enterprises are developing and deploying AI agents 3️⃣ Agentic AI risks and challenges 4️⃣ Risk mitigation and safeguards (security and safety) 5️⃣ Agentic AI evaluations and observability 6️⃣ Human oversight, accountability, and liability 7️⃣ Agentic AI governance frameworks 8️⃣ How EU law governs agentic AI: EU AI Act and GDPR 9️⃣ AI provider guidance and agentic AI usage policies This is a substantial update to my original resource guide, published in February. I've added dozens of new resources, reflecting an exceptionally active period for agentic AI governance. This includes landmark outputs from the OECD, NIST, UK AISI, Spanish DPA, European Commission, and Dutch DPA, alongside major new academic and industry contributions—particularly on agentic AI and the EU AI Act. I've also introduced a new category—AI provider guidance and agentic AI usage policies—to capture the wave of usage policies and guidance that companies like Anthropic, OpenAI, Microsoft, and Google have published. Check out the full guide on Enterprise AI Governance.
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisHow are agentic AI systems regulated under the EU AI Act? A group of leading scholars just answered this question. 'AI Agents Under EU Law' is the most sophisticated and detailed legal analysis on the topic. It assesses how various laws, including the EU AI Act, GDPR, and Product Liability Directive, regulate AI agents. Noting that "agents" and "agentic AI" are not explicitly defined or covered in the AI Act—and that there is not yet any substantive EU guidance on this—the authors outline a practical compliance framework that organisations can implement, to govern their agentic AI systems. The key message is that the AI Act is use case focused. This means that whether or not an AI system is high-risk depends on the specific domain of use. For example, an agentic AI system used for recruitment may be high-risk, whereas an agentic AI system used solely for academic research is unlikely to be. The major challenge, after risk classification, is determining how agentic AI systems can be developed and deployed in a way that is aligned with the requirements for high-risk AI systems: as stipulated in the AI Act itself and the draft and evolving CEN/CENELEC standards. The paper highlights core tensions between the autonomous, proactive, and unpredictable nature of agentic AI systems and their behaviour, and the requirements mentioned above, relating to risk management, robustness, human oversight, and transparency. For example, if the behaviour and actions of AI agents deployed in production change in ways that are significant and were not foreseeable or accounted for in the original conformity assessment, then this could potentially be non-compliant. The authors highlight "emergent behavioural drift" as an area of concern. This means that if you have an autonomous agentic AI system used in a high-risk AI domain, you will need to think carefully about the specific guardrails—including how agentic AI authority and action scope is bounded—and associated development and deployment choices, to ensure EU AI Act compatibility. The very autonomy and proactiveness that makes agentic AI so powerful is also a compliance risk, in certain scenarios. Kudas to Luca Nannini Aleksandr Tiulkanov LL.M., CIPP/E Adam Leon Smith DEng FBCS Michele Joshua Maggini Enrico Panai Sandra Feliciano Elena Maran James G. Piercosma Bisconti Lucidi, Ph.D. for this important contribution
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisHow to govern agentic AI in financial services A new paper directly answers this question with a framework that enterprises can implement today. Studies highlight that the financial services sector is ahead of most others when it comes to deploying agentic AI systems in production. This is perhaps unsurprising, given the huge volume of transactions that are executed, processed, and analysed every milisecond. Due to regulations passed in response to the 2008 financial crisis, model risk management (MRM) is a long-established and mature practice in the sector, and the fields of MRM and AI governance have been converging in recent years. However, as the authors argue, traditional approaches to MRM and AI governance—centred on pre-production risk assessments, model validation, and pre-deployment controls—are inadequate to govern increasingly autonomous agentic AI systems. My view is that although such controls remain necessary, they are insufficient for effective AI governance in the agentic era. The paper, 'Scalable Runtime Governance for Agentic AI in Financial Services', argues that MRM must be extended to incorporate runtime governance of agentic systems. Runtime governance simply means implementing controls that bound the autonomy and authority of AI agents, such as by restricting the actions they can execute, the tools they can use, and the data sources they can access. Continuous monitoring, real-time observability, and incident alerts are key elements, as well as implementing clearly-defined human review and approval stage-gates for consequential actions. As I have argued before, pitting compliance and policy-based governance against automated governance controls is a false dichotomy. To embed “policy as code”, you need to first have well-defined policies. To achieve this, the authors propose a four-layered process: 1️⃣ Layer 1. Human policy: define the natural-language requirements your agentic AI systems must adhere to. 2️⃣ Layer 2. Capability and orchestration specifications: develop artefacts to define and specify the capabilities of AI agents, the way in which their autonomy should be bounded, and the actions they should be permitted to execute in different scenarios. 3️⃣ Layer 3. Governed execution: at runtime, the system must adhere precisely to these policy-based artefacts, which must be incorporated into the design and architecture of the system itself. 4️⃣ Layer 4. Telemetry, monitoring, and runtime governance: monitor the behaviour and actions of agentic AI systems at scale and continuously adapt controls and organisational risk posture accordingly. Kudos to the authors Lukasz Szpruch Agus Sudjianto Tanveer Bhatti and Gary Ang, PhD for this important contribution to the field (link below).
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisThe UK AI Security Institute just published its evaluation of Claude Mythos Preview Their initial findings, published yesterday, indicate that Mythos Preview can execute multi-step cyber attacks that would take human professional experts days of work. This has significant implications for global cyber defence. The UK AI Security Institute is a research organisation within the UK government. It conducts and publishes cutting-edge research on the security, safety, and capabilities of frontier AI models, and partners with AI labs to perform state-of-the-art model testing and evaluations. Mythos Preview is Anthropic's latest general-purpose AI model. However, it has not been released to the public and it cannot be accessed via Claude. Instead, Mythos Preview has been released, for testing, evaluation, and analysis, to a limited group of over 40 organisations, including Google, AWS, Microsoft, JP Morgan Chase, and CrowdStrike. Anthropic have said that they will not make the model generally available, but have also implied that it may become available for wider use, once more progress has been made on cyber risk mitigation. Anthropic have done this because of concerns about Mythos Preview's advanced cyber capabilities, indicating that it has "reached a level of coding capability" where it can surpass "all but the most skilled humans at finding and exploiting software vulnerabilities". Anthropic claim that Mythos Preview has "found thousands of high-severity vulnerabilities, including some in every major operating system and web browser". Many of these vulnerabilities were previously unknown. Its evaluations highlight that Mythos Preview is significantly more capable—from a cyber offence perspective—than Opus 4.6, Anthropic's most advanced, generally available model. For this reason, it is being shared with leading technology companies, software and infrastructure providers, and cybersecurity firms, to support their defensive capabilities, enable research, and enhance their collective cyber posture. The UK AI Security Institute has been assessing the cyber risk posed by frontier AI models since 2023 and claims that Mythos Preview is the most capable model yet, in terms of cyber performance—corroborating some of Anthropic's claims. For example, in an evaluation called "The Last Ones" (see image), UK AI Security Institute researchers developed a "32-step corporate network attack simulation", which would result in the full takeover of a vulnerable network, if successfully completed. Mythos Preview is the first model tested which successfully completed this challenge; it did so 3 out of 10 times. The next most capable model, Opus 4.6, maxed out on 28 (out of 32) steps. Alongside this, the Financial Times reports that UK and U.S. financial regulators have held urgent meetings with major banks and financial institutions, to warn about the cybersecurity implications of increasingly capable frontier AI models, like Mythos Preview.
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisIn the past few months, agentic AI has gone mainstream Enterprises are adopting it at scale and individuals are using AI agents to turbocharge their productivity. This present significant opportunities for efficiency, productivity, and innovation, but it also poses risks—especially from a cybersecurity perspective. Agentic AI systems are built on large language models (LLMs) and therefore the same underlying technology as the generative AI systems we have all been using for the past few years. The LLMs serve as the core engine, enabling AI agents to process vast amounts of information, develop multi-step plans, and determine the best course of action to take, by mimicking human planning and reasoning. Because agentic AI systems are built on LLMs, they are characterised by the same fundamental limitations, including hallucinations, non-determinism, probabilistic outputs, and sycophancy. With generative AI, the output is information which the user consumes and acts upon. However, with agentic AI, the output is an action which an agent executes. This means that the stakes are higher with agentic AI, thereby elevating the importance of understanding and mitigating these fundamental limitations and risks. OWASP has published its Top 10 for Agentic Applications 2026. I highly recommend reading this resource in full. It explains each risk, providing practical guidance on mitigations and case study examples. My latest Cheat Sheet summarises the 10 key security risks highlighted by OWASP: ⚠️ Agent Goal Hijack ⚠️ Tool Misuse & Exploitation ⚠️ Identity & Privilege Abuse ⚠️ Agentic Supply Chain Vulnerabilities ⚠️ Unexpected Code Execution ⚠️ Memory & Context Poisoning ⚠️ Insecure Inter-Agent Communication ⚠️ Cascading Failures ⚠️ Human-Agent Trust Exploitation ⚠️ Rogue Agents I'll be speaking about this topic, including how responsible AI must evolve for the agentic era, at the IQPC Generative AI Summit in London in a couple of weeks (link below). Let me know if you will be there!
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisIt was energising to speak and participate at the IAPP Global Summit 2026 The pressure for organisations to adopt AI at speed and scale is immense. Previously, employees were gently encouraged to use AI and organisations were experimenting with an array of pilots and PoCs. Today, employees across all sectors are strongly expected to use AI (and in some cases penalised if they don't) and ROI needs to be proven via production-grade applications that generate significant value. Moreover, enterprise leaders are increasingly focused on the risks of not adopting AI and the imperative to remain competitive. In this context, AI governance professionals face significant scrutiny and must walk a delicate tight rope. If you over-govern or can't keep up with the pace of the business, you are perceived and labelled as a blocker and an impediment to the wider business strategy. However, if your policies or controls are insufficiently robust, you may be exposing the organisation to severe legal, reputational, or operational risks. Indeed, the defining challenge of AI governance is how to strike the right balance between managing risks and complying with regulations on the one hand, and enabling the business and maximising the value of AI on the other. There is no magic formula and the precise recipe will differ for every organisation. However, understanding that it is a balancing act and that there are trade-offs is key. To achieve this, the AI governance community will have to continue innovating—which includes using AI to govern AI. It was an honour to share the stage with Martin Woodward and Rachel Thompson. We discussed how to manage and future-proof digital governance in a more integrated and cohesive way, as well as how to use AI to augment and optimise various parts of the AI governance process, from submission to review. There are plenty of opportunities to augment legacy AI governance processes with AI capabilities. In doing so, AI governance professionals will be enhancing the effectiveness of their programmes, whilst also learning about AI—including its capabilities, limitations, failure modes, and guardrails—via hands-on product development, rather than merely theoretical risk assessments. More than ever, I am thankful to be part of such an inspiring and supportive professional community. The AI governance profession is uniquely interdisciplinary and dedicated to tackling some of the biggest challenges confronting individuals, businesses, and wider society today. Thanks to the IAPP team for another fantastic event! And congratulations to Joe Jones for the inspiring interview with Prince Harry.
-
Oliver Patel, AIGP, CIPP/E, MSc shared thisCheck out my updated EU AI Act Amendments Cheat Sheet: Comprehensive Mapping This Cheat Sheet maps and compares the negotiating positions of the European Commission, Council of the EU (member states), and European Parliament on the AI Act amendments. It distils 180+ pages of dense legislative complexity into one accessible graphic. You can download the high-res pdf for free at Enterprise AI Governance (link below). It's best viewed as a pdf on a large screen. Last week was a significant milestone for this process. The European Parliament formally adopted its position on AI Act simplification, with MEPs voting to adopt a set of proposed amendments on 26 March 2026. The margin of approval was decisive: 569 votes in favour, 45 against, and 23 abstentions. Following months of work behind the scenes, we now have the official proposals and negotiating positions from each of the three co-legislating institutions. This means that the trilogue negotiations can now begin. The clock is ticking down to August 2026, when the high-risk AI compliance date is due to kick in. Crucially, all three institutions are converging on 2 December 2027 as the potential applicable date for the obligations and requirements relating to high-risk AI systems listed in Annex III. Such a delay will give enterprises 16 additional months to prepare. This Cheat Sheet covers 8 key domains: ➡️ Prohibited AI practices ➡️ Timeline for high-risk AI compliance ➡️ Timeline for transparency-requiring AI compliance ➡️ Registration of "exempted" AI systems that are not high-risk ➡️ AI literacy obligation for providers and deployers ➡️ Processing sensitive data for bias detection and correction ➡️ European AI Office and oversight of general-purpose AI systems ➡️ Proportionality for small mid-cap enterprises (SMCs) Both the Council and the Parliament have curtailed some of the more ambitious simplification measures proposed by the Commission (e.g., on sensitive data processing for bias mitigation and the registration of “exempted” AI systems). They have also, broadly speaking, aligned on a new prohibited AI practice. Finally, the Parliament is ostensibly more supportive than the Council and Commission of retaining a broad and explicit AI literacy obligation.
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisJust got my blue belt in Brazilian Jiu-Jitsu. From white belt to blue belt. From a fractured ankle last year to standing on the mat again, smiling with my team. This certainly didn’t happen overnight. It happened because I kept showing up. Here’s the story in four pictures: - One shows me on crutches with a cast up to my knee - Another shows the new blue belt with my name on it. - The group shot is the academy celebrating promotions. - And the action shot? Well that’s me getting rag-dolled (in the best way) by my coaches - proof that the journey is still always in progress. Three simple takeaways from this white-to-blue journey that you can also hopefully carry straight into work and life: 1. Perseverance beats talent when talent quits. Last year my ankle snapped and everything stopped. Crutches, no training. The easy choice was to stay off the mat. The harder (and better) choice was to come back when the doctor cleared me - even when I was slow, rusty, and getting submitted by everyone. Grit isn’t about never falling down. It’s about deciding the fall doesn’t get the final say. 2. Discipline is just showing up when motivation is gone. Blue belt isn’t given for flashy moves or perfect technique. It’s given for consistency. For rolling when you’re tired, for drilling when it’s boring, for turning up on the days you’d rather scroll on the couch. Small, unsexy decisions compound. That’s true on the mats and in your career. 3. You don’t get better alone - community carries you. Every time I thought about quitting, someone in the academy pulled me back in. Coaches who corrected me patiently. Training partners who celebrated the tiny improvements and laughed with me through the brutal ones. BJJ is an individual sport, but you only survive the grind because of the people around you. Same in business. Same in life. I’m proud of the belt, but prouder of the person the journey helped me to become. If you’re in the middle of a tough season - injury, setback, long grind - keep going. The next belt (or next level) is usually closer than it feels. What’s one thing you kept showing up for even when it was hard?
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisBig personal news: I’m joining @GoogleDeepMind full-time in London starting this week. I’ll be working on the implications of AGI for human life, science, and society; on what it means to live, connect, and discover in a world where cognitive agency is no longer uniquely ours. The way we answer these questions will define what it means to be human. I can’t think of a better place to do it.
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisThe book I'm writing with Lode Lauwaert, 𝗧𝗵𝗲 𝗔𝗜 𝗘𝗻𝗱𝗴𝗮𝗺𝗲: 𝗧𝘂𝗿𝗻𝗶𝗻𝗴 𝗦𝗮𝗳𝗲𝘁𝘆 𝗥𝗶𝘀𝗸𝘀 𝘁𝗼 𝗕𝗲𝗻𝗲𝗳𝗶𝘁𝘀, now has its final cover (after months of work)! 𝘛𝘩𝘦 𝘈𝘐 𝘌𝘯𝘥𝘨𝘢𝘮𝘦 confronts the catastrophic risks posed by advanced AI and asks what it would take to steer toward a stable state of security instead. Drawing on the latest empirical research, historical precedent, and years of policy work shaping the EU AI Act, the book moves from detailed risk scenarios to the conceptual tools needed to reason about them, and finally to a portfolio of governance endgames and the positive futures they unlock. Its central argument is that no single solution will suffice — prevention must come first, defense-in-depth must follow, and we must act before it's too late. With Covid-19, we underinvested in prevention and preparedness and paid dearly in lives and money. Let's not repeat that mistake with AI. Written for policymakers, technologists, and anyone with a stake in how the AI transition goes, it offers not a prediction but a roadmap for the choices still open to us. A huge thank you to Vivianne Manlai, Omer Bilgin, and the entire Wiley team. We also appreciate everyone who participated in the cover selection polls and has supported the project along the way. More soon!
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisExcited to be joining the BBC as Head of Applied AI. My work has always focused on one thing: turning advances in AI into real-world impact. From building enterprise AI platforms at Mars to leading AI teams in R&D at AstraZeneca, I’ve seen how powerful AI can be when it moves beyond prototypes into real use. What makes this role particularly compelling is the opportunity to apply that at scale—at the intersection of strong research and innovation, trusted public service, and products used by millions of people. I’ve already been impressed by the depth of work coming out of BBC R&D. Looking forward to working with such a talented team—building on what’s already strong and translating it into meaningful impact. Looking forward to getting started! #NewStart #AI
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisHello Colleagues and Community; AstraZeneca cybersecurity is building something special! We are building out our Cybersecurity BISO function. Cybersecurity is integral to ensuring we deliver our AZ2030 Bold Ambition, AI30, and an emerging IT2030 transformation. We're growing a dedicated Business Information Security Officer (BISO) organization—cybersecurity leaders embedded directly alongside the business, not watching from the sidelines. This matters, because cybersecurity can't be an afterthought bolted on at the end. Our BISOs sit at the table where strategy is shaped, architectures are designed, and technology decisions are made. They translate cyber risk into business language, turn security from a blocker into an accelerator, and ensure resilience is built in from day one. We're not just filling roles—we're creating a new model of partnership between cybersecurity and the business. One that moves at the speed of innovation while keeping our patients, data, and platforms protected. We're hiring. If you're passionate about leading from the front, embedding security into the fabric of a global organization, and building something from the ground up—let's talk. Check out these roles at Careers.AstraZeneca.com: BISO – Enterprise AI & Data BISO – Commercial IT BISO – Manufacturing, Operations & Enabling
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisLast Friday was my last working day at McDermott International, Ltd. It was an extremely difficult decision, not only because I have been with the company for almost 14 years, but also because I truly enjoyed working there. McDermott for me was always about people around. I joined as an engineer, worked on construction site, continued as a department manager. My team, peers, and my managers supported me to start integrating AI when there was no widespread use of LLMs and when AI itself was perceived as something far from being applicable in our domain. Not to mention supporting my PhD. And I finished with the role of Global AI Solutions Lead. This career gave me something rare: experience across EPC, industrial AI, and AI compliance. But more than that, it gave me people, some of them became my lifelong friends and all of them created a very powerful network. The reason I am leaving is to focus fully on my own company ExplorAI - a conformity assessment for high-risk AI under the EU AI Act, with the goal of becoming a Notified Body designated by the EU Commission. AI compliance is where my passion is right now, and building such a company requires my full attention. Leaving McDermott means stepping away from an amazing career and an attractive role in a large corporation. But it also means committing fully to building something I believe the industry will need very soon. For everyone who was part of my journey - huge THANK YOU! Without you, nothing would have happened.
-
Oliver Patel, AIGP, CIPP/E, MSc liked thisOliver Patel, AIGP, CIPP/E, MSc liked thisThere was a version of me in 2020, hoping someone, somewhere, would read these books. I think about her a lot. Now these same books are finding their way all over the world. I don’t think she would believe this. I don’t think I do either. And somehow, today, I have 75,000 reasons to say thank you. 💙
Experience
-
AstraZeneca
-
-
IAPP - International Association of Privacy Professionals
-
AI Governance Faculty - AIGP Training Instructor
IAPP - International Association of Privacy Professionals
-
-
-
-
-
Department for Digital, Culture, Media and Sport (DCMS)
-
Policy Lead - International Data Transfers Expert Council
Department for Digital, Culture, Media and Sport (DCMS)
-
-
-
UCL European Institute
-
Head of Public Policy and Partnerships
UCL European Institute
-
Institute Manager
UCL European Institute
-
Research Associate (AI & Data Governance)
UCL European Institute
-
Policy Coordinator
UCL European Institute
-
-
-
-
Consulting Associate
Industry Forum
-
-
-
-
-
-
-
-
-
-
-
Education
-
The London School of Economics and Political Science (LSE)
Master of Science (MSc) Philosophy and Public Policy Distinction
-
Achieved a Distinction for my research thesis on how UK selective schools should implement affirmative action policies to promote social mobility.
-
Licenses & Certifications
-
Oxford Executive Leadership Programme
University of Oxford
-
Certified Information Privacy Professional Europe - CIPP/E
IAPP - International Association of Privacy Professionals
Issued Expires -
Skills
Publications
-
Brexit Transitional Arrangements: Legal and Political Considerations
UCL European Institute
-
Brexit: The Consequences for Other EU Member States
University College London - Constitution Unit
-
Post-Brexit trade negotiations would pose significant practical challenges for Whitehall
University College London - Constitution Unit
-
Brexit: The Consequences for the EU's Political System
University College London - Constitution Unit
-
The Constitutional Consequences of Brexit: Whitehall and Westminster
University College London - Constitution Unit
Languages
-
Serbian
Professional working proficiency
Recommendations received
1 person has recommended Oliver
Join now to viewOther similar profiles
Explore more posts
-
James Robson
Why treat consent as paperwork, when it can be your greatest enabler? What if consent‑based collaboration became the foundation not the obstacle of shared data innovation in health, research and public good? At the Social Data Foundation (SDF) in Southampton, we’ve moved beyond siloed agreements and manual paperwork. We built a datatrust model where citizens, NHS, councils, academia and researchers share data through explicit, ongoing consent, governed by purpose, time limits and governed by stewards not just lawyers. This is privacy embedded by design. Here’s what that shift looks like in practice: A community health board updates care pathways. Instead of waiting weeks via internal approvals, patient data is linked in a trusted research environment, with consent conditioned per study. Patients can revoke or extend permissions through user‑friendly dashboards. Researchers get access—fast—but only to what’s agreed. That design transforms governance from friction to trust: data providers feel in control, participants feel respected, and decision‑makers in research institutions see pace with accountability. Why does this reshape how we view consent? Because consent isn’t a one‑off checkbox, it can be a living contract with feedback loops, enabling collaboration that is scalable, transparent, and socially licensed. My experience across charities and universities confirms this is neither theoretical, nor restricted to large national efforts. Smaller care networks and research centres can replicate it using dynamic consent platforms, lightweight stewardship councils, audit‑ready TREs, and clear service level agreements. Embedding privacy by design isn’t just about compliance, it’s about enabling responsible innovation. Imagine internal operations teams releasing data faster; governance leads reducing red‑tape; legal and ethics boards reinforcing trust without slowing down impact. That’s the future. Have you seen consent built this way in your institution or wondered how to start? I’d love to hear what worked (or didn’t) in your context. #health #data #privacy #governance
1 Comment -
Luis Alberto Montezuma
UK's Consent or Pay’ Model Following the ICO's engagement with Meta about how it uses personal information for its advertising model, the ICO welcome's Meta's decision to ask users for consent to use their personal information to target them with ads. See https://lnkd.in/dzqACtbg. EU Cookies According to the report, two changes are currently on the table: First, more exceptions are to be created to reduce the number of banners. Secondly, users should be able to set their cookie settings once instead of having to define them again every time they visit a website. This could be done in the settings of the web browser, for example.
2 Comments -
Sian Basker
Hot off the press - the newest UK legislation around Data! This summary by the Department for Science, Innovation and Technology is pretty succinct (as legislation goes. Some interesting considerations for #charities #leaders #nonprofits and the #public sector around innovation, research, protecting people (esp children) and rights in relation to automated decision making.
-
Arunangsu Chatterjee
The University of Leeds and Aston University have secured £3.4M funding to launch AI.RDN+ The four-year initiative will: Capture researchers & supervisors current use of AI Co-Create guidance, case studies & training resources Offer experimentation funding for PGRs Collaborate with 20+ universities supported by Midlands Innovation & Yorkshire Universities & national partners like UKCGE Jisc Vitae and industry parters like Microsoft This work will help ensure AI adoption in doctoral research is responsible, ethical, and impactful which will be vital for the future of research skills in the UK. https://lnkd.in/dz-9GQZd Thanks a lot to the core team HOSAM AL-SAMARRAIE Phil Mizen Helen Turner among other colleagues. Thanks also to Nick Plant Masud Khokhar for their support #AI #Research #Capabilities
12 Comments -
Maeve Walsh FRSA
Excellent primer from Nuala Polo of the Ada Lovelace Institute on what we should be expecting/asking for from an upcoming #AIBill if it's going to create an effective regulatory framework - as we have in multiple other sectors - that is designed to manage risks and prevent harm. ⬇️ https://lnkd.in/evVWSN5p
-
Laura Fatah
Excellent write up of the JCHR session in ComputerWeekly.com, where UK regulators told the Committee how they are approaching the challenge of keeping people safe when using AI in society and what they need from government. #ArtificialIntelligence #AI #HumanRights https://lnkd.in/ex4ch8CV
-
Sarah Meyers
Calling all innovators in digital and emerging tech! The Digital Regulation Cooperation Forum (DRCF) is inviting innovators to help shape the Digital Regulatory Library a new one-stop shop for UK digital regulation, designed with users in mind. Really keen to get a broad user base of testers. See below.
-
Rob S.
Effective regulation of emerging technologies requires deep expertise and cross-sector collaboration. A great recent development is the UK Research and Innovation major new AI investment programme, which includes embedding specialist researchers directly into departments like Department for Science, Innovation and Technology and Digital Regulation Cooperation Forum (DRCF) to work on AI regulation, safety, and public trust. This collaborative approach perfectly echoes the theme of the upcoming Institute of Regulation 2026 Annual Conference: 'Advancing Regulation Together'. Building strong networks across the profession is essential for shaping responsible, forward-thinking innovation. https://lnkd.in/eFzYx6Uu #Regulation #Innovation
-
Lewis Bailey
When we at Labour Tech first began developing our Quantum Computing policy paper, it was a background issue that barely registered in Westminster. Most conversations with MPs, advisers, and parliamentary staff began with: “Oh, is that like quantum physics?” But once we set out the implications, from encryption risk to national resilience, the reaction was always the same: “We need to sort this now, don’t we?” That shift has been extraordinary to watch. In under a year, quantum has moved from a niche curiosity to a national priority, and it’s brilliant to see organisations like the Tony Blair Institute now delivering serious reports on the UK’s quantum future. The more of us pushing this agenda, the better. Because Q-Day could arrive within two years, and most governments, businesses, and local authorities are simply not ready. The risk to critical infrastructure and secure data is real — and preparation needs to begin now. This is exactly the kind of mission-led, future-focused challenge where a Labour government can lead: • by making quantum a pillar of Britain’s next industrial strategy, • by investing in sovereign capability and trusted infrastructure, and • by ensuring the benefits of this revolution are shared across every region. Quantum isn’t just about science — it’s about sovereignty, security, and strategy. Let’s make sure Britain leads the quantum age, not follows it. Great report from TBI https://lnkd.in/eKmJ86gS Joe Spencer Maxwell Marlow Adam Allnutt Kieran Bjergstrom and Lucy Maidwell thoughts?
-
Nelly Nneli
UK GDPR isn’t the hardest part of Information Governance. A lot of people think the hardest part of Information Governance is learning UK GDPR. I used to think that too. But once you’re in the role, you realise something pretty quickly, that knowing the law is just the starting point. The difficult moments are in the everyday application. When a team wants to move fast and you’re expected to “just sign it off”. When there isn’t a perfect answer, only a least-bad option. When you have to slow things down, even when you know it won’t be popular. That’s where Information Governance really shows up. Not in quoting legislation, but in using judgement, weighing risk, and taking responsibility for the decision. This is why two people can read the same UK GDPR guidance and still handle the same situation very differently. If you’re thinking about transitioning into Information Governance, this is worth knowing early. And if you're already in the field, what part of Information Governance do you find most challenging? #InformationGovernance #UKGDPR #DataProtection #CareersInGovernance #ProfessionalJudgement
4 Comments
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore More