BigID: Privacy by Design for Generative AI Systems

Name: BigID: Privacy by Design for Generative AI Systems
Uploaded: 2026-06-19T17:34:48-04:00
Duration: 1 min 17 s
Description: Privacy by Design for Generative AI | Aaron Weller on AI Risk, Guardrails & Continuous Oversight: https://bit.ly/3Oax9ex In this session from BigID’s AI Governance Leadership Forum, Aaron Weller (Leader, Privacy Innovation & Assurance at HP) explains w...

BigID

06/19/2026

0 (0%)

Report Like Favorite

TL;DR

Traditional privacy by design assumes predictable system behavior, but generative AI systems learn, adapt, and exhibit non-deterministic behaviors that require fundamentally different privacy frameworks.
Organizations must treat training data and model behavior as separate threat surfaces, each requiring distinct privacy controls and continuous monitoring rather than one-time assessments.
Privacy by design for AI should focus on establishing adaptive guardrails that shape behavior within boundaries, rather than rigid specifications that assume deterministic outcomes.

Summary

Aaron Weller, Leader of Privacy Innovation and Assurance at HP, explains why traditional privacy by design frameworks are insufficient for generative AI systems. Unlike conventional software with predictable behavior, generative AI introduces non-deterministic risks through both training data and emergent model behavior. Weller illustrates this with a real-world example of Microsoft Copilot surfacing vacation information that was never explicitly provided in a prompt, demonstrating how AI systems can exhibit unexpected behaviors. He argues that privacy controls must shift from static, point-in-time specifications to continuous oversight with adaptive guardrails. Rather than treating privacy by design as a one-time blueprint, organizations must establish ongoing governance frameworks that shape AI behavior within defined boundaries while accommodating the adaptive nature of these systems. This approach treats training data and model behavior as distinct threat surfaces requiring separate privacy considerations.

Chapters

0:00 - Traditional Privacy Frameworks Inadequate
0:10 - Real-World AI Behavior Example
0:35 - Continuous Oversight vs Point-in-Time
1:01 - Guardrails Over Blueprints

Key Quotes

0:03 "But with generative AI, we need privacy by design for systems that learn, adapt, and occasionally surprise us."
0:41 "I think we need to treat both the training data and the model behavior as different important threat surfaces, really."
1:01 "So I think for me, privacy by design can't be a blueprint that we do once and then it's done. It has to be the rules of the city that the building needs to live in."

FAQ

Why don't traditional privacy by design frameworks work for generative AI?

Traditional frameworks assume deterministic, predictable system behavior. Generative AI systems learn, adapt, and can exhibit emergent behaviors that weren't explicitly programmed, requiring continuous oversight rather than static controls.

Categories:

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise