GoKawiilLegal expert Daniel Garrie outlines AI liability frameworks for CISOs at ISC2 Congress
At ISC2 Strategic Congress 2026 in Denver, cyber legal expert Daniel B. Garrie, CEO of Law and Forensics, presented frameworks to help CISOs justify AI deployment decisions and preserve evidence in case of disputes or breaches. The approaches include scoring AI deployment risk, documenting board-level risk decisions, and specifying what incident data must be preserved, building on JAMS AI Rules he helped author in 2024 for arbitrating AI disputes.
GoKawiil's interpretation of the reporting above, not reported fact.
As agentic AI expands within enterprises, CISOs face growing exposure to liability when deployments go wrong, yet often lack standardized ways to prove due diligence was exercised. Garrie's push to bake evidence and incident-response terms into vendor contracts suggests organizations may need to treat AI governance as a legal and documentation exercise, not just a technical one. This could shape how companies negotiate with AI vendors and how courts or regulators eventually assess fault in AI-related incidents.
- Garrie proposes three frameworks: AI risk scoring, board decision documentation, and incident data preservation.
- The frameworks build on JAMS AI Rules established in 2024 for arbitrating AI-related disputes.
- Garrie recommends CISOs negotiate evidentiary and incident-response terms directly into AI vendor contracts.
Source: darkreading.com — Becky Bracken, 2026-10-27
Published there as: “3 Frameworks to Protect CISOs & Orgs Against AI Liability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.