The second edition of the Luxembourg GRC Summit, held on 3-4 June 2026, brought together cybersecurity governance, risk and compliance (GRC) professionals, practitioners and decision-makers to exchange knowledge and explore emerging challenges. Its interactive forum sessions provided a space for participants to share experiences, discuss different perspectives and identify practical responses. This outcome paper presents the insights and recommendations from the session “How should cyber governance evolve in the age of AI?”

AI challenges governance approaches build around relatively predictable systems and one-off assessments. As models, data, dependencies and operating environments evolve, organisations must continuously reassess risk and the conditions under which AI can be trusted. Increasing agency and autonomy complicates accountability, while AI’s ability to infer and combine information introduces additional privacy risks. These developments, alongside evolving EU regulatory requirements, call for closer integration of organizational and product risk management, data governance and cybersecurity. 

This report identifies continuous governance, evidence-based trust and meaningful human oversight as central priorities. It recommends ongoing monitoring, clear accountability, limits on AI agents’ permissions and autonomy, and oversight of third-party dependencies. Putting these measure into practice requires connecting regulatory requirements with operational controls, providing practical tools and guidance for SMEs, and strengthening AI literacy and professional skills while preserving human expertise.