On-demand session

Harnessing AI to Achieve Compliance at the Digital User Experience Layer

Start with the letter. It arrives at your general counsel’s desk, it threatens a class action, and it has screenshots attached showing your website handing customer data to tracking pixels. The date on the screenshots is seven months ago. You have thirty days to produce evidence of what was actually running on that page, on that day.

What happens at the digital experience layer stays at the digital experience layer. Once that browser session closes, the evidence is gone.

Ivan Tsarynny, in the session

Most organizations cannot answer that letter, and the reason is mundane rather than negligent: nobody logs what runs inside the browser. Ivan Tsarynny — who has testified before Congress on exactly this kind of tracking — uses the scenario to frame what changed in 2026. Proof replaced promises.

Three things a compliance team is now expected to be able to show:

• 01 Proof, not promises. Can you prove no data leaked before or after consent was given? Can you prove the site complies with its own privacy policy?
• 02 Always-on runtime verification. Confirm consent choices are actually enforced, not just configured. Move from quarterly sampling to always-on assurance.
• 03 Audit-ready evidence for 12 months. Maintain a record that stands up to regulators, auditors and litigation — and be able to show what happened 90 days ago on any page or app.

Then he does the arithmetic on auditing that by hand. Five digital properties, ten geographies, three languages, four consent states, fifty-two weeks:

• 31,200Weekly audits per year
• 171,600Hours per year
• 90Full-time auditors
• $10.7MTotal annual cost

And that is the conservative version — five properties, where most enterprises run dozens. The point is not the precise figure. It is that the manual approach has no version that works.

From there, the spine of the talk: six levels of AI-assisted privacy compliance, graded the way the industry grades self-driving cars.

• L1 The autocomplete. Someone on the privacy team asks a general assistant what a given cookie is, or what a jurisdiction requires. Useful, but it is a better search box.
• L2 The intern. AI drafts low-risk boilerplate — reviewing privacy notices, spotting a missing agreement with a vendor. Humans still do the actual work.
• L3 The junior professional. A scanner produces findings and AI interprets them, but humans still make every call. This is where it starts to feel like a colleague rather than a tool.
• L4 The pro. Agents run discovery at a scale that surfaces far more than a person can verify in real time, and the human becomes the bottleneck. Ivan is candid that this is where teams get uncomfortable — and what it means for what you send to outside counsel.
• L5 The senior professional. Agents run unattended for longer stretches and self-check before handing off. Oversight shifts from reviewing each step to reviewing outcomes. Very few organizations are here.
• L6 The compliance factory. You manage goals and constraints, not tools or workflows. Ivan is explicit that nobody is at this level yet — Feroot included — but that it is where this is heading.

The last stretch is practical. What continuous discovery has to cover: every pixel and SDK on every page and screen, including whatever marketing added last week; where sensitive data is collected, both in form fields and as plain text on an authenticated page; reconciling every vendor that loads against the agreement that is supposed to govern it; and keeping an audit trail long enough to answer a letter about something that happened months ago.

Ivan closes on the questions ISACA members actually ask — how this differs from a consent management platform, where it sits relative to GRC, SIEM and data-loss tooling, what the evidence looks like in a dispute, and whether the agents themselves touch personal data. (They observe behaviour and use synthetic data for discovery rather than ingesting real user records.)

Worth watching if you own:

• Audit or assurance, and you need to grade where your program actually sits today
• Privacy or compliance leadership weighing what to automate first, and what not to
• Security oversight, and evidence retention is going to land on your desk