The Observation

Regulations written by officials who have only ever watched from the pitlane wall tend to fail on first contact with the actual race. AI governance frameworks are increasingly being written by people who have never shipped an AI product, and the gap between regulatory intent and technical reality is widening. The EU AI Act's risk classification system, for instance, assumes organisations can neatly categorise AI systems into risk tiers before deployment. But the same model can be low-risk in one context and high-risk in another, depending entirely on how it is orchestrated and what data it processes.

Formula 1 recognised this problem and fixed it. Since 2010 the FIA has required a former driver to sit on every steward panel, precisely because decisions made without seat time lack credibility with the paddock. The same need is now emerging in AI governance: a market need for translators, professionals who can sit between the policy layer and the engineering layer and make each legible to the other.

What This Means for Data Privacy

DPOs and privacy professionals are arguably the best-placed people to fill this translation role. They already bridge legal and operational worlds. But the translation only works if policies are co-authored with the people who are actually building or deploying AI, rather than written in isolation.

We often see AI policies that read well as legal documents but cannot survive a ten-minute conversation with an engineer. The DPO who has used the tools, stress-tested them, and seen where they leak data is the official who came up through the paddock, and writes rules that survive contact with reality. If your AI governance documentation has not been tested against the people who will operate within it, there is a risk it becomes a compliance artefact rather than an operational tool. The value of the DPO in this landscape is making regulatory intent operational, and that requires close collaboration with technical teams.