THE INTERACTIVE HUB OF THE INFORMATION WORLD · ISSUE 253 · SEPTEMBER 2026 · £15.00
INFORMATION SECURITY SPECIAL EDITION
The quantum transition:
What information governance professionals need to know
12
Did OpenAI go rogue?
16
ISO 27001:2022: Why ISMS effectiveness matters more than size
20
Records managers – tricks of the trade
30
Before you hand the keys to the algorithm
Save 10% with discount code: IRMS-MEMBER
Information Governance and Caldicott Guardian CPD Training 10% DISCOUNT FOR IRMS MEMBERS Quote HCUK10IRMS when booking
Update your knowledge and skills in information governance and management including the role of the Caldicott Guardian, to ensure effective handling and sharing of patient information.
IAPP Certified Information Privacy Manager A unique IAPP qualification in privacy programme management for DPOs and senior compliance professionals. Learn how to translate data protection law into policies and procedures that organisations can adopt to create workable everyday practices.
For a full event listing visit: www.healthcareconferencesuk.co.uk/conferenc es-masterclasses/subjects/informationgovernance
www.freevacy.com TKM_advert_72mm x 108mm.qxp_Layout 1 31/01/2020 09:49
Data Protection Training:
®
Certificated Courses and Qualifications
Tkm offers data protection courses approved and certificated by the SQA and BCS Courses are scheduled across the UK and can be arranged in house. See website for dates. 10% discount on individual course fees for IRMS members. Fees start from £350 for a one day course (excluding VAT). For further information and booking please contact us t. 01599 511277 or 07833 617462 e. liz@tkmconsulting.co.uk
info@tkmconsulting.co.uk www.tkmconsulting.co.uk 2 BULLETIN 253 · SEPTEMBER 2026
bulletin September 2026 in this issue...
4
Who’s who
5
From the Chair
44
Industry news
52
Training partner courses
54
New members
55
Diary dates
Information security 8
The quantum transition: What information governance professionals need to know about post-quantum security Linda Shave
12
Did OpenAI go rogue? What businesses need to know Jason Lydford 16
ISO 27001:2022: Why ISMS effectiveness matters more than size Ben Kay
Information management 20
Records managers – tricks of the trade Craig Grimestad
26
Information governance versus data governance versus records management: What’s the difference? Paul Mullon
AI 30
Before you hand the keys to the algorithm Andrew Potter 34
AI procurement is now a governance function Amelia Williams Data protection 38
Do you understand? Speak human: Plain language in data protection Emma Butler 40 Soft opt-in for charities Sue White
INFORMATION AND RECORDS MANAGEMENT SOCIETY 3
Information and Records Management Bulletin Issue 253 · September 2026
Bulletin Editor Catherine Burton, G and C Media catherine@gandcmedia.co.uk Production Editors Jamprint info@jamprint.co.uk Chris Callander, G and C Media chris@gandcmedia.co.uk Publisher Information and Records Management Society® St James House, Vicar Lane, Sheffield, S1 2EX Tel: 01625 664520 www.irms.org.uk IRMS Executive Committee David Reeve AMIRMS, FIRMS, Chair david.reeve@irms.org.uk Reynold Leming AMIRMS, FIRMS, Vice Chair · (External) reynold.leming@irms.org.uk Maria Lim-Pittendrigh, Vice-Chair (Internal Governance) maria.lim@irms.org.uk Simon Ellis AMIRMS, FIRMS, Commercial Development Director simon.ellis@irms.org.uk Stephen Hurling (co-opted), Commercial Director stephen.hurling@irms.org.uk Rebekah Taylor, Treasurer rebekah.taylor@irms.org.uk Paulina Jedwabska, Conference Director paulina.jedwabska@irms.org.uk Lauren Cook, Groups Director lauren.cook@irms.org.uk Greg Stewart, Marketing & Communications Director greg.stewart@irms.org.uk Suzy Taylor, AMIRMS, FIRMS, Membership Director suzy.taylor@irms.org.uk Roger Poole FIRMS, Professional Standards Director roger.poole@irms.org.uk May Ladd, Training Director may.ladd@irms.org.uk Digital · (vacant) digital@irms.org.uk Secretary · (vacant) secretary@irms.org.uk IRMS Officers and Sub-committee Chairs Vicky Beddall, Conference Officer vickybeddall@irms.org.uk Kamil Soree, Data & Digital Officer kamil.soree@irms.org.uk Sian Astill, Data & Digital Officer sian.astill@irms.org.uk Bev Cunningham, Groups Officer groupsofficer@irms.org.uk Carys Hardy, Marketing & Communications Officer carys.hardy@irms.org.uk Jenny Moran, Marketing & Communications Officer jenny.moran@irms.org.uk Rob Bath, Microsoft 365 Advisor rob.bath@irms.org.uk Kamil Safai, Digital & Data Officer kamil.safai@irms.org.uk Sian Astill, Digital & Data Officer sianastill@irms.org.uk Lucy Dowling, Finance Officer lucy.dowling@irms.org.uk Technology Partnerships Officer · (vacant) technologypartnershipsofficer@irms.org.uk
4 BULLETIN 253 · SEPTEMBER 2026
IRMS Conference Emma Turley, IRMS Delegate Enquiries emma@revolution-events.com Deborah Ward Johnstone, IRMS Sponsorship Enquiries deborah@revolution-events.com IRMS Group contacts Ireland · Francesca Sarenas francesca.sarenas@irms.org.uk Public Sector · Elizabeth Barber AMIRMS, FIRMS elizabeth.barber@irms.org.uk Higher Education & Further Education · Anne Grzybowski anne.grzybowski@irms.org.uk IM Tech · Maria Lim maria.lim@irms.org.uk Information Rights · Craig Clark craig.clark@irms.org.uk Legal · Iram Ditta iram.ditta@irms.org.uk Midlands · Mark Smith mark.smith@irms.org.uk Wales/Cymru · Sarah Phillips sarah.phillips@irms.org.uk South West · Shannon Parsons shannon.parsons@irms.org.uk Schools · Laura Palmariello laura.palmariello@irms.org.uk Scotland · Khopolo Jamangile khopolo.jamangile@irms.org.uk Financial Services · (vacant) financial@irms.org London · (vacant) london@irms.org.uk North · (vacant) north@irms.org.uk Third Sector · (vacant) thirdsector@irms.org.uk How to join the IRMS Go to www.irms.org.uk/join How to contribute If you’d like to contribute to the Bulletin please send copy to the Editor at: catherine@gandcmedia.co.uk. The up and coming deadlines to submit copy are: 15 September for the November issue and 15 November for the January issue. How to advertise Deborah Ward Johnstone, IRMS Bulletin Advertising Enquiries deborah@revolution-events.com Published bi-monthly in January, March, May, SEPTEMBER, September, November. ISSN 2045-6581 The Bulletin provides a wide spectrum of opinion on information and records management matters: the views of the contributors do not necessarily reflect the views of the Information and Records Management Society®.
from the Chair with David Reeve · IRMS Chair
Dear readers, They say time flies when you are having fun. If so, then this bodes well for my tenure as Chair, since I am struggling to believe that the May Conference was 3 months ago!! Time indeed is flying by, with a mere 9 months to go before IRMS Manchester 2027! The fabulous IRMS Exec have been very busy setting up, delivering and completing various projects, all of which should help us deliver better services and give benefits to our members. Here are some of the activities that are underway. Our long journey to update and integrate our IT system is nearing completion. This began in 2023 with our migration from Google to our Microsoft 365 Teams and SharePoint platform. From there, we began the process of moving from our previous restrictive and limited website to our new WordPress site, which we launched to much acclaim last year. At the time, we implemented our new membership platform, Membership Works (which gives us far more intelligence and analytics) and payment system Stripe (a lot of our members were really struggling to pay their fees in the old system). Greg Stewart, Marketing and Communications Director, our Marcom officers and Digital and Data officers are now completing the final part of the integrated solution, a move to Mailchimp, to help with our email and marketing. I would like to thank all of our past and present Exec members who have worked so hard to achieve this ambition. Checking with our finance team, it looks like we have actually saved some money in carrying out all this integration work. At the May conference, I spoke about the importance of our training, skills (eg, skills matrix) and learning, and mentoring as key benefits for our members
from when they start as students, throughout their professional career, until retirement. We have an opportunity to provide quality training packages to meet our members needs at incentivised prices. Our new training director, May Ladd, along with Ren Leming and myself, has been planning a Training, Skills and Learning Project. It is currently looking like this project will be delivered in two phases: •
Phase I – current timeframe: Q3 2026–Q4 2027 (1 year)
We will firstly review our skills matrix with our stakeholders, who helped us create this. We will then work with our current training provider partners to map their training provision with the skills matrix. We will identify any gaps and may even commission the training to be written (depending on costs and budget). Members will be able to access this through our website at a discounted rate. This will be a fairly manual process to start with, but we are keen to get it up and running. •
Phase 2 – current timeframe: Q1 2027–Q4 2028 (2 years)
This will focus on how this basic service can be improved for members, training providers and the IRMS. We are looking at ideas such as partner expertise online sessions, use of AI-driven training, a new learning management system (LMS) and podcasts. This is an ambitious project and will take some time; we are all volunteers. We are also looking at updating some of our INFORMATION AND RECORDS MANAGEMENT SOCIETY 5
backend processes to improve the way we work. A big thank you for all their work on this goes to Marie Lim, our Vice Chair for Internal Governance; Rebekah Taylor, our Finance Director, along with our new finance officer, Lucy Dowling (welcome) and Hilary Laing of Moore Engage; our Digital and Data Officer, Sian Astill; and Suzy Taylor, our Membership Director. Lauren Cook, Groups Director; Bev Cunningham Groups Officer, and our Groups chairs are now working hard on their programmes for the year, so keep checking our website events page. Really excited to see that Francesca Sarenas, our new Ireland Group chair, is putting on a day event “Before the Algorithm, After the Prompt” on 21 October in Dublin.
was already underway. We had a planning and feedback (from Celtic Manor Conference) meeting at Kimpton Hotel in Manchester in August. It was a great day of planning in a much-appreciated air-conditioned room, as the centre of Manchester basked in 37 degrees! Getting excited about the event already; it is going to be epic. Huge thanks to the Revolution Events team for all their hard work. Our full package ticket prices remain the same as they were for 2026, with our loyalty rate to those who have attended in the last 3 years currently available (when I was writing this) at £999 for the first 80 places. Get your tickets quickly; don’t leave it too late. Hoping that you all had a great summer
Finally, Paulina Jedwabska and Vicky Beddall never stop. As Celtic Manor Conference 2026 was taking place, the planning for Manchester IRMS Conference 2027: Every Record Tells a Story
“The route to senior decision-makers in the Information Management Industry - in public and commercial sectors.”
ament ation manag 4,000 inform e read each issu ls a n io ss fe ro p be – They could of the bulletin message too. reading your For more details and to advertise in the bulletin contact Deborah Ward-Johnstone:
� deborah@revolution-events.com � 01892 820 936
6 BULLETIN 253 · SEPTEMBER 2026
Do you know what’s next for your professional development? Have you considered IRMS accreditation yet? If not, what’s stopping you? Are you: • A member of the IRMS • Someone that works with the management of information in any way? • Possessing 5+ years experience in the profession or 3+ years with a relevant qualification? • Someone that can demonstrate an understanding and practical application of the principles and practice of managing and governing information and records? Then why not apply?
“Accreditation helped me focus my professional development, look to the future and give me some confidence to battle that sense of imposter syndrome” Anne
- You’ll be assessed by written or verbal assessment (your choice) - We can offer you guidance, support and an application buddy - Regardless of outcome, you’ll have a professional development plan we’ll help you with
irms.org.uk/accreditation
Information security
The quantum transition: What information governance professionals need to know about post-quantum security BY LINDA SHAVE
Quantum computing is not simply an infrastructure issue; it introduces practical, long-term challenges for the ongoing confidentiality, integrity, and accessibility of permanent information assets. For decades, information security and records management have relied on a shared assumption: the cryptographic protections securing corporate records, financial transactions, and digital identities could not be broken within any realistic timeframe. Modern encryption methods, such as RSA and elliptic curve cryptography, have long formed the stable foundation of trust across digital business, government, and public services.
While large-scale quantum computers capable of matching current public-key cryptography do not yet exist, governments and cybersecurity agencies globally are encouraging organisations to begin a structured preparation for a postquantum environment. Far from a technical infrastructure issue alone, the emergence of quantum capabilities raises practical, longterm questions about the ongoing life-cycle management of permanent and long-term information assets.
As we look toward the next decade of digital preservation, this foundational assumption is beginning to evolve.
One of the core concepts in the postquantum discussion is known as “harvest now, decrypt later”. 8 BULLETIN 253 · SEPTEMBER 2026
WHY LIFE-CYCLE MANAGEMENT MATTERS TODAY One of the core concepts in the post-quantum discussion is known as “harvest now, decrypt later”. In this scenario, certain data intercepted today could theoretically be stored with the intent of decrypting it years down the track, once quantum capabilities mature. While this primarily impacts high-value state, corporate, or infrastructure data, it introduces a useful risk-management lens for records and information management professionals. Many organisations routinely retain information for extended periods due to legal, regulatory, or historical requirements. Such records frequently include the following:
•
sensitive personal information and identity data
•
health, medical, and clinical research records
•
corporate intellectual property and trade secrets
•
board minutes and executive decision records
•
critical infrastructure data and engineering schematics
•
government and public archives
If data being retained today needs to remain secure and confidential well into the future, information managers must ensure that our long-term digital preservation strategies account for shifting cryptographic standards over the entirety of the record’s life cycle.
THE GLOBAL MOVE TOWARDS POSTQUANTUM CRYPTOGRAPHY In response to these long-term timelines, the global cryptographic community has already developed new standards, known as postquantum cryptography (PQC). The United States National Institute of Standards and Technology has finalised its first official PQC standards, including ML-KEM (for encryption) and ML-DSA (for digital signatures). These standards are now forming the basis for migration planning worldwide. For information governance professionals operating in the UK, or managing cross-border data with regions like Australia, understanding the parallel regulatory approaches is highly beneficial. INFORMATION AND RECORDS MANAGEMENT SOCIETY 9
The challenge ahead is not a crisis, but a standard cycle of technological adaptation. UNITED KINGDOM: A PHASED MIGRATION APPROACH The UK’s National Cyber Security Centre (NCSC) has published clear guidance outlining indicative, manageable milestones for migrating to PQC. The NCSC explicitly recognises that this is a multi-year process, requiring careful planning rather than immediate system overhauls. The NCSC recommends aligning with a phased road map:
•
By 2028: define migration objectives, complete a discovery exercise to identify systems using public-key cryptography, and develop an initial migration plan.
•
By 2031: complete early, high-priority migration activities and refine internal migration road maps.
•
By 2035: complete migration to PQC across systems, services, and products where feasible.
For records and information management teams, this multi-year planning window presents an ideal opportunity to map where cryptographic controls are embedded within records repositories, cloud platforms, and digital preservation systems during standard review cycles.
10 BULLETIN 253 · SEPTEMBER 2026
AUSTRALIA: EMPHASISING QUANTUM READINESS AND CRYPTO-AGILITY Similarly, Australia’s cybersecurity authorities have integrated quantum readiness into their Information Security Manual. The Australian Signals Directorate strongly emphasises the principle of crypto-agility – the structural ability to replace cryptographic algorithms smoothly without requiring a wholesale, expensive replacement of hardware or core business applications. This principle directly mirrors core information governance philosophies. Because records regularly outlive the temporary technology platforms on which they were created, futureproofing information systems will increasingly require systems to be adaptable by design, allowing security protocols to upgrade seamlessly over time.
CORE INFORMATION GOVERNANCE IMPLICATIONS The transition to PQC is best managed not as an isolated IT project, but as part of standard information governance frameworks. 1. Long-term retention review The longer information is retained, the more it is exposed to successive generations of technological change. Governance teams can use this transition as a driver to actively review whether records being retained for extended periods genuinely justify their longterm storage obligations and associated confidentiality risks. 2. I nformation asset visibility A robust transition relies on good asset data. Governance teams can add massive value by working with security colleagues to identify where critical information assets live, their remaining retention life cycles, and any third-party cloud dependencies.
3. Procurement and supplier assurance As software and systems naturally reach their end-of-life and are replaced, procurement processes should include baseline questions regarding a vendor’s road map for supporting modern PQC standards. This ensures quantum readiness is baked into normal business-as-usual upgrades at no extra cost.
A NOTE ON BLOCKCHAIN AND DISTRIBUTED LEDGERS Some organisations use blockchain or distributed ledger technologies to support provenance and auditability in digital records. Like other digital systems, older blockchain implementations relying on traditional asymmetric cryptography will naturally need to adopt post-quantum standards over the coming decade. For information governance professionals, the focus remains simple: ensure that any platform relied upon for evidential records can demonstrate a clear, adaptable pathway toward modern security updates.
•
Review long-term retention risks: use this as an opportunity to reinforce robust defensible disposition practices, ensuring data that has reached its legal retention limit is securely destroyed.
LOOKING AHEAD Information governance has always been about protecting the authenticity and trustworthiness of information throughout its entire life cycle. The emergence of quantum computing standards is simply the next chapter in that ongoing responsibility. The challenge ahead is not a crisis, but a standard cycle of technological adaptation. By engaging early and incorporating cryptoagility into our long-term planning, information governance professionals can ensure that the digital archives we build today remain secure, verifiable, and trustworthy for decades to come.
PRACTICAL STEPS FOR INFORMATION GOVERNANCE TEAMS While the full global transition will span a decade or more, there are simple, practical actions that information governance teams can take today without disrupting current operations:
•
Build cryptographic awareness: develop a baseline understanding of where encryption is currently deployed within your core records repositories and cloud services.
•
Support discovery activities: leverage your existing information asset registers and retention schedules to help wider IT teams identify which long-term systems hold the most sensitive data.
•
Embed flexibility in procurement: coordinate with IT procurement to ensure that future software selection exercises ask vendors about their long-term cryptographic flexibility.
The Author Linda Shave is a visionary futurist, technology strategist, researcher, educator, author, and advocate for the record and information management industry and digital modernisation. As a dedicated researcher and advisor, she empowers public and private sectors to leverage emerging technologies, specialising in the convergence of AI, data science, and quantum computing to solve complex, real-world problems. Linda bridges the gap between theoretical, futuristic innovation and practical application.
<linda.bizwyse@gmail.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 11
Information security
Did OpenAI go rogue? What businesses need to know BY JASON LYDFORD
Recent headlines suggested that an OpenAI artificial intelligence (AI) agent had “gone rogue” after escaping a controlled testing environment and attempting to access another company’s systems.
The AI did not become conscious. It did not decide to attack anyone. It did not develop malicious intent.
It sounds like something from a science fiction film, but the reality is both less dramatic and, in many ways, more important. According to OpenAI and Hugging Face, during a controlled security test, an advanced AI agent identified a weakness in its testing environment, escaped the restrictions placed around it, and attempted to access systems belonging to Hugging Face – one of the world’s largest AI development platforms. The key takeaway isn’t that AI has become self-aware. It’s that modern AI systems are becoming capable of carrying out increasingly sophisticated cyber tasks with very little human intervention; tasks that until recently required experienced human hackers.
WHY IT MATTERS Cybercriminals have always looked for ways to automate attacks. For years, they’ve used scripts to scan websites, send phishing emails, and hunt for vulnerabilities. AI is now taking this to the next level. Instead of simply following pre-written instructions, modern AI agents can analyse situations, adapt their approach, and solve problems in real time. This means attacks that once required skilled hackers could increasingly be carried out by
12 BULLETIN 253 · SEPTEMBER 2026
AI-assisted tools. The speed of cyber threats is rising, while many organisations still rely on security processes designed for a slower world.
THE PLAIN-ENGLISH EXPLANATION The phrase “AI went rogue” makes for a dramatic headline, but it isn’t accurate. The AI did not become conscious. It did not decide to attack anyone. It did not develop malicious intent. Instead, it was given a goal during a security test. While pursuing that goal, it identified weaknesses in its environment, bypassed restrictions, and attempted to access Hugging Face because it believed useful information was there.
Businesses should expect cybercriminals to increasingly use AI to
•
discover vulnerabilities faster
•
write malicious code automatically
•
launch attacks at machine speed
•
adapt techniques when blocked
•
operate around the clock
This changes the economics of cybercrime. Tasks that once required experienced hackers can increasingly be automated, making attacks faster, cheaper, and easier to scale.
COMMON MISTAKES Think of it like a robot vacuum. If you tell it to clean every room and a door is left open, it will simply keep going. It isn’t being disobedient – it’s following its objective. Modern AI works the same way, except its problem-solving ability is becoming far more advanced.
WHAT BUSINESSES SHOULD TAKE AWAY The biggest lesson isn’t about OpenAI specifically. It’s about the future of cybersecurity.
Many organisations react to stories like this the wrong way. Some assume AI itself is the threat. Others dismiss it as marketing hype. The reality sits in the middle. The technology is genuinely advancing, but panic is not the answer. The right response isn’t to ban AI – it’s to build stronger cyber resilience.
WHAT GOOD LOOKS LIKE Organisations that are prepared for the next generation of threats typically
INFORMATION AND RECORDS MANAGEMENT SOCIETY 13
•
maintain an accurate inventory of systems
•
patch vulnerabilities quickly
•
enforce strong identity protection and multi-factor authentication
•
monitor their environment continuously
•
test backups regularly
•
train employees to recognise modern threats
•
treat cyber resilience as an ongoing business process
still require humans to create, deploy, and direct them, but they can increasingly automate tasks that previously required skilled cybercriminals. Did OpenAI’s AI become self-aware? No. There is no evidence that the AI became conscious or acted with its own intentions. According to OpenAI, it was attempting to achieve the objective it had been given during a controlled security test and exploited weaknesses in its testing environment along the way. Should businesses be worried about AIpowered cyberattacks?
FREQUENTLY ASKED QUESTIONS
Businesses should be aware rather than alarmed. Cybercriminals are already using AI to make phishing emails more convincing, automate vulnerability discovery, and accelerate attacks. The best defence is strong cyber resilience, not avoiding AI altogether.
Can AI really hack computer systems on its own?
Should my business stop using AI tools like ChatGPT or Microsoft Copilot?
Advanced AI agents are becoming capable of identifying vulnerabilities, writing code, and adapting their approach to achieve a goal. They
No. AI can significantly improve productivity when used responsibly. Businesses should establish clear AI usage policies, avoid sharing
Good cybersecurity has never been about stopping every attack. It’s about detecting, responding, and recovering quickly.
14 BULLETIN 253 · SEPTEMBER 2026
The key takeaway isn’t that AI has become self-aware. It’s that modern AI systems are becoming capable of carrying out increasingly sophisticated cyber tasks with very little human intervention; tasks that until recently required experienced human hackers. confidential information unnecessarily, and ensure employees understand both the benefits and the risks of AI.
responsibly and build strong cyber resilience will be far better placed than those that simply hope today’s defences will still be enough tomorrow.
How can my business prepare for AI-driven cyber threats? Start with the fundamentals. Keep systems updated, enable multi-factor authentication, monitor for suspicious activity, train employees regularly, test your backups, and review your cyber resilience. AI is changing how attacks happen, but organisations with strong security foundations remain far better protected.
THE MUNIO PERSPECTIVE Stories like this reinforce something we’ve been saying for years: cybercriminals are beginning to operate at machine speed, while many organisations are still defending at human speed. That’s why cyber resilience matters more than ever. Technology alone isn’t enough. Businesses need the right processes, visibility, and understanding to reduce risk before attackers can exploit it. The future of cybersecurity won’t be defined by whether AI exists – it already does. It will be defined by how quickly organisations adapt. Businesses that understand AI, use it
The Author Jason Lydford is the Founder and CEO of Munio, an award-winning UK cybersecurity and managed IT provider. With more than 20 years’ experience, Jason helps organisations understand cyber security, artificial intelligence and technology risk in plain English. He works with businesses across the UK to adopt AI safely, strengthen cyber resilience and make informed technology decisions through practical, jargon-free advice.
<J.lydford@munio-it.co.uk> <https://munio-it.co.uk >
INFORMATION AND RECORDS MANAGEMENT SOCIETY 15
Information security
ISO 27001:2022: Why ISMS effectiveness matters more than size BY BEN KAY
In short: ISO 27001:2022 is most effective when organisations treat their information security management systems (ISMSs) as a risk-led business enabler, not a compliance exercise. That means using leadership commitment, threat intelligence, targeted controls, and continuous improvement to focus limited resources on the risks that matter most. WHY ISO 27001:2022 IMPLEMENTATION OFTEN BECOMES COMPLIANCE-LED Organisations implementing ISO 27001:2022 frequently struggle to translate high-level requirements, such as Clause 5.1 (Leadership and Commitment), into practical, value-driven outcomes. This often results in an overemphasis on compliance activities, rather than focusing on meaningful risk reduction and business impact.
A key challenge lies in the effective use of limited resources. Organisations, particularly smaller ones, may attempt to replicate the scale or approach of larger enterprises, leading to inefficient allocation of time, budget, and personnel. Without clear prioritisation informed by relevant threat intelligence, risk assessments can become generic and misaligned to the organisation’s actual threat landscape. This is compounded by a lack of structured,
The answer isn’t spending more; it’s about making the resources available to you work as effectively as possible. Work smarter, not harder. 16 BULLETIN 253 · SEPTEMBER 2026
continuous improvement practices, which limit the organisation’s ability to evolve its ISMS and demonstrate ongoing maturity. As a result, many ISMS implementations fail to deliver their full potential. Addressing these challenges requires a shift from complianceled thinking to a smarter, prioritised, and continuously improving approach that maximises the effectiveness of available resources.
SMARTER RESOURCING: MAKING CLAUSE 5.1 WORK FOR YOU Clause 5.1 sets the tone for ISO 27001 by holding leadership accountable: ensuring the ISMS is properly resourced, aligned to intent, and supported at the highest level. While essential, these requirements can be interpreted very differently, depending on the organisation. A smaller company with greater restrictions on resources cannot implement security at the same scale as a multi-millionpound organisation. This ambiguity makes prioritisation vital. The answer isn’t spending more; it’s about making the resources available to you work as effectively as possible. Work smarter, not harder.
USE THREAT INTELLIGENCE TO PRIORITISE THE RISKS THAT MATTER Base your resource decisions on credible, business-relevant threat intelligence. Whilst threat intelligence was only introduced formally in the 2022 revision, it has been at the heart of implementation for some time. Failing to understand your threat landscape properly presents gaps in risk assessment, opening the door to vulnerabilities and threats. Focus on the risks that matter most and be clear about why those risks take priority – record this process and reference it in your evidence. This approach strengthens your ISMS, demonstrates effective risk management, and provides evidence that threat intelligence is being used to improve real business functions. Capture this process and ensure it is documented and evidenced to your auditors.
HUMAN RISK: A PRACTICAL EXAMPLE OF ISMS EFFECTIVENESS Effective security management is not about scale, it’s about impact. One of the most pertinent examples of this in practice is how organisations handle human risk and use it to their advantage.
INFORMATION AND RECORDS MANAGEMENT SOCIETY 17
Continuous improvement isn’t just an ISO requirement, it’s the engine that drives a mature, resilient, and future-ready security posture.
Phishing remains one of the most pervasive threats in today’s landscape, increasingly powered by AI-driven sophistication and voice emulation attacks (vishing). Phishing awareness/training shouldn’t be treated as a mere compliance box to tick, it’s a powerful opportunity to tailor your ISMS and showcase continuous improvement. If phishing isn’t a priority in your risk treatment strategy, you’re leaving a clear path open for data loss. Fortunately, phishing risk can be addressed with minimal cost and high impact. Tools like Microsoft’s E5 suite enable realistic attack simulations. Short, focused training sessions (20 minutes at a time) can significantly raise staff awareness. Paired with regular incident testing and accessible educational content, these practices build organisational resilience and embed good security habits into everyday operations. By addressing human error proactively, you demonstrate maturity in mitigating one of the most common and consequential risks to your organisation.
DEFINE, REFINE, RINSE, REPEAT: ISO 27001 CONTINUOUS IMPROVEMENT There is no magic wand for ISO 27001 compliance, unfortunately. If you want to
18 BULLETIN 253 · SEPTEMBER 2026
get something at the end, there is some hard work needed at the beginning and consistent, measurable work throughout. Policies won’t write themselves, controls take time to implement, and structuring evidence requires foresight and management. It is important to remember that the controls exist to protect your information and safeguard your people, systems, and reputation. You should view them as enablers, not as chores. What does make the ISO journey manageable is treating implementation as an iterative process. Run structured sprints of activity: gather evidence, identify weaknesses, implement improvements, and start again. Phishing programmes, for example, provide a steady stream of insights that help pinpoint weaknesses and highlight opportunities for refinement. Once your ISMS is established, consider running two to three improvement cycles each year, focusing on areas most relevant to your organisation. Document each sprint from start to finish. This not only creates a treasure trove of audit evidence, but also reinforces a culture of good practice. Continuous improvement isn’t just an ISO requirement, it’s the engine that drives a mature, resilient, and future-ready security posture. Leveraging this is critical to reaping the many benefits that ISO 27001 has to offer.
TURNING ISO 27001:2022 INTO A BUSINESS-ENABLING FRAMEWORK An effective ISMS is not defined by its size, but by how well it prioritises and addresses real organisational risks. Focusing resources on high-value areas such as human risk delivers meaningful, measurable improvements in security posture. Ultimately, continuous improvement is the key to transforming ISO 27001 from a compliance exercise into a resilient, business-enabling framework. For organisations that want ISO 27001 to deliver more than certification, the priority should be clear: focus on the risks that matter, evidence the decisions you make, and keep improving.
prioritise risk treatment and avoid generic risk assessments that are not aligned to the business. How does continuous improvement support ISO 27001 compliance? Continuous improvement helps organisations move beyond static policies and controls. Regular evidence gathering, testing, review, and refinement show that the ISMS is active, measured, and improving over time.
ISO 27001:2022 FAQS What is ISO 27001:2022? ISO 27001:2022 is the international standard for ISMSs. It sets out requirements for establishing, implementing, maintaining, and continually improving an ISMS. What does Clause 5.1 mean in ISO 27001:2022? Clause 5.1 focuses on leadership and commitment. In practice, this means senior leadership should ensure the ISMS is supported, appropriately resourced, aligned with business objectives, and continually improved. How can smaller organisations implement ISO 27001 effectively? Smaller organisations should avoid copying enterprise-scale approaches. Instead, they should prioritise the risks most relevant to their business, use available resources intelligently and evidence why those decisions were made. Why is threat intelligence important for ISO 27001:2022? Threat intelligence helps organisations understand their actual threat landscape,
The Author Ben is a Senior Project Manager and Consultant at Bridewell. With 24 years of experience in RAF Intelligence, he brings extensive expertise in security, risk, and strategic delivery. Managing bespoke military operations at home and on deployment has given him a strong understanding of how to translate strategy into practical, effective working practice that keeps assets safe. Ben has worked with a diverse range of clients to align security strategies with recognised frameworks, helping them make the most effective use of their resources and time to build security programmes that are both effective and achievable. <www.bridewell.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 19
Information management
Records managers: Tricks of the trade BY CRAIG GRIMESTAD
It’s been said that it is not what you know, but who you know, that makes one successful. For the successful records manager, it is a bit more complicated than that, it is not just what you know, who you know, what you do, but how you do what you do, and what you are thinking.
Records manager mindset Let’s start with the records manager’s mindset, that is, what should they be thinking? The records manager should be thinking their role is to be the records management visionary for their organisation, and a change agent to turn that vision into reality. They are the principal advocate for records management and a facilitator for understanding records management, compliance with records management requirements, and improvement of records management practices. Lastly, the records manager should think they are the “enforcer” of records management policies and procedures.
The records manager needs to have the frame of reference that their responsibilities and actions are mainly those of “service”, and that, despite records management being essential for the wellbeing of the organisation, the organisation’s areas they serve will not have managing records as a priority. When put side by side with any other business activity, records management will lose. However, at the end of the day, it must be done and done well! That is one of the challenges for a records manager: to help the organisation see the value of records (as corporate assets) and find the time and resources for effective records management. If the records manager comes across as understanding that workers have “better things to do with their time” and is viewed as being helpful, the organisation will be inclined to participate and work with someone who “understands”, is reasonable, and is trying to help them.
“each change is two changes – the operational or technical change, and the social consequence of that change.” 20 BULLETIN 253 · SEPTEMBER 2026
What is the records management vision? Records are a high-value corporate asset. Common records like sales contracts, invoices, receipts, work orders, and shipping orders are the lifeblood of the organisation. Proprietary records like patents and trade secrets are the company jewels that help to establish the value of the organisation. Sufficient resources must be assigned for the effective management of records, so that records access and retention meet business needs, satisfy legal and regulatory requirements, and avoid risk from having too few or too many records. As records management matures in the organisation, records management requirements and processes will be monitored vigilantly, and audited periodically, to confirm compliance. Also, the records management staff will actively participate in the selection and establishment of new business applications, databases, and records repositories, asking questions like “does this technology facilitate the storage and disposal of records, per their retention requirements?” Records management improvements will enable business efficiencies. Records management continues to mature; it will evolve into information governance, controlling records creation, processing, storage, access,
and disposal. Maturing records management policies, procedures, and practices will improve operating efficiencies that can transition the organisation to having the lowest cost operating practices, providing a competitive advantage in its segment.
Being a change agent The records manager will work to move the organisation in a direction that it would not naturally go. The changes advocated by the records manager commonly will necessarily impact the norms and practices of the workforce, and the associated value of work done by individuals. As William Juran famously said, “each change is two changes – the operational or technical change, and the social consequence of that change. The social consequence is a troublemaker!” Hence, the records manager will need to consider themselves a change agent and take advantage of known change management principals and techniques to successfully bring about changes to the organisation. William Juran provided several suggestions for dealing with resistance to change, including “provide participation to the recipient society”, “provide enough time for the recipient society”, “create a favourable social climate”, and “work with the recognised leadership of the culture”. These will be covered along with other tricks (or suggestions).
INFORMATION AND RECORDS MANAGEMENT SOCIETY 21
Maturity upgrades The records manager will necessarily propose operational improvements. This may include new application(s); a new comprehensive, functional, records retention schedule (foundationally based on legal and regulatory requirements); new records repositories; new email policies; or even a cleanup project to dispose of old paper and electronic records. As these projects are developed and proposed, they require organisational approval and funding. Identifying the cost savings and manpower savings will aid in obtaining project approval. Sometimes the savings will be hard cost savings like reduced storage costs. Other times, the savings will be or include soft savings like reducing the time required to accomplish an action, such as finding and retrieving a desired record. If the change would save, on average, even 3 minutes for each hour worked, that is a 5% saving! Don’t forget risk reduction. Does this change reduce the organisation’s risk? Once the project is approved, there are numerous “tricks” to bring success: Define the change – clearly define the current state and the end state, and what it will require in organisational resources (cost and labour), purchases, and time to transition from the current state to the desired state. Work with the recognised leadership of the culture – this leadership is both formal and informal. While the appropriate members of the management team need to be supportive and provide resources, it is also important to include recognised informal workforce leadership. These are the “go-to” individuals within the workforce, whose opinion can make or break a project. Having these go-to individuals be supportive, or perhaps even take ownership and provide local leadership for the change in their area, can assure the change will be made.
22 BULLETIN 253 · SEPTEMBER 2026
Provide participation to the recipient society – this is accomplished when go-to individuals join in owning and leading the change. When a go-to individual is unavailable, select individuals from the workforce that are open-minded, work well with others, and enjoy challenges. It is often necessary that the proposed change be vetted locally for the workforce to believe the “pitch”. This will help assure that the change will work and be implemented locally. Create a favourable social climate – the change should be developed, communicated, and implemented in a way that the workforce will want the change to be made. Not always possible, but it is best if the workforce will “pull” the change into existence, rather than having it “pushed” on them. I once had in my office a picture of a man pounding the table with the caption “A man convinced against his will is of the same opinion still!” Work hard to have the workforce desire the change. Provide enough time for the recipient society – while it may be “quick” to get a new application up and running, it is not usually quick for the workforce to understand, embrace, and utilise a new application. Recognise that pushing a change through too quickly will, in the end,
The desire or goal is to make the workforce feel good about the change, or at least be a “willing” participant in the change. often do more damage (errors [intentional and unintentional], omissions, neglect) than a delay or extended schedule. Be transparent – when making decisions for projects and programs, be willing to explain the reasoning for those decisions. Providing your reasoning allows others to align their thinking with yours and empowers them to make decisions without you. It also allows others to assist you make a better decision if needed. Be truthful – never lie. Your integrity and reputation for being a straight shooter is invaluable. The importance of your boss and the management team to have confidence in your word is priceless. “It must be true and actionable because YOUR NAME said so.” Have data to back up your assertions and have your data and/or facts in hand. Do not extrapolate unless you are clear that you are doing so. Speak objectively – always speak objectively, not personally. The plan can be improved… Not, your plan is bad. Concede fallibility – freely admit to your part of “could have done it better”. No one likes a “know it all” who appears to have all the answers, and therefore, comes across as thinking they are better than everyone else. You may have all, or most, of the answers – so then be a mentor, come across as wanting to help others to perform at their best. Build consensus – team with others who are “leaders” of the established culture. I have talked this through with “John Smith, Sam Timonski, Sue Chadoda, Mary Chin, and Mary Rodrigues”, and we think…
Being an advocate As an advocate, the records manager uses their vision, knowledge, and understanding to promote best practices and advocate records management improvements that will move the organisation forward in records management maturity. Advocates utilise many forms of communication. Elevator speech(s) – develop bursts of records management information that can be given quickly during chance encounters with leadership. Rather than the usual pleasantries, when an encounter occurs with a member of the leadership team, provide a quick update that you are excited about, which would be helpful to the program if they were aware, and which they would appreciate being knowledgeable about. Repeat the elevator speech frequently and include “catch phrases” that are easily remembered. The goal is to have others repeat those catch phrases. Positive news – keep the message positive. Negative news should not be repeated. There are plenty of others willing to spread negative news. If confronted, be honest about negative news, but speak to your remedy that hopefully is already in process. Newsletter – regularly communicate records management status and needs to the organisation, including suggested periods of time for records review, clean up, and disposal. Assume you have full organisational support, which you do unless someone tells you otherwise. Consider including highlights of the status reports (see below).
INFORMATION AND RECORDS MANAGEMENT SOCIETY 23
Status reports – when a records management initiative is underway, provide regular status reporting showing progress by area. Structure these in a way that clearly shows who is on schedule and who is not. No one likes to be called out, and this is a gentle and fair way to do so. Leadership in lagging areas will be motivated to energise their workforce and “catch up”.
Being a facilitator
to comply with legal and regulatory requirements. Forcing function – consider establishing new mandatory compliance friendly applications, repositories, and/or processes. This required departure from old systems and processes to the new compliant friendly tools and processes will force the organisation to review what it has today, select what will transition, and determine how it will be retained.
A facilitator is an essential role to guide and move the organisation from old ways and understandings to new ways and understandings with minimal resistance, understanding that resistance may be overt or covert. The desire or goal is to make the workforce feel good about the change, or at least be a “willing” participant in the change.
What’s in it for me? Guide the business and the individuals in it to an understanding of the value of records to the organisation, and the value of records to the individual. For the organisation, records are required for its operation, and to help establish the value of the organisation. For the individual, their records creation, records utilisation, and management of records are measures of their personal value to the organisation.
Education/training – assure each worker has a basic records management understanding (Records Management 101), including the distinction between official records, copies, and drafts, and retention/disposal requirements.
Being an enforcer
Retention requirements – the records manager needs to assure the organisation that they (the records manager) understand the organisation doesn’t exist to satisfy legal and regulatory requirements. It may be necessary to help the organisation understand what their actual organisational records retention requirements (needs) are, including what is needed to satisfy its customers. Once organisational needs are understood and identified, the organisation also needs 24 BULLETIN 253 · SEPTEMBER 2026
The records manager will be a principal in assuring records management policies and procedures are complied with, as well as assuring departments and individuals’ participation in program changes.
“A man convinced against his will is of the same opinion still!” Attestation statements – periodically, it will be appropriate and helpful to require the workforce to attest to completion of an activity or a task. As mentioned earlier, it would be helpful to publicise the percent of attestations received by work area. This will enable management to be aware of status and participate in the drive for completion.
BIBLIOGRAPHY Juran JM. Juran on Leadership for Quality – An Executive Handbook. The Free Press, New York, 1989. Juran JM. Managerial Breakthrough – The Classic Book of Improving Management Performance. McGraw-Hill, New York, 1995.
Temporary exceptions – as programs are initiated, individuals or departments will seek to be exempted from the requirement. While no exemptions should be given, temporary exceptions from requirements should be allowed for specific reasons, and for specific periods of time, with identified corrective action. This caseby-case agreement validates the requirement, while at the same time recognising the need for flexibility due to business reasons. Audit or compliance review – periodically, it is appropriate for the records management program to determine if its policies and procedures are being followed as intended with an audit or compliance review. A questionnaire designed to solicit simple “Yes”, “No”, or “In Process” responses can provide significant intelligence on compliance, without being burdensome to the organisation. “Intrusion” into the organisation is then only needed where the data shows need for concern. The position of records manager is a challenging and difficult assignment. These “tricks of the trade” are a combination of “change management” techniques and specific records management program suggestions. These “tricks of the trade” can help the records manager accomplish their goals, make the position a little less difficult, and perhaps even make the position a bit more enjoyable going forward.
The Author Craig Grimestad is a senior consultant with Iron Mountain Consulting. His specialty is designing RIM core components with sub-specialties for RIM auditing and change management. He holds an MSc in engineering and was the Records Manager for the Electro Motive Division of General Motors, where he participated in the development of the GM Corporate RIM program, and implemented and managed Electro Motive Division’s RIM program.
<www.ironmountain.com/uk/resources> <www.linkedin.com/in/craig-grimestad2214b37>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 25
Information management
Information governance versus data governance versus records management: What’s the difference? BY PAUL MULLON
Organisations often use information governance (IG), data governance, and records management interchangeably – yet they solve different problems. Understanding the difference helps you reduce risk, improve compliance, and build a practical framework that supports digital transformation. QUICK DEFINITIONS
HOW THEY FIT TOGETHER
Here’s the simplest way to understand the three disciplines:
Think of IG as the umbrella. It establishes the governance model, decision rights, policies, and controls that apply to all information – documents, records, emails, collaboration content, and data.
•
IG is the overarching framework that sets accountability, rules, and controls for information across the organisation.
•
Data governance focuses on structured data – ownership, quality, definitions, and rules that ensure data is accurate, consistent, and usable.
•
Records management focuses on evidence – retention, defensible disposal, and ensuring records are reliable and compliant throughout their life cycle.
•
Under that umbrella:
In practice, strong organisations treat these as connected capabilities under an overall IG approach.
26 BULLETIN 253 · SEPTEMBER 2026
•
Data governance ensures data is reliable and consistently defined.
•
Records management ensures records are kept for the right period and disposed of in a defensible way.
When these disciplines operate separately, organisations often see duplicated effort, conflicting rules, and technology implementations that don’t stick. When they work together, information becomes easier to trust, protect, and use.
IG: THE “OPERATING MODEL” FOR INFORMATION IG defines how your organisation manages information throughout its life cycle – who is accountable, what standards apply, and how controls are enforced. It typically includes:
data – information stored in databases, lineof-business systems, data warehouses, and analytics platforms. Its goal is to ensure the organisation can rely on data for operational decisions, reporting, and compliance. Typical data governance activities include:
•
Governance structures and accountability (roles, committees, decision rights)
•
Policies, standards, and procedures (classification, access, sharing, retention, disposal)
•
Defining data owners and data stewards
•
Standardising definitions (eg, what “customer” means across systems)
•
Improving data quality (accuracy, completeness, timeliness)
•
Technology enablement (configuring platforms to enforce governance)
•
•
Master data management and reference data controls
Adoption and training (making governed working the easiest way to work)
•
•
Rules for access, sharing, and use of sensitive data
Monitoring and continuous improvement (key performance indicators, audits, maturity reviews)
If you want a practical blueprint, read: The information governance framework: Key components explained.
DATA GOVERNANCE: ACCURACY, OWNERSHIP, AND CONSISTENCY Data governance is focused on structured
Data governance often overlaps with privacy and security, but its main driver is usually data trustworthiness and usability.
RECORDS MANAGEMENT: EVIDENCE, RETENTION, AND DEFENSIBLE DISPOSAL Records management ensures that records – information created or received as evidence of business activities – are managed through INFORMATION AND RECORDS MANAGEMENT SOCIETY 27
a controlled life cycle. This includes capture, classification, retention, access control, and defensible disposal. Strong records management typically includes:
•
A classification structure (often supported by a file plan)
•
A retention schedule aligned to legal, regulatory, and business requirements
•
Clear governance for disposal, approvals, and audit trails
•
Controls for investigations, legal holds, and exceptions
Common mistakes when organisations mix these up:
•
Assuming a policy document equals governance: governance needs ownership, controls, and adoption – not just documents.
•
Implementing technology first: platforms like SharePoint and ECM succeed only when structure, metadata, and life-cycle controls are defined.
•
Over-focusing on data quality, while ignoring documents and records: risk often hides in email, shared drives, and unmanaged content.
•
Keeping everything forever: without retention and disposal, storage costs and risk grow indefinitely.
WHICH CAPABILITY SHOULD YOU START WITH? The best starting point depends on your biggest risks and priorities:
•
If you have inconsistent ownership, uncontrolled repositories, and rising compliance risk, start with IG.
•
If reporting and analytics are unreliable, and different departments use different definitions, prioritise data governance.
•
If audits, investigations, or legal discovery are painful, and retention rules are unclear, prioritise records management.
In most organisations, the fastest progress comes from a practical IG workshop that aligns stakeholders and defines a phased road map.
The Author Dr Paul Mullon is an IG consultant and trainer with over 40 years’ experience in information management. He has B.Com (Hons), MBA, CIP, IGP, Fellow of Institute of Information Management (FIIM), honorary PhD (Records and Information Management), and Certified Change Practitioner qualifications. He has been involved in ISO standards development in document and records management since 2004. He provides records management consulting and training to government and the private sector.
<paulm@corconcepts.co.za> <https://corconcepts.co.za>
28 BULLETIN 253 · SEPTEMBER 2026
.ir m www
IRMS CONFERENCE
sc
on
fe r
KIMPTON CLOCKTOWER MANCHESTER 16-18 May 2027
en
ce
.o r g
.u k
EVERY RECORD TELLS A STORY The soundtrack to the past, present and future of information
Join us next year in Manchester. www.irmsconference.org.uk #IRMS27 INFORMATION AND RECORDS MANAGEMENT SOCIETY 29
AI
Before you hand the keys to the algorithm BY ANDREW POTTER
What does artificial intelligence (AI) readiness actually mean for your records program? Everyone in the records and information management world is getting the same pitch right now. AI can classify your records. AI can apply retention schedules automatically. AI can flag duplicates, identify sensitive content, and make disposal decisions at a scale no human
30 BULLETIN 253 · SEPTEMBER 2026
team ever could. And honestly? A lot of that is probably true. But there’s a question that keeps getting skipped in the excitement: is your records program actually ready for any of that?
A research framework out of the Geneva School of Business Administration – the Maturity Assessment for Appraisal (MAA) – offers one of the most useful lenses I’ve come across for thinking through that question seriously. It’s rooted in archival science and the InterPARES Trust AI project, but its implications land squarely in the middle of everyday information and records management (IRM) practice.
THE PROBLEM ISN’T THE AI Here’s the uncomfortable truth the MAA surfaces: most organisations that struggle with AI-assisted records management aren’t struggling because the tools are bad. They’re struggling because the underlying appraisal practice – the framework for deciding what to keep, for how long, and why – was never coherent enough to automate in the first place. You can’t train a model on inconsistent human decisions and expect consistent machine decisions. Garbage in, garbage out has always been true. It’s just more expensive and harder to explain when an algorithm is doing it. The MAA asks six foundational questions about your appraisal practice, and the honest answers tell you a lot about where you actually stand.
THE SIX QUESTIONS WORTH ASKING 1. Principles Does your program have an explicit, documented philosophical basis for appraisal? Not just “we follow the retention schedule” – but why certain records have value, how you think about access, diversity of documentary record, ecological cost of storage, and long-term usability? If the principles live only in the heads of your most experienced staff, you have a fragility problem that AI will expose quickly. 2. Vision and strategic framework Is there a written policy that explains your appraisal approach, who owns decisions, and how it maps to different parts of your organisation or jurisdiction? A retention schedule is not a strategy. It’s an output of one. 3. Compliance This one tends to feel solid until you look closely. Legal, regulatory, administrative, and normative requirements all need to be reflected in your appraisal logic – and they need to be current. AI tools that apply outdated or jurisdiction-mismatched rules don’t just produce wrong answers; they produce confidently wrong answers.
Garbage in, garbage out has always been true. It’s just more expensive and harder to explain when an algorithm is doing it. INFORMATION AND RECORDS MANAGEMENT SOCIETY 31
4. Methodology and processes Is there an actual documented process for how appraisal happens – who does it, when, with what inputs? What about reappraisal when regulations change, or when a business function evolves? Longterm preservation decisions? Disposal? If these exist only as informal tribal knowledge, they’re not automatable. Full stop. 5. Tools What tools do you currently use to identify document types, content, vital records, information assets, and retention obligations? If the answer is “a spreadsheet and institutional memory”, that’s worth sitting with. Profiling tools like DROID or Archifiltre exist precisely to give you the structured data that AI systems need as input. 6. Criteria This is often the weakest link. What are the explicit, documented criteria that justify a preservation decision? A disposal decision?
32 BULLETIN 253 · SEPTEMBER 2026
A sampling approach? Criteria aren’t just useful for AI – they’re what make appraisal defensible to auditors, legal teams, and the public. If your criteria are implicit, an AI system will invent its own.
MATURITY IS A SPECTRUM, NOT A CHECKBOX The MAA maps each of these dimensions across five levels – from “not existing” through “manual and ad hoc” up to “established and largely automated with AI”. Most programs will find themselves scattered across that spectrum, depending on the dimension. That’s not a failure. That’s useful diagnostic information. The point isn’t to shame programs for not being at level five everywhere. It’s to give decision makers a clear map of what needs to be shored up before deploying AI tools – and which areas might actually be ready to benefit from automation right now.
AI readiness isn’t just a technology question – it’s a governance question, a policy question, and a process maturity question. WHAT THIS MEANS IN PRACTICE If you’re evaluating AI records management vendors, the MAA framework is essentially a pre-procurement checklist. Any tool that promises to automate appraisal decisions is only as good as the appraisal logic you can hand it. That logic needs to be explicit, documented, consistent, and defensible.
The framework is available in multiple languages and is designed to be tested across different archival and IRM contexts. Worth a look – especially before the next vendor demo. The full paper by Basma Makhlouf Shabou was presented at the Ninth Computational Archival Science Workshop, IEEE Big Data, December 2024.
If you’re building a business case for investment in your IRM program, the six dimensions give you a structured argument. AI readiness isn’t just a technology question – it’s a governance question, a policy question, and a process maturity question. And if you’re just trying to figure out where to start, the answer is usually the same: document your criteria. Make the implicit explicit. The rest tends to follow. The MAA project is ongoing, with case studies underway in Switzerland, Brazil, and Japan.
The Author Andrew (Andy) Potter is a consulting information professional, writer, and speaker focused on records management, information governance, and the future of digital evidence. He is the founder of MetaArchivist Consulting and a former senior official at the US National Archives and Records Administration, where he worked on federal records policy, regulatory development, and strategies for managing digital records across the US Government. Andy now advises organisations navigating the governance challenges created by large-scale digital systems, artificial intelligence, and increasingly complex regulatory environments.
<apotter@metaarchivist.com> <https://metaarchivist.substack.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 33
AI
AI procurement is now a governance function BY AMELIA WILLIAMS
When an organisation signs an AI contract, it is making decisions about data sovereignty, liability, regulatory compliance, and longterm vendor dependency. Information professionals need to be part of the conversation. In the artificial intelligence (AI) era, traditional approaches for software procurement are no longer fit for purpose. Typically considered a commercial function – secure the best software for the best price – procurement teams are now making decisions about highly complex technical systems that can shape an organisation’s governance posture, regulatory exposure, security, and operational resilience. Organisations interact with AI in many forms, from standalone software to features embedded in existing platforms. Regardless of how AI enters the enterprise, its presence immediately raises governance concerns. Who owns the data? How was the system trained? Who is liable
34 BULLETIN 253 · SEPTEMBER 2026
for errors? Most procurement teams lack the technical expertise to parse this complexity and audit the systems before making purchasing decisions, creating governance risks from the outset. Exacerbating this complexity is an asymmetry of power between procurement teams and AI vendors. A small number of dominant AI providers can set the terms of use and implement top-down changes without negotiating with clients. Executives urging organisational AI adoption only intensify this pressure, leaving procurement officials to navigate out-of-date processes without the benefit of AI-specific training or guidance.
Together, these factors have created a new governance frontier. Procurement has transformed from a commercial function into one of the most consequential components of enterprise AI governance – and one in which information and records management professionals have a direct stake.
often unanswered at the point of contract. As a result, organisations may inadvertently expose confidential information, proprietary business data, or customer records to external model training processes. This has direct implications for UK General Data Protection Regulation compliance and information asset management.
THE EMERGING RISKS OF AI PROCUREMENT
AI presents intellectual property (IP) risks, too; models trained on data scraped from the web may generate outputs that include copyrighted or unauthorised material, exposing organisations to downstream legal and reputational risks. Other IP considerations, such as ownership of AI outputs and metadata, should be proactively addressed during procurement.
Unlike traditional software procurement, AI procurement introduces governance risks that continue to evolve after a contract is signed. AI supply chains span models, infrastructure providers, APIs, and application layers, making it difficult to pinpoint who is liable for what if things go wrong. Even if liability is decided at the time of procurement, rolling updates and feature releases can complicate accountability structures and introduce novel risks after contracts are signed. The pace of technological and regulatory change is also shortening procurement and contract review cycles. The upside is that shorter cycles offer flexibility; the downside is they introduce ongoing procurement and governance demands that organisations must manage continuously. These challenges are exacerbated by market concentration. OpenAI, Anthropic, and Google collectively account for 88% of enterprise large language model usage, leaving buyers exposed to top-down changes in pricing, product features, and contractual terms. On top of this, the nature of AI drives “lockin” to individual providers because models improve through interaction with user data and workflows. Switching providers can therefore become operationally disruptive, expensive, and technically difficult. Data management is one of the most underestimated areas of risk in AI procurement. Core due diligence questions dealing with data collection, storage, and model training are
Agentic AI is the next frontier of procurement risk. Capable of independently traversing multiple platforms and datasets, these systems introduce risks of a fundamentally different order of magnitude. Increasingly, vendors are excluding key AI-related harms from liability clauses within agentic AI contracts, leaving buyers exposed. As AI agents grow in sophistication and adoption, all these concerns – liability, accountability, dependency, and data management – will have to be continuously addressed and renegotiated.
FOUR PILLARS FOR RESPONSIBLE AI PROCUREMENT Because purchasing AI introduces unique risks not associated with conventional software, organisations need procurement frameworks designed specifically for AI. Based on our experience of consulting with enterprises on responsible AI adoption, we recommend building such frameworks on four pillars. First, teams should be upskilled. Procurement teams should be literate in AI functionalities, safety, and compliance. This does not mean every procurement official should become a technical expert, but they do need enough understanding to evaluate governance implications. INFORMATION AND RECORDS MANAGEMENT SOCIETY 35
Organisations should support this through certification programmes; cross-functional procurement models; and closer collaboration between procurement, legal, compliance, cybersecurity, and technical teams, including information governance. Broader workforce training on responsible AI use is also important, particularly as employees increasingly adopt AI tools independently. Emerging vendor engagement models, in which procurement personnel collaborate with AI vendors’ forward deployment engineers to tailor tools to operational needs, ensure a deeper understanding of technical elements. While this approach can improve outcomes, organisations also need to invest time in internal change management, governance reviews, and process design. Second, tailor procurement processes to the type of AI system being acquired. Procurement teams face a range of AI products, including AI-powered tools, AI-enabled features, and foundation models. Each category introduces novel governance, compliance, and operational risks that require tailored procurement approaches. For AI-powered products, procurement teams should focus on the use-case fit, data sovereignty, and hosting arrangements. Consider an adverse example: when Workday released its AI-powered applicant tracking system, it was presented as a ready-to-use HR tool. However, the product violated the Age Discrimination in Employment Act by favouring applicants under 40. Organisations that adopted it without sufficient procurement scrutiny faced compliance exposure under employment law. When vendors introduce AI features into existing software products, procurement teams should renegotiate contracts that lack AIspecific clauses. This is an increasingly common situation that presents complex governance and compliance risks. For example, when GitHub 36 BULLETIN 253 · SEPTEMBER 2026
As AI adoption accelerates, procurement can no longer operate as a purely commercial function. updated its training requirements early in 2026, organisations with lower-tier subscriptions found that their private data was being used to train AI models. Situations like this undermine organisations’ privacy, data protection, and security controls. When procuring a foundation model or platform, organisations should focus on technical capability and strategic implications, including data access arrangements. For example, the UK’s NHS recently faced criticism for a procurement process that allowed US firm Palantir to access identifiable patient data while developing a federated data platform. The platform is intended to deploy AI across patient records to improve efficiency. However, the procurement approach has undermined public trust in the NHS and its services. Third, AI procurement should be anchored in established governance frameworks, standards, and emerging regulatory requirements. Even in jurisdictions where AI regulation remains underdeveloped, aligning with the wider regulatory system allows organisations to demonstrate that their AI use is safe, responsible, and trustworthy. It also creates defensible evidence that governance obligations were considered before deployment.
Standards such as ISO 42001 for AI management systems and ISO 23894 for AI risk management can help organisations establish documented governance processes and create auditable evidence trails from the outset. Other mechanisms, like IEEE standards and conformity assessment and IAPP AI governance vendor reports, can further support procurement due diligence. For organisations already working with established information governance frameworks, these standards extend naturally into the AI procurement context. Finally, procurement should be embedded within ongoing AI governance processes. When an organisation purchases an AI system, it is making governance choices about data sovereignty, liability, regulatory compliance, and long-term vendor dependency. These choices require continuous review with governance stakeholders as models evolve, regulations change, and vendors update products or terms of service. Organisations should therefore integrate procurement directly into broader AI governance structures through recurring audits, compliance reviews, performance assessments, and cross-functional oversight processes. Where possible, organisations should pursue shorter contracts and procurement cycles to avoid making long-term commitments in the face of rapidly changing technology. Information asset registers, data protection impact assessments, and records retention policies will all need to reflect the AI systems procured, making the information governance function a necessary participant in procurement governance.
AI GOVERNANCE STARTS AT PROCUREMENT For many organisations, procurement remains one of the least mature dimensions of AI governance. Yet procurement decisions increasingly determine how data is managed, where accountability sits, which vendors gain
influence over operations, and how resilient organisations remain as AI systems evolve. As AI adoption accelerates, procurement can no longer operate as a purely commercial function. It has become a governance mechanism; one that will play a defining role in whether enterprise AI systems are deployed responsibly, compliantly, and effectively. For information records professionals, this has a direct impact. The contractual commitments made at procurement will shape what data is processed, on what legal basis, with what protections, and with what audit trail. Getting a seat at that table, early and consistently, is one of the most consequential contributions the information governance profession can make to responsible AI adoption.
Article originally published in Observer.com, June 2026. Adapted for the IRMS Bulletin.
The Author Amelia Williams is a Senior Research Impact Officer at Trilateral Research with expertise in scientific communication at the intersection of emerging technologies, ethics, and policy. At Trilateral, she supports the development and implementation of research projects alongside policy, media, and industry engagement.
<https://trilateralresearch.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 37
Data protection
Do you understand? Speak human: Plain language in data protection BY EMMA BUTLER
I have written before about where data protection (DP) and plain language meet, in the context of transparency obligations and privacy notices. But I am seeing more and more examples of legalese, jargon and impenetrable text across all areas of compliance. Policies, processes, contracts, regulator guidance, regulator enforcement documents… it’s not just the public being bamboozled. Practitioners, compliance teams and anyone required to read a policy or follow a process is being left wondering what exactly it is they are supposed to do. And, of course, it all starts with the various DP laws themselves. Legislators are not known for choosing the plain language option when drafting laws, and in places, the recent UK Data Use and Access Act seems to be just messing about with words for the sake of it. WHAT’S GOING ON? In many cases, people are used to writing a certain way and assume complex = serious and official. It doesn’t. Some people think legalese and jargon are the only options when you need to be precise. Also not true. In some cases, convoluted text and writing in the passive is a way to hide behind the words. It’s a way of avoiding responsibility, accountability and telling people things they might not like. With privacy notices and terms and conditions, we often hear how no one reads 38 BULLETIN 253 · SEPTEMBER 2026
them anyway (massive generalisation; not sure that’s true). But if they read like a 17th century proclamation from the King, of course no one reads them! LAND OF CONFUSION It’s not just individuals who suffer from privacy notices and terms and conditions they don’t understand. If your policies and processes aren’t clear enough, don’t be surprised when your staff don’t follow them. And you won’t have a leg to stand on when you try to go after someone for a policy breach if they can argue they didn’t understand it. Practitioners also have to navigate badly written laws and unclear regulator communications. This isn’t just an English language problem either, I recently came across a Spanish enforcement notice that was 65 pages of legalese. Now, admittedly I don’t speak Spanish, but I do speak French and Italian and that usually means I can have a decent go at reading clearly written Spanish. But I think even my Spanish-speaking fellow DP practitioners would have struggled with this one!
Another bugbear of practitioners is supplier documents that need a master’s in either marketing or engineering to understand. As exciting as it sounds to leverage the latest agentic artificial intelligence flux capacitor, the compliance person just needs to know what it’s doing with personal information. And while we can appreciate the simplicity of gaining valuable insights to inform customer service management, it doesn’t help us assess the risks to individuals.
Actually, maybe no one will thank you. But that’s okay too. Because the outcome we’re all looking for is that whoever you want to read your stuff understands it the first time they read it. Bask in the glow of a job well done, even if no one pats you on the back. In fact, if you become a plain language champion, and if it becomes the norm in your organisation, that’s the plain language gold medal right there. * Well they might, I’m speculating, no guarantees…
WHERE DO WE GO FROM HERE? It’s not rocket science. Write for your audience. No really, it’s that simple. So, by all means, dazzle the sales team with flashy slides, cost savings and jazz hands. Channel your inner Star Trek for technical implementation documents for developers. Write your hospital research paper for peer review in medicalese. But for everyone else, just write in plain language. Even where your audience is specialist, consider who else might read it, and provide plain language summaries.
HELP! If you prefer someone else to do the heavy lifting, get in touch. I offer both DP consultancy and plain English editing and training**. The sweet spot sees me plain Englishing your DP documents, or helping you get your DP governance sorted with a green light to draft in plain English. What I really like about where DP and plain language meet is that both are, at heart, about the same thing: respect for people. And who doesn’t want that?
TELL ME HOW Know your audience and your goal
• • • • • • • • • •
Plan content and presentation Shorter sentences Active not passive Verbs not nouns Appropriate words “You” and “we” Give instructions Lists make information clearer User testing Say what you mean
There are plenty of online resources to help you write in plain language. It might seem daunting at first, but once you get the hang of it, you’ll wonder how you managed before. Your staff will thank you; your customers and users will thank you; your Data Protection Officer or compliance team will buy you chocolates*.
The Author Emma Butler runs Creative Elephant, helping organisations with DP compliance, as well as offering plain English editing and training. She started working in DP in 2005, leading the Information Commissioner’s Office’s international policy team. She was also an in-house Data Protection Officer at both a multinational and a biometric digital identity SME.
<www.creative-elephant.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 39
Data protection
Soft opt-in for charities BY SUE WHITE
The Data (Use and Access) Act (2025) extended the use of “soft opt-in” within marketing activities for charities, and this part of the Act went live on 5 February 2026. The Information Commissioner’s Office (ICO) recently posted its guidance. This article explores what this means and how charities might, and might not, be able to use it. BACKGROUND When marketing to individuals electronically, organisations must obtain opt-in consent as part of the Privacy and Electronic Communications Regulations (PECR). The only exception to this is where the soft opt-in applies. Until recently, this had only been available to commercial activities, meaning you could send electronic marketing to someone who had purchased or expressed an interest in purchasing your products and services (with strict conditions). The Data (Use and Access) Act 2025 recently opened this
up to include the ability for charities to send electronic marketing, under the soft opt-in, to people who had expressed an interest in furthering a charity’s charitable purposes (again with strict conditions).
WHAT ARE THE “STRICT CONDITIONS” OF SOFT OPT-IN FOR CHARITABLE PURPOSES? A charity may send electronic mail for the purposes of direct marketing where all the below conditions apply: 1. The communication must further one or more of that charity’s charitable purposes. 2. The individual’s contact details must have been obtained directly by the charity when they expressed interest in the charity’s work, eg, signing up to volunteer, requesting information, or donating, and this must have been received on or after the new legislation came into effect on 5 February 2026. 3. The individual must have clearly been offered the chance to opt out at the point their data was collected, and at each subsequent communication.
40 BULLETIN 253 · SEPTEMBER 2026
This means a charity could contact an individual, who has donated, with further messages, without asking for their consent, as long as all the above applies.
LIMITATIONS OF THE SOFT OPT-IN Despite the benefits, the new soft opt-in comes with limitations: 1. Charities cannot use the soft opt-in for individuals already in their database before this legislation. Existing supporters will still require explicit consent for electronic marketing because charities cannot retrospectively rely on the soft opt-in where the original collection did not meet its requirements. 2. Charities will need to maintain one list for supporters with consent and another for those acquired under the soft opt-in framework. 3. Where a charity has different marketing activities, lists of supporters for marketing must be split into charitable soft opt-in, commercial marketing of products and services, and communications based on pre-existing consent. (Please see the next section for more details.) 4. A s the contact information must have been obtained directly by the charity, any data obtained by other organisations, such as trading subsidiaries or third-party funding platforms, cannot rely on the soft opt-in. 5. Opting out must be easy, visible, and included in every communication.
EXAMPLES OF WHERE WE CAN USE THE SOFT OPT-IN Example 1 A supporter donates through the charity’s website. The online form asks for their email address and has a prominent opt-out box the supporter can tick if they do not want to receive marketing about the charity’s charitable purposes. Example 2 A supporter donated in 2025 and gave the charity their email address as part of the process but did not consent to receiving electronic mail marketing. In April 2026, they made another online donation. As part of this, they provided their contact details again. This time, they were given a clear way to opt out of receiving electronic mail marketing about the charity’s charitable purposes.
WHAT IS “FURTHERING YOUR CHARITY’S CHARITABLE PURPOSES”? The ICO’s guidance makes it clear that an individual may do something over and above merely receiving your support to show they are interested in your charitable purposes. Therefore, when an individual contacts a charity to ask for assistance or report incidents with the sole aim of receiving support, there will be no reasonable lawful basis to use the soft opt-in: Unlike the commercial soft opt-in, which applies to marketing about an organisation’s own similar products and services, the charitable soft opt-in only applies to direct marketing that furthers charitable purposes.
The communication must further one or more of that charity’s charitable purposes. INFORMATION AND RECORDS MANAGEMENT SOCIETY 41
GOOD PRACTICE * A mental health charity runs drop-in
wellbeing sessions in a community centre. During one session, a visitor spends time talking to a staff member about the charity’s broader initiatives, including their peer-support groups and public education work. The visitor asks for a copy of a resource booklet, so the staff member offers to email them a copy. They ask the visitor to write their email address on a paper form. The form says: “We may also email you occasional updates about our charitable work to improve mental health. If you do not want to receive these emails, tick this box.”
BAD PRACTICE * A person uses a charity’s website to request
emergency food support. They provide their phone number so the charity can text them to confirm the collection time. They don’t ask about the charity’s aims, programmes, or wider work and don’t take any steps that indicate interest beyond receiving the support they need. *Source - ICO * WHAT HAPPENS IF BOTH SOFT OPT-INS APPLY?
The soft opt-ins cover different types of electronic mail marketing. One lets organisations send marketing about their own products or services. The other lets charities send marketing that furthers their charitable purposes. Charities can sometimes use both at the same time. If you want to use both soft opt-ins together, you must offer separate opt-out boxes for each one when you collect the contact details. You must only provide an opt-out box where you have met the collection requirements for that soft opt-in. You must also provide a way for the recipient to opt out of each type of marketing in every subsequent message you send. If you have satisfied the collection requirements for both soft opt-ins, you can 42 BULLETIN 253 · SEPTEMBER 2026
send one message combining both types of direct marketing. However, you must ensure your message only includes marketing that is permitted under those soft opt-ins. You must have the recipient’s consent to send any other type of electronic mail marketing. Using both soft opt-ins together may mean that different people on your contact list are permitted to receive different categories of marketing. For example, some people may only meet the criteria for the charitable purpose soft opt-in, while others may meet the criteria for both. You may also be using consent to send marketing to some people, such as historic supporters who gave their consent before the charitable purposes soft opt-in existed. To manage this properly, you should keep clear records showing which method applies for each person. A simple set of flags or preference fields in your system is usually enough. This helps ensure you only send each person the specific type of marketing you’re allowed to send them.
EXAMPLE Someone buys an entry ticket to visit a historic mill operated by a heritage preservation charity. The charity is satisfied that the person has bought a product or service and provided support for the charity’s heritage preservation work. During checkout, the charity collects the person’s email address and presents two separate opt-out boxes: I do not want to receive email marketing about your similar products or services (for example, tickets for future exhibitions or guided tours); and I do not want to receive email marketing about your charitable purposes (for example, volunteering opportunities, requests for donations or updates about your work)
The person doesn’t tick either box. The charity can send the person emails combining direct marketing about their similar products and services and their charitable purposes. The charity gives the person a clear unsubscribe link in every subsequent message they send where the person can choose to opt out of each type of direct marketing.
at all, especially where they may be in a vulnerable situation or at risk of harm. (Please see related ICO guidance here.) The more reasonable, expected, and fair it would be for individuals to expect marketing from charities, the more likely it is for the legitimate interests assessment to be in the charity’s favour. If you require further assistance with this, please contact <info@naomikorn.com>.
*Source - ICO
PRACTICAL CONSIDERATIONS FOR CHARITIES This is a big development for charities and although it may be tempting to add all new contacts to mailing lists, it is important to note that the Act has also significantly increased PECR fines. Breaches can now attract penalties of up to £17.5 million or 4% of global annual turnover. This means that although the opportunities for marketing are greater, so are the consequences for getting it wrong.
CASE EXAMPLE: The ICO has fined HelloFresh £140,000 for sending 79 million spam emails and 1 million spam texts over a 7-month period. The ICO found the marketing messages were sent based on an opt-in statement that did not clearly inform customers about future marketing communications via text.1 When we use soft opt-in, we need to make this clear in our Privacy Notice. PECR permits marketing under soft opt-in, but you must still identify a UK General Data Protection Regulation (GDPR) lawful basis (often legitimate interests). This means that we need to undertake a legitimate interests assessment to show how our interests might balance against the rights and freedoms of individuals. In these situations, it is particularly important to consider whether it is appropriate to send marketing to the person 1
ICO fines HelloFresh £140,000 for spam texts and emails
The Author Sue White, Head of Information Law Sciences, is a data protection. Sue is a data protection specialist with GDPR experience within local government and higher education. Sue held the post of Data Protection Officer for both the University of East Anglia (UEA) and Norwich University of the Arts and has over a decade of governance experience within district councils. Sue holds a practitioner certificate in data protection. At Naomi Korn Associates, Sue works with a range of clients across the education and charitable sectors. Sue has written and produced training packages for several organisations and her strength is her ability to communicate with people at all levels of understanding, turning complex legislation into something relevant and meaningful.
<info@naomikorn.com>
INFORMATION AND RECORDS MANAGEMENT SOCIETY 43
Businesses across Britain sign up to Cyber Resilience Pledge as ministers urge firms to strengthen cyber defences More than 60 businesses from every corner of the British economy, and strategic suppliers to government, have committed to strengthening their cyber defences, as cyber threats grow in scale, frequency and sophistication. Launched at 10 Downing Street in July, the new Cyber Resilience Pledge comes as businesses face an increasingly urgent threat environment – with over 5 million cybercrimes committed against UK firms last year – equivalent to one every 6 seconds (source: NCSC Annual Review 2025). Hostile cyber activity in the UK continues to escalate, with the National Cyber Security Centre (NCSC) handling 204 nationally significant incidents in the year to September, up from 89 the year before. The average cost of a significant cyberattack on an individual UK business now stands at almost £195,000, with the annual cost to organisations estimated at £14.7 billion, excluding wider disruption across the economy (source: Independent research on the economic impact of cyberattacks on the UK). The threat is also evolving. While artificial intelligence (AI) provides new capabilities for defenders, it is also lowering the barriers for attackers – by helping them find weaknesses in software, write the code to exploit them, and do so at a speed and scale that would have been impossible even a year ago. Founding signatories to the Pledge span retail, financial services, media, utilities and technology – including M&S, Nationwide,
44 BULLETIN 253 · SEPTEMBER 2026
ITV, Microsoft UK, Cloudflare, Deloitte LLP, Accenture UK, Vodafone Group and VodafoneThree. The voluntary pledge, which has been designed for medium and large organisations but is open to organisations of all sizes and sectors, asks signatories to take three concrete actions to improve their cybersecurity:
•
Make cybersecurity a board-level responsibility, by implementing the Cyber Governance Code of Practice and ensure all board members complete the NCSC’s Cyber Governance Training.
•
Register for the NCSC’s free Early Warning service, a tool that alerts organisations to potentially suspicious activity on their networks.
•
Take a risk-based approach for requiring government-backed Cyber Essentials certification across their supply chain.
The Technology Secretary Liz Kendall launched the Pledge at 10 Downing Street and said: “Today, some of Britain’s biggest businesses are taking action to strengthen their cyber defences and setting a powerful example for others to follow. By signing this Pledge, they are showing that cyber resilience is no longer just an IT issue – it is a business imperative. “Cyberattacks can disrupt services, put customers’ data at risk and have a real impact
on the bottom line. As AI makes these threats more sophisticated and easier to launch, no organisation can afford to stand still.
a signatory of the Cyber Resilience Pledge.”
“That’s why we’re working with businesses to help them strengthen their defences. The steps in this Pledge are practical, achievable and proven to make a difference. Today’s signatories are leading the way, and I encourage organisations across the UK to follow their example.”
“We have long held the view that cyber resilience is a critical business and organisational enabler. It underpins our growth, our economic security, and the safety and security of our people. With the average cost of significant cyberattacks to the UK economy recently estimated to be £14.7 billion annually – the equivalent of 0.5% of our GDP – it’s clear that cybersecurity and resilience must be recognised as a leadership responsibility and should no longer be viewed as an IT issue alone. We are, therefore, proud signatories of the Government’s Cyber Resilience Pledge, committing to the practical actions set out for our own organisation as well as continuing to champion, more widely, accountability for cyber risk at the board level.”
The launch comes ahead of the new National Cyber Action Plan, which will set out how the government will continue to work with industry to protect the nation from the cyber threats it faces in the AI era, including through investment in AI-powered defensive capabilities, the adoption of new secure technologies and through new measures under the National Security Bill to tackle cybercrime. The Pledge is a central pillar of this work. Alongside the Pledge, the Department for Science, Innovation and Technology has been developing a government Cyber Charter with its 39 strategic suppliers: companies that deliver critical services to the government. As part of that Charter, all of the strategic suppliers have been invited to sign the Pledge as an initial commitment to bolstering their cyber resilience, with more than 20 of them having done so as part of this first cohort of signatories. David Boda, Chief Security and Resilience Officer at Nationwide, said: “Uplifting the cyber resilience of the UK economy is a collective endeavour that no one organisation or sector can achieve alone. As a modern mutual Nationwide Building Society, we are proud to play our part and be
Julian David, CEO of techUK, said:
Experts at the NCSC are urging organisations of all kinds to urgently focus on their cybersecurity as the threats evolve at pace. The steps organisations should take to protect themselves, their supply chains and their customers against AI-driven cyber threats are the same fundamental cyber hygiene measures recommended to combat traditional attacks, though businesses are being urged to act with increased urgency given damaging cyber incidents over the past year. The NCSC says the three actions enshrined in the Pledge are practical steps that will help improve an organisation’s resilience and, if adopted at scale, strengthen resilience across the wider economy. Resilient organisations are better able to recover from incidents, protect their customers and demonstrate to investors, partners and suppliers that they are taking cyber risk seriously.
INFORMATION AND RECORDS MANAGEMENT SOCIETY 45
UK SME Cybersecurity Report 2026 published A new report has been published based on primary research conducted by AMVIA in partnership with an independent market research agency in January and February 2026.
Notably, businesses with certification reported average breach costs 68% lower than noncertified peers – the most compelling return on investment data point for certification investment in the dataset.
The escalating threat environment The multi-factor authentication MFA gap The 2026 findings paint a stark picture of a rapidly deteriorating threat environment for UK small and medium-sized enterprises (SMEs). Two-thirds of businesses experienced at least one cyberattack in 2025 – a significant increase on the government’s own figures and a sign that attackers are intensifying their focus on smaller targets. Phishing remains the dominant attack vector, implicated in 83% of incidents. However, the notable rise in supply-chain attacks – from 9% to 18% year-on-year – reflects a strategic shift by sophisticated threat actors, who are increasingly targeting small businesses as entry points to larger enterprise customers. Financial impact The average cost of a breach for a UK SME rose to £6,400 in 2025, up 52% from the 2024 baseline of £4,200. This figure encompasses direct costs (IT recovery, specialist forensic support) and indirect costs (business downtime, customer attrition, regulatory fines, and increased cyber insurance premiums following a claim).
46 BULLETIN 253 · SEPTEMBER 2026
Despite widespread awareness, only 58% of SME respondents had enforced multi-factor authentication across all cloud services. Among the 42% who had not, the most common reasons cited were “concerns about staff disruption” (44%), “not sure how to implement it” (31%) and “hadn’t prioritised it yet” (25%). Given that credential-based attacks account for over 60% of breaches, this represents the single largest addressable gap across the SME market. Industry benchmarks Financial services and professional services firms reported the highest breach rates (74% and 71%, respectively), reflecting both their attractive data assets and the targeted nature of financially motivated threat actors. Manufacturing and construction firms showed the largest year-onyear increase – a 58% rise in attack incidence – consistent with National Cyber Security Centre intelligence about ransomware groups pivoting to target critical supply-chain businesses. For the full report visit <https://amvia.co.uk/ research/uk-sme-cybersecurity-2026>.
Thematic review and gap analysis on AI security The Department for Science, Innovation and Technology commissioned Lancaster University to conduct a thematic review and gap analysis covering peer-reviewed research on the security of artificial intelligence from the last 5 years (January 2021 to January 2026). This report was sought to provide a detailed overview of the state of research in this field. The study identified 9,109 relevant publications, which could be grouped under 12 themes. The research also found various gaps in the literature, with five prevalent areas identified.
Please note the report presents independent research commissioned by the Department for Science, Innovation and Technology. The views expressed do not represent UK Government policy and the report’s findings are derived from research led by Lancaster University. This research is part of the government’s wider work to understand the cybersecurity implications of critical and emerging technologies, and to support improvement of the UK’s cyber resilience. Follow the link to read the report: Thematic review and gap analysis on AI security - GOV.UK.
ICO offers free data protection training for SMEs Small and medium-sized organisations, and sole traders, across the UK are being encouraged to take the new online training from the Information Commissioner’s Office. The training is relevant to all types of business and organisations and includes sector-specific examples for the education and childcare, health and social care, professional services, retail, and property sectors. Data Protection Essentials is free. It’s covered by the data protection fee that organisations pay and is also available to those that are exempt from paying the fee. Faye Spencer, Head of Business Services at the Information Commissioner’s Office, said: “We’re always looking for ways to make data protection easier and more accessible for
smaller organisations, who often have limited time and resources. “We know from speaking to small organisations across a range of sectors that many would welcome more practical, step-by-step support to help them apply data protection in their day-to-day work. Balancing customer needs, service delivery, business growth and other operational priorities can make it difficult to find time to focus on data protection. “That’s why we’ve designed Data Protection Essentials to be flexible, self-paced and easy to fit around busy working days. It breaks data protection into achievable steps that help build confidence over time. Our aim is to give organisations the confidence to use personal information responsibly and effectively, helping them build trust, reduce risk and achieve their goals.”
INFORMATION AND RECORDS MANAGEMENT SOCIETY 47
Widespread implementation of AI by businesses presents new opportunities for cybercriminals A new report from global cybersecurity and corporate intelligence firm S-RM and global stakeholder strategy firm FGS Global predicts that the widespread adoption of artificial intelligence (AI) by global corporates could pose new cyber vulnerabilities if implemented too quickly and without appropriate guardrails. As organisations deploy more AI agents, automated workflows, and API-driven integrations to drive efficiency and performance, they create new categories of non-human identities with sometimes broad-ranging privileges. These privileges could, inadvertently, give attackers even greater access to a company’s systems and make it harder for organisations to understand what data has been accessed and what has been done with it. Compromised automation systems may interact with dozens of services, process thousands of transactions autonomously and behave in unpredictable ways, which will require security teams to develop new approaches for monitoring these non-human identities, as well as frameworks for containing and investigating incidents involving compromised AI systems. At the same time, cybercriminals are using AI to help them find and exploit the information that would be most damaging to an organisation if it were exfiltrated or unavailable. Cybercriminals are learning which data types generate the most pressure for payment – including customer information, intellectual property, regulatory violations and material that could trigger additional legal liabilities – and are using AI to quickly review and categorise data.
48 BULLETIN 253 · SEPTEMBER 2026
Other key predictions for 2026 identified in the report include the following:
•
Established ransomware groups will continue to dominate: a handful of prolific, well-established threat actor groups will continue to dominate headlines and victim counts, including the likes of Akira, Qilin and Scattered Spider/ShinyHunters, while smaller newcomers emerge with regularity.
•
Ransomware attacks will get faster: ransomware operators have become increasingly sophisticated in their automation, organisation and execution. What once took weeks now takes days, and what took days now takes hours.
•
Increasing emergence of the “speed paradox”: as attacks become faster, organisations will have dramatically less time to respond before trust begins to erode. Businesses will therefore increasingly face a speed paradox: communicating quickly to maintain trust – but often with incomplete data – or waiting for certainty, which can signal organisational paralysis.
In today’s hyper-connected world, managing reputation during a cyber incident has become more critical than ever. Companies need to contend with the continued acceleration of the professionalisation and sophistication of cybercriminals’ engagement and communications with victim organisations. While AI has ensured written communications are more polished and verbal communications more realistic, threat actors have become more
aggressive in their briefing of the media as a way to exert pressure on companies, as well as calling out what they deem to be misleading communications in the media – leaving companies red-faced about some of their early communications, which attempted to size and scale the problem before they had all the facts.
and capabilities that made a group successful don’t disappear when a brand is disrupted. This resilience means that while individual group names may come and go, the overall threat level will remain relatively constant, with experienced operators continuing their activities under new identities.”
At the same time, the steady emergence of smaller, relatively unknown groups – both genuine newcomers and rebrands of disrupted operations – will create growing unpredictability for companies trying to control their stakeholder communications in a ransomware attack.
Jenny Davey, Global Co-Head of FGS Global’s Crisis & Issues Management Practice, added:
Jamie Smith, Global Managing Director, Cyber Security at S-RM commented: “We are moving into unchartered territory where the speed and sophistication of cyberattacks are outmanoeuvring traditional defences. What once took weeks now takes days, and what took days now takes hours. Attackers are no longer just encrypting systems; they are using AI to find the most sensitive information that could cause maximum damage to an organisation and using this as leverage. The result is more targeted extortion that goes beyond generic threats of data publication. Threats are becoming specific and more personalised, designed to maximise the victim’s fear and willingness to pay. “As more companies embed AI agents in their workflows, the risk rises exponentially. AI agents should be treated as untrusted identities, with least privilege access to systems, continuous monitoring and explicit segmentation from sensitive systems or AI adoption risks creating privileged, opaque intermediaries that threat actors can manipulate for maximum harm. “Meanwhile, while we expect some disruption to the operations of certain well-established threat actor groups in 2026, it is important to not get complacent. The knowledge, relationships,
“Ransomware incidents are highly feared by Boards and leadership teams, and for good reason. As recent high-profile attacks have shown, they can have crippling consequences on a business’s operations, financial situation and reputation – and the knock-on effects can be significant and far-reaching. “As Boards consider the implementation of AI agents and automated workflows across their business, they must be mindful that it can be a double-edged sword: while AI can drive efficiency and performance across the business, it can also open up new attack vectors for cybercriminals to exploit and therefore present new reputational risks. Boards must also remain mindful of how AI is enabling cybercriminals to be more sophisticated in communications and engagement with victim organisations, and how it is driving and sharpening threats that are cyber-adjacent, such as deepfakes, synthetic media and misinformation campaigns. These can be particularly reputationally damaging if not handled swiftly and with care. “In today’s complex and rapidly evolving environment, organisations who treat security posture, operational resilience and stakeholder engagement as one, with a holistic, agile and tested approach, will fare better and maintain trust when they’re hit with the inevitable.” The full report is available here: <www.srminform.com/cyber-insights-report-2026>.
INFORMATION AND RECORDS MANAGEMENT SOCIETY 49
Metropolitan Police Service issued with enforcement notice and reprimand following data protection failures The Information Commissioner’s Office (ICO) has issued an enforcement notice and reprimand to the Metropolitan Police Service (MPS) after personal information in two highly sensitive police cases was erroneously disclosed. The ICO found that MPS failed to put in place appropriate technical and organisational measures to protect people’s personal information, an infringement of section 40 of the Data Protection Act 2018. The investigation revealed a common issue of poor data protection training compliance rates at the MPS with inadequate monitoring and governance. Incident one An MPS officer served unredacted documents to a defendant in a Stalking Protection Order (SPO) case. The documents included the victim’s new address and telephone number, as well as the names and contact details of three witnesses. The victim had changed her address and phone number because of the risks she faced. The defendant later contacted the victim on her new number and said he had received documents containing her new contact details from the MPS. The ICO found MPS failed to ensure confidential third-party information was redacted before documents were served. They also found relevant officers had not received the required specialist SPO training at the time, and that the process for preparing and quality assuring documents was inadequate. Incident two This related to the so-called “Honeytrap matter”, where people linked to the UK parliament had been targeted by someone via WhatsApp messages in 2024 and 2025 in an attempt to gather compromising information.
50 BULLETIN 253 · SEPTEMBER 2026
An MPS officer emailed all the people affected to advise them of a change to the suspect’s bail date. The recipients’ email addresses were placed in the “To” field, meaning all recipients could see each other’s email addresses and names. The context of the email meant that highly sensitive information could potentially be inferred about the recipients, even though the body of the email did not explicitly contain that information. MPS confirmed that 18 people linked to the UK Parliament were affected. The ICO concluded MPS should have used more appropriate methods to communicate with the affected people and not relied on sending one bulk email in such sensitive circumstances. Investigations findings Investigations revealed that the breaches were not isolated mistakes. They reflected wider weaknesses in MPS policies, procedures and assurance arrangements for handling sensitive personal information. They also found serious and ongoing shortcomings in MPS data protection training. The officer who sent the email in Incident two had not completed data protection training for over 4 years before the incident, and the officer’s line manager had also not completed relevant training for almost four years prior to the incident. Wider completion rates for mandatory Managing Information training were discovered to be low, with MPS itself acknowledging that further improvement was required. As a result, the ICO issued MPS with a reprimand for the infringements identified in both incidents. They also issued
an enforcement notice requiring MPS to take steps within 3 and 12 months to improve its data protection training compliance, monitoring and governance arrangements. Jo Stones, ICO Group manager – Civil and Cyber Investigations, said: “People entrust the police with some of their most sensitive personal information, often at moments when they are vulnerable or at risk. They have the right to expect that information will be handled securely. “In these cases, the Metropolitan Police Service failed to put in place the safeguards needed to protect people’s personal information. One breach exposed a stalking victim’s new contact details to the person she needed protection from. Another revealed the identities of people connected to a highly sensitive investigation. “These incidents were foreseeable and preventable. Our action makes clear that organisations, particularly those in the public sector handling sensitive law enforcement information, must have effective training, monitoring and assurance in place. Policies and reminders are not enough if they are not followed, checked and enforced.”
ICO hits company selling call blockers with £190k fine for nuisance calls The Information Commissioner’s Office (ICO) has fined Elderly Aids Ltd (EAL) £190,000 for bombarding people with the very nuisance calls it claimed to protect them from. The company deliberately targeted elderly people to promote call-blocking devices, claiming they were trying to protect them from nuisance calls.
EAL made 758,053 unsolicited direct marketing calls to people registered with the Telephone Preference Service (TPS) between May 2024 and February 2025, with 20 complaints made to the ICO and TPS during this period. The complaints revealed that EAL’s callers were aggressive, misleading, and often failed to identify themselves. One complainant said: “overcharging for call blocking services that they aren’t authorised to sell – my father was persuaded to sign up to pay £139 upfront and a £6.99 monthly fee.” Throughout the ICO’s investigation, EAL repeatedly ignored requests for information and continued making unsolicited calls, which led to further complaints. The company also attempted to strike itself off the Companies House register once it became aware it was under scrutiny and is now registered at a default address. Andy Curry, Head of Investigations at the ICO, said: “Not only did this company target vulnerable people who had explicitly asked not to be called – they harassed them to sell callblocking devices. EAL showed a complete disregard for the law and the people they were hounding. This penalty should serve as a clear warning to any business that thinks the law does not apply to them – we will hold them to account for both exploiting people in this way and trying to avoid accountability. “Alongside the monetary penalty, the ICO also issued an enforcement notice ordering EAL to stop making unlawful marketing calls and to comply with caller identification requirements. “It is against the law to make a live marketing call to anyone who is registered with the TPS, unless the individual has informed the specific organisation that they do not object to receiving calls from them.” INFORMATION AND RECORDS MANAGEMENT SOCIETY 51
Latest offerings from our Training Partners Subject Area
Provider
Course Title
Delivery method
Duration
Data Protection
DPS & BJM IG and Data Privacy Training
UK GDPR/GDPR, Data Protection and the Common Law of Confidentiality for all staff
Training delivery can be virtual or in house. From a group of 4 and can be recorded
2.30 hours
Data Protection
DPS & BJM IG and Data Privacy Training
Essential General Data Protection Training
Training delivery can be virtual or in house. From a group of 4 and can be recorded
4 hours
Data Protection
DPS & BJM IG and Data Privacy Training
Advanced Data Protection Training for IG Leads
Training delivery can be virtual or in house. From a group of 4 and can be recorded
6 hours
Data Protection
HCUK
Developing your role as a Senior Information Risk Owner (SIRO)
Online
5.5 hours
Data Protection
Online on Demand: BCS Tkm Consulting Foundation Certificate in Data Protection
e-learning
20 hours
Data Protection
Tkm Consulting
Introduction to Information Asset Registers
Live online
40 hours (4 days)
Data Protection
Conduction Data ProtecTkm Consulting tion Impact Assessments
Live online
6 hours (2 half days)
Data Protection
Naomi Korn Associates
Privacy by Design: Data Protection Impact Assessments (DPIAs)
Live online
3 and a half hours/ 1 half day
Data Protection
Naomi Korn Associates
Information Security and Data Breach Management
Live online
3 and a half hours/ 1 half day
Data Protection
Naomi Korn Associates
Data Protection Essentials
Live online
7 hours across 2 half days
Data Protection
Naomi Korn Associates
Data Protection Rights (focused on Data Subject Access Requests)
Live online
3 and a half hours/ 1 half day
Data Protection
Naomi Korn Associates
An Overview of The Freedom of Information Act and Environmental Information Regulations
Live online
3 and a half hours/ 1 half day
52 BULLETIN 253 · SEPTEMBER 2026
For full details of all the courses, including course description and cost, please visit: <https://irms.org.uk/page/ThirdPartyTrainingProviderCourses> And don’t forget to take advantage of your fantastic IRMS member discount.
Subject Area
Provider
Course Title
Delivery method
Duration
Data Protection
Naomi Korn Associates
Information Security and Data Breach Management
Live online
3 and a half hours/ 1 half day
Data Protection/ Information Architecture/Information Law (Governance)/ Freevacy Records Management
Certified Information Privacy Technologist
Live online, instructor-led training & in-company classroom training option for groups of 6 or more
4 x 4 hour online sessions, or 2 days on site + unlimited 1-2-1 coaching and exam preparation
Data Protection/ Information Law (Governance)/Re- Freevacy cords Management
Certified Information Privacy Manager
Live online, instructor-led training & in-company classroom training option for groups of 6 or more
4 x 4 hour online sessions, or 2 days on site + unlimited 1-2-1 coaching and exam preparation
Data Protection/ Information Law (Governance)
Freevacy
Certified Information Privacy Professional Europe (CIPP/E)
Live online, instructor-led training & in-company classroom training option for groups of 6 or more
4 x 4 hour online sessions, or 2 days on site + unlimited 1-2-1 coaching and exam preparation
Data Protection/ Information Law (Governance)
Freevacy
Certified Information Privacy Professional Europe (CIPP/US)
Live online, instructor-led training & in-company classroom training option for groups of 6 or more
4 x 4 hour online sessions, or 2 days on site + unlimited 1-2-1 coaching and exam preparation
Information Architecture
DPS & BJM IG and Data Privacy Training
Essential Cyber Security Training
Training delivery can be virtual or in house. From a group of 4 and can be recorded
3 hours
Practitioner Certificate Information Law Tkm Consulting in Scottish Public Sector (Governance) Records Management
Live online
21 hours (3 days)
Practitioner Certificate Information Law Tkm Consulting in Scottish Freedom of (Governance) Information
Live online
30 hours (6 half days)
BCS Foundation CertifiInformation Law Tkm Consulting cate in Artificial Intelli(Governance) gence
Live online
21 hours (3 days)
Online
4 hours
Information Law HCUK (Governance)
Continued on Page 52
Working Together: Combined course for Senior information Risk Owners, Caldicott Guardians and Data Protection Officers: Half day
INFORMATION AND RECORDS MANAGEMENT SOCIETY 53
Subject Area
Provider
Course Title
Delivery method
Duration
Information Law HCUK (Governance)
Responding to Subject Access Requests for Health & Social Care
Online
6.5 hours
Information Law HCUK (Governance)
Data Protection Officer in Health and Social Care: What Good Looks Like
Online
7.5 hours
Records Management
HCUK
Effective Records Management Health and Care Documentation and Record Keeping
Online
7 hours
Records Management
HCUK
Caldicott Principles & Information Sharing in End of Life Care
Online
7 hours
new members
SEPTEMBER 2026 There have been 239 new members since January 2026
Student/apprentice members
Individual members
Angelique Golding
Richard Cottam
Chidinma Egbuna
Vanessa Smith
Laura O’Neiill
School Affiliate Ley Top Primary School
54 BULLETIN 253 · SEPTEMBER 2026
diary Dates IRMS Scotland: Professional development and advocacy Join Liz Taylor and the IRMS Scotland Group as we continue the conversation on professional development and advocacy within the information profession. In an ever‑changing environment, established terms from information governance and records management are increasingly being reused to describe emerging disciplines such as data governance. This can create both opportunity and confusion for the profession. Liz Taylor will explore with the group the varied ways in which records management is defined and described today, and how practitioners can effectively advocate for the profession while developing the new skills needed to meet the challenges of tomorrow. 4 SEPTEMBER 2026 Venue: online Time: 12:00–13:00 IRMS Public Sector Group: Local government reorganisation focus group The focus group is a forum for those within local government who have been, are, or will be going through LGR. The aim is to work together collaboratively on the records management impact of local government re-organisation. 9 SEPTEMBER 2026 Venue: online Time: 13:00–14:00 IRMS Schools Webinar: Beyond the Screen: AI, Social Media & Online Safety: An exclusive interview with former undercover detective Jonathan Taylor Jonathan spent over 10 years working undercover, to investigate and prevent the grooming and exploitation of children online. Today, he works with schools across the UK, helping them understand the rapidly changing risks posed by AI, social media, gaming platforms and emerging technologies. Rather than focusing on headlines, this session will provide practical insight into: • how offenders are using AI and social media • the new risks created by deepfakes, AI companions and voice cloning • what schools should be doing now to protect pupils • the role every member of staff
plays in safeguarding. Although this is a safeguarding webinar, it is equally relevant to information and records professionals. After all, safeguarding is everyone’s responsibility. Effective safeguarding depends upon good information governance. Recording concerns accurately, managing safeguarding records appropriately, preserving evidence, sharing information lawfully and ensuring policies remain fit for an AI-enabled world are all underpinned by strong records management. This webinar is therefore relevant to: • Records Managers • Information Governance professionals • Data Protection Officers • Designated Safeguarding Leads • School Business Managers • Senior Leaders • Governors • Anyone working in or supporting schools We’d also like this to be an interactive session. If there is a question you’ve always wanted to ask someone who has spent years investigating online grooming and child exploitation, please send it to us in advance. We’ll put as many questions as possible to Jonathan during the interview. We hope you can join us for what promises to be a fascinating and thought-provoking discussion. 29 SEPTEMBER 2026 Venue: online Time: 11:00–12:00 IRMS Ireland: Before the algorithm, after the prompt: Records, data, and the real work of AI governance Every artificial intelligence (AI) system runs on data. Every piece of data came from somewhere. And in most organisations, nobody has done the work to establish whether that somewhere is trustworthy, current, complete, or even findable. This event, hosted by IRMS Ireland during EU AI Innovation Month, cuts against the grain of the wider month’s agenda to examine what has to be true about your information and records environment before any AI deployment can be considered responsibly governed. It also broadens that lens to address a critical but often overlooked requirement: understanding and managing the end-to-end
environmental impact of AI, from data acquisition and storage through to model training, deployment, and ongoing use. Drawing on the EU AI Act’s requirements for data quality and traceability, the Data Governance Act’s framework for trusted data sharing, and hard-won practitioner experience across regulated sectors in Ireland and Europe, the event covers four interlocking themes: data quality as the silent variable in every AI outcome; retention and classification as underestimated AI risk controls; the accountability gap when records cannot support the audit trail that law and policy require; and the professional opportunity for information and records managers to lead – not follow – the AI governance agenda in their organisations. The format is deliberately practitionercentred: short provocations from experienced speakers, a cross-sector panel, and structured discussion time that attendees can take back to their desks. AI governance does not begin with a model. It begins with a record. 21 OCTOBER 2026 Venue: South County Business Park, D18 DH6K, Dublin, Ireland Time: 10:00 IRMS Midlands Group: Future perfect? IRMS Public Sector Group: Implementing records management in M365 including Purview By Rachel Mitchell, from Leadership Through Data, will be taking a look at the application of M365, including Purview, to Records Management. 11 NOVEMBER 2026 Venue: online Time: 13:00–14:00 IRMS Public Sector Group: Introduction to records management (Records Management 101) IRMS Public Sector Group is pleased to have Rachel Mitchell, Trainer and Consultant with Leadership Through Data, present a Records Management 101 session on an Introduction to Records Management. 9 DECEMBER 2026 Venue: online Time: 13:00–14:00
INFORMATION AND RECORDS MANAGEMENT SOCIETY 55
.ir m www
IRMS CONFERENCE
sc
on
fe r
KIMPTON CLOCKTOWER MANCHESTER 16-18 May 2027
en
ce
.o r g
.u k
EVERY RECORD TELLS A STORY The soundtrack to the past, present and future of information
Join us next year in Manchester. www.irmsconference.org.uk #IRMS27