Lessons Learned from FPF “Deploying AI Systems” Workshop

On May 7, 2025, the Future of Privacy Forum (FPF) hosted a “Deploying AI Systems” workshop at the Privacy + Security Academy’s Spring Academy, which took place at The George Washington University in Washington, DC. Workshop participants included students and privacy lawyers from firms, companies, data protection authorities, and regulatory agencies around the world.

The two-part workshop explored the emerging U.S. and global legal requirements for AI deployers, and attendees engaged in exercises involving case studies and demos on managing third-party vendors, agentic AI, and red teaming. The workshop was facilitated by FPF’s Amber Ezzell, Policy Counsel for Artificial Intelligence, who was joined by Anne Bradley (Luminos.AI), Brenda Leong (ZwillGen), Bret Cohen (Hogan Lovells), and Daniel Berrick (FPF).

From the workshop, a few key takeaways emerged:

• When vetting third-party AI tools, deployers agreed that it is necessary to independently test the tools using their own data, rather than relying on representations made by third party vendors – especially for “high risk” use cases. This is due to the growing amount of regulatory interest in unfair and deceptive practices pertaining to AI deployment (e.g. misleading statements about the capabilities, nature of implementation, and data collection and management practices of AI tools). Regulators are also concerned with whether organizations are monitoring and testing for accuracy, discriminatory, or biased outputs. 
• Most deployer organizations feel they are facing significant constraints on resources for AI risk management, and that they are having to “do more with less.” In comparison, organizations are investing more resources towards AI adoption and innovation; nevertheless, they agreed on the importance of having a risk-based approach to AI deployment for mitigating risk and regulatory pitfalls.
• Despite the buzz about “AI agents,” agentic systems are not yet a main focus of risk governance for most participants. Nonetheless, agentic systems may soon begin to pressure test or amplify governance questions relevant to more widely deployed forms of AI (e.g. general purpose LLMs or automated decisionmaking tools). 

As organizations, policymakers, and regulators grapple with the rapidly evolving landscape of AI development and deployment, FPF will continue to explore a range of issues at the intersection of AI governance.

If you have any questions, comments, or wish to discuss any of the topics related to the Deploying AI Systems workshop, please do not hesitate to reach out to FPF’s Center for Artificial Intelligence at [email protected].