Emerging Technology Policy (AI, Cloud, IoT, Supply Chain)
Governing new tech
Emerging tech policy asks how existing governance adapts to new risk. For AI, know the risk-management lifecycle (map, measure, manage, govern), the distinction between AI actors (providers, deployers, users) and their duties, and concepts like explainability, bias, model provenance, and human oversight. Expect questions on risk-tiered regulation - higher-risk uses demand more controls - and on AI supply-chain risk from third-party models and data.
For cloud, understand the shared responsibility model: the provider secures the cloud; the customer secures what they put in it. Traps include assuming provider certification transfers accountability, and ignoring data residency, exit/portability, and concentration risk (over-reliance on one provider).
For IoT, policy focuses on insecure-by-default devices, patching longevity, identity, and botnet risk from compromised devices. Supply chain policy emphasizes software bill of materials (SBOM), provenance, vendor risk management, and flow-down of security requirements to subcontractors.
Trap: treating emerging tech as exempt from existing law. Privacy, breach-notification, and sector rules still apply.
Worked example: A company deploys a third-party AI hiring tool. The vendor is certified, but the deployer remains responsible for bias testing, human review, and privacy of applicant data - certification does not shift accountability. Policy should require model documentation, testing evidence, and an exit plan.