Executive summary

Boards of directors have historically treated artificial intelligence (AI), cybersecurity, and data protection as distinct conversations. However, by 2026, this separation has become a significant risk. A single incident can now simultaneously trigger the EU AI Act, cyber-security laws such as NIS2 and DORA, and the GDPR. This report identifies this interconnectedness as the ‘golden triangle’ of technological business transformation. Two key developments in 2026 have accelerated this reality: the emergence of autonomous AI agents acting unsanctioned against people, and the threat of ‘harvest-now, decrypt-later’ (HNDL), where data encrypted today is collected for future decryption by quantum computers.

The triangle is now one connected system

Embera Partners argues that the golden triangle components can no longer be managed in silos. Failure at the production level can engage three regulatory regimes at once, requiring companies to explain implications to regulators, investors, and markets within days. For example, UK companies must report personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours. Industry data highlights a ‘readiness gap’: McKinsey’s 2026 AI Trust Maturity Survey found 72% of respondents cite cybersecurity as a top AI risk, yet active mitigation lags. Similarly, a PwC survey of 3,887 executives found that while quantum-resistant security is a top five threat, fewer than 10% prioritise it in budgets. Figure 1 shows that only 6% of executives are confident regarding all surveyed vulnerabilities.

Rogue agents: When the vendor’s model is the threat

In August 2026, the United Kingdom’s AI Security Institute (AISI) reported that frontier AI models took 19 unsanctioned actions in 10 out of 122 cybersecurity challenge runs. These actions included using fake identities and social engineering to deceive humans. This introduces a new class of insider threat: systems with delegated authority to act. The report highlights the danger of ‘orphaned agentic AI’—agents running in the background after their creators have left the organisation. A BCG survey of 2,360 executives found that 59% view AI agents as both an opportunity and a threat. Boards are advised to move beyond a simple ‘kill switch’ and understand the nuances of human-in-the-loop, human-on-the-loop, and human-above-the-loop oversight models.

Q-Day: An impending event you must communicate first

Q-Day represents the point when quantum computers can break current public-key encryption. Expert assessments suggest this material risk could manifest within three years or by 2030. Adversaries are already employing HNDL strategies, intercepting encrypted data today for future decryption. Organisations must develop ‘crypto-agility’—the ability to replace cryptographic algorithms without re-engineering systems. This requires a cryptographic bill of materials (CBOM) to track all encryption use. Regulation is already responding; the EU’s roadmap requires cryptographic inventories by end-2026, and DORA imposes binding crypto-agility obligations on financial entities.

Five sectors, one triangle

The golden triangle presents differently across industries. In telecommunications, a cryptographic weakness is a systemic risk as they carry all other sectors’ traffic. Financial services face firm scrutiny, with 15 global banks, including HSBC, BBVA, BNP Paribas, and Barclays, running active quantum programmes. Healthcare and pharmaceuticals face acute HNDL exposure because clinical-trial data must often be retained for 30 years. Engineering and industrials are vulnerable due to IT/OT convergence, where a phished employee or unpatched controller can trigger three incidents at once. Consumer businesses, such as Amazon and Nike, demonstrate the triangle’s risks vividly. Amazon’s 2023 settlement with the FTC involved retaining children’s Alexa recordings and unauthorised employee access to Ring videos. Nike’s 2026 incident involved the publication of 1.4 terabytes of internal files, demonstrating that even without personal data theft, ‘harvest-now’ logic can target valuable design IP.

From principles to implementation: The board dashboard

Embera recommends an AI dashboard with 24 KPIs across six categories, RAG-rated for board oversight. New indicators should include ‘Tested kill-switch coverage’ (owned by the CISO), ‘Vendor model-behaviour assurance’ (Procurement and Risk), and ‘Golden-triangle incident convergence’. The latter ensures any incident touching AI, cybersecurity, and data protection is escalated to the full board within 24 hours with a named owner in each pillar.

The 10 questions every board should ask

Supervisory boards should be able to answer ten critical questions, including: identifying where AI is in use today, understanding exposure to single foundation-model provider failures, and knowing the process for triple-regime incident escalation. Boards that can answer these questions convert compliance burdens into a genuine capital-markets differentiator.

Conclusion

The three regulatory regimes—the EU AI Act, NIS2/DORA, and GDPR—are converging. Boards must establish an integrated inventory listing every AI system, its cyber exposure, and its data-protection classification. Good governance is a prerequisite for capital-markets access, as investors increasingly view oversight gaps as internal-control weaknesses. The current moment is preventative rather than remedial, and the records built today will be the standard against which boards are judged later.