# Samantha Cowan

Samantha Cowan writes about AI governance, privacy, and vendor security, with a focus on how AI and connected tools handle sensitive email and calendar data.

- Profile: https://b2binfluencer.marketing/creators/samantha-cowan/
- LinkedIn: https://www.linkedin.com/in/samanthacowan
- Topics: artificial-intelligence, ai-governance, agentic-ai, responsible-ai
- Based on 16 dated posts, latest 2026-09-25

## Summary

They are most useful for making AI governance, privacy, and vendor risk in communications workflows practical for enterprise buyers.

- Best for: B2B SaaS security and trust teams seeking AI governance and vendor-risk messaging.
- Not for: Consumer wellness apps, non-technical mobile users, scripted video, or fixed-rate sponsored placements.
- Check first: Confirm audience roles, independence, disclosure, and whether work is commissioned or co-published.

### Takeaways

- Governance, not the AI model, is the hard enterprise problem.
- Risk travels through connected vendors, so single-vendor review misses it.
- Privacy by design is an engineering principle, not a compliance checkbox.

## Main ideas

- **Governance, not the model, is the hard enterprise problem**: Samantha Cowan argues that organisations adopting AI still open the conversation with the model, when the harder work is governing how AI is developed, deployed, monitored, and overseen over time. Procurement and trust conversations, they say, have shifted toward accountability: how AI risks are identified and assessed, who oversees them, how third-party AI providers are evaluated, and what controls exist throughout the AI lifecycle. Governance is an ongoing discipline that evolves alongside the technology, not a one-time exercise; AI adoption makes it as important as the models themselves.
- **Risk travels through connected vendors, so single-vendor review misses it**: Cowan argues that security teams still evaluate vendors one at a time, while real workflows almost never work that way. A single communications workflow can involve APIs, identity providers, CRMs, AI providers, cloud infrastructure, subprocessors, and automation tools that share data, permissions, and operational dependencies. Vendor security therefore cannot stop at questionnaires, certifications, or point-in-time reviews; organisations also need to see how risk moves between systems. They apply the same reasoning to AI: securing it is not only about prompt injection or model choice, but also about how it interacts with sensitive communications data across a connected environment.
- **Privacy by design is an engineering principle, not a compliance checkbox**: Cowan treats privacy as an architectural decision, not something to add after launch. Choices about handling customer data—OAuth scopes, data minimisation, authentication, retention, encryption, and access controls—are made at the start of a build. Privacy claims should therefore be traceable to those decisions, not merely asserted as a value. The same reasoning applies to APIs: access to data does not mean all of it should be collected or used. Responsible use starts with least privilege, purpose limitation, transparency, and protecting information throughout its lifecycle.
- **Autonomy is a dial to set, and safeguards should match the setting**: Cowan separates three workflow types—rules-based automation, AI-assisted workflows, and agentic or autonomous workflows—and argues that moving along the spectrum changes architecture, permissions, monitoring, auditability, and governance requirements, not just the user experience. An AI system that drafts a message for human review carries a very different risk profile from one that sends it, schedules a meeting, updates a CRM, and triggers downstream actions without approval. The aim is not to maximise autonomy, but to choose a level of autonomy and safeguards suited to the workflow’s potential impact.
- **Regulation is really an accountability question**: On the EU AI Act, Cowan argues that most coverage focuses on the model, while the harder enterprise problem is governance: which vendors are responsible for what, how AI fits into existing security and procurement processes, and what to ask vendors when AI touches communications data. Communications platforms make the problem visible: meeting summaries, email classification, and automated workflows often span multiple providers, raising accountability questions that model selection cannot resolve. The piece is written for people working through these issues—security, privacy, compliance, procurement, and AI governance leads—not as statutory commentary.
- **Write for the role that has to defend the decision**: Across the posts, Cowan prioritises naming the reader who carries the internal burden of proof—security, privacy, legal, procurement, AI governance, or enterprise architecture—and giving them something usable: questions, controls, or a way to place a workflow on a spectrum. These topics, they note, have become routine parts of enterprise procurement and trust conversations. The posts summarise longer articles and spell out their coverage in bullets so readers can quickly decide whether the full piece answers their question. No sponsorship, paid-partnership, or product-promotion formats appear; the material is tied to publishing around Nylas security and governance themes.

## Work to read

- [Ten questions to ask AI vendors about data usage](https://www.linkedin.com/posts/samanthacowan_10-questions-to-ask-ai-vendors-about-data-activity-7485717836238069761-59HV)
- [How Nylas approaches AI governance for email](https://www.linkedin.com/posts/samanthacowan_how-nylas-approaches-ai-governance-for-email-activity-7486057636161822720-hPTA)
- [Vendor security as a shared ecosystem responsibility](https://www.linkedin.com/posts/samanthacowan_vendor-security-as-a-shared-ecosystem-responsibility-activity-7489007652891426816-32u-)
- [AI-assisted vs. autonomous email workflows](https://www.linkedin.com/posts/samanthacowan_ai-assisted-vs-autonomous-email-workflows-activity-7488256312896610304-caPn)
- [AI risk in connected email and calendar platforms](https://www.linkedin.com/posts/samanthacowan_ai-risk-in-connected-email-and-calendar-platforms-activity-7487544785688240128-wp5Q)
- [How Nylas builds privacy into email and calendar](https://www.linkedin.com/posts/samanthacowan_how-nylas-builds-privacy-into-email-and-calendar-activity-7484995645687103488-duPf)
- [EU AI Act for enterprise communication platforms](https://www.linkedin.com/posts/samanthacowan_eu-ai-act-for-enterprise-communication-platforms-activity-7483967383314001920-J8vA)
- [Responsible use of email and calendar APIs](https://www.linkedin.com/posts/samanthacowan_responsible-use-of-email-and-calendar-apis-activity-7486422444442796033-i-yl)

## Brand relationships

- **Nylas** (disclosed_partnership)

## Partnerships

Samantha Cowan’s posts are educational articles produced for Nylas, covering AI governance, privacy, vendor risk, and communications security. Each follows the same format: a governance question, a short list of principles or controls, and a link to the full Nylas article. This is employer-branded thought leadership, not evidence of independent sponsored placements or a stated offer for outside brands to commission content, appear in it, or pay for placement. Before planning a partnership, ask Cowan to confirm the format, deliverables, disclosure practice, approval process, and whether the specific placement—such as a sponsored article, co-branded research piece, or product mention—is available.

## Alternatives

- Shawn Edwards: Choose Shawn Edwards when a campaign needs critical-infrastructure or telecom-sector cybersecurity credibility, particularly around collective defence, sector information sharing and government compliance programmes. Edwards’ posts show work on a communications-sector cyber information-sharing body and a compliance and government-security leadership role covering frameworks such as CMMC, NIST 800-171, FedRAMP, DFARS, SOC 2, ISO 27001 and PCI DSS. For a vendor-risk brief aimed at regulated or government-adjacent buyers, this gives the campaign a specific sector and compliance frame that Cowan’s posts do not cover.
- Michelle Woodward Hodges: Choose Michelle Woodward Hodges when a campaign targets MSPs, channel partners or managed-security providers and needs language around AI fluency, AI-enabled security operations, and identity and access fundamentals. The posts connect AI readiness to partner resilience, describe people-first AI as a force multiplier, and lay out an identity-security service model: reviewing privileged, inactive and third-party accounts; strengthening authentication with MFA and SSO; applying least-privilege and zero-trust controls through IAM and PAM; continuously monitoring login activity; and finding exposed services before attackers use them. For a partner-enablement or managed-services angle on AI governance, this is a closer operational match than Cowan’s enterprise procurement and shared-responsibility framing.
- Robert Bimm, CAIO-CP, CAIERO-CP: Choose Robert Bimm when a campaign needs an executive-level AI governance argument that extends beyond model risk to information integrity, decision intelligence, and AI plus quantum computing. The posts argue that AI governance should broaden from model accuracy and security to the quality, bias and manipulability of the information feeding AI. They ask what sources AI consumes, how information is validated, whether recommendations trace back to trusted sources, how bias is identified before decisions, and what controls exist when agents act autonomously. For thought leadership aimed at CAIOs, CIOs and transformation leaders, this gives the campaign a larger strategic frame than Cowan’s communications-platform focus.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/