Personal AI is arriving in organisations through agents, staff’s own accounts and wearables. What boards need to ask, the 10 December privacy deadline, and thirteen AI risks for your risk register.