Highlights from the Compliance Alliance Lunch Workshop at Team26 Europe, exploring AI governance, sovereign and isolated cloud, and validation for regulated industries.
On 8 October, the Compliance Alliance (SoftComply, Izymes and Redmoon Software) organised its 6th Compliance Lunch Workshop during Atlassian Team ’26 Europe in Amsterdam. With over 50 attendees, our highest attendance yet, the workshop brought together Atlassian Marketplace and Solutions partners to explore how regulated organisations can adopt cloud and AI while meeting their security, compliance and governance requirements.
Over lunch, four Atlassian speakers addressed different parts of that challenge: choosing trusted Marketplace apps, managing cloud migration for regulated industries, adopting Rovo responsibly and connecting external AI tools to Atlassian.
Scaling with Confidence: Enterprise-Grade Governance & Procurement for Marketplace Apps
Kelsey Van Scoy, Senior Product Marketing Manager, Atlassian Marketplace
A Marketplace app can solve a business problem in minutes, while getting it approved for use can take considerably longer. In regulated organisations, security, legal, procurement and quality teams may all need evidence about the supplier, its technology, and how it handles customer information.
Kelsey introduced the Atlassian Enterprise Certified (AEC) program, which provides an Atlassian-verified signal that an app meets common enterprise requirements across security, reliability, privacy, compliance, accessibility and responsible AI use. She highlighted requirements including penetration testing, declared data egress, documented incident management and accessible trust information.
Why is this important for regulated organisations?
The practical benefit is a more consistent starting point for supplier assessment. Clear information about data handling, security practices and support arrangements can help reviewers identify potential gaps earlier and reduce repeated requests for evidence. It also gives security, legal and procurement teams a better basis for reviewing an app in parallel.
This matters particularly when Marketplace apps support important processes such as risk management, document approvals or software testing. The assessment needs to consider both the app’s functionality and the assurance behind it. AEC evidence can support that assessment, while the organisation remains responsible for determining whether the app is suitable for its intended use and specific regulatory obligations.
Removing Roadblocks from Data Center to Cloud Migration: From Commercial to Sovereign and Isolated Cloud + Cloud Validation
Sascha Wiswedel, Principal Solutions Engineer at Atlassian
For regulated organisations, moving to cloud involves decisions about data location, operational responsibility, configuration and the evidence needed to demonstrate that important processes continue to work.
These deployment models raise different questions about sovereignty and isolation. A public-sector organisation may have particular requirements around jurisdiction and access, while a company handling highly sensitive information may need stronger separation between environments. The value of considering different models is the opportunity to match the deployment approach to actual requirements. That assessment also needs to cover the availability of essential apps, integrations and capabilities within the chosen environment.
When moving from DC to Cloud, topics such as change management, configuration deployment and governance become particularly important. Sascha explained that, on Data Center, organisations controlled when to install new releases and could assess and test them before deployment. In Cloud, updates are delivered continuously, requiring teams to adapt how they monitor changes, assess their impact and maintain validation evidence. He also showed how Governance Manager can help organisations configure relevant settings and identify configuration drift.
For regulated teams, ongoing change assessment therefore needs to be built into both migration planning and day-to-day operations. Validation of Jira and Confluence Cloud can support this through documented intended use, assessment of changes, testing of critical workflows and retained evidence. For example, a medical device company using Jira to support development may need confidence that its approval workflows and traceability continue to function after relevant changes. Combining suitable deployment choices with configuration governance and validation can help teams maintain that confidence as their cloud environment evolves.
Rovo for the Enterprise: Trust, Security, Usage-Based Pricing and the Road Ahead
Ali BenCafu, Principal Product Manager, Rovo at Atlassian
Enterprise AI becomes more useful when it can understand the context of an organisation’s work. Ali’s presentation illustrated how agents draw on information from code, meetings, conversations and documents, alongside a view of how organisations could assess and improve the quality of that connected context.
For regulated industries, the opportunity is significant. Teams often spend considerable time finding the right information, reconstructing decisions and bringing together material from different systems. With appropriate access and reliable sources, AI could help assemble information for a change assessment, summarise project history or prepare a first draft for expert review. These uses could reduce administrative effort and give specialists more time to assess risks and make decisions.
The quality and governance of the underlying information are therefore crucial. An outdated procedure or an unclear document status can affect the usefulness of an AI-generated answer. Organisations need current source material, appropriate permissions and clear expectations for checking outputs. Where AI contributes to regulated records or consequential decisions, human review and approval need to be part of the workflow.
Usage-based pricing introduces a further consideration: understanding consumption and the value delivered. Teams will need to assess which use cases justify their cost and how usage changes as adoption grows. As Rovo develops towards more complex tasks, the governance questions become increasingly practical: what may an agent access, which actions may it perform, who reviews the result and who remains accountable? Establishing those responsibilities can help regulated organisations expand AI use with greater confidence.
MCP Enterprise Enablement: Trust, Organisational Controls and Governance for Enterprise Adoption
Jemma Swaak, Product Manager, MCP Server at Atlassian
Many organisations already use several AI assistants, while the information those assistants need sits in Jira, Confluence and other business systems. Jemma explored how the Model Context Protocol (MCP) can connect assistants such as ChatGPT and Claude to Atlassian information and actions, helping teams retain the context of their work across tools.
This could reduce the need to manually copy information into prompts or explain the same project repeatedly. For regulated teams, a potential benefit is keeping work connected to its supporting records. An assistant could help retrieve relevant requirements or prepare a summary from project information, with people checking the sources and reviewing the result before it is used.
Jemma outlined how Atlassian’s AI tooling can make the administration of these connections tangible, employing settings for connections, authentication and advanced permissions. These distinctions are important because retrieving a record and changing one carry different risks. Deployed properly, an organisation could begin with a narrowly defined use case but permit additional actions as its assessment and governance processes mature.
Connecting an external AI service also creates a supplier and data-handling consideration. Organisations need to understand what information may be passed to the assistant, how that service handles it and whether the arrangement is appropriate for the intended use. Combined with carefully scoped access, clear ownership and human approval for consequential actions, MCP offers a way to explore connected AI workflows within defined organisational boundaries.
Thank you to Kelsey, Sascha, Ali and Jemma for sharing their expertise, and to everyone who joined us for the discussions, questions and lunch!
See you all in San Fransisco for Atlassian Team ‘27 & the 7th Compliance Lunch Workshop to discuss how we continue building strong governance in the fast-moving, ever evolving AI landscape.
