Certificate in AI Governance

What they teach at SCS
Legal Principles in Canadian Business
AI Governance Foundations

Current role
AI Risk & Governance, EY Canada | LL.L, LL.M, PhD (Law) Candidate | CIPP/C, CIPP/E

Education
Paulina holds a Law degree, as well as a Master of Laws degree, from the University of Ottawa. She is currently a PhD (Law) Candidate at Osgoode Hall Law School, where her research focuses on AI governance and risk. She has been heavily involved in research throughout her academic parcours – working in numerous research positions at the heart of the law faculty, as well as in research institutions. She is also a Certified Information Privacy Professional (CIPP/C, CIPP/E) through the International Association of Privacy Professionals.

Professional experience
Paulina Vengeroff is a bilingual, bijurally-trained legal and privacy professional – fluent in English and French, and educated in both English common law and French civil law. She currently focuses on AI risk at EY Canada, contributing to the firm’s approach to AI governance, risk assessment, and the responsible deployment of AI-enabled tools and systems. She specializes in large corporation data governance and compliance, privacy and data protection law, regulation of AI, and data and model ethics, and is continuously in search of opportunities to learn and expand her horizon of knowledge. Prior to this, she worked in advisory and compliance capacities for the Government of Canada, Crown corporations, and leading private corporations in Canada and internationally. She works closely with software developers, engineers, and other innovative IT specialists, where she simplifies legislation and supports international projects with risk compliance. Alongside, she advises on the development and deployment of complex data-using systems, automated decision-making, and other uses of data and models for innovation. Amongst her training in Canadian law, she is well-versed in European Union and United States legislation in her areas of expertise.

Teaching philosophy
As a lecturer, she believes that patience, creativity, empathy, and communication are vital to teaching. She aims to create positive, fair, and student-centric learning environments, while fostering strong and open dialogue with her students. She understands the indispensable role of education for students and the translation of academic lessons into the real world. For this reason, she works hard to consistently support her students and join them in their path towards success.

What they teach at SCS
Fundamentals of Information Privacy
Privacy in Technology
Privacy Operations
Designing Trustworthy AI

Current role
Founder and Principal – PRIVĀT, LLC

Recognition
In 2024, Peter was nominated for Privacy Educator of the Year (“Privacy Leader: Academia/Thought Leadership”) by the PICCASO-Canada Privacy Awards, a juried recognition of excellence in Canadian data privacy and security.

Professional experience
Peter Kosmala is a recognized data governance practitioner and educator with extensive experience working within organizations and advising clients in the IT, ad tech and digital media arenas. This includes training professionals and speaking to audiences on the responsible uses of artificial intelligence and other emerging technologies.

Since 2020, Peter has led the development and instruction of the Information Privacy Certificate (IPC) program at York’s School of Continuing Studies. He spent many years with the International Association of Privacy Professionals (IAPP) first as Director of Certification and then as Assistant Director and Vice President. He helped to establish the IAPP’s office in Canada as well as the annual IAPP Canada Symposium, the largest privacy, security and AI governance event in the country.

Peter led the creation of the world’s first professional certification in privacy and data protection, the IAPP’s Certified Information Privacy Professional (CIPP). He followed this with credentials in Canadian privacy laws and practices (CIPP/C) as well as privacy standards for information technology (CIPT).

Peter has served in leadership roles at technology companies, CMGI and Dataxu (now Roku) as well as at technology publisher, WIRED magazine and its online property, Hotwired, the first ad-supported commercial Website on the Internet.

Peter’s roots are in product and service design at firms that include George Tassian Organization (Cincinnati) and Henry Dreyfus Associates (New York) where he worked within the industrial design teams. He has both taught and implemented methods for Design Thinking, Privacy by Design and Security by Design.

What they teach at SCS:
Operationalizing AI Governance

Education:
Sarah holds an LL.M. from the University of Notre Dame (Fulbright Scholar), and a BA/LL.B. from Lahore University of Management Sciences. She has served as Co-Chair of the IAPP KnowledgeNet Toronto and Co-Newsletter Editor of the Ontario Bar Association’s Privacy Section.

Professional Experience:
Sarah Nasrullah brings over eight years of experience as a Privacy & Product Counsel, advising technology and telecommunications organizations on product development, data governance, consent, and strategic data partnerships. Her expertise spans the full lifecycle of privacy and AI governance—from designing consent architectures and conducting privacy impact assessments to strengthening vendor risk management and embedding privacy by design into agile development. In her roles at Bell Enterprise, OpenText, and Norton Rose Fulbright, Sarah has partnered closely with product, engineering, marketing, and AI teams to translate evolving regulatory requirements—including PIPEDA, Bill C-27, Québec’s Law 25, GDPR and CCPA/CPRA — into practical, risk-based guidance that enables responsible innovation. She has led enterprise privacy policy modernization, designed privacy engineering workflows, and developed AI governance guidance for the responsible adoption of generative AI. Sarah is known for her clear judgment and ability to balance legal risk with business growth. She is recognized by colleagues as a trusted advisor who brings both legal rigor and commercial pragmatism to complex challenges. Her current work focuses on the governance of AI systems, including the legal design of agentic AI workflows and the operationalization of privacy by default in AI-driven products.

Teaching Philosophy:
My teaching philosophy centers on building a bridge between legal theory and operational reality. I believe mid-career professionals learn best when they can immediately apply new frameworks to their daily work, so my courses are designed to be highly interactive, practical, and grounded in real-world case studies.