As another piece of harmonization legislation, the AI Act is unsurprisingly reminiscent in regulatory philosophy to the GDPR. Many of the same data principles (transparency, accuracy, security) are present, as is an explicit risk-based approach. Understanding precisely where there is overlap with your existing GDPR program is a head start in your AI Act compliance
The General Services Administration Federal Acquisition Service has released draft contract terms and conditions related to AI-related procurements through a new proposed GSAR clause 552.239-7001, “Basic Safeguarding of Artificial Intelligence Systems” (February 2026), that would impose material new requirements on contractors and service providers supplying AI capabilities to the federal government. If adopted, the clause
Oklahoma has joined the growing chorus of states enacting comprehensive consumer privacy legislation. With the passage of Senate Bill 546, the Sooner State has a new data protection framework taking effect on January 1, 2027.
Here is what businesses need to know.
Current approaches to agentic AI governance seem more focused on trying to apply governance after a system is developed, like a Band-Aid, instead of baking in reasonable governance and controls into the guts of the system. In the same way that security teams refer to “trust assurance” as the measures and frameworks that give them
A putative class action filed in December 2025 in the U.S. District Court for the Central District of Illinois offers a reminder that AI meeting assistant and transcription tools potentially carry significant legal exposure when organizations deploy them without appropriate governance guardrails in place. It also serves as a reminder to apply strong governance principles
As I shared in last week’s edition, I attended both the IAB Public Policy & Legal Summit and the IAPP GPS sessions. This week, I want to focus on what I learned at IAB and in the US State Privacy Law workshop. Here’s the summary from my many pages of notes.
Sorry folks – it’s
By Odia Kagan
How far does a platform’s responsibility extend when a user posts someone else’s personal data in a classified ad, especially one involving sensitive subject matter like sex work? The Italian Data Protection Authority (Garante) recently fined online classifieds platform Bakeca S.r.l. after an unknown user published two ads, including an explicit offer
One of the most valuable AI companies in the world may have just accidentally given away one of its crown jewels and immediately turned to copyright law to limit the damage. On March 31, 2026, Anthropic accidentally exposed the source code for Claude Code, one of its most valuable AI products. The company issued Digital
@media screen and (max-width: 1023px){section[data-id=”block_2432676e6df83f9e094498de340ec148″]{ }}@media screen and (min-width: 1024px) and (max-width: 1365px){section[data-id=”block_2432676e6df83f9e094498de340ec148″]{ }}@media screen and (min-width: 1366px){section[data-id=”block_2432676e6df83f9e094498de340ec148″]{ }}
Healthcare providers are increasingly deploying artificial intelligence (AI) tools for diagnostics, documentation and operational efficiency. In fact, over the last few months, large AI platforms are now marketing AI-enabled tools directly to healthcare providers. Providers must navigate a rapidly evolving regulatory landscape, while keeping in mind existing and longstanding requirements intended to safeguard