On August 5, 2026, the New York Department of Financial Services (NYDFS) entered into a consent order with Order Express, Inc., a money transmitter licensed by NYDFS. Although Order Express qualified for a limited exemption under the NYDFS cybersecurity regulation, NYDFS found that the company violated the regulation’s applicable requirements in three ways: (1)
Data Protection Report
Data protection legal insight at the speed of technology
Blog Authors
Latest from Data Protection Report
The EU AI Act – when does it become enforceable now?
The Digital Omnibus on AI (AI Omnibus) has now been published in the EU’s statute book. This pushes back some of the application dates for the AI Act. So, what’s applicable now and when will the rest become applicable? This post gives an overview of key dates to be aware of and a timeline…
Rhode Island’s new AI and healthcare privacy law
We recently published an article to commemorate AI Appreciation Day, but readers may also appreciate a law that recently passed In Rhode Island, known as the “Use of Artificial Intelligence by Healthcare Providers Notification Act.” The bill went into effect on June 16, 2026.
The law’s stated purpose is “is to ensure…
AI Appreciation Day 2026 and key developments in governance and compliance
As artificial intelligence (AI) becomes embedded in business operations, data protection frameworks are increasingly shaping how organizations manage AI use. This update highlights key regulatory developments, including risk-based approaches and sector-specific rules, and outlines practical considerations for compliance, oversight and responsible deployment.
Read the full article, “AI Appreciation Day 2026: Regulations, risks
NYDFS issues guidance “in a heightened cybersecurity environment”
On May 21, 2026, the New York Department of Financial Services (NYDFS) issued industry guidance to licensees regarding security measures they should consider taking “in a heightened cybersecurity threat environment.” Even organizations not subject to NYDFS regulation may want to consider these steps that the NYDFS characterizes as “best practices.”
Background
Many regulators, including NYDFS,…
Is my use case a high-risk AI system? Applying the Commission’s guidelines and next steps
The EU Commission’s long-awaited guidelines on high-risk AI systems were published on 19 May 2026. This is the promised explainer on what is – and is not – a high-risk AI system under the EU AI Act.
The guidelines
The Commission has published three sets of draft guidelines:
- general principles;
- Annex III high-risk AI systems
…
When AI becomes the cyber attacker: Mythos and what comes next
Anthropic’s April 7, 2026 announcement that it built a model too powerful for public consumption, Claude Mythos Preview (Mythos), marks a notable moment for the legal, compliance, and cybersecurity communities. It is no surprise that the US Department of the Treasury and the Federal Reserve convened an emergency meeting with major bank CEOs the day…
Colorado’s new AI governance law
We recently published an alert that highlights Colorado’s new artificial intelligence (AI) governance law. After X.AI sued to enjoin enforcement of Colorado’s first AI governance law and the federal government moved to intervene, the Colorado Attorney General agreed to temporarily suspend enforcement of the law. The Colorado General Assembly has since passed a bill to…
Colorado AI Act: DOJ Steps In As X.AI Suit Pauses
We recently published an alert that highlights recent developments in the case filed by X.AI LLC seeking to enjoin enforcement of Colorado’s Senate Bill 24-205 (SB-24-205), often referred to as the Colorado AI Act (the AI Act). The AI Act was set to go into effect on June 30, 2026, and purports to, among other…
How to approach governance of AI agents
Current approaches to agentic AI governance seem more focused on trying to apply governance after a system is developed, like a Band-Aid, instead of baking in reasonable governance and controls into the guts of the system. In the same way that security teams refer to “trust assurance” as the measures and frameworks that give them…