California enacted a new law that imposes certain obligations on lawyers’ use of generative artificial intelligence beginning January 1, 2027, which is covered in our AI blog. That post also discusses a Connecticut case in which the court sanctioned a
CIPA legislation enacted
On September 30, 2026, the California Governor signed SB 690, which amends the California Invasion of Privacy Act (CIPA) to restrict private enforcement—but only for claims under CIPA’s pen register and trap-and-trace provisions arising from websites and online or
Internet privacy updates: CalPrivacy fines data brokers, Colorado proposes new AI regulations
Anyone who contracts for internet or social-media-based advertising may have overlooked two recent actions by the California Privacy Protection Agency (CalPrivacy) and the proposed draft AI regulations from Colorado, but there are some important takeaways that should not be missed.
NYDFS levies $250,000 fine on licensee for inadequate cyber risk assessment
On August 5, 2026, the New York Department of Financial Services (NYDFS) entered into a consent order with Order Express, Inc., a money transmitter licensed by NYDFS. Although Order Express qualified for a limited exemption under the NYDFS cybersecurity regulation
Rhode Island’s new AI and healthcare privacy law
We recently published an article to commemorate AI Appreciation Day, but readers may also appreciate a law that recently passed In Rhode Island, known as the “Use of Artificial Intelligence by Healthcare Providers Notification Act.” The bill
AI Appreciation Day 2026 and key developments in governance and compliance
As artificial intelligence (AI) becomes embedded in business operations, data protection frameworks are increasingly shaping how organizations manage AI use. This update highlights key regulatory developments, including risk-based approaches and sector-specific rules, and outlines practical considerations for compliance
NYDFS issues guidance “in a heightened cybersecurity environment”
On May 21, 2026, the New York Department of Financial Services (NYDFS) issued industry guidance to licensees regarding security measures they should consider taking “in a heightened cybersecurity threat environment.” Even organizations not subject to NYDFS regulation may want to
Colorado’s new AI governance law
We recently published an alert that highlights Colorado’s new artificial intelligence (AI) governance law. After X.AI sued to enjoin enforcement of Colorado’s first AI governance law and the federal government moved to intervene, the Colorado Attorney General agreed to temporarily
NYDFS Cybersecurity Enforcement: US$2.25m Fine Against Delta Dental
On April 30, 2026, the New York Department of Financial Services (NYDFS) announced a consent order with Delta Dental Insurance Company and Delta Dental of New York, Inc. for alleged violations of the NYDFS Cybersecurity Regulation relating to the 2023
How to approach governance of AI agents
Current approaches to agentic AI governance seem more focused on trying to apply governance after a system is developed, like a Band-Aid, instead of baking in reasonable governance and controls into the guts of the system. In the same way