-
You Can Outsource the Service. Forty-Four States Say You Cannot Outsource the Duty.
A 44-attorney-general Labcorp settlement reinforces a critical governance principle: organizations can outsource services, but they cannot assume outsourcing eliminates responsibility for governing third-party cybersecurity risk.
-
Rogue AI Agents Have Entered the Enforcement Phase
Rogue AI agents are moving from theoretical risk to regulatory scrutiny. Organizations must now prove what agents were authorized to do, what controls existed, and…
-
The Government Wants Frontier AI Companies to Report Incidents. It Hasn’t Defined How.
The U.S. wants serious frontier AI incidents reported, but key definitions and thresholds remain unsettled. Organizations should not wait for regulation to build AI incident…
-
A Major Cyber Information-Sharing Liability Shield Expires in 9 Days
CISA 2015 expires September 30, potentially changing legal protections for cyber threat sharing. Organizations should know what protections they rely on before they disappear.
-
The FTC Is Showing How Data Governance Can Become Enforcement Risk
The FTC’s personalized-pricing proposal exposes a growing governance risk: data may be properly collected and protected while its new use creates regulatory exposure.
-
The 72-Hour Cyber Reporting Clock Is Really a Governance Test
CIRCIA’s 72-hour cyber incident reporting requirement is more than a compliance deadline. It tests whether organizations can move from detection through classification, decision authority, reporting,…
-
When Marketplace Policies Aren’t Evidence
Amazon’s response to New York City’s crackdown on prohibited e-bikes and scooters exposes a larger governance question: when companies have compliance policies, can they prove…