Expert Analysis

• AI Risks May Recalibrate 'Reasonable Security' Standards

  

  A definitive answer to what constitutes reasonable vulnerability management in the age of artificial intelligence is still emerging, but the answer is likely less a reset of the standard than a recalibration of how organizations meet it, say Scott Loughlin at Hogan Lovells and Mike Priest at Globe Life.

• Key Risk Assessment Gaps To Note From NY Cyber Guidance

  

  Covered entities should take a fresh look at the compliance gaps flagged in recent New York State Department of Financial Services guidance on "deficient cybersecurity programs," particularly around scope, asset inventories and documentation, say attorneys at Mayer Brown.

• Tort Liability When AI Goes Rogue: Strict Liability

  

  If artificial intelligence agents misbehave in unpredictable ways, and no reasonable precaution can prevent resulting harms, then a negligence regime may not provide sufficient remedy, and strict liability might be adapted to cover agents' misconduct — but the common notion of strict liability fits this situation imperfectly, says Donald Hawthorne at Carter Ledyard.

• Open Issues After 2nd Circ.'s Airport Phone Search Ruling

  

  While the Second Circuit’s recent U.S. v. Alisigwe decision confirms border agents' broad authority to conduct routine manual cellphone searches at ports of entry, significant questions remain about more wide-ranging forensic searches at the border, say attorneys at Baker Botts.

• FTC's Changing Model Raises Questions About Its Mission

  

  Federal Trade Commission leaders have recently sketched a vision of an agency that continues an enforcement role distinct from the U.S. Department of Justice's, even as a shift toward greater presidential control makes enforcement more responsive to changes in administrations, say attorneys at Wiley.

• 2nd Circ. EFAA Ruling Shifts Employer Litigation Strategy

  

  In Diaz-Roa v. Hermes Law, the Second Circuit recently held that, under the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act, employers can't carve out nonharassment claims and send them to arbitration, which has implications for discovery, litigation costs and resolution strategy in EFAA-covered disputes, say attorneys at Krevolin Horst.

• Tort Liability When AI Goes Rogue: Negligence Theory

  

  If reasonable care in the use of artificial intelligence agents cannot eliminate the risk of third-party harm, then AI companies and users of AI agents must consider whether negligence theory provides an adequate framework for assessing harm caused by agents that go rogue, says Donald Hawthorne at Carter Ledyard.

• Digging Into Dems' Letter On Subpoena Secrecy Demands

  

  Lawmakers’ recent letter arguing that federal agencies’ use of boilerplate nondisclosure language in subpoenas pressures recipients into silence may lead to a significant overhaul of the current framework, but in the meantime, companies should review their rights and options, say attorneys at Crowell & Moring.

• 3 Steps To Mitigate The Cyber Risks From Employee AI Use

  

  Recent data showing a doubling in breaches tied to employee use of unapproved AI tools demonstrates a convergence of cybersecurity risk, data privacy exposure and legal liability that workplace policies don't often address, but business leaders can get ahead of these risks, say attorneys at Ogletree.

• AG Watch: Minnesota Takes Action To Secure Child Safety

  

  Minnesota Attorney General Keith Ellison has built one of the most aggressive and structurally coherent child protection enforcement programs in the country, targeting consumer-facing sectors that his office has concluded prey on minors, such as tobacco and nicotine, social media platforms, and artificial intelligence, say attorneys at Crowell & Moring.

• Series

  Being In The Peace Corps Made Me A Better Lawyer

  

  When I served in the Peace Corps, the people of the West African village where I was stationed helped me acclimate to my new surroundings and enabled me to develop problem-solving, teamwork and empathy skills that have bolstered my legal practice far beyond the ability to offer technical advice, says Brian Bewley at McGuireWoods.

• Immunity May Not Protect Gov't-Backed Cyber Operators

  

  Companies considering participation in a National Coordination Center program that authorizes private actors to conduct offensive cyber operations on the government’s behalf should understand the limits of sovereign immunity and the operational and legal risks lurking in the details and undefined parameters of the program, say attorneys at Steptoe.

• White House AI Accord Could Reshape Reasonable Care

  

  President Donald Trump's recent joint commitment on frontier responsibilities — signed by leaders of Google, Anthropic, Meta and more — may pose legal risks for nonsignatories, as businesses using artificial intelligence may find the accord's safeguards cited against them as evidence of what reasonable care requires, says Peter Schildkraut at Arnold & Porter.

• OCC Plan May Bring Data Sharing Flexibility, Diligence Issues

  

  The Office of the Comptroller of the Currency's recent proposal to overhaul its supervisory information sharing regime for the first time in decades would provide important flexibility to banks, but it could create new issues around confidentiality agreements, disclosure controls and diligence processes, say attorneys at Simpson Thacher.

• Protecting Trade Secrets When AI Agents Go Rogue

  

  In light of a recent incident in which artificial intelligence agents compromised parts of Hugging Face's production systems, and the uncertain court guidance surrounding liability in such situations, companies looking to update their trade secret protections should carefully examine agents' permissions and technical limitations, says Matt Nealon at Marshall Gerstein.