On September 24, 2026, Labcorp settled with 44 state attorneys general for $2,287,455 over a 2019 data breach—one that occurred not on Labcorp's systems, but at AMCA, the debt collector to which it had outsourced patient billing. The breach exposed the personal information of 27.5 million people, including 10.2 million Labcorp patients. Why is Labcorp the one signing the consent order? Because, as the Connecticut Attorney General put it, "data security is a non-delegable duty." A company can outsource billing; it cannot outsource its responsibility for overseeing vendors. For HIPAA covered entities and business associates, the lesson is direct: a signed business associate agreement is not a vendor management program. We walk through the settlement terms, the pending HHS Security Rule amendments on annual vendor verification, and the five vendor-management practices companies handling PHI should have in place before a regulator, or an enterprise customer, asks.

Two incidents this year moved agentic misalignment out of the realm of research demonstrations and into the labs’ own live systems. Namely, OpenAI’s models hacked Hugging Face, and Alibaba’s ROME agent mined crypto. Neither agent was instructed to do what it did. This is the problem of agentic self-optimization. And our current AI governance frameworks—and most contracts—are not built to handle this.

Most AI agreements are SaaS templates with the word "AI" added. That is a mistake—and it gets worse as the product becomes more autonomous. SaaS contracts assume software runs and a human acts. But generative AI produces probabilistic outputs, AI agents take actions, and agentic AI pursues its own goals. Each step breaks a different assumption about performance, data, liability, indemnification, and audit rights.

How SaaS GCs can review AI vendor agreements, manage data and privacy risk, and negotiate safer AI contracts using a structured playbook approach from AMBART LAW.

New York State now requires businesses to disclose when they have set a price using an algorithm that has been fed a consumer's personal data. Personalized dynamic pricing is here; it now just requires a disclaimer.

Companies have long used user-generated content (“UGC”) to market and promote products and services, by recruiting social media influencers to create video reviews. Now, many brands are turning to AI influencers, to skip the human error, slow speeds, and high costs of contracting with human social media influencers. Because these tools blur the boundaries between authentic and fabricated endorsement, they may raise ethical and legal concerns.

Last week, AI governance practitioners and policymakers braced themselves for a federal ban that would have erased state AI laws. But, in the final hours before voting on the “One Big Beautiful Bill” ahead of the Independence Day holiday, the U.S. Senate removed a proposed moratorium on state legislation.  Since introduced a few weeks ago, the moratorium’s rise and fall revealed deep divisions not just over AI policy, but over states’ rights, federalism, and the future of tech oversight in the United States.

President Trump signed into law the TAKE IT DOWN Act (the “Act”) on May 19, 2025. The Act requires online platforms to remove non-consensual intimate images (“NCII”) upon request or face civil liability. This includes what the Act calls “digital forgeries,” commonly known as deepfakes. The Act also criminalizes the publication of NCII.

This month, the White House Office of Management and Budget (“OMB”) released two memoranda on federal agencies’ AI use and procurement. Broadly, the memoranda prioritize American leadership in the AI space and encourage AI agencies to adopt AI efficiently and effectively (noting that the fiscal benefits of AI in the workplace are well-documented). Importantly, for “high-impact AI,” the memoranda establish minimum risk management practices and emphasize transparency through public reporting and feedback.

The Texas Responsible AI Governance Act (“TRAIGA”) stands as one of the most closely watched artificial intelligence bills in the United States. Introduced by Texas State Representative Giovanni Capriglione (R-District 98) on December 23, 2024, this legislation has undergone significant revisions in its scope and impact, likely in line with the current federal government’s attitudes toward AI regulation. Does this new version, filed in March 2025, stand a chance?

New York City’s “AI Law” or Local Law 144 (also known as “The Artificial Intelligence in Hiring Law”) addresses the use of automated employment decision tools (AEDTs) by companies in their hiring and promotion decisions. NYC Local Law 144 seeks to promote transparency surrounding algorithmic decision-making in employment. But are companies hiring in NYC following it?

On February 20, 2025, the Virginia General Assembly passed HB2094, the High-Risk Artificial Intelligence Developer and Deployer Act (the “Virginia AI Act”). If signed into law by Governor Glenn Youngkin, the Virginia AI Act would make Virginia the second U.S. state, after Colorado, to have a comprehensive AI law. It applies to both developers and users of AI systems that make decisions affecting Virginia residents in employment, healthcare, housing, and other high-risk sectors.

Currently, Washington, Nevada, and Connecticut have enacted consumer health data laws, with New York poised to join them if Governor Hochul signs Senate Bill 929 into law (New York’s proposed Health Information Privacy Act). These state-level laws represent a significant shift in the privacy landscape, requiring that businesses receive opt-in consent from users, which is not the norm in the United States, and extending protections beyond traditional healthcare settings and HIPAA-covered entities. These heightened requirements have also increased the cost of doing business, particularly for most SaaS, DTC, and Consumer Tech brands.

Yesterday, DeepSeek’s opensource R1 overtook ChatGPT in downloads in the Apple App Store. As R1 became the top rated free application, DeepSeek had to limit registrations, due to numerous large-scale cyberattacks. DeepSeek’s Privacy Policy states “We store the information we collect in secure servers located in the People’s Republic of China.” Many people have indicated concerns about DeepSeek’s privacy practices.

On Monday morning, U.S. tech stocks tumbled after an announcement from China: DeepSeek, a relatively unknown AI startup, unveiled an open source ChatGPT-like model called R1. According to DeepSeek, the company spent less than $6 million on computing power for its base model–by comparison, spending hundreds of millions of dollars less than U.S.-based companies such as OpenAI or Google. For years now, the United States has implemented measures to restrict the supply of advanced AI chips to other countries, particularly China. Newly announced regulations also seek to restrict the export of model weights. On January 13, 2025, the Bureau of Industry and Security (“BIS”) under the Biden-Harris Administration released an Interim Final Rule on Artificial Intelligence Diffusion. The rule: i) revises controls on advanced AI chips (a specialized type of integrated circuit optimized for handling AI algorithms’ high computational demands) and creates a new licensing framework, and ii) implements a licensing regime for exporting “model weights” (the parameters that encode an AI system’s core).

The FTC finalized its changes to the Children’s Online Privacy Rule, consistent with the Children’s Online Privacy Act. Online operators that direct their sites or services to children will have to make certain important changes, by the end of Q1.

The most foolproof way to create an AI model that produces reliable, correct outputs (thus fostering customers’ use and trust) is to simply build a custom model from scratch. Unfortunately, that’s a bit like saying that the best way to buy the optimal wine for your restaurant is to fly to Italy or France and start your own vineyard—an option that feasibly exists, but is out of budget for most. In response, many Chief Information Officers (CIOs) of leading companies are scrambling to find cost-effective ways to “upskill” broad foundational AI models to make AI work in their business context. We discuss different methods of leveraging foundational AI models.

We have identified the top 25 AI legal risks for 2025 and how to mitigate, which clients should use when developing an AI-Contracting Playbook. By proactively addressing and understanding ownership of input data (Risk #1) and outputs (Risk #2), bias (Risk #3), accountability for harms (Risk #4), and the uncertainty of navigating a patchwork of applicable laws (Risk #5), you can better position your organization to unlock the benefits of this digital transformation.

AI models carry significant risks to produce biased outputs. Bias, when applied to AI models, generally manifests as either cognitive bias or computational bias. Each type of bias carries different harms, and it is important to what (if any) steps your AI vendor takes to mitigate these risks.