The EU Commission’s long-awaited guidelines on high-risk AI systems were published on 19 May 2026. This is the promised explainer on what is – and is not – a high-risk AI system under the EU AI Act.
The guidelines
The Commission has published three sets of draft guidelines:
…
Anthropic’s April 7, 2026 announcement that it built a model too powerful for public consumption, Claude Mythos Preview (Mythos), marks a notable moment for the legal, compliance, and cybersecurity communities. It is no surprise that the US Department of the Treasury and the Federal Reserve convened an emergency meeting with major bank CEOs the day…
We recently published an alert that highlights Colorado’s new artificial intelligence (AI) governance law. After X.AI sued to enjoin enforcement of Colorado’s first AI governance law and the federal government moved to intervene, the Colorado Attorney General agreed to temporarily suspend enforcement of the law. The Colorado General Assembly has since passed a bill to…
We recently published an alert that highlights recent developments in the case filed by X.AI LLC seeking to enjoin enforcement of Colorado’s Senate Bill 24-205 (SB-24-205), often referred to as the Colorado AI Act (the AI Act). The AI Act was set to go into effect on June 30, 2026, and purports to, among other…
On April 30, 2026, the New York Department of Financial Services (NYDFS) announced a consent order with Delta Dental Insurance Company and Delta Dental of New York, Inc. for alleged violations of the NYDFS Cybersecurity Regulation relating to the 2023 MOVEit cybersecurity incident. Please see our Legal Update here.
The changes to data controllers’ complaints handling obligations, made via the Data (Use and Access) Act, will come into force on 19 June 2026. These include a new obligation to acknowledge complaints within 30 days, respond without undue delay, and inform data subjects about the right to complain.
This briefing focuses on the impact of…
Current approaches to agentic AI governance seem more focused on trying to apply governance after a system is developed, like a Band-Aid, instead of baking in reasonable governance and controls into the guts of the system. In the same way that security teams refer to “trust assurance” as the measures and frameworks that give them…
Healthcare providers are increasingly deploying artificial intelligence (AI) tools for diagnostics, documentation and operational efficiency. In fact, over the last few months, large AI platforms are now marketing AI-enabled tools directly to healthcare providers. Providers must navigate a rapidly evolving regulatory landscape, while keeping in mind existing and longstanding requirements intended to safeguard…
A popular public AI tool has been accused in federal court of practicing law without a license. Please see the post on the Artificial Intelligence page of Inside Tech Law: AI in litigation series: Complaint accuses OpenAI of practicing law without a license | Inside Tech Law | Global law firm | Norton Rose Fulbright…
Multi‑factor authentication (MFA) is now a well-established baseline cybersecurity control. The amended New York Department of Financial Services (NY DFS) solidified that understanding and expanded MFA requirements under 23 NYCRR Part 500 (the NY DFS Cybersecurity Regulation). Since November 1, 2025, Covered Entities are required to use MFA for any individual accessing the Covered Entity’s…
