Cross-sector · Regulation & Compliance
Articles in this selection, newest first. Change the filters, or clear them to see every article.
12 articles · Cross-sector · Regulation & Compliance
Articles
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU pushed back its high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on time. For banks, insurers, hospitals and agencies serving Europeans, the work now sits in chat windows, content pipelines and publishing sign-off.
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Many banks and health systems answer state privacy laws with one line: “GLBA or HIPAA exempts us.” Three laws that took effect on January 1, 2026 showed why that line needs a citation, and why exempting an organization differs from exempting its data.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate stripped a proposed federal moratorium, and AI compliance stayed with the states. Across their many laws, one durable core kept recurring: notice, explanation, human review and records. Organizations that built that core first could absorb everything else that kept shifting.
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best guide to which obligations would last was not their topic but their legal form: a statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 24 July 2023
Under the SEC’s final cyber rule, the clock starts at a decision, so the decision needs a record
In July 2023 the SEC gave public companies four business days to disclose a material cyber incident, counted from when they decide it is material. So the decision itself needs governing: who makes it, what record it leaves, how it fits other deadlines.
Week of 26 June 2023
Two privacy laws on, one rulebook paused: compliance by capability map
In one week, Colorado and Connecticut switched on their privacy laws and a California court paused new rules a day before enforcement. When deadlines move like that, the steadier approach is to build four lasting capabilities and map each new law onto them.
Week of 24 April 2023
Four regulators, no new law: the AI statement put the buyers of models on the hook
The April 2023 joint statement created no new rules. It simply said existing lending, employment, housing and consumer protection law already reached automated systems, which made the organization using a model answerable for its data, its opacity and its use, whoever built it.
Week of 7 March 2022
Describe your board’s cyber oversight in a filing, and you have made a promise
The SEC’s March 2022 proposal is remembered for its four-day clock on reporting cyber incidents. Its governance disclosures reached further: every public company would describe how management and the board handle cyber risk, and those words would become a standard others could test.
Week of 3 January 2022
After the FTC’s Log4j warning, the response record was the defense
In January 2022 the FTC told companies that leaving Log4j unfixed could break the law. Regulators judge “reasonable” security after the fact, from records, so the work that counted most was writing down the response as it happened.
Week of 19 April 2021
How the AI Act proposal tied risk to the use, whatever the model
The European Commission’s April 2021 AI Act proposal regulated what AI is used for, not how it is built. Its four tiers sorted the AI in banks, hospitals and agencies by business process, so compliance belonged to process owners as much as to data scientists.
Week of 2 November 2020
Exempt institution, covered data: what Proposition 24 meant for banks and hospitals
Proposition 24 created the first U.S. regulator devoted to privacy. Banks and health systems that assumed federal law exempted them learned that California exempts certain data, not whole institutions, and that everything else needs real operational plumbing.
Week of 28 September 2020
From crisis call to compliance record: OFAC’s ransomware advisory
Treasury’s October 1, 2020 advisories did not ban ransom payments. They attached strict sanctions liability to victims and to the firms that help them pay, which moved the decision out of the crisis room and into a governed, documented compliance process.