58 articles · Regulation & Compliance · page 1 of 3
Articles
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU pushed back its high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on time. For banks, insurers, hospitals and agencies serving Europeans, the work now sits in chat windows, content pipelines and publishing sign-off.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still disputed. Providers bound by it need their own record of decisions, documentation and appeals, a record that serves daily operations and the policy fight alike.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 deadline for stablecoin rules, but the law’s January 2027 backstop date stayed put. Banks could not wait for final text to choose their role, and the question of deposits ran through every choice.
Week of 16 February 2026
Why Part 2’s compliance date reached hospitals that never ran a treatment program
On February 16, 2026, addiction treatment records came under the same complaint, breach and penalty system that governs other health data under HIPAA. Because the duties follow the records, general hospitals, health plans and their vendors were covered too.
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Many banks and health systems answer state privacy laws with one line: “GLBA or HIPAA exempts us.” Three laws that took effect on January 1, 2026 showed why that line needs a citation, and why exempting an organization differs from exempting its data.
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
The SEC’s amended Regulation S-P took effect for larger firms on December 3, 2025, making notice to customers after a breach the default. Whether a firm could notify narrowly depended on evidence it had to keep long before anything went wrong.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
On November 10, 2025, Defense contracts began carrying CMMC cybersecurity requirements. Most eyes went to assessment levels, but the bigger change was a senior executive’s signature, which turned security claims into dated statements to the government with real legal weight.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s final cybersecurity deadline, November 1, 2025, paired multi-factor login for everyone with a maintained inventory of every system. The login rule got the attention. The inventory was harder, and the annual sign-off by named executives made both personal.
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
Regulators retired the tool community banks had used for a decade to check their cybersecurity on August 31, 2025. Most banks quickly picked a new framework. Fewer noticed they had also lost the step that told them how much security their business needed.
Week of 7 July 2025
How the DOJ’s bulk data rule made reach, not storage, the health data test
The Justice Department’s grace period ended on July 8, 2025, leaving health systems and life sciences firms facing a rule that asks who could reach their data, not how well it is protected. That puts procurement, research administration and HR on the front line.
Week of 30 June 2025
State AI law after the 99-to-1 vote: build for notice, explanation and human review
The Senate stripped a proposed federal moratorium, and AI compliance stayed with the states. Across their many laws, one durable core kept recurring: notice, explanation, human review and records. Organizations that built that core first could absorb everything else that kept shifting.
Week of 21 April 2025
A new SEC chair rewrites the agenda, not the compliance calendar
Paul Atkins arrived at the SEC promising a lighter touch. What mattered to broker-dealers and advisers was each rule’s legal status: proposals could vanish quickly, adopted rules kept their dates, and the examiners kept knocking.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist added to a chat of senior officials made the headlines. For agencies at every level, the lasting failure was an approved channel that could not set content limits, confirm who was present and keep the record, all at once.
Week of 3 March 2025
HHS’s end of voluntary comment periods hit grantees hardest and Medicare providers least
By dropping the Richardson Waiver, HHS stopped asking for public comment where the law did not require it. The lost warning fell unevenly: hardest on grant recipients, less on contractors and least on Medicare providers, whose own statute still requires comment.
Week of 16 December 2024
CISA’s encryption advice and the SEC’s recordkeeping cases asked for the same channel
After hackers burrowed into U.S. phone networks, CISA urged targeted people to switch to encrypted messaging, just as regulators were fining brokers over unrecorded chats. The two demands meet on one answer: a firm-controlled channel that is encrypted, recorded and easy to use.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The CFPB’s rule let federal examiners into the biggest payment apps, and it lasted under six months. With Synapse’s collapse still fresh, the more lasting exposure lay elsewhere: in the law apps already owed and in the banks holding their customers’ money.
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best guide to which obligations would last was not their topic but their legal form: a statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas settled with Pieces Technologies by treating an AI tool’s advertised error rate like any other sales claim. Hospital leaders can test such a number on three counts: what it counts, where it was measured, and whether it stays true.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
Europe’s new AI treaty covers AI used by public authorities and by private companies acting on their behalf. So an agency’s duties follow the service into its contractors, and the fuzzy edge of “on their behalf” is where governance gaps will open.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
In five days, four Supreme Court decisions ended deference on what statutes mean, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.