AI‑enabled transcription tools have quickly become a fixture in modern business meetings. Properly vetted and deployed, they offer efficiency and accessibility advantages. Yet, while many companies are still developing governance frameworks for authorized AI tools, an emerging risk has quietly surfaced: employees using unauthorized transcription tools without the company’s or participants’ consent.

This practice, often referred to as shadow AI, creates new layers of compliance, privacy, and legal exposure. For companies seeking to adopt AI responsibly, it is no longer enough to decide which tools to authorize; they must also manage the risk of employees using tools outside approved systems.

In a recent survey conducted by the National Cybersecurity Alliance, 43 percent of AI users admitted to sharing sensitive company information with AI tools without their employer’s knowledge.¹ These statistics underscore that shadow AI use is not theoretical, it is already happening, often outside company’s systems and platforms, and, therefore, not in view of legal and compliance teams.

Understanding the Risk Landscape

Once employees begin using transcription tools that the company has not vetted or authorized, problems can emerge quickly. Key risk areas include state law recording‑consent requirements, privilege and confidentiality obligations, governance controls, and record retention practices, all of which can lead to serious downstream consequences if not addressed through clear policy and oversight.

In “two‑party” or “all‑party” consent jurisdictions, every participant in a conversation must agree before the meeting is recorded or transcribed.² Employees who enable transcription functions without consent may unknowingly violate state law. Some states impose criminal penalties; others allow civil lawsuits. In jurisdictions imposing civil liability, and where company policy does not expressly forbid unauthorized transcription, employers may face vicarious liability if employees act within the scope of their duties. In jurisdictions that recognize corporate criminal liability, an employer may be exposed if, for example, an employee surreptitiously records and transcribes a meeting with an executive of another company.

Unauthorized tools can also jeopardize confidentiality and privilege. When a company contracts directly with a vendor, it can negotiate data‑security and retention terms, deletion rights, confidentiality protections and control over how information is processed. Consumer or free transcription tools do not typically offer these safeguards. Meeting content may be uploaded into large, unbounded language models that learn from user data or store information indefinitely, creating potential waiver of attorney-client privilege, loss of trade‑secret protection, and violation of data‑privacy obligations. Once data enters such systems, the company cannot control its dissemination, access, or downstream use.

From a governance perspective, unauthorized transcription denies the organization the ability to decide strategically when and how meetings are recorded. Recording decisions should be made at the organizational level, not by individual employees, because the decisions determine what becomes part of the corporate record. Without that oversight, the company has no real visibility into what employees are recording or how the resulting transcripts are being managed. When employees record meetings on their own, the company loses the opportunity to review transcripts for accuracy, ensure proper context, and reconcile them with official notes or minutes.

These risks increase in litigation and regulatory matters. Data stored outside official retention and discovery channels can lead to production gaps or spoliation concerns, and civil discovery sanctions or even potential obstruction of justice charges if the production is to a government entity and as not maintained.³ Most consumer platforms lack defined retention periods or deletion controls, making it difficult for companies to ensure that unauthorized records comply with established data‑management policies. Investigators or opposing counsel may also compel transcripts directly from employees, bypassing corporate legal oversight and creating conflicting accounts that can undermine privilege and raise credibility questions.

In short, shadow AI undermines a core principle of good governance — the company must maintain control over what is recorded, how it is stored, and how long it is retained. Reestablishing that control is essential to protecting privilege, confidentiality, and compliance.⁴

Taking Control of Shadow AI

Effective management of shadow AI begins with a threshold question: should employees be permitted to use transcription tools at all, and if so, under what circumstances? That decision should be made as part of the company’s broader AI governance framework, led by legal, compliance, and IT‑security functions.

If the company concludes that transcription tools can provide value when properly managed, legal counsel should bring AI usage into the open. Begin by identifying what tools employees already rely on and why. In many cases, employees turn to shadow AI for efficiency, not to evade policy, and that insight should help shape a practical response. Engage directly with business teams to understand where current tools or support fall short and adjust approved solutions to meet those needs.

Once the landscape is understood, select secure, enterprise‑grade transcription tools that satisfy confidentiality, privilege, and record‑keeping requirements and align with the company’s operational needs and regulatory environment. Authorized vendors should offer clear data‑ownership terms, defined retention and deletion rights, and secure environments that prevent company information from being used to train AI models.

Company policies should specify when recordings are permitted and who approves them. Recording decisions should rest with designated personnel, not individual employees; and employees must also understand that each recording is a corporate document subject to consent obligations and document‑hold requirements.

Employee engagement and training are essential. Counsel and compliance teams should make sure employees understand:

• The legal and reputational risks of unauthorized recording or transcription;
• State consent requirements and the potential penalties for non‑compliance;
• How privilege and confidentiality can be lost through unapproved tools; and
• When recording is permitted, who must authorize it, and how to manage resulting data.

Equally important is giving employees functional, approved tools that actually meet their needs. When authorized solutions are efficient and transparent, shadow AI use naturally declines.

If the company decides transcription should not be used, that position must be communicated and reinforced through training. Employees should understand the reasons: unauthorized recordings can violate the law, compromise confidentiality and waive privilege. Technical controls can support enforcement by spotting or blocking prohibited applications, but consistent communication and visible support from leadership are usually more effective at sustaining compliance.

Looking ahead, companies should assume that some shadow AI activity exists. Strong governance depends on visibility and accountability — identifying unauthorized tools, limiting their use, and ensuring data from approved channels is properly managed. Integrating AI oversight into existing compliance and information‑governance programs helps organizations stay in control as technology and business practices continue to evolve.

This article was originally published in on January 7, 2026, and is republished here with permission.

Lawmakers on the state, federal and local levels are taking shots at legislation that is aimed at understanding or regulating the use of artificial intelligence in employment-related decisions.

Employers should know about two of the most recent efforts joining the fray — a bipartisan U.S. Senate bill that would require certain companies to regularly report on personnel decisions affected by AI, and a bipartisan bill in the U.S. House of Representatives that would require human oversight and disclosure of AI tools that are used in employment decisions.

These Senate and House proposals — along with state legislation — potentially clash with the White House’s recent executive order calling for a minimally burdensome national framework for AI regulation.

With the flurry of competing priorities and various takes on regulation, employers must stay on their toes to remain compliant.

At the very least, this means that employers should be able to understand and explain their use of AI — a task that is perhaps easier said than done — and must comply with any applicable state laws while awaiting further direction from the federal government.

The Senate Bill: Quarterly Updates on AI’s Impact on the Workforce

On Nov. 5, Sens. Josh Hawley, R-Mo., and Mark Warner, D-Va., introduced the AI-Related Job Impacts Clarity Act — invoking their belief that we need more transparency about how AI affects the workforce.

To that end, the Senate bill would require covered entities to file quarterly reports to the U.S. Department of Labor identifying how many employees were laid off because their job functions were replaced or automated by AI, how many employees were hired as a result of the employer’s adoption of AI, and how many vacancies the employer chose not to fill for reasons that were substantially related to AI-driven replacement or automation.

Employers would also have to report the number of employees who were retrained due to AI, along with any additional information about AI-related job impacts that the secretary of labor may require.

The Senate bill would require such disclosures from publicly traded companies and the federal government, as well as from some as-yet-unknown universe of companies that are not publicly traded.

For the latter camp, the Senate bill requires regulations, which must be issued within 180 days of passage, to outline which private companies are covered.

The Senate bill calls for the regulations to include categories of companies that are not publicly traded that have a “significant workforce, estimated enterprise value, or employment impact on a regional or national basis,” considering things like employer size, annual revenue and industry classification.

The secretary of labor would be responsible for preparing quarterly and annual reports summarizing the data that is reported by covered entities. The bill does not currently have co-sponsors other than Hawley and Warner, and has been referred to the Senate Committee on Health, Education, Labor and Pensions.

It is unclear how quickly the bill may move through the Senate and then to the House. Even less clear is whether President Donald Trump would approve the Senate bill, given his calls for less state regulation of AI.

What it Would Mean for Employers

While the Senate bill may be far from passage, employers should consider whether they would be positioned to meet its reporting obligations, including the following:

Who is responsible for determining whether AI is substantially affecting personnel decisions, thus potentially requiring reporting under the act? Consider designating a team or point person to be responsible for these assessments in order to embed consistency.

How will an employer determine that AI is substantially affecting personnel decisions? Often, multiple nuanced forces drive layoffs or hiring, and employers will have to assess AI’s potential role among them. While the determination may be clear where a chatbot replaces a human worker, it may be unclear where AI tools are incorporated across multiple employees’ workflows, driving efficiencies over time.

Do the employer’s internal systems allow for tracking whether and how AI is affecting personnel decisions? Solid documentation could be critical to showing compliance.

In sum, employers may wish to proactively assess their decision-making and data hygiene to address whether they can identify and document positions being eliminated or created because of AI, as well as positions requiring additional AI training.

Of course, the complexity of wrangling this information just on an individual employer basis underscores stakeholders’ likely questions about the value of data that is aggregated from a vast number of employers, each with their own interpretation of the Senate bill’s criteria.

The House Bill: Human Oversight and Disclosure of AI Tools in Employment

On the heels of the Senate bill’s push to gather information about employers’ use of AI, a small bipartisan group in Congress introduced a bill that would more directly and sweepingly regulate such use — primarily by mandating human oversight and disclosures to employees, among other requirements.

On Dec. 3, Reps. Suzanne Bonamici, D-Ore., and Chris Deluzio, D-Pa., along with Del. James Moylan, R-Guam, introduced the No Robot Bosses Act of 2025. If passed, the act would apply to employers with 11 or more employees. According to Bonamici, the bill would require, among other things, that employers:

Audit their AI tools for issues like discrimination and bias, both before using them and periodically;

Provide independent, human oversight of information, decisions, predictions or recommendations that are generated by AI tools that the employer uses; and

Disclose to employees the employer’s use of AI tools in employment-related decisions, like hiring, firing, compensation, promotion, scheduling, benefits and others.[1]

The No Robot Bosses Act of 2025 is the latest iteration of similar proposals that were introduced without bipartisan support in 2023 and 2024. But the fate of the 2025 version is also uncertain, particularly given Trump’s critique of arguably similar state legislation.

State Laws Regarding AI

Indeed, multiple jurisdictions — including California, Colorado, Illinois, New York City and Texas — have already passed their own legislation concerning AI’s impact on employment.[2] Broadly speaking, these laws restrict how and when companies may use AI in making employment decisions.

For example, California and Texas prohibit using AI in a way that discriminates against applicants.[3]

Colorado, Illinois and New York City mandate that covered employers notify employees and applicants if they are using AI to make hiring and other employment decisions.[4]

New York City’s AI law goes further, prohibiting employers from using an AI tool if it has not been subject to a specific type of bias audit within one year.[5]

Employers that are subject to these state laws and use AI in their employment processes should carefully evaluate their processes to ensure compliance.

For example, the AI laws in Illinois and Colorado, which take effect in January and June, respectively, will require employers to provide certain notices to employees or applicants about their use of AI. Employers must understand when such disclosures are required and be prepared to provide them.

As another example, employers that are subject to the New York City law must ensure that they are meeting the bias audit requirements for using AI tools in employment.

Further, employers that are seeking remote applicants or employing remote workers should also be aware that while they may not be based in a jurisdiction with an AI law, their recruiting or hiring in such jurisdictions renders them subject to those jurisdictions’ regulations.

The White House’s Executive Order

While federal, state and local lawmakers are busy proposing regulations for AI or regulating employers’ use of it, the White House just issued an executive order criticizing “excessive State regulation” of AI as stifling innovation, and instead calling for “a minimally burdensome national policy framework for AI.”

Specifically, on Dec. 11, the White House issued Executive Order No. 14365, which is aimed at discouraging state-level AI regulations.[6]

The order directs the attorney general to create a dedicated AI litigation task force. Among other things, this unit would be responsible for challenging state-specific AI legislation that is allegedly at odds with national policy objectives.

The order also directs the secretary of commerce to publish a review of state AI laws within 90 days, and to restrict funding to states with AI laws that are deemed objectionable.

The White House’s preference for a minimally burdensome national AI policy appears to conflict with the goals of federal and state lawmakers on both sides of the aisle, whose policies and proposals favor legislation.

For example, the order explicitly critiques Colorado’s ban on algorithmic discrimination, but the No Robot Bosses Act similarly requires AI tools that are used in employment to be validated with respect to the “lack of any potential discriminatory impact” of the tools.

We anticipate that the order will be subject to legal challenges, just as the AI litigation task force that the order contemplates may challenge state AI laws.

In the meantime, though, employers that are subject to state AI laws are bound to comply, absent a court order stating otherwise.

The Bottom Line

The Senate bill detailed above reflects bipartisan interest in understanding how AI is affecting workers. Likewise, the No Robot Bosses Act suggests some in Congress want to place guardrails on employers’ use of AI — as certain states have already.

The passage and final contours of these proposals remain unknown and, particularly given Trump’s pro-AI posture, a lot could change. But employers would nevertheless benefit now from proactively and methodically monitoring both their own usage of AI and staying apprised of updates to federal and state laws.

The authors commentary also appeared in .

[1] .

[2] See, e.g., Cal. Code Reg. tit. 2, § 11008-11097 (2025); Colo. Rev. Stat. § 6-1-1701 (2024); 775 III. Comp. Stat. 5/2-101-110 (2026); N.Y., Admin. Code §§ 20-870 to 20-874; Texas Responsible Artificial Intelligence Governance Act, 89th Leg., R.S., ch. 1174, 2025 Tex. Gen. Laws.

[3] See, e.g., Cal. Code Reg. tit. 2, § 11008-11097 (2025); Texas Responsible Artificial Intelligence Governance Act, 89th Leg., R.S., ch. 1174, 2025 Tex. Gen. Laws.

[4] See, e.g., Colo. Rev. Stat. § 6-1-1701 (2024); 775 III. Comp. Stat. 5/2-101-110 (2026); N.Y., Admin. Code §§ 20-870 – 20-874.

[5] N.Y.C. Admin. Code §§ 20-871. [6]

Artificial intelligence (AI) is rapidly reshaping the digital health sector, driving advances in patient engagement, diagnostics, and operational efficiency. However, for Privacy Officers, AI’s integration into digital health platforms raises critical concerns around compliance with the Health Insurance Portability and Accountability Act and its implementing regulations (HIPAA). As AI tools process vast amounts of protected health information (PHI), digital health companies must carefully navigate privacy, security, and regulatory obligations.

The HIPAA Framework and Digital Health AI

HIPAA sets national standards for safeguarding PHI. Digital health platforms—whether offering AI-driven telehealth, remote monitoring, or patient portals—are often HIPAA covered entities, business associates, or both. Accordingly, AI systems that process PHI must be able to do so in compliance with the HIPAA Privacy Rule and Security Rule, making it vital for Privacy Officers to understand:

• Permissible Purposes: AI tools can only access, use, and disclose PHI as permitted by HIPAA. The introduction of AI does not change the traditional HIPAA rules on permissible uses and disclosures of PHI.
• Minimum Necessary Standard: AI tools must be designed to access and use only the PHI strictly necessary for their purpose, even though AI models often seek comprehensive datasets to optimize performance.
• De-identification: AI models frequently rely on de-identified data, but digital health companies must ensure that de-identification meets HIPAA’s Safe Harbor or Expert Determination standards—and guard against re-identification risks when datasets are combined.
• BAAs with AI Vendors: Any AI vendor processing PHI must be under a robust Business Associate Agreement (BAA) that outlines permissible data use and safeguards—such contractual terms will be key to digital health partnerships.

AI Privacy Challenges in Digital Health

AI’s transformative capabilities introduce specific risks:

• Generative AI Risks: Tools like chatbots or virtual assistants may collect PHI in ways that raise unauthorized disclosure concerns, especially if the tools were not designed to safeguard PHI in compliance with HIPAA.
• Black Box Models: Digital health AI often lacks transparency, complicating audits and making it difficult for Privacy Officers to validate how PHI is used.
• Bias and Health Equity: AI may perpetuate existing biases in health care data, leading to inequitable care—a growing compliance focus for regulators.

Actionable Best Practices

To stay compliant, Privacy Officers should:

1. Conduct AI-Specific Risk Analyses: Tailor risk analyses to address AI’s dynamic data flows, training processes, and access points.
2. Enhance Vendor Oversight: Regularly audit AI vendors for HIPAA compliance and consider including AI-specific clauses in BAAs where appropriate.
3. Build Transparency: Push for explainability in AI outputs and maintain detailed records of data handling and AI logic.
4. Train Staff: Educate teams on which AI models may be used in the organization, as well as the privacy implications of AI, especially around generative tools and patient-facing technologies.
5. Monitor Regulatory Trends: Track OCR guidance, FTC actions, and rapidly evolving state privacy laws relevant to AI in digital health.

Looking Ahead

As digital health innovation accelerates, regulators are signaling greater scrutiny of AI’s role in health care privacy. While HIPAA’s core rules remain unchanged, Privacy Officers should expect new guidance and evolving enforcement priorities. Proactively embedding privacy by design into AI solutions—and fostering a culture of continuous compliance—will position digital health companies to innovate responsibly while maintaining patient trust.

AI is a powerful enabler in digital health, but it amplifies privacy challenges. By aligning AI practices with HIPAA, conducting vigilant oversight, and anticipating regulatory developments, Privacy Officers can safeguard sensitive information and promote compliance and innovation in the next era of digital health. Health care data privacy continues to rapidly evolve, and thus HIPAA-regulated entities should closely monitor any new developments and continue to take necessary steps towards compliance. Please reach out to the authors, your Â鶹ֱ˛Ą relationship partner, to our Artificial Intelligence Area of Focus and Health Care & Life Sciences Sector with any questions.

Quantum computing has the potential to revolutionize various fields, but practical deployments capable of solving real-world problems face significant headwinds due to the fragile nature of quantum systems. Qubits, the fundamental units of quantum information, are inherently unstable and susceptible to decoherence—a process by which interactions with the environment cause them to lose their quantum properties. External noise from thermal fluctuations, vibrations, or electromagnetic fields exacerbates this instability, necessitating extreme isolation and control, often achieved by maintaining qubits at ultra-low temperatures. Preserving quantum coherence long enough to perform meaningful computations remains one of the most formidable obstacles, particularly as systems scale.

Another major challenge is ensuring the accuracy and reliability of quantum operations, or “gates.” Quantum gates must manipulate qubits with extraordinary precision, yet hardware imperfections introduce errors that accumulate over time, jeopardizing the integrity of computations. While quantum error correction techniques offer potential solutions, they demand enormous computational resources, dramatically increasing hardware requirements. These physical and technical limitations present fundamental hurdles to building scalable, practical quantum computers.

The Intersection With Neural Networks

One promising approach to mitigating these issues lies in the unexpected ability of classical neural networks to approximate quantum states. As discussed in (Yang et al., 2024), certain neural network architectures—such as recurrent neural networks (RNNs) and convolutional neural networks (CNNs)—can be trained to exhibit quantum properties. This insight suggests that instead of relying entirely on fragile physical qubits, classical neural networks could serve as an intermediary computational layer, learning and simulating quantum behaviors in ways that reduce the burden on quantum processors. Yang further proposes that classical deep learning models may be able to efficiently learn and encode quantum correlations, allowing them to predict and correct errors dynamically, thereby improving fault tolerance without the need for excessive physical qubits.

Neural networks capable of representing quantum states could also enable new forms of hybrid computing. Instead of viewing artificial intelligence (AI) and quantum computing as separate domains, recent research suggests a future where they complement one another. Classical AI models could handle optimization, control, and data preprocessing, while quantum systems tackle computationally intractable problems.

Ultimately, the interplay between quantum mechanics and AI will most likely reshape our approach to computation. While quantum computers remain in their infancy, AI could provide a bridge to unlock their potential. By harnessing classical neural networks to mimic quantum properties, the scientific community may overcome the current limitations of quantum hardware and accelerate the development of practical, scalable quantum systems. The boundary between classical and quantum computation may not be as rigid as once thought.

The U.S. Copyright Office’s long-awaited assessing the issues raised by artificial intelligence (AI) makes clear that purely AI generated works cannot be copyrighted, and the copyrightability of AI-assisted works depends on the level of human creative authorship integrated into the work.

With the rise of mainstream generative AI platforms, clarity has been sought by creators, artists, producers, and technology companies concerning whether works created with AI may be entitled to copyright protection. In its most recent report, the Copyright Office concludes that existing copyright legislation and principles are well-suited for the issue of AI outputs’ copyrightability and suggests that AI may be used in the creation of copyrighted works as long as there is the requisite level of human creative expression. The Copyright Office’s report also makes clear that copyright protection will not extend to purely computer-generated works. Instead, copyrightability must be assessed on a case-by-case basis analyzing whether a work has the necessary human creative expression and originality to be copyrightable. Such intensive analysis equips existing U.S. copyright law to adapt to works made with emerging technologies.

In the process of crafting the report, the Copyright Office considered input from over 10,000 stakeholders seeking clarity on the protection of works for licensing and infringement purposes. This report does not address issues relating to fair use in training AI systems or copyright liability associated with the use of AI systems; these topics are expected to be covered in separate publications.

Report on Copyrightability of AI Outputs

The Copyright Office’s report examines the threshold question of copyrightability, or whether a work can be protected and endowed with rights that are enforceable against subsequent copiers, which raises important policy questions on the incentives of copyright law and the history of emerging technologies. Overall, the Copyright Office makes clear that tangential use of AI technology will not disqualify any subsequent work of authorship from protection, but rather the level of protection hinges on the nature and extent of the human expression added to the work.

I. Scope of the Report

The Copyright Office sought to clarify several overarching questions on the copyrightability of AI outputs, including:

• Whether the Copyright Clause of the Constitution protects AI-generated works.
• Whether AI can be the author of a copyright.
• If additional protection for AI generations is recommended, and if so what additions.
• If revisions to the human authorship standard are necessary.

II. The Copyrightability Standard and Current AI Technology

Human Authorship –There is a low level of human creativity or “authorship” needed to create copyright protection in a work, and the Copyright Office believes existing legal frameworks are relevant to the assessment of AI-generated outputs. Specifically, the Copyright Office believes that determining whether the authorship standard for copyrightability has been met depends on the level of human expressive intervention in the work.

For example, a photographer’s arrangement, lighting, timing, and post-production editing are all indications of the human expression required for copyright protection, even though, technologically, the camera “assists” to capture the photo.[1] On the other hand, photos taken by animals do not create authorship in the animal because of their non-human status.[2] Similarly, “divine messages” from alleged spirits do not contain the requisite human creativity to amount to authorship.[3] In the context of AI, like a photographer using a camera, the use of new technology does not default to a lack of authorship, but like a monkey taking a picture, non-human machines cannot be authors and therefore the expressions created solely by AI platforms cannot be copyrighted.

Assistive AI – The report further comments on the incorporation of AI into creative tasks, like aging actors on film, adding or removing objects to a scene, or finding errors in software code, and concludes that protection of works using such technology would depend on how the system is being used by a human author and whether a human’s expression is captured by the resulting work.

Protection of Prompts – The Copyright Office concludes that prompts alone do not form a basis for claiming copyright protection in AI-generated outputs (no matter how complex they may seem), unless the prompt itself involves a copyrightable work. At its core, copyright law does not protect ideas because copyright seeks to promote the free flow of ideas and thought. Rather, copyright law protects unique human expressions of the underlying ideas which are fixed in some tangible medium. The Copyright Office explains that prompts do not provide sufficient human control to make AI-users authors. Instead, prompts function as instructions that reflect a user’s conception of the idea but do not control the expression of that idea. Primarily, gaps between prompts and resulting outputs demonstrate that lack of control a user has in the expression of those ideas.

Expressive Inputs – The Copyright Office uses two examples in its report to illustrate this point. The first prompt, detailing the subject matter and composition of a cat smoking a pipe, was considered uncopyrightable because the AI system fills in the gaps of a user’s prompt. Here, the prompt does not specify the breed or coloring of the cat, its size, the pose, or what clothes it should be wearing underneath the robe. Without these particular instructions in the user’s prompts, the AI system still generated an image based on its own internal algorithm to fill in the gaps, thus stripping away expressive control from the user.

In contrast, the second prompt, asking the AI system to generate a photorealistic graphic of a human-drawn sketch, was considered copyrightable because the original elements of the sketch were retained in the AI-generated output. In assessing copyrightability, the Copyright Office pointed to the copyright in the original elements of the sketch as evidence of authorship, and any output depicting identifiable elements of the sketch (directed by the human author) was viewed by the Office as a derivative work of the sketch’s copyright. The artist’s protection in the AI output would overlap with the protectable elements in the original sketch, and like other derivative rights, the AI output would require a license to the original sketch.

In sum, where a human inputs their own copyrightable work into an AI system, they will be the author of that portion of the work still perceptible in the output; the individual elements must be identifiable and traceable to the initial human expression.

The Copyright Office views the current use of prompts as largely containing unprotectable (or public domain) ideas but notes that extensive human expression could potentially make prompts protectable, just not with currently available technology. Additionally, the Copyright Office notes that current technology is unpredictable and inconsistent, often producing vastly different outputs from the same prompts, which in its view shows that prompts lack the requisite clear direction of expression to rise to the level of human authorship.

Arrangement and Modification of AI Works –The Copyright Office also concludes that human authorship can be shown by the additions to, or arrangement of, AI outputs, including the use of AI adaptive tools. For example, a comic book “illustrated” with AI but with added original text by a human author was granted protection in the arrangement and expression of the images in addition to any copyrightable text because the work is the product of creative human choices. The same reasoning applies to AI generated editing tools which allow users to select and regenerate regions of an image with a modified prompt. Unlike prompts, the use of these tools enables users to control the expression of specific creative elements, but the Copyright Office clarifies that assessing the copyrightability of these modifications depends on a case-by-case determination.

III. International AI Copyright Decisions

In its review of international responses to AI copyright questions, the U.S. Copyright Office notes the general consensus of applying existing human authorship requirements to determine copyrightability of AI works.

from ´ł˛ą±č˛ą˛Ô’s Cultural Counsel underline the case-by-case basis necessary for assessing copyrightability and noted examples of human AI input that may rise to a copyrightable level. These include the number and type of prompts given, the number of attempts to generate the ideal work, selection by the user, and any later changes to the work.

A court in China found that over 150 prompts, along with retouches and modifications to the AI’s output, resulted in sufficient human expression to gain copyright protection.

In the European Union, most member states agree that current copyright policy is equipped to cover the use of AI, and similar to the U.S., most member states require significant human input into the creative process to qualify for copyright protection.

Canada and Australia have both expressed a lack of clarity on the issue of AI, but neither has taken steps to change legislation.

Unlike other countries, some commonwealth jurisdictions like the United Kingdom, India, New Zealand, and Hong Kong enacted laws before modern generative AI allowing for copyright protection for works created entirely by computers. With recent developments in technology, the United Kingdom has considered changing this law, but other countries have yet to clarify whether their existing laws would apply to AI-generated works.

IV. Policy Implications for Additional Protection

Incentives – One of the key components of copyright policy, as written in the U.S. Constitution, is to “promote science and the useful arts.” Comments to the Copyright Office varied on whether providing protection for AI-generated work would incentivize authorship; proponents of increasing copyright protection argued that it would promote emerging technologies, while opponents note the quick expansion of these technologies shows incentivization is not necessary. The Copyright Office finds the current legal framework as sufficiently balanced, stating that additional laws are not needed to incentivize AI creation because the existing threshold requirement of human creativity already protects and incentivizes the works of human authorship that copyright law seeks to promote.

Staying Internationally Competitive – Commentators noted that without underlying copyright protection, U.S. creators would be impacted by weaker protection for AI-generated works. The Copyright Office counters that similar protections are available worldwide and align with the U.S.’s standards of human authorship.

Clarity on AI-Generated Protection – Commentators petitioned Copyright Office officials for some legal certainty that works created with AI could be licensed to other parties and be registered with the Copyright Office. The Copyright Office’s report provides assurance that works made with assistance from AI platforms may be registered under existing copyright laws and notes the difficulty of any further clarity due to the case-by case nature of copyright analysis.

Conclusion and Considerations[4]

The foundations of U.S. copyright law have been applied consistently to emerging technologies, and the Copyright Office believes those doctrines will apply equally well to AI technologies. With the Copyright Office’s affirmation that purely AI-generated works cannot be copyrighted, and that AI-assisted works must involve meaningful human authorship, businesses leveraging AI systems must consider several key legal and strategic factors:

• Maintain detailed records of human prompts and modifications, such as arranging, adapting, or refining AI outputs.
• Focus on enhancing human-made, copyrightable works with AI systems rather than generating works solely through uncopyrightable prompts.
• For companies commissioning AI-assisted work, specify in contracts that employees or contractors provide sufficient human control, arrangement, or modification of AI works to ensure copyrightability.
• For companies offering AI-assisted work as part of their services, consider mitigating risks by excluding AI generated works from standard IP representations/warranties, and further disclaiming any liability in relation to the use of such works.
• Consider variations in international AI copyright laws to assess the impact on global IP strategies.

Given the unique analysis copyright cases require, and the existing precedent requiring human input for protection, copyright law is well prepared to face the challenges posed by AI platforms. Due to the unique facts of each case, creators are encouraged to check with an experienced copyright attorney who can help evaluate whether an individual AI-assisted work includes enough human intervention to be protectable.

---

[1] Burrow-Giles Litho. Co. v. Sarony, 111 U.S. 53, 55–57 (1884).

[2] Naruto v. Slater, No. 15-cv-04324, 2016 U.S. Dist. LEXIS 11041, at *10 (N.D. Cal. Jan. 28, 2016) (finding animals are not “authors” within the meaning of the Copyright Act).

[3] Urantia Found. v. Kristen Maaherra, 114 F.3d 955, 957–59 (9th Cir. 1997) (holding that copyright law does not intend to protect divine beings, and protects the arrangement of otherworldly messages, but not the messages’ content).

[4] As noted above, the Copyright Office’s report does not address issues relating to fair use in training AI systems or copyright liability associated with the use of AI systems; these topics are expected to be covered in a separate publication.

Artificial intelligence (AI) is increasingly being integrated into health care operations, from administrative functions such as scheduling and billing to clinical decision-making, including diagnosis and treatment recommendations. Although AI offers significant benefits, concerns regarding bias, transparency, and accountability have prompted regulatory responses. Colorado’s Artificial Intelligence Act (the Act), set to take effect on February 1, 2026, imposes governance and disclosure requirements on entities deploying high-risk AI systems, particularly those involved in consequential decisions affecting health care services and other critical areas.

Given the Act’s broad applicability, including its potential extraterritorial reach for entities conducting business in Colorado, health care providers must proactively assess their AI utilization and prepare for compliance with forthcoming regulations. Below, we discuss the intent of the Act, what types of AI it applies to, future regulation, potential impact on providers, statutory compliance requirements, and enforcement mechanisms.

1. What Is the Act Trying to Protect Against?

The Act primarily seeks to mitigate algorithmic discrimination, defined as AI-driven decision-making that results in unlawful differential treatment or disparate impact on individuals based on certain characteristics, such as race, disability, age, or language proficiency. The Act seeks to prevent AI from reinforcing existing biases or making decisions that unfairly disadvantage particular groups.

Examples of Algorithmic Discrimination in Health Care

• Access to Care Issues: AI-powered phone scheduling systems may fail to recognize certain accents or accurately process non-English speakers, making it more difficult for non-native English speakers to schedule medical appointments.
• Biased Diagnostic Tools and Treatment Recommendations: Some AI diagnostic tools may recommend different treatments for patients of different ethnicities, not because of medical evidence but due to biases in the training data. For instance, an AI model trained primarily on data from white patients might miss early signs of disease that present differently in Black or Hispanic patients, resulting in inaccurate or less effective treatment recommendations for historically marginalized populations.
• By targeting these and other AI-driven inequities, the Act aims to ensure automated systems do not reinforce or exacerbate existing disparities in health care access and outcomes.

2. What Types of AI Are Addressed by the Act?

The Act applies broadly to businesses using AI to interact with or make decisions about Colorado residents. Although certain high-risk AI systems — those that play a substantial factor in making consequential decisions — are subject to more stringent requirements, the Act imposes obligations on most AI systems used in health care.

Key Definitions in the Act

• “Artificial Intelligence System” means any machine-based system that generates outputs — such as decisions, predictions, or recommendations — that can influence real-world environments.
• “Consequential Decision” means a decision that materially affects a consumer’s access to or cost of health care, insurance, or other essential services.
• “High-Risk AI System” means any AI tool that makes or substantially influences a consequential decision.
• “Substantial Factor” means a factor that assists in making a consequential decision or is capable of altering the outcome of a consequential decision and is generated by an AI system.
• “Developers” means creators of AI systems.
• “Deployers” means users of high-risk AI systems.

3. How Can Health Care Providers Ensure Compliance?

Although the Act sets out broad obligations, specific regulations are still forthcoming. The Colorado Attorney General has been tasked with developing rules to clarify compliance requirements. These regulations may address:

• Risk management and compliance frameworks for AI systems.
• Disclosure requirements for AI usage in consumer-facing applications.
• Guidance on evaluating and mitigating algorithmic discrimination.

Health care providers should monitor developments as the regulatory framework evolves to ensure their AI-related practices align with state law.

4. How Could the Act Impact Health Care Operations?

The Act will require health care providers to specifically evaluate how they use AI across various operational areas, as the Act applies broadly to any AI system that influences decision-making. Given AI’s growing role in patient care, administrative functions, and financial operations, health care organizations should anticipate compliance obligations in multiple domains.

Billing and Collections

• AI-driven billing and claims processing systems should be reviewed for potential biases that could disproportionately target specific patient demographics for debt collection efforts.
• Deployers should ensure that their AI systems do not inadvertently create financial barriers for specific patient groups.

Scheduling and Patient Access

• AI-powered scheduling assistants must be designed to accommodate patients with disabilities and limited English proficiency to prevent inadvertent discrimination and delayed access to care.
• Providers must evaluate whether their AI tools prioritize certain patients over others in a way that could be deemed discriminatory.

Clinical Decision-Making and Diagnosis

• AI diagnostic tools must be validated to ensure they do not produce biased outcomes for different demographic groups.
• Health care organizations using AI-assisted triage tools should establish protocols for reviewing AI-generated recommendations to ensure fairness and accuracy.

5. If You Use AI, With What Do You Need to Comply?

The Act establishes different obligations for Developers and Deployers. Health care providers will in most cases be “Deployers” of AI systems as opposed to Developers. Health care providers will want to scrutinize contractual relationships with Developers for appropriate risk allocation and information sharing as providers implement AI tools into their operations.

• Obligations of Developers (AI Vendors)
  • Disclosures to Deployers: Developers must provide transparency about the AI system’s training data, known biases, and intended use cases.
  • Risk Mitigation: Developers must document efforts to minimize algorithmic discrimination.
  • Impact Assessments: Developers must evaluate whether the AI system poses risks of discrimination before deploying it.

• Obligations of Deployers (e.g., Health Care Providers)
  • Duty to Avoid Algorithmic Discrimination
    • Deployers of high-risk AI systems must use reasonable care to protect consumers from known or foreseeable risks of algorithmic discrimination.
  • Risk Management Policy & Program
    • Deployers must implement a risk management policy and program that identifies, documents, and mitigates risks of algorithmic discrimination.
    • The program must be iterative, regularly updated, and aligned with recognized AI risk management frameworks.
    • Requirements vary based on the deployer’s size, complexity, AI system scope, and data sensitivity.
  • Impact Assessments (Regular & Event-Triggered Reviews)
    • Timing Requirements: Deployers must conduct impact assessments:
      • Before deploying any high-risk AI system.
      • At least annually for each deployed high-risk AI system.
      • Within 90 days after any intentional and substantial modification to the AI system.
    • Required Content: Each impact assessment must include the AI system’s purpose, intended use, and benefits, an analysis of risks of algorithmic discrimination and mitigation measures, a description of data processed (inputs, outputs, and any customization data), performance metrics and system limitations, transparency measures (including consumer disclosures), and details on post-deployment monitoring and safeguards.
    • Special Requirements for Modifications: If an impact assessment is conducted due to a substantial modification, it must also include an explanation of how the AI system’s actual use aligned with or deviated from its originally intended purpose.
  • Notifications & Transparency
    • Public Notice: Deployers must publish a statement on their website describing the high-risk AI systems they use and how they manage discrimination risks.
    • Notices to Patients/Employees: Before an AI system makes a consequential decision, individuals must be notified of its use.
    • Post-Decision Explanation: If AI contributes to an adverse decision, deployers must explain its role and allow the individual to appeal or correct inaccurate data.
    • Attorney General Notifications: If AI is found to have caused algorithmic discrimination, deployers must notify the Attorney General within 90 days.

Small deployers (those with fewer than 50 employees) who do not train AI models with their own data are exempt from many of these compliance obligations.

6. How is the Act Enforced?

• Only the Colorado Attorney General has enforcement authority.
• A rebuttable presumption of compliance exists if Deployers follow recognized AI risk management frameworks.
• There is no private right of action, meaning consumers cannot sue directly under the Act.

Health care providers should take early action to assess their AI usage and implement compliance measures.

Final Thoughts: What Health Care Providers Should Do Now

• The Act represents a significant shift in AI regulation, particularly for health care providers who increasingly rely on AI-driven tools for patient care, administrative functions, and financial operations.
• Although the Act aims to enhance transparency and mitigate algorithmic discrimination, it also imposes substantial compliance obligations. Health care organizations will have to assess their AI usage, implement risk management protocols, and maintain detailed documentation.
• Given the evolving regulatory landscape, health care providers should take a proactive approach by auditing existing AI systems, training staff on compliance requirements, and establishing governance frameworks that align with best practices. As rulemaking by the Colorado Attorney General progresses, staying informed about additional regulatory requirements will be critical to ensuring compliance and avoiding enforcement risks.
• Ultimately, the Act reflects a broader trend toward AI regulation that is likely to extend beyond state borders. Health care organizations that invest in AI governance now will not only mitigate legal risks but also maintain patient trust in an increasingly AI-driven industry.
• If health care providers plan to integrate AI systems into their operations, conducting a thorough legal analysis is essential to determine whether the Act applies to their specific use cases. This should also include careful review and negotiation of service agreements with AI Developers to ensure that the provider has sufficient information and cooperation from the Developer to comply with the Act and to properly allocate risk between the parties.

Compliance is not a one-size-fits-all process. It requires careful evaluation of AI tools, their functions, and their potential to influence consequential decisions. Organizations should work closely with legal counsel to navigate the Act’s complexities, implement risk management frameworks, and establish protocols for ongoing compliance. As AI regulations evolve, proactive legal assessment will be crucial to ensuring that health care providers not only meet regulatory requirements but also uphold ethical and equitable AI practices that align with broader industry standards.

Â鶹ֱ˛Ą is here to help you address the short- and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Â鶹ֱ˛Ą relationship partner, our Health Care & Life Sciences Sector, or to our Innovative Technology Sector with any questions.

On January 16, 2025, President Joe Biden signed the “Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity.” This directive seeks to tackle the increasingly complex and evolving cybersecurity threats confronting the United States. From nation-state actors to sophisticated cybercriminal organizations, the U.S. faces unprecedented challenges to its critical infrastructure, government systems, and private sector networks. The executive order outlines a multifaceted strategy aimed at safeguarding the nation’s digital landscape while encouraging innovation and collaboration in cybersecurity technologies.

However, the future of this order has come into question following President Donald Trump’s inauguration on January 20, 2025. President Trump has shown a readiness to reassess policies set by his predecessor, including the potential revocation of previous executive orders. This client alert offers a summary of President Biden’s cybersecurity order, explores potential implications under the Trump administration, and provides guidance for businesses navigating this uncertain regulatory landscape.

Overview of President Biden’s Executive Order

President Biden’s executive order is a comprehensive initiative aimed at addressing the most pressing challenges in cybersecurity. The directive outlines crucial measures that federal agencies, contractors, and private sector partners are required to adopt to enhance their resilience against cyber threats. Key components of the order include:

Development of Minimum Cybersecurity Standards

The order requires the development of baseline cybersecurity standards for federal contractors and suppliers. These standards encompass requirements for multi-factor authentication (MFA), endpoint detection and response (EDR) systems, and the encryption of sensitive data both in transit and at rest. Contractors must demonstrate compliance to secure or maintain government contracts.

Enhanced Public-Private Collaboration

Acknowledging the interconnected nature of the public and private sectors, the order establishes a framework for improved information sharing. Federal agencies are directed to share threat intelligence and vulnerability information with private entities to enable faster responses to emerging threats.

Sanctions on Foreign Cyber Actors

To deter nation-state-sponsored cyberattacks, the executive order allows for sanctions against foreign actors targeting U.S. entities, including critical infrastructure such as health care facilities and energy systems. This provision underscores the administration’s commitment to holding adversaries accountable for malicious cyber activities.

Quantum-Resistant Cryptography

The order prioritizes transitioning federal systems to quantum-resistant cryptographic algorithms to safeguard sensitive data from future quantum computing threats. Agencies are required to develop implementation plans and timelines for this transition.

Artificial Intelligence in Cybersecurity

The executive order calls for pilot programs to investigate the use of artificial intelligence (AI) in cybersecurity applications, particularly in the energy sector. These programs seek to leverage AI for real-time threat detection, automated responses, and enhanced incident recovery.

Potential Impacts Under the Trump Administration

The Trump administration’s approach to cybersecurity remains uncertain, but early signs indicate possible adjustments to Biden’s executive order. Historically, the administration has focused on minimizing regulatory burdens and encouraging industry-led solutions, which may influence the implementation of this directive.

Adjustments to Cybersecurity Standards

The administration may choose to implement less prescriptive cybersecurity requirements, encouraging businesses to adopt voluntary best practices rather than enforceable mandates for federal contractors. This could lead to greater flexibility but might also introduce variability in security practices.

Reevaluation of Quantum-Resistant Cryptography

While quantum-resistant cryptography addresses long-term risks, the administration might prioritize immediate cybersecurity challenges, potentially delaying the transition to quantum-resistant algorithms.

Focus on Targeted Sanctions

The Trump administration may refine its sanctions policy to focus on specific high-impact cases rather than broad deterrence, which could influence the overall effectiveness of this measure.

Shifts in Public-Private Collaboration

Efforts to enhance public-private collaboration may evolve, with businesses potentially taking on a larger role in independently managing cybersecurity risks. This could lessen the emphasis on centralized federal support for information sharing.

Guidance for Companies

In light of these developments, businesses must proactively adapt to an evolving cybersecurity landscape. Regardless of whether the executive order remains in effect, organizations should prioritize cybersecurity to mitigate risks and uphold resilience. Below are suggested actions for companies:

Strengthen Internal Cybersecurity Measures

• Conduct a thorough assessment of existing cybersecurity protocols to identify vulnerabilities and opportunities for enhancement.
• Implement multi-factor authentication (MFA), endpoint detection and response (EDR) tools, and robust encryption practices to protect sensitive data.
• Develop and test incident response plans to ensure rapid recovery from cyber incidents.

Monitor Regulatory Changes

• Stay updated on possible changes to the executive order and associated cybersecurity policies from the Trump administration.
• Engage with legal and compliance teams to assess the effects of regulatory changes on business operations.
• Monitor state and international regulations to ensure compliance with relevant standards.

Invest in Cybersecurity Innovation

• Investigate emerging technologies, such as AI-driven cybersecurity tools, to enhance threat detection and response capabilities.
• Evaluate the feasibility of transitioning to quantum-resistant cryptographic algorithms, even in the absence of federal mandates.
• Collaborate with industry partners to embrace innovative solutions and exchange best practices.

Foster Public-Private Partnerships

• Engage in information-sharing initiatives like the Cybersecurity and Infrastructure Security Agency’s (CISA) programs to remain informed about threat intelligence.
• Promote policies that encourage collaboration between the public and private sectors to strengthen collective security.

Prepare for Geopolitical Risks

• Monitor geopolitical developments and their potential impact on cyber threats, particularly those originating from nation-states.
• Strengthen supply chain security to reduce risks associated with foreign adversaries.
• Conduct tabletop exercises to simulate responses to nation-state cyberattacks.

Implications for the Private Sector

The uncertainty surrounding the executive order underscores the necessity for businesses to adopt a proactive and flexible approach to cybersecurity. Key implications include:

Increased Responsibility on Businesses

With potential adjustments to federal oversight, companies may need to be more proactive in managing their cybersecurity risks. Implementing strong internal policies and investing in advanced security technologies will be crucial.

Fragmented Regulatory Environment

If federal mandates are modified, businesses may face a patchwork of state and international regulations. Navigating this fragmented landscape will demand considerable resources and expertise.

Heightened Cyber Threats

The evolving threat landscape, along with potential policy changes, could make critical infrastructure and private networks more vulnerable to sophisticated attacks. Companies must remain vigilant and prepared to respond to emerging threats.

Competitive Differentiation

Organizations that prioritize cybersecurity and demonstrate a commitment to protecting customer data may gain a competitive advantage in the market. Establishing trust with stakeholders through transparency and robust security measures will be crucial.

Final Thoughts

President Biden’s executive order marks a significant advancement in addressing the nation’s cybersecurity challenges. However, its future under the Trump administration remains uncertain, with the potential for policy adjustments. Businesses must navigate this evolving landscape by bolstering internal measures, staying updated on regulatory shifts, and investing in innovation.

While the federal government’s role in cybersecurity may evolve, the responsibility for safeguarding critical systems and data ultimately rests with the private sector. By implementing proactive strategies and encouraging collaboration, companies can enhance their resilience against cyber threats and contribute to a more secure digital ecosystem.

For additional information about President Biden’s executive order, check out President Biden Issues Second Cybersecurity Executive Order.

On January 20, 2025, President Donald Trump signed an rescinding the 2023 directive issued by former President Joe Biden on artificial intelligence (AI). Biden’s order outlined extensive measures aimed at guiding the development and use of AI technologies, including the establishment of chief AI officers in major federal agencies and frameworks for tackling ethical and security risks. This revocation signals a major policy change, transitioning away from the federal oversight put in place by the previous administration.

The move to revoke Biden’s executive order has led to a climate of regulatory uncertainty for companies operating in AI-driven fields. In the absence of a unified federal framework, businesses could encounter various challenges, such as an inconsistent regulatory landscape as states and international organizations intervene, increased risks related to AI ethics and data privacy, and unfair competition among companies that implement differing standards for AI development and deployment.

Looking Forward

In light of this shift, companies are encouraged to adopt proactive measures to navigate the evolving environment. To uphold trust and accountability, it is essential to bolster internal governance by creating or improving ethical guidelines concerning AI usage. Organizations should also invest in compliance by monitoring state, international, and industry-specific regulations to align with new standards like Colorado’s Artificial Intelligence Act and the EU’s AI Act.

Additionally, staying informed about possible federal policy changes and legislative efforts is crucial, as further announcements may signal new directions in AI governance. Collaborating with industry groups and standards organizations can help shape voluntary guidelines and best practices, while robust risk management frameworks will be essential to mitigate issues such as bias, cybersecurity threats, and liability concerns.

To navigate this evolving landscape, organizations should consider taking the following steps now:

• Strengthen Internal Governance: Develop or enhance internal AI policies and ethical guidelines to promote responsible and legally compliant AI use, even in the absence of federal mandates.
• Invest in Compliance: Stay updated on state, international, and industry-specific AI regulations that could impact operations. Proactively align practices with emerging standards such as Colorado’s Artificial Intelligence Act and the EU’s AI Act.
• Monitor Federal Developments: Keep a close eye on further announcements or legislative actions from Congress and federal agencies that could signal new directions in AI policy and regulation.
• Engage in Industry Collaboration: Collaborate with industry groups and standards organizations to help influence voluntary AI standards and best practices.
• Focus on Risk Management: Establish strong risk assessment frameworks to identify and address potential AI-related risks, including biases, cybersecurity threats, legal compliance, and liability concerns.

President Trump’s decision reflects a preference for less regulation, increasing the responsibility on the private sector to ensure ethical and safe AI usage. Companies need to navigate an uncertain regulatory landscape while innovating responsibly. As circumstances change, businesses must stay alert and flexible to uphold their competitive advantage and public trust.

Fiduciaries should be aware of recent developments involving AI, including emerging and recent state law changes, increased state and federal government interest in regulating AI, and the role of AI in ERISA litigation. While much focus has been on AI’s impact on retirement plans, which we previously discussed here, plan fiduciaries of all types, including health and welfare benefit plans, must also stay informed about recent AI developments.

Recent State Law Changes

Numerous states recently codified new laws focusing on AI, some of which regulate employers’ human resource decision-making processes. Key examples include:

• California – In 2024, California enacted over 10 AI-related laws, addressing topics such as:
  • The use of AI with datasets containing names, addresses, or biometric data;
  • How one communicates health care information to patients using AI; and
  • AI-driven decision-making in medical treatments and prior authorizations.

For additional information on California’s new AI laws, see Â鶹ֱ˛Ąâ€™s Client Alert, Decoding California’s Recent Flurry of AI Laws.

• Illinois – Illinois passed legislation prohibiting employers from using AI in employment activities in ways that lead to discriminatory effects, regardless of intent. Under the law, employers are required to provide notice to employees and applicants if they are going to use AI for any workplace-related purpose.

For additional information on Illinois’ new AI law, see Â鶹ֱ˛Ąâ€™s Client Alert, Illinois Enacts Legislation to Protect against Discriminatory Implications of AI in Employment Activities.

• Colorado – The Colorado Artificial Intelligence Act (CAIA), effective February 1, 2026, mandates “reasonable care” when employers use AI for certain applications.

For additional information on Colorado’s new AI law, see Â鶹ֱ˛Ąâ€™s Client Alert, Regulating Artificial Intelligence in Employment Decision-Making: What’s on the Horizon for 2025.

While these laws do not specifically target employee benefit plans, they reflect a trend toward states regulating human resource practices broadly, are aimed at regulating human resource decision-making processes, and are part of an evolving regulatory environment. Hundreds of additional state bills were proposed in 2024, along with AI-related executive orders, signaling more forthcoming regulation in 2025. Questions remain about how these laws intersect with employee benefit plans and whether federal ERISA preemption could apply to state attempts at regulation.

Recent Federal Government Actions

The federal government recently issued guidance aimed at preventing discrimination in the delivery of certain healthcare services and completed a request for information (RFI) for potential AI regulations involving the financial services industry.

• U.S. Department of Health and Human Services (HHS) Civil Rights AI Nondiscrimination Guidance – HHS, through its Office for Civil Rights (OCR), recently issued a “Dear Colleague” letter titled Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies. This guidance emphasizes the importance of ensuring that the use of AI and other decision-support tools in healthcare complies with federal nondiscrimination laws, particularly under Section 1557 of the Affordable Care Act (Section 1557).

Section 1557 prohibits discrimination on the basis of race, color, national origin, sex, age, or disability in health programs and activities receiving federal financial assistance. OCR’s guidance underscores that healthcare providers, health plans, and other covered entities cannot use AI tools in a way that results in discriminatory impacts on patients. This includes decisions related to diagnosis, treatment, and resource allocation. Employers and plan sponsors should note that this guidance applies to a subset of health plans, including those that fall under Section 1557, but not to all employer-sponsored health plans.

• Treasury Issues RFI for AI Regulation – In 2024, the The RFI included several key considerations, including addressing AI bias and discrimination, consumer protection and data privacy, and risks to third-party users of AI. While the RFI has not yet led to concrete regulations, it underscores federal attention to AI’s impact on financial and employee benefit services. The ERISA Industry Committee, a nonprofit association representing large U.S. employers in their capacity as employee benefit plan sponsors, commented that AI is already being used for retirement readiness applications, chatbots, portfolio management, trade executions, and wellness programs. Future regulations may target these and related areas.

AI-Powered ERISA Litigation

Potential ERISA claims against plan sponsors and fiduciaries are being identified using AI. In just one example, an AI platform, Darrow AI, claims to be:

“designed to simplify the analysis of large volumes of data from plan documents, regulatory filings, and court cases. Our technology pinpoints discrepancies, breaches of fiduciary duty, and other ERISA violations with accuracy. Utilizing our advanced analytics allows you to quickly identify potential claims, assess their financial impact, and build robust cases… you can effectively advocate for employees seeking justice regarding their retirement and health benefits.”

Further, this AI platform claims it can find violations affecting many types of employers, whether a small business or a large corporation, by analyzing diverse data sources, including news, SEC filings, social networks, academic papers, and other third-party sources.

Notably, health and welfare benefit plans are also emerging as areas of focus for AI-powered ERISA litigation. AI tools are used to analyze claims data, provider networks, and administrative decisions, potentially identifying discriminatory practices or inconsistencies in benefit determinations. For example, AI could highlight patterns of bias in prior authorizations or discrepancies in how mental health parity laws are applied.

The increasing sophistication of these tools raises the stakes for fiduciaries, as they must now consider the possibility that potential claimants will use AI to scrutinize their decisions and plan operations with unprecedented precision.

Next Steps for Fiduciaries

To navigate this evolving landscape, fiduciaries should take proactive steps to manage AI-related risks while leveraging the benefits of these technologies:

• Evaluate AI Tools: Undertake a formal evaluation of artificial intelligence tools utilized for plan administration, participant engagement, and compliance. This assessment includes an examination of the algorithms, data sources, and decision-making processes involved, including an assessment to ensure their products have been evaluated for compliance with nondiscrimination standards and do not inadvertently produce biased outcomes.
• Audit Service Providers: Conduct comprehensive audits of plan service providers to evaluate their use of AI. Request detailed disclosures regarding the AI systems in operation, focusing on how they mitigate bias, ensure data security, and comply with applicable regulations.
• Review and Update Policies: Formulate or revise internal policies and governance frameworks to monitor the utilization of AI in operational planning and compliance with nondiscrimination laws. These policies should outline guidelines pertaining to the adoption, monitoring, and compliance of AI technologies, thereby ensuring alignment with fiduciary responsibilities.
• Enhance Risk Mitigation:
  • Fiduciary Liability Insurance: Consider obtaining or enhancing fiduciary liability insurance to address potential claims arising from the use of AI.
  • Data Privacy and Security: Enhance data privacy and security measures to safeguard sensitive participant information processed by AI tools.
  • Bias Mitigation: Establish procedures to regularly test and validate AI tools for bias, ensuring compliance with anti-discrimination laws.
• Integrate AI Considerations into Requests for Proposals (RFPs): When selecting vendors, include specific AI-related criteria in RFPs. This may require vendors to demonstrate or certify compliance with state and federal regulations and adhere to industry best practices for AI usage.
• Monitor Legal and Regulatory Developments: Stay informed about new state and federal AI regulations, along with the developing case law related to AI and ERISA litigation. Establish a process for routine legal reviews to assess how these developments impact plan operations.
• Provide Training: Educate fiduciaries, administrators, and relevant staff on the potential risks and benefits of AI in plan administration, emerging technologies and the importance of compliance with applicable laws. The training should provide an overview of legal obligations, best practices for implementing AI, and strategies for mitigating risks.
• Document Due Diligence: Maintain comprehensive documentation of all steps to assess and track AI tools. This includes records of audits, vendor communications, and updates to internal policies. Clear documentation can act as a crucial defense in the event of litigation.
• Assess Applicability of Section 1557 to Your Plan: Health and welfare plan fiduciaries should determine whether your organization’s health plan is subject to Section 1557 and whether OCR’s guidance directly applies to your operations, and if not, confirm and document why not.

Fiduciaries must remain vigilant regarding AI’s increasing role in employee benefit plans, particularly amid regulatory uncertainty. Taking proactive measures and adopting robust risk management strategies can help mitigate risks and ensure compliance with current and anticipated legal standards. By dedicating themselves to diligence and transparency, fiduciaries can leverage the benefits of AI while safeguarding the interests of plan participants. At Â鶹ֱ˛Ą & Lardner LLP, we have experts in AI, retirement planning, cybersecurity, labor and employment, finance, fintech, regulatory matters, healthcare, and ERISA. They regularly advise fiduciaries on potential risks and liabilities related to these and other AI-related issues.

On January 6, 2025, the U.S. Food and Drug Administration (FDA) released draft guidance titled (“guidance”) explaining the types of information that the agency may seek during drug evaluation. In particular, the guidance outlines a risk framework based on a “context of use” of Artificial Intelligence (AI) technology and details the information that might be requested (or required) relating to AI technologies, the data used to train the technologies, and governance around the technologies, in order to approve their use. At a high level, the guidance underscores the FDA’s goals for establishing AI model credibility within the context of use.

This article provides an overview of the guidance, including example contexts of use and detailing the risk framework, while explaining how these relate to establishing AI model credibility through the suggested data and model-related disclosures. It further details legal strategy considerations, along with opportunities for innovation, that arise from the guidance. These considerations will be valuable to sponsors (i.e., of clinical investigations, such as Investigational New Drug Exemption applications), along with AI model developers and other firms in the drug development landscape.

Defining the Question of Interest

The first step in the guidance’s framework is defining the “question of interest:” the specific question, decision, or concern being addressed by the AI model. For example, questions of interest could involve the use of AI technology in human clinical trials, such as inclusion and exclusion criteria for the selection of participants, risk classification of participants, or determining procedures relating to clinical outcome measures of interest. Questions of interest could also relate to the use of AI technology in drug manufacturing processes, such as for quality control.

Contexts of Use

The guidance next establishes contexts of use – the specific scope and role of an AI model for addressing the question of interest – as a starting point for understanding any risks associated with the AI model, and in turn how credibility might be established.

The guidance emphasizes that it is limited to AI models (including for drug discovery) that impact patient safety, drug quality, or reliability of results from nonclinical or clinical studies. As such, firms that use AI models for discovering drugs but rely on more traditional processes to address factors that the FDA considers for approving a drug such as safety, quality, and stability, should be aware of the underlying principles of the guidance but might not need to modify their current AI governance. An important factor in defining the contexts of use is how much of a role the AI model plays relative to other automated or human-supervised processes; for example, processes in which a person is provided AI outputs for verification will be different from those that are designed to be fully automated.

Several types of contexts of use are introduced in the guidance, including:

1. Clinical trial design and management
2. Evaluating patients
3. Adjudicating endpoints
4. Analyzing clinical trial data
5. Digital health technologies for drug development
6. Pharmacovigilance
7. Pharmaceutical manufacturingGenerating real-world evidence (RWE)
8. Life cycle maintenance

Risk Framework for Determining Information Disclosure Degree

The guidance proposes that the risk level posed by the AI model dictates the extent and depth of information that must be disclosed about the AI model. The risk is determined based on two factors: 1) how much the AI model will influence decision-making (model influence risk), and 2) the consequences of the decision, such as patient safety risks (decision consequence risk).

For high-risk AI models—where outputs could impact patient safety or drug quality—comprehensive details regarding the AI model’s architecture, data sources, training methodologies, validation processes, and performance metrics may have to be submitted for FDA evaluation. Conversely, the required disclosure may be less detailed for AI models posing low risk. This tiered approach promotes credibility and avoids unnecessary disclosure burdens for lower-risk scenarios.

However, most AI models within the scope of this guidance will likely be considered high risk because they are being used for clinical trial management or drug manufacturing, so stakeholders should be prepared to disclose extensive information about an AI model used to support decision-making. Sponsors that use traditional (non-AI) methods to develop their drug products are required to submit complete nonclinical, clinical, and chemistry manufacturing and controls to support FDA review and ultimate approval of a New Drug Application. Those sponsors using AI models are required to submit the identical information, but in addition, are required to provide information on the AI model as outlined below.

High-Level Overview of Guidelines for Compliance Depending on Context of Use

The guidance further provides a detailed outline of steps to pursue in order to establish credibility of an AI model, given its context of use. The steps include describing: (1) the model, (2) the data used to develop the model, (3) model training, (4) and model evaluation, including test data, performance metrics, and reliability concerns such as bias, quality assurance, and code error management. Sponsors may be expected to be more detailed in disclosures as the risks associated with these steps increase, particularly where the impact on trial participants and/or patients increase.

In addition, the FDA specifically emphasizes special consideration for life cycle maintenance of the credibility of AI model outputs. For example, as the inputs to or deployment of a given AI model changes, there may be a need to reevaluate the model’s performance (and thus provide corresponding disclosures to support continued credibility).

Intellectual Property Considerations

Patent vs. Trade Secret

Stakeholders should carefully consider patenting the innovations underlying AI models used for decision-making. The FDA’s extensive requirements for transparency and submitting information about AI model architectures, training data, evaluation processes, and life cycle maintenance plans would pose a significant challenge for maintaining these innovations as trade secrets.

That said, trade secret protection of at least some aspects of AI models is an option when the AI model does not have to be disclosed. If the AI model is used for drug discovery or operations that do not impact patient safety or drug quality, it may be possible to keep the AI model or its training data secret. However, AI models used for decision-making will be subject to the FDA’s need for transparency and information disclosure that will likely jeopardize trade secret protection. By securing patent protection on the AI models, stakeholders can safeguard their intellectual property while satisfying FDA’s transparency requirements.

Opportunities for Innovation

The guidance requires rigorous risk assessments, data fitness standards, and model validation processes, which will set the stage for the creation of tools and systems to meet these demands. As noted above, innovative approaches for managing and validating AI models used for decision-making are not good candidates for trade secret protection, and stakeholders should ensure early identification and patenting of these inventions.

We have identified specific opportunities for AI innovation that are likely to be driven by FDA demands reflected in the guidance:

• Requirements for transparency
  1. Designing AI models with explainable AI capabilities that demonstrate how decisions or predictions are made
  1. Bias and fitness of data
     1. Systems for detecting bias in training data
     1. Systems for correcting bias in training data
  1. Systems for monitoring life cycle maintenance
     1. Systems to detect data drift or changes in the AI model during life cycle of the drug
     1. Systems to retrain or revalidate the AI model as needed because of data drift
     1. Automated systems for tracking model performance
  1. Testing methods
     1. Developing models that can be tested against independent data sets and conditions to demonstrate generalizability
  1. Integration of AI models in a practical workflow
     1. Good Manufacturing Practices
     1. Clinical decision support systems
  • Documentation systems
    1. Automatic systems to generate reports of model development, evaluation, updates, and credibility assessments that can be submitted to FDA to meet regulatory requirements

The guidance provides numerous opportunities for innovations to enhance AI credibility, transparency, and regulatory compliance across the drug product life cycle. As demonstrated above, the challenges that the FDA seeks to address in order to validate AI use in drug development clearly map to potential innovations. Such innovations are likely valuable since they are needed to comply with FDA guidelines and offer significant opportunities for developing a competitive patent portfolio.

Conclusion

With this guidance, the FDA has proposed guidelines for establishing credibility in AI models that have risks for and impacts on clinical trial participants and patients. This guidance, while in draft, non-binding form, follows a step-by-step framework from defining the question of interest and establishing the context of use of the AI model to evaluating risks and in turn establishing the scope of disclosure that may be relevant. The guidance sets out the FDA’s most current thinking about the use of AI in drug development. Given such a framework and the corresponding level of disclosure that can be expected, sponsors may consider a shift in strategy towards using more patent protection for their innovations. Similarly, there may be more opportunities for identifying and protecting innovations associated with building governance around these models.

In addition to using IP protection as a backstop to greater disclosure, firms can also consider introducing more operational controls to mitigate the risks associated with AI model use and thus reduce their disclosure burden. For example, firms may consider supporting AI model credibility with other evidence sources, as well as integrating greater human engagement and oversight into their processes.

In meantime, sponsors that are uncertain about how their AI model usage might interact with future FDA requirements should consider the engagement options that the FDA has outlined for their specific context of use.

Comments on the draft guidance can be or mailed before April 7, 2025, and our team is available to assist interested stakeholders with drafting.

Â鶹ֱ˛Ą is here to help you address the short- and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Â鶹ֱ˛Ą relationship partner, our Health Care & Life Sciences Sector, or to our Innovative Technology Sector with any questions.