Autonomy started with cars. The same perception, decision, simulation, and control challenges now apply across robots, drones, and AI-enabled machines operating in the physical world. Understanding the taxonomy of these inventions is the first step toward protecting them.

The Original AV Patent Taxonomy: Where It Started

The self-driving vehicle industry has always been, at its core, a patent story. Every autonomous vehicle on the road today represents the convergence of hundreds (sometimes thousands) of patented inventions working together. In 2019, the European Patent Office mapped this innovation landscape in a comprehensive study, Patents and Self-Driving Vehicles, identifying and categorizing every major technology subsector required to make a car drive itself. While the study focused on European filings, its taxonomy has become a globally recognized framework, and one that is directly relevant to U.S. patent practitioners and companies building patent portfolios at the USPTO.

The taxonomy broke the self-driving technology stack into four principal layers:

1. Perception & Sensing: lidar, radar, cameras, and ultrasonic sensors (the system’s “eyes”) that detect and interpret the physical environment;
2. Communication: vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) data exchange that allows the system to “see” beyond its own sensors;
3. Data Processing & AI: the onboard computing and machine learning that make sense of all that sensor data in real time; and
4. Vehicle Control: the path planning, steering, and braking systems that translate decisions into physical action.

For U.S. companies, these layers map directly to the types of utility patent applications filed daily at the USPTO, and to the claim drafting challenges that patent practitioners navigate under Alice and Section 101.

That technology taxonomy is complemented by the SAE J3016 standard, the most widely cited classification system in the industry and one routinely referenced by U.S. regulators, courts, and patent examiners. SAE J3016 defines six levels of driving automation, from Level 0 (no automation; a conventional car) through Level 5 (full automation, where no human driver is needed, anywhere, anytime). The critical dividing line sits between Level 2 and Level 3. At Levels 1 and 2 (think adaptive cruise control, lane-keeping assist), the human driver remains in charge of monitoring the road. At Levels 3 through 5, the automated driving system itself takes over the entire driving task (perceiving, deciding, and acting) within its defined operating conditions.

Why does this matter for patent strategy? Because the level of automation directly correlates with the density and complexity of patentable innovation. The jump from Level 2 to Level 3 is where the truly novel inventions live, and where U.S. patent filings have surged. This layered classification gave patent practitioners, investors, and business leaders a shared vocabulary for identifying where innovation was occurring and where patent protection could be most strategically deployed.

What the Patent Landscape Says Now

The patent landscape for transportation innovation has changed dramatically since 2019, and the data are striking. WIPO’s Technology Trends 2025: Future of Transportation report found that over 1.1 million patent families related to the future of transportation were published between 2000 and 2023, growing at a compound annual growth rate of 11%. To put that in perspective, traditional transportation technologies grew at only 4% over the same period. The report identified two driving megatrends (Sustainability and Digitalization) and organized the patent landscape into four technology trend clusters: Sustainable Propulsion, Automation and Circularity, Communication and Security, and Human-Machine Interface.

Notably, land transport patents dominate, with over 3.5 times the number of patents compared to sea, air, and space transport modalities combined. The top five inventor locations (China, Japan, the United States, the Republic of Korea, and Germany) account for over 90% of all inventions. These data points confirm that the original AV innovation ecosystem has matured, but they also reveal something equally important: the same digitalization technologies (communication, security, automation) that drive autonomous vehicle innovation are now being deployed across every mode of transportation and every category of autonomous physical system.

This trend is global. At the EPO, AI-related inventions and battery technologies were identified as key growth areas in 2024. At the USPTO, autonomous driving and AI patent filings have grown exponentially, with top assignees including not only traditional automakers (Ford, GM, Toyota) but also technology companies (Waymo, NVIDIA, Baidu). The convergence of AI, sensor fusion, and physical control systems is not slowing; if anything, the patent data suggest it is accelerating and broadening. The United States remains one of the most active and strategically important filing jurisdictions.

The Physical AI Expansion

The term “physical AI” has emerged as the unifying concept for this broadening. At CES 2026, NVIDIA CEO Jensen Huang described the moment as “the ChatGPT moment for physical AI—when machines begin to understand, reason and act in the real world.” Physical AI in this context refers to AI systems that perceive, reason, and act in real-world environments, enabling machines to anticipate behavior rather than simply react to it. At GTC 2026, NVIDIA announced major expansions to its physical AI platform spanning autonomous vehicles, industrial robots (through partnerships with FANUC and ABB), and humanoid robotics foundation models.

This is not merely a rebranding exercise. The underlying technical challenges are structurally identical to those mapped by the EPO’s original AV taxonomy. Consider the parallels:

AV Technology Layer (EPO 2019)	Physical AI Equivalent (2026)
Perception & Sensing (lidar, radar, cameras)	Multimodal perception for robots, drones, surgical systems
Communication (V2V, V2X)	Multi-agent coordination, swarm protocols, fleet messaging
Data Processing & AI (onboard ML, decision-making)	Edge inference, world models, sim-to-real transfer
Vehicle Control (path planning, actuation)	Manipulation, locomotion, multi-DOF control loops
Simulation & Testing (scenario generation)	Digital twins, hardware-in-the-loop, synthetic data
Safety & Redundancy (fault detection, fail-safe)	Runtime monitoring, formal verification, FDIR systems

The taxonomy that began with self-driving vehicles now applies to warehouse robots navigating dynamic environments, surgical systems performing precision manipulation, agricultural drones adapting to weather and terrain, defense platforms coordinating in contested airspace, and humanoid robots interacting with humans in unstructured settings. In each case, the same fundamental engineering questions arise: how does the system perceive its environment, how does it decide what to do, how does it execute that decision in the physical world, and how does it fail safely when something goes wrong?

From Taxonomy to Strategy

Understanding this expanded taxonomy is not an academic exercise. It is the predicate for any meaningful IP strategy in the autonomous systems space. A company developing autonomous warehouse robots, for example, must identify which layers of the technology stack contain its most competitively differentiated innovations. Is the company’s advantage in its perception pipeline (sensor fusion, object detection)? In its control algorithms (grasping, navigation in dynamic environments)? In its simulation infrastructure (digital twins, scenario generation for safety validation)? Or in its data pipeline (proprietary labeling, active learning, federated fleet data)?

Each layer presents distinct considerations for patentability, for the trade-off between patent disclosure and trade secrecy, and for where and when to file. In the United States, AI-related claims must be drafted with particular care to satisfy the post-Alice eligibility framework under 35 U.S.C. § 101. The good news for autonomous systems companies is that claims tying AI innovations to concrete physical-world improvements (such as better sensor accuracy, faster real-time control, or reduced computational load for edge processing) tend to fare well under the USPTO’s 2024 guidance on AI subject matter eligibility. The key is connecting the software innovation to a specific, technical improvement in how the machine operates in the real world. Internationally, the EPO, China, Japan, and South Korea each apply different (and in some cases more permissive) eligibility frameworks for AI-related inventions, which creates opportunities for companies building global portfolios.

The taxonomy also informs defensive strategy. As WIPO’s data confirm, the transportation patent landscape is heavily concentrated among a small number of jurisdictions and companies. Companies entering adjacent physical AI markets (robotics, drones, agtech, defense) should anticipate that incumbent AV patent holders may assert their portfolios broadly, particularly where claim language is drafted at a level of abstraction that captures perception, planning, and control innovations regardless of the specific physical platform.

Setting the Stage

The expansion of the autonomy taxonomy from vehicles to physical AI systems has a straightforward implication for companies, investors, and IP leaders: the playbook that AV startups developed for patent strategy between 2015 and 2022 must now be generalized. What to patent, where to file, and how to align IP activity with product development and funding milestones are questions that every autonomous systems company must answer deliberately and early.

In our next article, we will address exactly that: a comprehensive IP strategy framework for autonomous systems companies, covering the protection of proprietary competitive information, IP ownership considerations, a detailed taxonomy of patentable subject matter across the full autonomous systems stack, jurisdictional filing strategy, and the alignment of patent filings with product and funding milestones. The taxonomy established here (perception, AI/ML, control, edge computing, simulation, safety, human-machine interface, fleet management, and data infrastructure) provides the foundation on which that strategy is built.

For autonomous systems companies, the first strategic question is not “should we file patents?” It is “do we understand which layers of the autonomy stack contain our defensible innovation, and are we protecting them deliberately?” The answer requires a taxonomy. The rest requires a strategy.

DISCLAIMER: The information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

Chicago has become the latest city to push back against new data center development. On August 11, 2026, Chicago Mayor Brandon Johnson signed Executive Order 2026-5, titled “Protecting Chicagoans’ Clean Water, Clean Air, Energy Affordability, and Quality of Life.” The Order establishes an enhanced regulatory framework for data center development in Chicago. In the Order, the Mayor calls on the City Council to enact a temporary moratorium on new data center construction and material expansions of existing facilities.

Key Takeaways from the Order

• Immediate Regulatory Action: Within 90 days of the Order’s effective date (approximately November 9, 2026, subject to potential extension by the Mayor), the Chief Sustainability Officer (CSO) must publish data center air pollution rules and noise rules under Section 8-32-090 of the Municipal Code. New air permit conditions will be addressed through annual certificates of operation.
• Moratorium Request: The Mayor has called on City Council to enact a temporary moratorium on new data center development and material expansion.
• Task Force Recommendations Due March 2027: The Data Center Task Force will develop comprehensive regulatory recommendations, including proposed Municipal Code amendments, by March 15, 2027.

Provisions of Executive Order 2026-5

• Sections 1 and 2 (Air Pollution and Noise Control): The CSO may impose conditions on air pollution control permits for regulated data center equipment and areas, and must review the noise framework under Section 8-32-090 of the Municipal Code. Within 90 days of the Order’s effective date (approximately November 9, 2026, subject to extension by the Mayor), the CSO must publish air pollution and noise rules through the applicable public notice process. Compliance with new air permit conditions will be addressed in annual certificate of operation applications under Section 11-4-660 of the Municipal Code.

• Section 3 (Enhanced Planned Development Review): For every proposed Planned Development that includes a data center, the Department of Planning and Development (DPD) must notify the Commissioners of Buildings, Business Affairs and Consumer Protection, Environment, and Water Management. Each has 60 days to provide written recommendations and proposed conditions, which DPD must include in any proposed Planned Development ordinance submitted to City Council. The review must consider projected electricity demand, water consumption, emergency and backup power generation, air emissions, noise impacts, cumulative environmental impacts, transportation impacts, emergency response capacity, and impacts on neighboring communities. Section 3 automatically rescinds when a City Council ordinance establishing a temporary moratorium on new data centers or material expansions becomes effective.

• Section 4 (Data Center Task Force): The Interdepartmental Data Center Environment and Community Protection Task Force (Data Center Task Force) is co-chaired by the CSO and the Mayor’s Chief of Police and includes representatives from Building, Environment, Planning and Development, Technology and Innovation, and Water Management, plus other designated City personnel. It will evaluate and, where appropriate, implement the Sustainable Data Centers Working Group’s recommendations, engage residents, subject-matter experts, and stakeholders, and provide recommendations and proposed Municipal Code amendments and rules to the Mayor by March 15, 2027 (or another date approved by the Mayor consistent with any moratorium timing), addressing permitting, impact controls, licensing, zoning, and reporting.

What does this mean to you?

Existing operators: Review current air pollution permits and prepare for new conditions at the next annual certificate of operation renewal.

If you have pending PD projects: Projects awaiting final City Council approval should expect enhanced cross-departmental review and possible delays if a moratorium is enacted.

As demand for artificial intelligence infrastructure continues to accelerate, policymakers are increasingly grappling with the impact of large-scale data center development on local communities, energy resources, and economic policy. New York has now become the first state in the nation to enact a statewide moratorium on certain AI data center development projects—marking a significant departure from the local and municipal restrictions that have characterized regulatory responses to date.

While the immediate impact on nationwide data center growth may be limited, the move could signal a broader shift in how states approach the rapid expansion of AI infrastructure.

A First-of-Its-Kind Statewide Action

Historically, efforts to slow or pause data center growth have occurred at the municipal or county level, often driven by local concerns surrounding energy consumption, land use, water resources, and community impact. New York’s action is notable because it represents the first statewide moratorium of its kind.

The development bears close watching as several other states—including Minnesota, Michigan, Pennsylvania, South Carolina, New Hampshire, and Virginia—are considering legislation that could impose similar restrictions on future data center projects. If additional states follow suit, New York’s decision could become the beginning of a broader regulatory trend rather than an isolated event.

Limited Immediate Impact, Significant Long-Term Implications

Despite the attention surrounding the moratorium, New York has not been among the most active markets for new hyperscale data center development in recent years. As a result, the direct effect on overall U.S. data center growth may be relatively modest.

Nevertheless, industry participants—from hyperscalers and AI firms to developers and investors—are likely viewing the development as an important signal. The greater concern may not be the New York market itself, but whether other jurisdictions adopt similar policies that could influence future site selection decisions and infrastructure planning.

In this sense, New York’s moratorium may represent the first domino in a broader conversation about how states regulate the rapidly expanding AI economy.

State Politics Are Becoming Increasingly Important

The data center industry’s site selection process has evolved considerably over the past several years. Beyond traditional considerations such as power availability, fiber connectivity, tax incentives, and workforce access, developers are now paying closer attention to political and community dynamics.

Growing local opposition to data center projects, combined with increased legislative activity at the state level, has elevated regulatory risk as a key factor in development planning. Industry participants—including data center developers, hyperscalers, and emerging AI infrastructure providers—are closely monitoring state legislative developments as they evaluate where to deploy capital and build new facilities.

Tax Incentives Also Face Greater Scrutiny

In addition to the moratorium, New York Governor Kathy Hochul has indicated plans to pursue repeal of the state’s sales tax exemption for large data centers. Such a change could significantly affect project economics.

For facilities currently under development—or those in the planning stages—the loss of these exemptions could increase costs associated with purchasing critical equipment and construction materials. This includes major infrastructure investments such as long-lead electrical equipment, as well as high-value computing hardware like GPUs and CPUs that are central to AI workloads.

Developers with projects in New York may therefore face both regulatory uncertainty and increased capital expenditures, potentially reshaping investment decisions in the state.

Looking Ahead

New York’s moratorium may not dramatically alter the trajectory of U.S. data center growth on its own, but it represents an important milestone in the evolving regulatory landscape surrounding AI infrastructure. As states balance economic development opportunities with energy, environmental, and community concerns, industry stakeholders should expect heightened scrutiny of future data center projects.

For developers, investors, hyperscalers, and AI companies, monitoring legislative activity at both the state and local level will remain critical as the race to build next-generation digital infrastructure continues.

Want to learn more about Â鶹ֱ˛Ąâ€™s Data Centers and Digital Infrastructure team? Click here.

Connecticut has significantly expanded and toughened its consumer privacy law. Under (Public Act 25-113), sweeping amendments to the Connecticut Data Privacy Act (CTDPA) took effect on July 1, 2026, with one key obligation – a new profiling impact assessment – following on August 1, 2026. The amendments widen who must comply, broaden the data the law protects, and add new obligations around profiling, artificial intelligence, minors’ data, and privacy disclosures. For many businesses, the takeaway is simple: you may now be covered even if you never were before.

Who Is Now Covered?

As of July 1, 2026, the CTDPA applies to any entity that conducts business in Connecticut, or targets products or services to Connecticut residents, and that during the preceding calendar year satisfied any one of the following:

• Controlled or processed the personal data of at least 35,000 consumers (reduced from 100,000), excluding data processed solely to complete a payment transaction;
• Controlled or processed consumers’ sensitive data, regardless of volume; or
• Offered consumers’ personal data for sale in trade or commerce, regardless of volume.

The prior threshold tied to deriving 25% or more of gross revenue from the sale of personal data has been removed. Because the second and third triggers contain no numerical threshold, any business that processes sensitive data or offers personal data for sale may now fall within the scope of the CTDPA, even a very small one.

What Counts as “Sensitive Data” under the CTDPA?

Your company is swept in if, during the past year, it collected or processed any of the following, no matter how few Connecticut residents were involved:

– Data revealing racial or ethnic origin – Data revealing religious beliefs – Data revealing a mental or physical health condition, diagnosis, disability, or treatment – Data revealing sex life, sexual orientation, or status as nonbinary or transgender – Data revealing citizenship or immigration status – Consumer health data – Genetic or biometric data, or information derived therefrom – Precise geolocation data

– Personal data collected from a known or willfully disregarded child – Data concerning an individual’s status as a victim of a crime – Neural data – Financial account numbers, log-in credentials, or credit/debit card numbers that, combined with any required access code or password, would allow access to a financial account – Government-issued identification numbers (e.g., Social Security numbers, passport numbers, state ID or driver’s license numbers)

What Counts as a “Sale”?

The “sale” trigger is broader than many businesses assume. Under the CTDPA, a “sale” includes sharing, transferring, or disclosing personal data to a third party for valuable consideration (in addition to money), so many everyday practices can qualify, including:

• deploying tracking cookies from ad networks to serve targeted ads later;
• embedding third-party tracking pixels on a checkout page, which transfers unique device IDs and browsing history to an ad network in exchange for targeted audience insights and optimized ad campaigns;
• sending customer data to a vendor whose terms let it use your data to improve its own algorithms or train its AI models; and
• swapping loyalty data or email marketing lists with a partner brand to cross-promote, even with no money changing hands (among other examples).

What’s Changed and Why It Matters

Below are the key operational implications for covered businesses under the latest amendments to the CTDPA.

Stronger Profiling and Automated Decision-Making Rules

The opt-out right now covers any automated decision that produces a legal or similarly significant effect (not just those made without human involvement) and expressly includes decisions made “on behalf of” a controller by third parties or service providers. Where feasible, consumers may question outcomes, receive an explanation of how a decision was reached, review the data used, and – in housing-related contexts – correct inaccurate data and request re-evaluation.

Expanded Consumer Rights

Consumers gain new rights tied to covered profiling decisions and a new right to obtain a list of third parties to whom their personal data was sold. The rights to know and access now expressly include inferences and profiling information. Notably, controllers may not hand over certain higher-risk categories (such as Social Security numbers, certain financial data, and biometric elements) in response to a request; only confirmation that the data is held is required.

Heightened Protections for Individuals Under 18

The protected age range rises from 13-16 to 13-17, and there is now a blanket prohibition on targeted advertising to, and the sale of personal data for this age group, regardless of consent, where the controller has actual knowledge of or willfully disregards that a consumer is between 13 and 17 years of age. Controllers are also barred from using design features that increase, sustain, or extend a minor’s use of an online service, and must conduct heightened impact assessments for minors’ data.

Updated Privacy Notice Requirements

Privacy notices must now disclose whether personal data is used to train large language models (LLMs), along with profiling and targeted advertising practices. Notices must be reachable through a conspicuous homepage hyperlink containing the word “privacy,” provided in each language the controller uses, and accessible to individuals with disabilities. Material retroactive changes to data practices require notice and an opportunity to withdraw consent.

Tighter Data Minimization and New Impact Assessments

Data collection must now be reasonably necessary and proportionate to the disclosed purposes, and material new secondary uses require fresh consent. Controllers that profile consumers to make legally significant decisions must conduct a dedicated impact assessment (separate from the existing data protection assessment) for processing activities created or generated on or after August 1, 2026.

Updated Controller Duties

Processing sensitive data now requires both a “reasonably necessary” basis and consent, and antidiscrimination obligations are reinforced to guard against unlawful disparate treatment.

The Bottom Line

Connecticut has shifted from a threshold-based law that mostly affected large companies to an expansive framework that can capture smaller organizations – particularly those that touch sensitive data, rely on ad-tech and targeted advertising, share data in ways that may count as a “sale,” or offer online features used by minors. With the Connecticut Attorney General’s cure period gone and enforcement already active, the cost of waiting has risen. Companies with any nexus to Connecticut should consider the following steps:

• Reassess whether you are in scope. Given that the sensitive data and sale triggers under the amended CTDPA have no volume threshold, assume you may be in scope until confirmed otherwise.
• Map your data. Inventory what personal and sensitive data you collect, how it is used, and with whom it is shared – including via tracking pixels and list exchanges.
• Refresh privacy notices and consent flows. Disclose profiling, targeted advertising, and any use of personal data to train LLMs, and ensure notices are conspicuous, multilingual, and accessible.
• Review profiling and automated decision-making. Build compliant processes to honor opt-out requests, provide explanations for how decisions were reached, and complete the new impact assessment for activities on or after August 1, 2026.
• Strengthen protections for minors. Stop targeted advertising to, and sales of personal data of, individuals aged 13-17, and remove engagement-maximizing design features.

If you are unsure whether the amended CTDPA now applies to your business – or how to close the gaps – our Data Privacy and Cybersecurity attorneys can help you assess your compliance obligations and build a practical path forward. Please reach out to a member of our team to start the conversation.

How AI is modernizing investigations for high-stakes matters

As scrutiny intensifies, leaders must understand how AI can strengthen investigations without compromising reliability, privilege or trust.

In brief

• AI is transforming investigations by accelerating analysis of communications, transactions and evidence while improving accuracy and early decision‑making.
• These benefits depend on disciplined governance, transparency and human judgment to ensure defensibility under regulatory and legal scrutiny.
• Leaders should expect advisors to deploy AI responsibly, validate outputs and protect privilege throughout the investigative lifecycle.

As organizations expand their use of AI across the enterprise, even the most complex and non‑routine activities are being reshaped — including corporate and government investigations. These matters often represent a company’s most consequential and urgent challenges, requiring the expertise of legal advisors and forensic specialists who have traditionally relied on labor-intensive methods. AI is transforming both the speed and scale of these efforts, enabling teams to work more efficiently and with far greater accuracy and insight. Leadership teams overseeing such matters will increasingly depend on professionals who can integrate AI appropriately to realize these benefits.

Even highly complex, bespoke investigations can gain significant advantages from AI. Generative AI (GenAI), agentic tools, predictive analytics, and advanced legal technology platforms enable investigators to rapidly analyse vast data sets, detect patterns of misconduct, and build case narratives like never before. AI not only reduces professional hours and associated costs but also accelerates the ability to pinpoint and intervene — helping organizations “stop the bleeding” sooner and return to normal operations more quickly. In critical matters where days, not weeks, count, these capabilities are transformative.

But the benefits of AI do not diminish the need for professional judgment and responsible application. High-stakes investigations face intense scrutiny from regulators, auditors, boards and litigators. Heightened transparency and defensibility remain key considerations in deploying AI. AI should therefore serve as a powerful accelerant — not a replacement — for the expertise required to navigate sensitive and nuanced matters.

Boards, committees, executives and legal counsel who oversee investigations — and rely heavily on external advisors — should expect their advisors to answer two essential questions:

• What benefits can we realize on this matter through the use of AI?
• How will AI be applied responsibly to ensure the work withstands scrutiny?

---

Jump to chapter:

---

Where AI delivers tangible investigative value

From communications review to financial analysis and drafting, AI enables faster, more accurate investigations with earlier clarity for leadership.

AI is already strengthening investigations and the specific value these capabilities deliver to leadership teams, allowing teams to work faster, more accurately and with greater precision. For example, investigative teams currently employ AI tools to review large data sets of electronic communications to quickly identify critical discussions and focus on key issues, participants and timeframes. AI is also being used to analyze certain transactions by comparing separate datasets such as accounting data, supporting business records and related contemporaneous communications. Although each investigation is unique, several consistent use cases are emerging across legal, forensic and discovery domains. These capabilities are no longer experimental — they are being deployed today to enhance investigative judgment and accelerate outcomes in matters that carry significant legal, regulatory and reputational stakes.

Across industries, several use cases consistently demonstrate the tangible benefits that AI provides.

1. Rapid analysis of large volumes of communications

Organizations continue to generate immense amounts of email, chat, messages and collaborative‑platform content. Traditional review approaches — manual sampling, search terms and linear review — struggle to keep up with the volume and complexity.

What AI enables

• Rapid ingestion and review of communications at scale
• Identification of themes, sentiment shifts, behavioral anomalies and emerging issues
• Prioritization of key custodians, conversations and time periods for human review

Value to leadership

• Meaningfully reduces time by compressing weeks or months of manual review into hours or days
• Reduces cost by minimizing attorney and specialist review time
• Improves decision-making by surfacing critical issues earlier, enabling faster triage and early case assessment

2. Detection of financial and transactional irregularities

Investigations often require analyzing structured data—such as accounting records, payment files, procurement activity, HR data and transaction logs. These datasets are often too large and too complex for traditional manual forensic techniques to fully evaluate and, before AI, have relied upon judgmental targeting and sampling.

What AI enables

• Detection of anomalous transactions, unusual patterns or inconsistent accounting entries
• Linking of transactional spikes or anomalies to related communications or documents
• Cross-dataset analytics to highlight high-risk processes, vendors or individuals

Value to leadership

• Accelerates insight by scanning millions of records rapidly
• Reduces cost by streamlining forensic accounting procedures
• Improves risk focus by identifying the highest-risk activity early and guiding investigative resources

3. Accelerated drafting of investigative materials

Significant investigative time is typically spent creating chronologies, witness outlines, workplans, memoranda and interim reports.

What AI enables

• First-draft creation of workplans, timelines, interview outlines and narrative summaries
• Synthesis of large sets of documents into clear, defensible narratives
• Consistent organization of facts aligned to investigative logic

Value to leadership

• Faster output that compresses drafting cycles
• Lower cost by reducing hours spent by senior investigators and counsel
• More informed decision-making through clear, structured updates earlier in the lifecycle

4. Enhanced interview preparation and post‑interview analysis

Interviews remain one of the most judgment-led phases of an investigation. AI does not replace investigative skill — but it significantly enhances preparation and follow‑up.

What AI enables

• Summaries of key documents and communications for each witness
• Identification of inconsistencies, corroborating statements, or new leads from transcripts
• Suggestions for follow-up questions based on cross‑referencing of structured and unstructured data

Value to leadership

• Improves quality of interviews by grounding them in comprehensive, data‑driven insight
• Reduces manual prep time and accelerates post‑interview analysis
• Enhances defensibility through more consistent, better‑documented evaluative processes

Across all investigative use cases, AI delivers cross‑cutting advantages that significantly enhance the efficiency and strategic value of the work. By surfacing key documents and early indicators sooner, AI accelerates initial case understanding and shortens the path to clarity. It unifies evidence by integrating structured and unstructured data into a more complete fact pattern, while reducing reliance on manual review — lowering cost, minimizing sampling risks and improving overall accuracy. Together, these collective benefits enable investigative teams to operate with greater speed, insight and confidence.

---

Why responsible AI use determines investigative defensibility

Governance, transparency, verification and human oversight are essential to ensure AI enabled investigations withstand external scrutiny.

Investigations — particularly those involving potential misconduct, regulatory scrutiny or significant organizational impact — nearly always face some form of external review. Boards, auditors, regulators and government agencies routinely evaluate not only the findings of an investigation but also the sufficiency of the process used to reach them. As AI becomes more deeply embedded in investigative workflows, leadership should expect its use to be evaluated with the same rigor applied to traditional forensic and legal procedures.

Defensibility depends on the professionals guiding the work — their judgment in selecting AI tools built on responsible governance principles, their decisions about how those tools will be deployed, their oversight of AI‑generated outputs throughout the matter and their deployment in a manner to uphold privilege protections. A sound investigation begins with clarity about who the key stakeholders are and what information they will require, as this understanding shapes the investigative workplan, including when and how AI should be incorporated. Ensuring defensibility requires thoughtful decisions at every stage — beginning with this upfront planning to inform selection of the right tools and their application.

Governance and transparency of AI tools

Corporate boards and leadership will rely on the expertise of its legal advisors and forensic specialists to select and deploy AI tools that are both appropriate and advantageous to the unique nature of the matter. This professional judgment is applied at the very outset — specifically in selecting AI tools that are built on responsible governance principles. AI models vary widely in their approaches to data security, model training, transparency and auditability. Professionals must therefore prioritize tools that provide explainability, maintain clear documentation of how outputs were generated, and align with established governance principles. These features help ensure reliability before any analysis begins.

That same judgment is essential in determining how and when to deploy AI. The decision to apply AI cannot be based on convenience alone; it must reflect the size and complexity of the data, the nature of the allegations, and the likely scrutiny the investigation will face. Whether AI is used to review communications, identify anomalies or synthesize documents, its application must be demonstrably reliable, reasonable and sufficient. By grounding both tool selection and deployment in expertise and responsible governance, professionals ensure that AI enhances investigative rigor rather than undermining it.

Testing and verification of AI outputs

Two core concepts underpin the credibility of AI-generated insights: accuracy and explainability.

• Accuracy reflects AI’s ability to produce consistent and correct results. Investigators should apply reperformance techniques to verify that the system arrives at the same outcome under similar conditions. This not only validates the tool’s effectiveness but also demonstrates to external stakeholders that results were not arbitrary or the product of a “black box.”
• Explainability applies to subjective or judgment‑oriented assessments — particularly with decision-making often seen in Agentic AI — such as prioritizing documents, identifying thematic patterns, or suggesting relationships between data points. Here, investigators must be able to follow the model’s rationale, understand why it reached a conclusion and assess whether the logic is reasonable within the broader fact pattern. This ability to test and challenge the AI’s reasoning is essential to establishing that human judgment, not automation, guided the investigation and interpretation of results.

AI should enhance professional expertise — not replace it. Investigators remain responsible for interpreting outputs, assessing their reasonableness, adjusting inputs or parameters, and documenting key decisions. They also oversee and verify the accuracy and explainability of AI‑generated results. Throughout the process, investigators must stay actively engaged: testing outputs, validating that they align with the broader fact pattern, and ensuring no model operates with unchecked autonomy. Maintaining clear records of how AI supported the investigation, how outputs were validated, and where human judgment guided the analysis is essential to demonstrating reliability and sufficiency during external review.

Consistent with these principles, courts have made clear that uncritical or unchecked reliance on AI — particularly without independent verification, transparency, and documented human judgment — can expose organizations to serious legal and evidentiary consequences. Recent federal decisions demonstrate that AI‑related failures are treated no differently than other lapses in professional responsibility.[1] Where parties have relied on AI-generated outputs without meaningful review, courts have imposed significant sanctions, awarded attorneys’ fees and costs, and warned that such conduct can undermine the integrity of proceedings and jeopardize case outcomes. These decisions underscore a central expectation: AI may assist professional work, but responsibility for accuracy, reasonableness and reliability remains firmly with the humans deploying it.

Protecting privilege

Further, investigators must exercise caution both in the degree to which they rely on AI and in the nature of the information they disclose to generative AI tools. Courts have clarified that the use of AI tools does not, standing alone, create or preserve attorney‑client privilege or work‑product protection. In particular, disclosures to publicly available AI platforms may undermine confidentiality and result in the waiver of otherwise applicable protections. Recent decisions emphasize that recognized privileges depend on a confidential, fiduciary relationship with a licensed professional and do not extend to interactions with non‑human, publicly accessible systems. [2] Accordingly, investigators and counsel must exercise care in determining what information is shared with AI tools and must ensure that AI is used in a manner consistent with privilege, confidentiality obligations and professional oversight.

---

[1] Representative decisions include: ByoPlanet Int’l, LLC v. Johansson, 2025 WL 201025 (S.D. Fla. July 17, 2025); Versant Funding LLC v. Teras Breakbulk Ocean Navigation Enters., LLC, 2025 WL 1440351 (S.D. Fla. May 20, 2025); Huntington Nat’l Bank v. M/Y [redacted], 2025 WL 1684109 (S.D. Fla. June 11, 2025), report and recommendation approved, 2025 WL 1684136 (S.D. Fla. June 16, 2025).

[2] See United States v. Heppner, No. 25 CR. 503 (JSR), 2026 WL 436479 (S.D.N.Y. Feb. 17, 2026).

---

What human-led, AI accelerated investigations enable

Organizations that pair AI’s analytical power with professional judgment are better positioned to manage risk and respond decisively.

AI is reshaping how investigations are conducted, enabling teams to work faster, more accurately and with greater precision, when paired with experienced professional judgment. The most effective investigative teams embrace AI for the acceleration and analytical power it brings, while maintaining the governance, oversight and disciplined reasoning required to withstand scrutiny.

Organizations that modernize their investigative approaches — by empowering legal advisors and forensic specialists to deploy AI wisely — will be better equipped to manage risk, uncover facts quickly, respond decisively in high‑stakes environments, and reduce financial and operational disruption. As the landscape of data, regulation and corporate exposure continues to evolve, shifting from traditional methods to human-led, AI-accelerated investigations is not simply an enhancement. It is a strategic imperative.

This article was co-authored by Jeff Ferguson and Katie Kyle, partners for Forensic & Integrity Services at Ernst & Young LLP.

For two years, the legal technology conversation has turned on a single premise, that artificial intelligence can read a contract. It can.

In due diligence, where the review of hundreds or thousands of agreements once set the cost and the calendar, a well-pointed model now does in an afternoon what a team of associates needed two weeks to finish. The most labor-intensive phase of diligence has become, for practical purposes, nearly free.

The temptation is to treat that as the whole victory. In my experience it is not. Compressing the middle of a process does not eliminate the work that surrounds it. It moves that work to the two ends, and those ends are where legal AI is least useful. Cross-border technology M&A makes the point as well as any practice I know.

A Process That Resembles a Software Build

It helps to look at diligence the way an engineer looks at building software. Software moves through three phases, architecture, engineering and deployment. Due diligence moves through three of its own, scoping, issue identification and remediation. In both, the middle phase was historically the constraint. Engineering consumed the calendar, and issue identification consumed the associates who read every contract and flagged every clause.

Coding assistants compressed the first of those phases. Legal AI is compressing the second. The consequence is the same in each case. When the middle of a process is no longer the bottleneck, the work that determines the outcome shifts to the front and the back. Engineers spend their judgment on architecture and deployment. Diligence lawyers should spend theirs on scoping, which decides what to examine, and on remediation, which decides what the findings mean. Those phases turn on judgment rather than volume, and judgment is the thing the model does not provide.

The Familiar Problem of Garbage In, Garbage Out

A fast engine will carry out a poor instruction faithfully. Point legal AI at a loosely scoped review and it returns 500 findings, of which perhaps 50 bear on the transaction. The fee a team thought it had saved comes back as the labor of sorting the pile, and a deal-defining issue can sit in that pile receiving the same brief attention as the boilerplate around it.

This is the part of the story that tends to go unmentioned. The model surfaces everything, which means a person still has to decide what everything means. A tool that makes identification cheap raises the value of the scoping that comes before it and the remediation that follows. It does not lower it.

Where the Judgment Lives, In Practice

The point is clearest in the diligence of a modern software company, which is global whether or not anyone planned it that way. Code is written wherever the engineers live. Intellectual property is created across jurisdictions. A target with modest revenue can carry employees, data, and tax exposure in a dozen countries without a single foreign office. The central scoping question becomes geographic. Which jurisdictions deserve real scrutiny, and which do not.

That question rests on a distinction a model will not draw reliably on its own, the difference between a few foreign employees and a genuine foreign operating footprint. A handful of remote engineers in three countries presents real but bounded risk, usually handled with focused local employment advice. Running a full review in each of those countries spends money to disprove a risk that was never material. A company that genuinely operates abroad is a different matter, and two questions reward careful attention. The first is whether the company owns its intellectual property at all. Many jurisdictions, unlike the United States, do not vest an employee’s work product in the employer by default, and if the chain of title fails under local law, the buyer may not own the asset it is paying for. The second is tax. The assumption that a structuring review has answered the tax question can obscure whether a dispersed workforce has created a taxable presence in a country where nothing was ever filed.

A model can flag an assignment clause. It will not tell you that the clause is unenforceable under Portuguese law, or that the missing clause for a contractor in Bangalore is the one that matters. Recognizing that is scoping and remediation, the work at the two ends, and it remains human.

The Discipline the Tools Require

The lesson reaches past M&A, and it is the one worth carrying into any workflow that AI now touches. An accelerated middle pays off only when the ends are handled with discipline. In diligence that means scoping tightly enough that the machine looks in the right places, and remediating carefully enough to separate the exposures that threaten a deal from the ones that only look alarming on a printout. It also means scoping for the parties who rely on the work after signing. The representations and warranties insurer decides what it needs to see before it will cover a risk, and it penalizes too little diligence and too much in equal measure. The lenders have their own requirements for guarantees, share pledges, and audited financial statements, and those requirements surface at financing rather than at signing unless counsel has anticipated them.

Legal AI can read every document in a data room faster than any team a firm could assemble. It cannot tell a buyer which jurisdiction holds a real operation and which holds a single laptop, and it cannot tell the buyer what the deal’s eventual insurers and lenders will require. That judgment is the work the technology has made more valuable rather than less. The firms that see this will use AI to clear the middle and put the time it frees back into judgment at the ends. The firms that treat a faster review as a finished one will reach the wrong answer sooner than before.

Reprinted with permission from the June 4, 2026 edition of the Legaltech news ©2026 ALM Global Properties, LLC. All rights reserved. Further duplication without permission is prohibited, contact 877-256-2472 or asset-and-logo-licensing@alm.com.

The American Hospital Association (AHA) and the recently the launch of the (Accelerator) at AHA’s Health Research & Educational Trust (HRET), a three-year national initiative designed to help hospitals and health systems operationalize and scale proven technologies across care environments. The initiative is supported by a $12 million commitment from West Health Institute and will focus on three priority areas: electronic health record (EHR) optimization, virtual care, and artificial intelligence (AI) utilization and integration.

The announcement addresses a practical challenge for hospitals and health systems: many organizations are testing or adopting technologies that can improve care delivery, quality, safety, and operational performance, but it can be difficult to move those tools from limited pilots to consistent use across the organization. The Accelerator is intended to help close that gap. Participating hospitals and health systems will have access to a digital hub, implementation support, peer-learning opportunities, and examples from hospitals and health systems serving as national models. In other words, the initiative is focused on helping hospitals make the technologies work in real care delivery settings.

Why This Matters

The AHA/West Health announcement is another sign that AI, virtual care, and EHR optimization are moving out of the “innovation project” category and into the day-to-day operations of health care delivery. That shift matters because once technology is embedded in clinical workflows, staffing models, patient communications, documentation practices, triage pathways, and care management programs, it becomes more than an IT initiative. Implementation can raise practical questions about clinical oversight, medical staff governance, professional responsibility, documentation, reimbursement, and compliance infrastructure.

For hospitals and health systems, the key question is no longer only whether a technology works. It is whether the organization can implement the technology safely, consistently, and in a way that aligns with existing health care regulatory requirements.

The Accelerator’s Three Priority Areas

The Accelerator focuses on three areas that are already priorities for many hospitals, but that can be difficult to implement consistently across an organization: EHR optimization, virtual care, and AI utilization and integration.

EHR Optimization

EHR optimization has become both an operational priority and a compliance issue. Hospitals are looking for ways to reduce administrative burden, improve clinical workflows, support earlier identification of patient risk, and make it easier for care teams to act on the right information at the right time. As EHR workflows become more closely integrated with AI-enabled tools, clinical decision support, documentation functions, virtual care platforms, and care management programs, hospitals should assess whether those workflows continue to support integral functions including accurate documentation, appropriate billing, medical record integrity, and clear clinical accountability. This is especially important when technology changes how information is presented to clinicians, how documentation is generated, or how patient needs are escalated. Even when a tool improves efficiency, the hospital still needs a clear process for determining who is responsible for reviewing the information, acting on it, and documenting the clinical decision-making process.

Virtual Care

The Accelerator’s focus on virtual care also reflects the continued evolution of telehealth from an access tool to a broader care delivery and staffing strategy. For hospitals and health systems, virtual care may include telehealth visits, virtual nursing, centralized care teams, specialist consults, remote monitoring, and hybrid care models. These models can help expand capacity, support staffing flexibility, and improve access, but they also need to be structured carefully. Scaling virtual care requires more than selecting a platform. Hospitals need workflows that are clinically appropriate, operationally sustainable, and compliant across the states and care settings in which patients and clinicians are located.

Artificial Intelligence Utilization and Integration

The Accelerator’s AI focus is notable because it is framed around utilization and integration, not just experimentation. In hospital settings, AI tools may support a range of functions, including clinical workflow support, documentation, risk identification, operational efficiency, and care team coordination. The regulatory analysis depends less on the fact that a tool uses AI and more on how the tool is used, what role it plays in the care delivery process, and who remains responsible for clinical judgment. An AI tool that supports an administrative workflow raises different regulatory issues than a tool that influences clinical decision-making, generates clinical documentation, prioritizes patient outreach, recommends next steps, or communicates information to patients or care teams. Hospitals should classify AI-enabled tools by use case and risk level, then align oversight, documentation, monitoring, and escalation processes accordingly.

From Pilots to Systemwide Practice

A similar implementation challenge applies beyond the Accelerator. For many hospitals, the difficult step is not identifying a promising technology-enabled use case but moving that use case from a limited pilot to a workflow that can operate consistently across the organization.

Many hospitals are already testing or using AI-enabled tools, virtual care models, remote monitoring programs, or EHR-enabled interventions in limited settings. Those pilots can be useful, but broader implementation is different. A pilot may be managed through a narrow protocol, limited users, and close operational oversight. Systemwide implementation requires a more formal framework, including policies, governance, training, escalation pathways, documentation standards, medical staff involvement, billing review, and ongoing monitoring.

A workflow that is appropriate for a small pilot may not be sufficient once the same technology is deployed across multiple service lines, facilities, or patient populations. As hospitals move from pilots to broader implementation, legal and compliance teams should be involved early enough to help design a scalable model, not just review issues after the technology is already in use.

Regulatory Questions Hospitals Should Ask Before Scaling

Hospitals and health systems evaluating AI, virtual care, and EHR-enabled tools should consider several threshold questions before moving from pilot programs to broader implementation. These questions should be addressed early in the implementation process, rather than after the workflow is already live.

1. Who is furnishing the service?

Hospitals should determine whether the technology changes which clinicians or care team members are involved in furnishing the service. For example, a virtual nursing model, centralized monitoring program, or AI-supported triage workflow may involve different personnel than the hospital’s traditional in-person workflow. That can raise questions about licensure, scope of practice, supervision, delegation, credentialing, privileging, and medical staff oversight.

2. Where are the patient and clinician located?

For virtual care models, patient and clinician location remain central regulatory questions. Hospitals should evaluate whether clinicians are appropriately licensed or otherwise authorized to furnish services to patients in the states where the patients are located. This is especially important for centralized or cross-state virtual care models. Hospitals should also consider state-specific virtual care requirements.

3. How is the workflow documented?

Hospitals should confirm that the medical record accurately reflects the care furnished, the individuals involved, the information reviewed, and the clinical decisions made. If technology generates summaries, prompts, alerts, draft notes, risk scores, or recommended actions, hospitals should determine whether and how those outputs are incorporated into the medical record and who is responsible for reviewing them.

4. How is the service billed?

Technology-enabled workflows can affect coding, billing, and reimbursement. Hospitals should evaluate whether the workflow supports the requirements for the service being billed, including any applicable requirements related to clinician involvement, supervision, time, documentation, patient consent, or location of service, and payor-specific coverage or billing rules.

5. Who reviews and acts on technology-generated information?

Hospitals should clearly define who is responsible for reviewing alerts, summaries, escalations, or recommendations generated through AI-enabled tools, EHR workflows, remote monitoring platforms, or virtual care programs. If a workflow generates information that requires clinical action, the hospital should have a clear process for review, escalation, documentation, and follow-up.

6. Does the workflow require medical staff or committee review?

Some technology-enabled workflows may require review through medical staff, clinical leadership, quality, compliance, IT, or other governance channels, particularly if the tool affects clinical decision-making, patient safety, documentation, or care delivery responsibilities. Hospitals should consider whether existing committees and policies are sufficient or whether additional review processes are needed for AI-enabled or virtual care workflows.

Looking Ahead

The AHA/West Health Accelerator reflects the continued push to move AI, virtual care, and EHR-enabled tools from limited pilots into broader operational use. For hospitals and health systems, broader implementation of these tools creates an opportunity to improve quality, safety, efficiency, and access. It also underscores the need for practical regulatory planning. As these tools become part of day-to-day care delivery, hospitals should be prepared to show not only that the technology works, but that it is being implemented consistently and with appropriate clinical and operational oversight. Hospitals should also build regulatory review into the implementation plan, with clear accountability for clinical review, documentation, billing, escalation, and ongoing monitoring.

Â鶹ֱ˛Ą is here to help you address the short- and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Â鶹ֱ˛Ą relationship partner, our Health Care & Life Sciences Sector, or to our Health Care Practice Group with any questions.

AI‑enabled transcription tools have quickly become a fixture in modern business meetings. Properly vetted and deployed, they offer efficiency and accessibility advantages. Yet, while many companies are still developing governance frameworks for authorized AI tools, an emerging risk has quietly surfaced: employees using unauthorized transcription tools without the company’s or participants’ consent.

This practice, often referred to as shadow AI, creates new layers of compliance, privacy, and legal exposure. For companies seeking to adopt AI responsibly, it is no longer enough to decide which tools to authorize; they must also manage the risk of employees using tools outside approved systems.

In a recent survey conducted by the National Cybersecurity Alliance, 43 percent of AI users admitted to sharing sensitive company information with AI tools without their employer’s knowledge.¹ These statistics underscore that shadow AI use is not theoretical, it is already happening, often outside company’s systems and platforms, and, therefore, not in view of legal and compliance teams.

Understanding the Risk Landscape

Once employees begin using transcription tools that the company has not vetted or authorized, problems can emerge quickly. Key risk areas include state law recording‑consent requirements, privilege and confidentiality obligations, governance controls, and record retention practices, all of which can lead to serious downstream consequences if not addressed through clear policy and oversight.

In “two‑party” or “all‑party” consent jurisdictions, every participant in a conversation must agree before the meeting is recorded or transcribed.² Employees who enable transcription functions without consent may unknowingly violate state law. Some states impose criminal penalties; others allow civil lawsuits. In jurisdictions imposing civil liability, and where company policy does not expressly forbid unauthorized transcription, employers may face vicarious liability if employees act within the scope of their duties. In jurisdictions that recognize corporate criminal liability, an employer may be exposed if, for example, an employee surreptitiously records and transcribes a meeting with an executive of another company.

Unauthorized tools can also jeopardize confidentiality and privilege. When a company contracts directly with a vendor, it can negotiate data‑security and retention terms, deletion rights, confidentiality protections and control over how information is processed. Consumer or free transcription tools do not typically offer these safeguards. Meeting content may be uploaded into large, unbounded language models that learn from user data or store information indefinitely, creating potential waiver of attorney-client privilege, loss of trade‑secret protection, and violation of data‑privacy obligations. Once data enters such systems, the company cannot control its dissemination, access, or downstream use.

From a governance perspective, unauthorized transcription denies the organization the ability to decide strategically when and how meetings are recorded. Recording decisions should be made at the organizational level, not by individual employees, because the decisions determine what becomes part of the corporate record. Without that oversight, the company has no real visibility into what employees are recording or how the resulting transcripts are being managed. When employees record meetings on their own, the company loses the opportunity to review transcripts for accuracy, ensure proper context, and reconcile them with official notes or minutes.

These risks increase in litigation and regulatory matters. Data stored outside official retention and discovery channels can lead to production gaps or spoliation concerns, and civil discovery sanctions or even potential obstruction of justice charges if the production is to a government entity and as not maintained.³ Most consumer platforms lack defined retention periods or deletion controls, making it difficult for companies to ensure that unauthorized records comply with established data‑management policies. Investigators or opposing counsel may also compel transcripts directly from employees, bypassing corporate legal oversight and creating conflicting accounts that can undermine privilege and raise credibility questions.

In short, shadow AI undermines a core principle of good governance — the company must maintain control over what is recorded, how it is stored, and how long it is retained. Reestablishing that control is essential to protecting privilege, confidentiality, and compliance.⁴

Taking Control of Shadow AI

Effective management of shadow AI begins with a threshold question: should employees be permitted to use transcription tools at all, and if so, under what circumstances? That decision should be made as part of the company’s broader AI governance framework, led by legal, compliance, and IT‑security functions.

If the company concludes that transcription tools can provide value when properly managed, legal counsel should bring AI usage into the open. Begin by identifying what tools employees already rely on and why. In many cases, employees turn to shadow AI for efficiency, not to evade policy, and that insight should help shape a practical response. Engage directly with business teams to understand where current tools or support fall short and adjust approved solutions to meet those needs.

Once the landscape is understood, select secure, enterprise‑grade transcription tools that satisfy confidentiality, privilege, and record‑keeping requirements and align with the company’s operational needs and regulatory environment. Authorized vendors should offer clear data‑ownership terms, defined retention and deletion rights, and secure environments that prevent company information from being used to train AI models.

Company policies should specify when recordings are permitted and who approves them. Recording decisions should rest with designated personnel, not individual employees; and employees must also understand that each recording is a corporate document subject to consent obligations and document‑hold requirements.

Employee engagement and training are essential. Counsel and compliance teams should make sure employees understand:

• The legal and reputational risks of unauthorized recording or transcription;
• State consent requirements and the potential penalties for non‑compliance;
• How privilege and confidentiality can be lost through unapproved tools; and
• When recording is permitted, who must authorize it, and how to manage resulting data.

Equally important is giving employees functional, approved tools that actually meet their needs. When authorized solutions are efficient and transparent, shadow AI use naturally declines.

If the company decides transcription should not be used, that position must be communicated and reinforced through training. Employees should understand the reasons: unauthorized recordings can violate the law, compromise confidentiality and waive privilege. Technical controls can support enforcement by spotting or blocking prohibited applications, but consistent communication and visible support from leadership are usually more effective at sustaining compliance.

Looking ahead, companies should assume that some shadow AI activity exists. Strong governance depends on visibility and accountability — identifying unauthorized tools, limiting their use, and ensuring data from approved channels is properly managed. Integrating AI oversight into existing compliance and information‑governance programs helps organizations stay in control as technology and business practices continue to evolve.

I. Introduction

This article is designed to provide an overview of the current state consumer privacy landscape in the United States, the key distinctions among these state laws, practical compliance approaches, and actionable takeaways for operationalizing privacy programs in a fragmented regulatory environment.

Companies operating across the United States today face one of the most complex privacy regulatory environments in the world. Unlike the European Union, which adopted a single, comprehensive framework in the General Data Protection Regulation (“GDPR”), the United States has no federal omnibus consumer privacy law governing the collection and use of personal information. States have filled the gap, creating a fast-growing, often contradictory patchwork of rules that challenges even the most sophisticated privacy programs. With over twenty comprehensive state consumer privacy laws now enacted and counting, understanding each state’s requirements – and choosing the right compliance strategy – is no longer optional. It is foundational to responsible data governance and, as cure periods sunset and regulators sharpen their enforcement tools, the margin for error is narrowing by the quarter.

The sections that follow trace the rise of the state-based privacy regime, examine California’s outsized role, survey the “baseline” states that have followed Virginia’s lead, identify the critical distinctions that separate these laws from one another, explore the emerging role of automated decision-making provisions, survey enforcement trends, and present two competing compliance models alongside practical guidance for harmonizing them into a cohesive program.

II. The Rise of the State-Based Privacy Regime

When the GDPR took effect on May 25, 2018, it redefined global expectations for data protection and gave individuals across the European Union a robust set of rights over their personal data. That same year, California enacted the California Consumer Privacy Act (“CCPA”), the first comprehensive consumer privacy law in the United States, which took effect on January 1, 2020. The CCPA was later amended and significantly expanded by the California Privacy Rights Act (“CPRA”), which California voters approved as a ballot initiative in November 2020 and which took full effect on January 1, 2023.¹

California’s law set the tone. Over the following years, more than twenty additional states enacted their own comprehensive consumer privacy statutes.² Each of these laws grants consumers some version of the core rights that have become standard in the modern privacy lexicon – access, deletion, correction, portability, and the ability to opt out of certain processing activities. But while these laws share surface-level similarities, they diverge in critical details. Each state establishes its own definitions, exemptions, applicability thresholds, response timelines, and obligations.

These differences are not academic. They determine whether a particular business must comply at all, how operationally burdensome compliance will be, what categories of data must be protected, and how a company must respond to consumer rights requests. For organizations operating in multiple states – which, in the age of e-commerce, means most organizations of any meaningful scale – this divergence translates into tangible operational complexity.

The absence of a federal privacy law is the primary driver of this fragmentation. Despite sustained interest on Capitol Hill, disagreements over federal preemption of state laws and whether to include a private right of action have repeatedly stalled legislative efforts.³ In the absence of federal legislation, states continue to fill the void, and the patchwork continues to expand.

III. California: The Most Impactful State

California remains the single most impactful jurisdiction in U.S. privacy law. It enforces some of the strictest requirements in the country, and its law contains several features that no other state has replicated.

• A Standalone Revenue Threshold. California is the only state whose consumer privacy law applies based on a standalone annual gross revenue threshold. Under the CPRA, a business is subject to the law if it has annual gross revenues exceeding $26,625,000 – a figure that the California Privacy Protection Agency (“CPPA”) has inflation-adjusted from the original $25 million threshold.⁴ Critically, this revenue test applies regardless of the volume of California residents’ personal information in the business process. The practical effect is that many business-to-business companies, professional services firms, and other non-consumer-facing organizations are pulled into scope solely by virtue of their revenue, even if they collect or otherwise process minimal consumer data.
• Employment and B2B Data Coverage. Most state privacy laws confine their protections to “consumers,” defined narrowly as natural persons acting in a personal or household capacity – meaning that individuals acting in a commercial or employment context are generally excluded from coverage. As a result, business-to-business contacts, employees, and job applicants typically fall outside the scope of these statutes, unless a specific exception applies. Conversely, California takes a broader approach, applying its law to personal information collected from or about employees, job applicants, independent contractors, and business representatives and contacts who reside in that State.⁵ This dramatically expands compliance obligations for human resources departments, recruiting functions, and sales and business development teams – particularly for national companies that meet California’s revenue threshold.
• The Sensitive Data Paradox. One of the more counterintuitive features of the CPRA is its treatment of sensitive personal information. The majority of the other state consumer privacy laws require businesses to obtain opt-in consent before processing sensitive data, such as biometric identifiers, precise geolocation, health- or medical-related details, or information about racial or ethnic origin, among other sensitive data elements.⁶ California, by contrast, does not require prior opt-in consent. Instead, the CPRA restricts businesses from using or disclosing “sensitive personal information” beyond those purposes specifically enumerated in the statute, and grants consumers the right to limit that use.⁷ In this particular respect, California is surprisingly less stringent than most of its counterparts. In nearly every other regard, however – enforcement mechanisms, applicability thresholds, the breadth of consumer rights, and the scope of covered data – California remains the most complex and operationally demanding state for privacy compliance.

For any organization evaluating or building a privacy program, understanding the full scope of California’s requirements is an essential first step.

IV. Baseline States: The Virginia Model and Its Variations

Outside of California, many states have modeled their comprehensive privacy laws on the Virginia Consumer Data Protection Act (“VCDPA”), which took effect on January 1, 2023.⁸  These “baseline” states, which include Indiana, Kentucky, Tennessee, Texas, Nebraska, and Rhode Island, among others, generally share a common architecture.

The baseline model typically provides consumers with:

• Rights to access, delete, correct, and port their personal data;
• Rights to opt out of (i) the sale of personal data, (ii) the processing of personal data for targeted advertising purposes, and (iii) in some states, certain forms of profiling; and
• Requirements that controllers conduct data protection assessments for high-risk processing activities.

This common architecture gives the appearance of uniformity. In practice, however, even these facially similar laws contain differences that create real compliance challenges. The distinctions are often found in the details — in how each state defines key terms, where it sets its applicability thresholds, what exemptions it grants, and how it structures enforcement. The sections that follow highlight the most consequential of these differences.

V. Key Distinctions Among State Privacy Laws

(a) The Definition of “Sale”

The definition of “sale” is among the most consequential variables in the state privacy landscape. California’s CPRA defines “sell” to mean the disclosure of personal information for “valuable consideration,” a formulation broad enough to capture exchanges in which no money changes hands.⁹ Under this definition, activities such as third-party analytics integrations, targeting cookies, pixel-based advertising tools, and cross-context behavioral advertising may all constitute a “sale,” triggering specific disclosure obligations and opt-out rights.

Other states, however – including Virginia and Indiana – define “sale” more narrowly, requiring that the exchange involve monetary consideration.¹⁰ This single definitional difference can dramatically alter a company’s compliance strategy with respect to cookies, tracking pixels, analytics tools, and advertising technology. A practice that constitutes a “sale” under California law requiring prominent opt-out mechanisms may fall entirely outside the scope of a narrower state’s sale provisions.

(b) Applicability Thresholds

States diverge sharply in when their privacy laws apply:

• California applies its law based on a standalone annual gross revenue threshold of $26,625,000, irrespective of consumer data volume.
• Texas and Nebraska impose no numerical consumer-count thresholds. If a business conducts operations in the state and does not qualify as a “small business” under applicable federal definitions, the law applies.¹¹
• Most other states use consumer-count thresholds, but these range widely – from as few as 35,000 residents to as many as 175,000.
• Connecticut is especially notable: effective July 1, 2026, its amended threshold will be low enough that many companies currently outside its scope will unexpectedly qualify.¹²

These threshold differences mean that a company’s applicability analysis cannot be performed once and applied universally. It must be conducted on a state-by-state basis.

(c) Exemptions

Differences in exemptions are among the most operationally significant – and most frequently overlooked – sources of complexity in multistate privacy compliance. This is particularly true for financial services companies, healthcare organizations, and utilities.

Key exemption variations include:

• Some states exempt entities that are subject to the Gramm-Leach-Bliley Act (“GLBA”)¹³ in their entirety; others exempt only the data that is subject to GLBA, leaving the entity itself within scope for non-GLBA-covered data.
• Some states exempt regulated utilities, while others do not.
• Some states exempt nonprofit organizations, while others subject them to the full weight of the law.

The result is that a company with identical operations across multiple states may be fully subject to one state’s law, partially exempt from another’s, and entirely excluded from a third’s.

(d) Consumer Rights and Response Timelines

Although the core consumer rights are broadly similar across states, the timelines for responding to consumer requests vary meaningfully. Most states require controllers to respond to consumer requests within 45 days, but several mandate a shorter 30-day window. California imposes a 10-business-day acknowledgment requirement for all requests, in addition to its substantive response deadline.¹⁴ Appeal timelines — the period within which a consumer may appeal a controller’s denial of a rights request – also differ from state to state.

For companies that receive high volumes of consumer rights requests, these timeline variations create genuine operational complexity and increase the risk of inadvertent noncompliance.

(e) Data Rights Variability

Even core privacy rights that appear in most state laws are not truly universal. For example:

• Iowa does not grant consumers the right to correct inaccurate personal data.
• Utah does not require controllers to offer an opt-out right with respect to profiling.
• Oregon and Minnesota require controllers to disclose the specific third parties – not merely categories of third parties – with whom they share consumer data.¹⁵

These variations may appear minor in isolation. In the aggregate, they meaningfully affect the design of consumer-facing communications, privacy notices, and intake workflows.

VI. Automated Decision-Making and Profiling

An area of growing importance – and one that directly intersects with the rise of artificial intelligence and machine-learning technologies – is the treatment of automated decision-making (“ADM”) and profiling under state consumer privacy laws. As this panel’s learning objectives emphasize, understanding these provisions is essential for any organization deploying algorithmic tools that affect consumers.

Several state privacy laws now grant consumers the right to opt out of profiling that produces legal or similarly significant effects.¹⁶ The specifics, however, vary. Some states define “profiling” broadly to encompass any automated processing used to evaluate, analyze, or predict aspects of an individual’s behavior, preferences, or characteristics. Others limit the opt-out right to profiling that results in decisions with concrete legal, financial, or similarly significant consequences.

Colorado’s regulations are among the most detailed in this area, establishing specific requirements for data protection assessments and consumer notification when profiling is used in connection with decisions that produce legal or similarly significant effects.¹⁷ Connecticut has also strengthened its ADM provisions. As states continue to refine their frameworks, businesses deploying AI-driven tools – including automated underwriting, content personalization, targeted advertising algorithms, and fraud detection models – should expect growing scrutiny of how those tools interact with consumer rights.

The practical takeaway is that companies cannot evaluate their AI and machine-learning deployments in isolation from their privacy compliance obligations. The same algorithmic tool that enhances operational efficiency may trigger profiling opt-out obligations, require a data protection impact assessment, or necessitate heightened consumer disclosures, depending on the state.

VII. Enforcement Regimes and Trends

Understanding state privacy laws also requires understanding how they are enforced, and here, too, the landscape is far from uniform.

• Enforcement Authority. Most state comprehensive privacy laws vest enforcement authority in the state attorney general. California is the notable exception: the CPRA created the CPPA, a dedicated regulatory body with independent rulemaking and enforcement authority – the first of its kind in the United States.¹⁸ The CPPA has been active, issuing regulations, conducting public proceedings, and initiating enforcement actions. In states without a dedicated agency, the attorney general’s office serves as both regulator and enforcer, with varying levels of resources and appetite for privacy-specific enforcement.
• Cure Periods. Many early-enacted state privacy laws included mandatory cure periods – typically 30 days – during which businesses could remedy alleged violations before facing enforcement action. Several states, however, have allowed their cure periods to sunset or have eliminated them altogether.¹⁹ Colorado, Connecticut, and Virginia initially included cure periods that have since expired or transitioned to discretionary consideration. The trend is toward stricter enforcement without a guaranteed opportunity to cure.
• Private Rights of Action. The vast majority of state consumer privacy laws do not grant consumers a private right of action; enforcement is limited to the attorney general or applicable regulatory body. California is the principal exception, providing a limited private right of action for data breaches resulting from a business’s failure to implement reasonable security measures.²⁰ Washington’s My Health My Data Act also provides a private right of action for violations involving consumer health data.²¹ The availability (or absence) of private enforcement rights significantly affects litigation exposure and, accordingly, should influence a company’s risk assessment.
• Enforcement Actions to Date. State regulators have already begun to exercise their enforcement authority. The CPPA and the California Attorney General have pursued actions against companies for alleged failures to honor opt-out requests, provide adequate privacy notices, and comply with data minimization requirements. Other states’ attorneys general have likewise signaled increasing willingness to investigate and act. Companies should treat the current enforcement environment as the floor, not the ceiling, of regulatory activity.

VIII. Compliance Approaches: “Race to the Top” vs. “State-Specific by Design”

With twenty state consumer privacy laws currently in effect, companies face a fundamental strategic question: how to structure a compliance program that addresses multiple overlapping but non-identical legal requirements. Two competing models have emerged.

(a) Approach One: “Race to the Top” (One-Size-Fits-All)

Under this approach, a company identifies the most stringent requirement from across all applicable state consumer privacy laws – whether it relates to consumer rights, response timelines, sensitive data handling, or opt-out obligations – and applies that requirement universally to all consumers, regardless of their state of residence.

In sum: The “Race to the Top” approach trades operational simplicity for the risk of over-compliance. This approach works best for organizations that prioritize uniformity and have the resources to meet the highest standard across the board. It simplifies training, reduces the risk that employees will apply the wrong rule, promotes consistency across systems, and offers a degree of future-proofing as new states enact laws. However, it carries real risks. Voluntarily extending California-level rights to consumers in states with less demanding laws may create enforcement exposure if the company fails to meet those self-imposed standards. And for certain obligations – such as universal opt-in consent for health data under Washington’s My Health My Data Act – blanket application may be impractical or commercially untenable.

(b) Approach Two: “State-Specific by Design” (Jurisdiction-Specific)

Under this approach, a company builds state-specific workflows – often supported by geolocation tools – to apply the precise legal requirements of each state to the consumers who reside there.

In sum: The jurisdiction-specific approach trades operational complexity for precision and flexibility. It is well-suited to organizations in regulated industries – financial services, healthcare, and data-intensive businesses – where over-compliance may carry genuine commercial costs or where state-specific exemptions offer meaningful relief. It avoids unnecessary obligations and allows businesses to tailor their programs to the regulatory environment that actually applies. On the other hand, this approach demands branching logic in technology systems, rigorous training and internal oversight, and ongoing monitoring of legal developments. Regulators may also view inconsistency across jurisdictions as a red flag if programs are not carefully documented and implemented.

(c) Finding the Middle Ground

In practice, most companies will adopt a hybrid approach that draws on the strengths of both models. A common framework might apply a uniform set of consumer rights across most states – honoring the broadest access, deletion, and opt-out rights regardless of jurisdiction – while introducing state-specific overlays only where the legal requirements diverge materially. A single privacy notice with jurisdiction-specific addendums, for example, can provide consistency without the chaos of fully splintered programs. This hybrid model allows companies to reduce over-compliance in states with narrower requirements while maintaining the operational simplicity needed to scale a privacy program across the country.

IX. Practical Key Takeaways for Companies

As this panel’s learning objectives emphasize, understanding the law is only part of the challenge. Operationalizing a compliance program across more than twenty jurisdictions requires practical planning. The following takeaways are designed to bridge the gap between legal analysis and day-to-day execution.

1. Conduct a Thorough Applicability Assessment. Do not assume that a single applicability analysis covers all states. Since thresholds, exemptions, and definitions vary, a company may be in scope in one state and exempt in another. This assessment should be revisited at least annually, as states continue to amend their laws and adjust their thresholds.
2. Map Your Data Flows. Understanding what personal data the organization collects, from whom, where it flows, and with whom it is shared is a prerequisite to compliance with any state privacy law. Data mapping also supports data protection assessments, which an increasing number of states require for high-risk processing activities.
3. Evaluate Your Compliance Model Deliberately. Whether a company chooses a race-to-the-top model, a jurisdiction-specific approach, or a hybrid, the decision should be made intentionally, not by default. The right model depends on the company’s operations, systems, risk tolerance, industry, data practices, and internal resources.
4. Pay Close Attention to Sensitive Data. Because states define “sensitive data” differently and impose divergent consent requirements – opt-in in most states, use-limitation in California – companies must understand exactly what data they process that falls into a “sensitive” category and how each applicable state regulates it.
5. Build Profiling and ADM Compliance into AI Governance. Companies deploying AI and machine-learning tools should evaluate those tools against each applicable state’s profiling and automated decision-making provisions. As regulators sharpen their focus on algorithmic accountability, the intersection of privacy law and AI governance will only become more consequential.
6. Monitor Enforcement Trends. The enforcement landscape is evolving rapidly. Companies should track regulatory guidance, enforcement actions, and litigation developments as leading indicators of regulatory expectations. Early investment in monitoring pays dividends in reduced enforcement risk.
7. Invest in Training. The complexity of multistate privacy compliance makes employee training essential. Whether a company adopts a uniform or jurisdiction-specific model, front-line personnel – from customer service representatives to marketing teams to HR professionals – need to understand their obligations and how to execute them correctly.
8. Revisit and Refresh. Privacy compliance is not a one-time project. With new laws taking effect, existing laws being amended, cure periods sunsetting, and enforcement accelerating, companies should treat their privacy programs as living frameworks that require continuous attention.

X. Conclusion

The U.S. state consumer privacy landscape has reached a level of complexity that demands sustained, deliberate attention from every organization that collects personal information. Understanding each state’s unique thresholds, definitions, exemptions, consumer rights, and enforcement mechanisms is foundational. But choosing the right compliance approach – and operationalizing it effectively – is equally important.

Whether an organization leans toward a one-size-fits-all strategy, a jurisdiction-specific approach, or a hybrid model, thoughtful planning and consistent execution are essential. The practical takeaways outlined above are intended to help attendees of this panel translate the legal landscape into concrete compliance action. As states continue to legislate and regulators continue to enforce, the companies that invest in understanding and operationalizing these frameworks will be best positioned to manage risk and build trust with the consumers they serve.

For further reference, practitioners may wish to consult Â鶹ֱ˛Ą & Lardner LLP’s U.S. State Comprehensive Consumer Data Privacy Law Comparison Chart, available at /ľ±˛Ô˛őľ±˛µłółŮ˛ő/‌płÜ˛ú±ôľ±ł¦˛ąłŮľ±´Ç˛Ô˛ő/2026/01/łÜ˛ő-˛őłŮ˛ąłŮ±đ-ł¦´Ç˛Ô˛őłÜłľ±đ°ů-»ĺ˛ąłŮ˛ą-±č°ůľ±±ą˛ął¦˛â-±ô˛ą·É˛ő/.

---

[1] Cal. Civ. Code § 1798.100, et seq. For ease of readability, the CCPA and CPRA are collectively referred to as the CPRA.

[2] As of the date of this article, comprehensive state consumer privacy laws have been enacted in, among other states, California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Montana, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island.

[3] See, e.g., American Data Privacy and Protection Act, H.R. 8152, 117th Cong. (2022) (advanced out of committee but did not receive a floor vote).

[4] Cal. Civ. Code § 1798.140(d)(1)(A); Cal. Code Regs. tit. 11, § 7001(d) (inflation-adjusted threshold).

[5] Cal. Civ. Code § 1798.140(c)(1)–(2).

[6] See, e.g., Va. Code Ann. § 59.1-578(A)(5); Colo. Rev. Stat. § 6-1-1308(7); Conn. Gen. Stat. § 42-520(a)(5).

[7] Cal. Civ. Code § 1798.121(a).

[8] Va. Code Ann. §§ 59.1-575 to 59.1-585. Other baseline states include, but are not limited to, Indiana (Ind. Code §§ 24-15-1-1 to 24-15-14-1), Kentucky (Ky. Rev. Stat. Ann. §§ 367.400–367.499), Tennessee (Tenn. Code Ann. §§ 47-18-3301 to 47-18-3313), Texas (Tex. Bus. & Com. Code §§ 541.001–541.205), Nebraska (Neb. Rev. Stat. §§ 87-1101 to 87-1116), and Rhode Island (R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-16).

[9] Cal. Civ. Code § 1798.140(ad)(1).

[10] See Va. Code Ann. § 59.1-575 (defining “sale of personal data” as an exchange of personal data “for monetary consideration” by a controller to a third party); Ind. Code § 24-15-2-17 (same).

[11] Tex. Bus. & Com. Code § 541.002(a); Neb. Rev. Stat. § 87-1103

[12] Conn. Gen. Stat. § 42-516(a) (as amended, effective July 1, 2026).

[13] 15 U.S.C. §§ 6801–6809

[14] Cal. Civ. Code § 1798.130(a)(1).

[15] See Iowa Code ch. 715D (omitting a right to correction); Utah Code Ann. §§ 13-61-101 to 13-61-404 (omitting a profiling opt-out right); Or. Rev. Stat. § 646A.578(1)(d) (requiring disclosure of specific third parties); Minn. Stat. § 325O.07, subd. 1 (similar).

[16] See, e.g., Colo. Rev. Stat. § 6-1-1306(1)(a)(IV); Conn. Gen. Stat. § 42-520(a)(6); Va. Code Ann. § 59.1-577(A)(5).

[17] 4 Colo. Code Regs. § 904-3, Rules 7-8.

[18] Cal. Civ. Code § 1798.199.10.

[19] See, e.g., Va. Code Ann. § 59.1-584(B) (30-day cure period); Colo. Rev. Stat. § 6-1-1311 (cure period sunset Jan. 1, 2025).

[20] Cal. Civ. Code § 1798.150(a)(1).

[21] Wash. Rev. Code §§ 19.373.005–19.373.900.