AI Governance
AWS lets customers opt out of AI data use via AWS Organizations, but the Service Terms don't describe a timestamped record of when that setting was configured — a gap worth checking as AWS's Bedrock-powered service list keeps growing.
Medicaid policy
Medicaid managed care covers more than three-quarters of beneficiaries, but the encounter data states use for rate-setting, fraud detection, and MCO oversight has no systematic independent validation at scale. What that structural gap means for enforcement, H.R. 1 compliance, and FWA tools.
Healthcare compliance
H.R. 9396 would require health plans to publish PA denial rates, appeal outcomes, and AI decision metrics starting 2027 — but contains no attestation, audit, or accuracy framework. Here's what compliance teams need to watch before rulemaking closes.
AI Governance
Microsoft's Agent 365 terms make customers responsible for AI agent compliance — but don't answer what governs the evidentiary record of agent actions when licensing changes. Here's what compliance officers and federal agencies need to ask before deployment.
State AI Laws
Connecticut, Arkansas, and Utah AI obligations take effect July 1 — while DOJ litigation challenging similar state laws is already underway in Colorado. Standard compliance guidance doesn't address what to do when both are true simultaneously.
Financial Reporting
Three federal documents — the RISE Final Rule, LOANS-26-05, and COD-26-04 — expose a compliance documentation gap institutions must assess before their first post-July 1 program review. The issue is not managing disbursement eligibility. It is being able to prove it.
Supply chain risk
EO 14411 restructures importer of record accountability, requiring IORs to submit supply chain documentation they may not control — while the statutory "reasonable care" liability under 19 U.S.C. § 1484 remains on them. CBP has 90–180 days to define the standards.
Chatbot safety
The KIDS Act contains 3 distinct compliance regimes with different obligations by title. Title I mandates technology verification. Title II excludes age-gating. Title IV triggers SAFEBOTs duties when chatbot providers know users are minors.
AI Agent Governance
97% of enterprise security leaders expect an AI-agent-driven incident within 12 months. Four 2026 surveys confirm the same governance gap: deployment has outrun controls, visibility, and budget.
AI Compliance
On June 12, 2026, BIS ordered Anthropic to suspend its Fable 5 and Mythos 5 models for all foreign nationals — forcing a global shutdown of both APIs. It's the first documented use of ECRA authority on a running AI model, and the legal mechanism applies to every frontier AI vendor.
Supply chain risk
CrowdStrike says China-nexus adversaries targeted technology more than any other sector, but the deeper signal is evidence: can organizations prove how sensitive assets are controlled?
Regulatory Intelligence
The EEOC’s EEO reporting proposal is under OIRA review, but current obligations have not changed. Here’s what employers should monitor now.