Introduction

On September 16, 2026, the Ninth Circuit held in Doe v. GitHub, Inc. that outputs produced by a generative AI coding tool are newly generated works, not copies of existing works, and therefore fall outside the Digital Millennium Copyright Act’s (DMCA) prohibition on removing or altering copyright management information (CMI).1 The court limited that characterization to the § 1202(b) removal and alteration analysis, and declined to reach whether AI outputs that reproduce copyrighted material could constitute copyright infringement.2 The ruling turned on the generative architecture of the accused AI systems, distinguishing generative AI tools that generate outputs by predicting sequences from statistical patterns from retrieval-based systems that retrieve and disseminate existing copyrighted material, with the court suggesting the latter could face different legal treatment. The Ninth Circuit also declined to reach, on procedural grounds, the question of whether training on copyright-protected materials from which CMI has been stripped violates § 1202(b).

Continue Reading Ninth Circuit Rules Generative AI Outputs Are Not “Stripped Copies” Under the DMCA

In the final weeks of California’s 2026 legislative session, lawmakers passed a series of bills that stand to significantly reshape the state’s privacy and AI regulatory landscape. Of particular significance, Senate Bill 690 (SB 690) seeks to curtail one of the principal theories underlying the recent wave of California Invasion of Privacy Act (CIPA) litigation, which has swept across diverse industries to affect website operators ranging from consumer brands to financial services firms. The bill would eliminate private actions under CIPA’s pen register and trap-and-trace provision, leaving the California Attorney General as the sole party authorized to bring those civil claims. If enacted, SB 690 would also apply retroactively to any pending pen/trap claim in actions filed within two years before its operative date, potentially affecting certain website-tracking cases already in litigation.

Continue Reading California Legislature Advances Key Privacy and AI Bills, Including Limits on Website Tracking Lawsuits

On August 4, 2026, the United States Court of Appeals for the Ninth Circuit issued its decision in Amazon.com Services, LLC v. Perplexity AI, Inc., vacating a preliminary injunction that had barred Perplexity’s AI-enabled web browser from interacting with Amazon’s website. The decision addresses a question of first impression: whether an AI “agent” that assists a user in navigating a website constitutes unauthorized “access” under the federal Computer Fraud and Abuse Act (CFAA). The court held that, on the facts presented, it does not, concluding that it is the user, not the AI tool, who “accesses” the website for purposes of the statute. This alert summarizes the decision and its practical implications for AI developers and deployers, as well as for businesses whose platforms or data may be implicated by AI-driven interactions.

Continue Reading Tool or Intruder? What Amazon v. Perplexity Means for Agentic AI and the CFAA

What You Need to Know — and Do — Now
Frontier AI capabilities can now weaponise IT weaknesses in “a matter of minutes or hours,” the European Systemic Risk Board warned this week when it elevated the status of systemic cyber risk to “severe.” This warning aligns with other recent regulatory announcements, including a joint statement last month by the Five Eyes cybersecurity agencies that AI is accelerating the speed, scale and sophistication of cyber threats and may transform offensive and defensive capabilities in a matter of months, not years.

Most recently, the European Central Bank sent a letter on 7 July 2026 to key lenders in the eurozone warning that the financial services sector needed to produce comprehensive action plans addressing AI-driven cyber risk by the end of October — the most prescriptive response yet by any major central bank to the AI-charged cybersecurity threat.

The release of Anthropic’s Claude Mythos Preview in April 2026 ushered in a new reality where the window between vulnerability disclosure and active exploitation is no longer weeks or months, but potentially minutes. Anthropic identified that its new model was capable of autonomously discovering zero-day vulnerabilities and writing code to exploit them at superhuman speeds. Regulators today are increasingly focused on the potential risks and harms that these advanced AI models may facilitate. For all commercial organisations, this evolution presents an immediate escalation in legal risk, regulatory exposure, and organisational liability that demands urgent attention.

This article sets out the nature of the new AI-driven threat environment, examines its implications for legal and compliance functions, and provides practical guidance on the steps organisations should be taking now — and planning for in the months ahead.

Continue Reading Regulatory Frontier: Cybersecurity In A World Of New AI Models

On June 2, 2026, Connecticut Governor Ned Lamont signed Senate Bill 5 into law, designated as Public Act 26-15 and also known as the Connecticut Artificial Intelligence Responsibility and Transparency Act (the “CART Act” or “Act”).1 The CART Act is among the most comprehensive state AI laws enacted to date, creating distinct obligations for employment-related automated decision tools, consumer chatbots, frontier-model developers, generative-AI provenance, and online platforms used by minors, while also addressing AI applications in healthcare through targeted carveouts and innovation initiatives.

Continue Reading Connecticut Enacts Sweeping AI Law Covering Employment, Healthcare, and Online Safety

On June 2, 2026, President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security” (the “Order”), which establishes a new framework for government collaboration with the AI industry on cybersecurity and the secure deployment of advanced AI models.1 While voluntary in form, the Order builds significant institutional architecture, including classified benchmarks administered by the National Security Agency (NSA) and a government-managed pre-release review window, that marks the administration’s first direct engagement with pre-deployment evaluation of frontier AI capabilities.

This alert examines the Order’s key provisions and their implications for AI developers, critical infrastructure operators, enterprises deploying AI tools, and investors in AI-driven companies.

Continue Reading Trump’s AI Cybersecurity Order: A Voluntary Framework with Mandatory Implications

On May 14, 2026, Colorado Governor Jared Polis signed a new Colorado AI Act, S.B. 26-189 (the “2026 Act”)1, which repeals and replaces the prior Colorado AI Act, S.B. 24-205, which had passed in 2024 (the “2024 Act”) and was originally scheduled to take effect on June 30, 2026.2 As a result, the 2024 Act will not take effect, and the 2026 Act goes into effect January 1, 2027. This enactment reflects both scrutiny from the federal government3 and Colorado’s governor4 for the 2024 Act’s broad, sweeping AI regulatory framework.

Continue Reading Colorado Scales Back AI Law, with Targeted Implications for Health Care

On May 15, 2026, China’s National Medical Products Administration (“NMPA”) issued the Implementation Measures for Drug Trial Data Protection (the “Measures”), effective immediately, to formalize China’s protection regime for eligible undisclosed chemistry, manufacturing and control (CMC) and clinical study data submitted in marketing authorization applications. The Measures define the eligible products, protection periods, application process, publication mechanism, and restrictions on follow-on applications that rely on protected data.

Continue Reading China’s NMPA Issues Final Measures on Regulatory Data Protection

On April 29, 2026, the United States Supreme Court issued a unanimous opinion in First Choice Women’s Resource Centers, Inc. v. Davenport, where it held that a nonprofit suffered an injury to its First Amendment right of association when it was subpoenaed by a state attorney general to produce donor information, including donor identities.1 Justice Gorsuch, writing for the Court, held that the nonprofit petitioner could challenge the subpoena in federal court without first waiting for a state court to compel compliance.

Continue Reading Supreme Court Reinforces Donor Privacy Protections, Permitting Immediate Federal Court Challenge to State Subpoena

For almost a decade, the scientific research provisions of the General Data Protection Regulation (GDPR) have lacked authoritative, European Union (EU)-wide interpretation, leaving sponsors of clinical trials and research institutions alike to navigate a patchwork of national implementing laws. A 2019 study commissioned by the European Data Protection Board (EDPB) — the body comprising EU national data protection authorities — confirmed significant divergence among EU Member States, and interim guidance published in 2021 by the EDPB highlighted — but left unresolved — several key GDPR compliance issues facing organisations in the life sciences industry. In the years since, the COVID-19 pandemic and the United Kingdom’s post-Brexit departure from the EU framework have only sharpened the need for more specific guidance. Ropes & Gray attorneys co-authored an article published in Science magazine in October 2020 that provided a summary of the complexity in this space and potential solutions.

Continue Reading The European Data Protection Board Releases New Guidelines on the Processing of Personal Data for Scientific Research