Uncategorized

Subscribe to Uncategorized via RSS

Introduction

On September 16, 2026, the Ninth Circuit held in Doe v. GitHub, Inc. that outputs produced by a generative AI coding tool are newly generated works, not copies of existing works, and therefore fall outside the Digital Millennium Copyright Act’s (DMCA) prohibition on removing or altering copyright management information (CMI).1 The court limited that characterization to the § 1202(b) removal and alteration analysis, and declined to reach whether AI outputs that reproduce copyrighted material could constitute copyright infringement.2 The ruling turned on the generative architecture of the accused AI systems, distinguishing generative AI tools that generate outputs by predicting sequences from statistical patterns from retrieval-based systems that retrieve and disseminate existing copyrighted material, with the court suggesting the latter could face different legal treatment. The Ninth Circuit also declined to reach, on procedural grounds, the question of whether training on copyright-protected materials from which CMI has been stripped violates § 1202(b).

Continue Reading Ninth Circuit Rules Generative AI Outputs Are Not “Stripped Copies” Under the DMCA

What You Need to Know — and Do — Now
Frontier AI capabilities can now weaponise IT weaknesses in “a matter of minutes or hours,” the European Systemic Risk Board warned this week when it elevated the status of systemic cyber risk to “severe.” This warning aligns with other recent regulatory announcements, including a joint statement last month by the Five Eyes cybersecurity agencies that AI is accelerating the speed, scale and sophistication of cyber threats and may transform offensive and defensive capabilities in a matter of months, not years.

Most recently, the European Central Bank sent a letter on 7 July 2026 to key lenders in the eurozone warning that the financial services sector needed to produce comprehensive action plans addressing AI-driven cyber risk by the end of October — the most prescriptive response yet by any major central bank to the AI-charged cybersecurity threat.

The release of Anthropic’s Claude Mythos Preview in April 2026 ushered in a new reality where the window between vulnerability disclosure and active exploitation is no longer weeks or months, but potentially minutes. Anthropic identified that its new model was capable of autonomously discovering zero-day vulnerabilities and writing code to exploit them at superhuman speeds. Regulators today are increasingly focused on the potential risks and harms that these advanced AI models may facilitate. For all commercial organisations, this evolution presents an immediate escalation in legal risk, regulatory exposure, and organisational liability that demands urgent attention.

This article sets out the nature of the new AI-driven threat environment, examines its implications for legal and compliance functions, and provides practical guidance on the steps organisations should be taking now — and planning for in the months ahead.

Continue Reading Regulatory Frontier: Cybersecurity In A World Of New AI Models

On June 2, 2026, President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security” (the “Order”), which establishes a new framework for government collaboration with the AI industry on cybersecurity and the secure deployment of advanced AI models.1 While voluntary in form, the Order builds significant institutional architecture, including classified benchmarks administered by the National Security Agency (NSA) and a government-managed pre-release review window, that marks the administration’s first direct engagement with pre-deployment evaluation of frontier AI capabilities.

This alert examines the Order’s key provisions and their implications for AI developers, critical infrastructure operators, enterprises deploying AI tools, and investors in AI-driven companies.

Continue Reading Trump’s AI Cybersecurity Order: A Voluntary Framework with Mandatory Implications

As recent events indicate, American companies may be the subject of destructive data “wiper” attacks and potential data theft by Iran-linked hackers. Ongoing tensions in the Middle East underscore the stark and evolving cyberthreat landscape facing companies. These types of cyberattacks blend the regulatory and litigation exposure of a traditional data breach with the extreme business risks associated with near total operational disruption. This alert highlights potential legal implications and outlines practical steps companies should consider to strengthen preparedness.

Continue Reading When Cyberwar Hits the Corporate Home Front

On February 13, 2026, the U.S. Department of Health and Human Services (“HHS”), Office for Civil Rights (“OCR”) announced its civil enforcement program to implement the updates to the Substance Use Disorder (“SUD”) confidentiality provisions of the regulation at 42 CFR Part 2 (“Part 2”).1 The new enforcement program became effective February 16, 2026, in accordance with the deadline set by the 2024 Final Rule modifying Part 2 (“2024 Final Rule”).

Continue Reading HHS OCR Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records
Screenshot 2025-12-30 203740

As firms face rising data volumes, competitive pressure, and regulatory scrutiny, asset managers are increasingly turning to tools driven by artificial intelligence for everything from investment research and portfolio construction to risk modeling and operational efficiency.

In a recent whitepaper, Ropes & Gray partners Melissa Bender, Amy Jane Longo, Fran Faircloth, Megan…

security-5199236_1280

On March 7, 2025, the Department of Homeland Security (“DHS,” “the agency”) disbanded the Critical Infrastructure Partnership Advisory Council (“CIPAC,” “the Council”), originally established in 2006 to facilitate communication between the public and private sectors on critical infrastructure issues. CIPAC’s termination comes against the backdrop of the 2015 Cybersecurity Information Sharing Act’s (“CISA 2015,” “the Act”) upcoming expiration on September 30, 2025. CIPAC and CISA 2015 have jointly provided a valuable legal and operational framework for sharing information between the public and private sector in the U.S. for the past decade. Financial services industry stakeholders and members of Congress have expressed concern in recent months over increased cyber threats to industry stakeholders should the current public-private information sharing framework deteriorate. These recent developments are poised to significantly impact the financial services industry’s cybersecurity landscape – absent steps by Congress and the Administration to provide continuity for the current framework. 

Continue Reading CIPAC Disbandment and CISA 2015 Reauthorization: Recent Developments in the U.S. Cybersecurity Landscape
pexels-gstudio-8640331

In an International Association of Privacy Professionals (IAPP) article, health care partner David Peloquin and data, privacy and cybersecurity associate Jake Barr along with Legend Biotech Chief Privacy Officer and Assistant General Counsel Corey Dennis discuss the landmark rule limiting sensitive data transfers to “countries of concern.” The article reviews key aspects for health care…

money-7923867_1280

In 2024, financial sector regulators prioritized cybersecurity issues impacting financial institutions and the public. Key U.S. federal agencies—including the Securities and Exchange Commission, Federal Trade Commission, and the Consumer Financial Protection Bureau—have been joined by state regulators such as the New York Department of Financial Services in significant new federal and state regulations and more…

ai-generated-9106907_1280

In December 2024, New York Governor Kathy Hochul signed into law two bills (A8872A and S2376B; collectively, the “Bills”) that amend New York’s Data Breach Notification Law.1 The Bills introduce a maximum thirty-day timeframe for notifying affected New York residents of a reportable “breach of the security of the system”2 under…