United States: Compliance

California's new Senate Bill 574 introduces statutory duties for attorneys using generative AI, including mandatory citation verification and court disclosure requirements starting January 1, 2027. The law raises critical questions about how these obligations extend to AI-assisted eDiscovery review and document summarization that feed into court filings.

FDA's inspection approach is evolving beyond checking individual procedures to evaluating quality systems as integrated wholes, fundamentally changing how medical device and pharmaceutical companies should respond to Form 483 observations. Drawing from experience with over 25 Form 483 and warning letter responses, this analysis reveals critical strategies for addressing systemic issues, demonstrating management engagement, and preparing for follow-up inspections in the QMSR era.

The Federal Communications Commission has amended its TCPA consent revocation rules, introducing category-specific opt-outs for informational robocalls and allowing callers to designate exclusive revocation methods. The changes aim to balance consumer control with operational flexibility while addressing concerns about the previous "revoke all" requirement that could inadvertently block wanted communications like fraud alerts and security notifications.

Two critical vulnerabilities in PHP, the software powering countless websites and internet-facing systems, are being actively exploited to allow unauthorized code execution and data theft. Organizations face urgent questions about what was exposed before patches were applied, which credentials may have been compromised, and how to preserve evidence of potential breaches. Legal counsel must look beyond simple patch deployment to address preservation obligations, vendor accountability, and documentation of re

HHS's Kidney Care National Plan signals a shift toward stricter accountability and performance-based oversight for transplant centers and donor hospitals. The plan leverages payment incentives, living donation expansion, and converging federal oversight to drive more kidney transplants. Will your organization shape the coming regulatory changes or simply react to them?

The Federal Trade Commission has reached a settlement with a payment processor and four affiliated entities over allegations that they knowingly facilitated deceptive merchants, including foreign tech-support operations, in accessing the U.S. card-payment system. The case resulted in a $4.85 million monetary judgment and features a significant Joint Statement from FTC leadership establishing a knowledge standard for unfair payment-processing claims under Section 5.

California's new cybersecurity audit requirements under CCPA are set to take effect in 2027, with phased implementation based on company revenue. Companies that derive significant revenue from selling or sharing personal information, or process data about large numbers of consumers, must prepare now for independent audits that evaluate the implementation and effectiveness of their cybersecurity controls.

Companies are shifting from building privacy and AI governance frameworks to proving they work in practice. As regulators scrutinize consumer opt-outs, vendor oversight, and California's new cybersecurity audit requirements, in-house legal teams face mounting pressure to demonstrate that policies translate into effective controls across their organizations.

Fake applicants, fraudulent recruiters, and AI-enabled deception are creating real-time security, compliance, and reputational risks for employers. Privacy experts examine the issues from both sides of the hiring process, providing practical steps employers can take to verify candidates, strengthen safeguards and third-party relationships, and respond effectively when suspicious conduct arises.