In mid-August, Taft published the latest edition of The Big Long List of U.S. AI Laws. The list now includes over 60 entries focused on the commercial regulation of AI by the states.

Despite persistent rumors to the contrary, AI law compliance is anything but a detail or triviality.

There is nothing particularly glamorous about notifying your job applicants of your AI, putting disclaimers on your chatbot, conducting risk assessments, disclosing data sources, developing policies, or ensuring contracting standards. But, increasingly, requirements such as these are required or advisable under law for a growing number of particular AI applications. Businesses that develop and deploy AI without carefully considering the growing list of compliance issues do so at their own risk.

New entries on the latest list include:

  • Illinois Artificial Intelligence Safety Act. From the bulletin: “Requires certain AI model developers to develop, implement, publish, and annually update a frontier AI framework addressing potential catastrophic risk and to obtain independent third-party audits of covered frontier models, report safety incidents within strict timeframes, and prohibit retaliation against employees who report such risks. Requires frontier developers to publish a transparency report before deploying or substantially modifying a covered model, disclosing its release date, intended uses, and restrictions.”
  • Three Separate Rhode Island LawsHB 7538 requires health care providers and facilities to notify patients of the use of AI, and to engage in quality control review of AI documentation after the visit. HB 7350 requires disclosures to consumers around the use of “AI Companion” applications. Such applications must also detect expressions of self-harm and respond appropriately. And SB 2197 restricts the use and advertising of AI for therapeutic purposes.
  • South Carolina. HB 4591 reflects unique regulation on social media. If a platform uses AI to estimate user ages (noting that such estimation is required), it must refresh or update that estimate when using AI to update certain other information.
  • NAIC / Insurance Regulation. Our list now notes the wide adoption, across states, of a model bulletin governing the use of AI by insurance providers. I previously wrote about AI in the insurance industry context here.
  • Connecticut’s Online Safety Act, signed in May with provisions effective this October, probably deserves an honorable mention. Though it escaped the notice of many businesses at the time, this statute reflects a broad AI regulation with special focus on subscription services (SaaS providers beware!), frontier developers, HR applications, companion bots, and restrictions on the provision of algorithmic feeds to minors in the social media context.  

To keep up with the latest for the latest in privacy, security, and artificial intelligence legal news, you can follow us here at Privacy and Data Security Insights and on LinkedIn. Should you need counsel in any of these areas, Taft’s Privacy, Security & AI attorneys are ready to assist.

Companies today are more tied to a single ERP vendor than ever.

  • That dependency carries real risk unless you manage it well.

What is vendor lock-in?

  • It’s relying on one provider (like Oracle or SAP) for all your tech needs, instead of spreading systems across multiple vendors.

The risks: You lose control over your own data, get stuck with forced upgrade schedules that can hit during your busy season, and face steep price hikes at renewal since vendors know a full system overhaul is painful.

  • Some vendors also restrict data use to pressure upsells.
  • Notably, 94% of IT leaders now cite lock-in as a top concern.

The alternative: Multi-cloud setups give you flexibility to swap vendors but add real cost and complexity in managing and integrating separate systems.

How to flip the script: If you’re staying with one vendor, use your spend as leverage:

  • Negotiate a renewal cap (3–5%, tied to a standard index)
  • Lock in multi-year pricing to buy stability
  • Start renewal talks 6 months early, not at the deadline
  • Secure clean, low-fee data exit terms upfront

Done right, lock-in becomes leverage, not a trap.

#erplawyer #erpcommunity #erpfailure #saps4hana #oraclecontracts #softwarelawyer #sapservices #saphanacloudplatform #saas #erpcloud #teamtaft #sapcontracts #oraclelawsuit #oraclefailure #oracletermination #saptermination #teamtaft

Most ERP implementations fail — not because of the software itself, but because of unrealistic expectations set right from the start.

In this video, I break down the “dirty secret” behind why so many companies pour millions into new ERP systems (SAP, Oracle, Microsoft Dynamics, NetSuite, etc.) only to end up over budget, behind schedule, and disappointed.

Key takeaways:

  • Why 70-85% of ERP projects miss timelines, budgets, and expected business benefits.
  • How vendors’ sales hype ( “out-of-the-box in months!”) sets customers up for failure.
  • The hidden costs most organizations ignore: data migration, customizations, change management, training, and long-term support.
  • Common pitfalls like undersized budgets/timelines, rushed testing, skimping on resources, and over-reliance on part-time internal teams.
  • Practical steps to set realistic expectations: talk to references, conduct site visits, benchmark with experienced third parties, dedicate proper resources, and plan for contingencies

If you’re planning or in the middle of an ERP/digital transformation project, this is essential viewing to avoid the most expensive mistakes.

  • Success requires clear-eyed planning, strong leadership, and realistic timelines — not best-case sales pitches.

Have you dealt with ERP implementation challenges?

  • Share your biggest lesson (or horror story) in the comments!
👇 #erpcommunity #erpfailure #saps4hana #oraclecontracts #softwarelawyer #sapservices #saphanacloudplatform #saas #erpcloud #teamtaft #sapcontracts #oraclelawsuit #oraclefailure #oracletermination #saptermination

AI is one of the few technologies I have seen in my career that will live up to the hype.

  • It goes without saying that using AI for the sake of AI makes no sense.
  • You must have a business case for it.

But what is the cost?

  • What rights are you giving up in your data in exchange for utilizing AI functionality in the context of your ERP system?
  • Who owns not only your data, but your customer’s data that is input into the ERP system? Are you putting confidential information at risk?
  • Are you losing trade secrets?
  • Who can use the data you put into the AI tool?

I discuss these issues in my latest video

#erpimplementation #digitaltransformation #ai #artificialintelligence #openai #generativeai

Make no mistake: if you are about to start a digital transformation, the cards are stacked against you.

  • As an ERP customer, you are at an incredible disadvantage when trying to successfully implement ERP software.
  • To some extent, that is by design.

ERP vendors and integrators act in their self-interest to maximize revenue.

  • They minimize the complexity of the implementation process, which can result in unreasonable expectations.
  • ERP software consultants and salespeople act in their own self-interest.

An entire ecosystem is built up around each of the major ERP providers.

  • Often, partner networks, self-dealing, and commissions drive recommendations more than objectivity.
  • Large consulting firms have entire practice areas devoted to implementing Oracle, SAP, or Infor.

This sets up unreasonable expectations and prevents you from devoting the appropriate resources to your ERP software project.

  • Unreasonable expectations cause ERP software project failure.
  • I discuss these issues in my latest YouTube video
#erplawyer #erpcommunity #erpfailure #saps4hana #oraclecontracts #softwarelawyer #sapservices #saphanacloudplatform #saas #erpcloud #teamtaft #sapcontracts #oraclelawsuit #oraclefailure #oracletermination #saptermination

General counsel face growing pressure to support aggressive AI adoption. At the same time, they must protect their organization’s legal and governance posture.

This video directly addresses that tension.

Employee resistance to AI rarely stems from a dislike of technology. It stems from unmanaged uncertainty about job security, performance evaluation, and data use. That uncertainty can lead to shadow AI use and even employee sabotage.

Watch to learn how to:

  • Spot early warning signs of AI-related behavior risk among employees.
  • Understand how those behaviors threaten data integrity, privilege, and compliance.
  • Reframe AI risk management as a legal function, not an IT problem.

The discussion also covers practical steps for structuring policies, training, and communication. The goal: build AI systems that are trusted, auditable, and aligned with your organization’s employment, confidentiality, and governance obligations.


#ArtificialIntelligence
#AIGovernance #ShadowAI #InHouseCounsel #LegalRisk #industriallawyer #insurancelawyer #commericallitigation #privacylaw #datasecuritylaw #whitecollardefense #defenselaw #classactionlawsuits #AIlawsuits #AIdatabreach

Artificial intelligence is moving into government contract performance.

  • AI now supports scheduling, logistics, and production planning on federal contracts.

Defense contractors are asking a critical question.

  • Does using AI on a Navy or other government contract give the government rights to your proprietary systems, methods, or data?
  • The short answer is no. The real risk lies elsewhere.

Vague AI transparency and explainability clauses can quietly expand disclosure obligations.

  • This contract language can erode trade secret protections that have existed for decades.

This video explains how government IP rights apply to AI-assisted performance and identifies the exposure points that general counsel need to know about.

  • Key actions include defining deliverables precisely, managing explainability requests without revealing proprietary logic, and treating AI workflows as intellectual property assets.
#GovernmentContracts #ArtificialIntelligence #NavyContracts #ShipRepair #DefenseIndustry #FederalContracts #TradeSecrets #AICompliance #industriallawyer #insurancelawyer #commericallitigation #privacylaw #datasecuritylaw #whitecollardefense #defenselaw #classactionlawsuits #AIlawsuits #AIdatabreach

Artificial intelligence is reshaping how lawyers research, draft, and advise.

But AI has introduced two legal risks that users cannot ignore.

  • Courts are sanctioning attorneys for AI-generated errors in court filings.
  • And a February 2026 federal decision held that a client’s independent use of a public AI chatbot was not protected by attorney-client privilege.

This video explains both risks, outlines the decisions behind them, and identifies steps in-house counsel can take now, including AI-use policies and guidance for legal departments.


#Art
ificialIntelligence #LegalEthics #AttorneyClientPrivilege #AILaw #LegalTechnology #industriallawyer #insurancelawyer #commericallitigation #privacylaw #datasecuritylaw #whitecollardefense #defenselaw #classactionlawsuits #AIlawsuits #AIdatabreach

If you are a Navy contractor, ship repair company, or defense supplier wondering whether using AI puts trade secrets at risk, you are asking exactly the right question. I see why this concern is growing. Federal agencies now operate under formal AI governance and acquisition guidance, which means contractors should expect more questions about oversight, documentation, and how AI-assisted decisions are made.

My short answer is this: AI itself does not automatically hand your trade secrets to the government. The real risk usually comes from contract language, deliverable definitions, disclosure obligations, vendor terms, data handling, and how your team responds when the government asks for an explanation. That is where contractors can lose control of valuable methods without realizing it until the project is already underway.

In my view, the better question is not simply whether using AI puts trade secrets at risk. The better question is what part of your workflow could turn an internal advantage into something you are forced to disclose, deliver, or defend. When I look at this issue, I focus on the contract first, then the data, then the process.

#GovernmentContracts #ArtificialIntelligence #NavyContracts #ShipRepair #DefenseIndustry #FederalContracts #TradeSecrets #AICompliance #industriallawyer #insurancelawyer #commericallitigation #privacylaw #datasecuritylaw #whitecollardefense #defenselaw #classactionlawsuits #AIlawsuits #AIdatabreach

Does using AI put trade secrets at risk by itself?

Trade secret law can protect valuable business and technical information, including internal methods, processes, programs, planning systems, and engineering know-how, as long as that information is actually treated as confidential. That can include scheduling logic, labor forecasting assumptions, optimization rules, and internal AI-supported workflows that give a contractor a competitive advantage.

The key point is that using AI alone does not automatically mean those protections disappear. If a contractor uses AI as an internal tool to help perform work, that does not automatically transfer the underlying model, logic, or proprietary process to the government. The more important question is what the contract requires the contractor to deliver or explain. If the contract is vague about AI outputs, transparency, or explainability, that is where the real risk begins. In other words, the problem is usually not the use of AI itself, but rather that it is unclear contract language that can blur the line between the final work product and the protected internal methods behind it.

Where the real exposure begins

The real exposure usually starts with vague drafting. If a contract requires a schedule, a forecast, a recommendation, or a report, that sounds straightforward. But once a clause starts using broad phrases like AI outputs, explainability, transparency, validation materials, model documentation, or auditable decision support, the scope can widen quickly. Federal AI acquisition and governance memoranda have pushed agencies to strengthen risk management and visibility into AI systems, so contractors should expect more scrutiny around how AI-assisted outputs are generated and controlled.

Now that doesn’t mean the government automatically owns your internal methods. However, sloppy definitions can create leverage for broader disclosure requests. When explainability is undefined, a request for an explanation can turn into pressure to reveal assumptions, weighting, workflow logic, source inputs, or other confidential details that give your company its advantage. That is the moment when using AI becomes a practical contract problem instead of a theoretical one.

Why this matters so much on Navy work

Navy and ship repair work is especially sensitive because competitive advantage often lives inside the process rather than the final paper you hand over.

A schedule may look simple on the surface. But behind that schedule may be years of institutional knowledge about drydock congestion, supplier slippage, rework patterns, labor efficiency, overtime impact, sequencing risk, and how to compress an availability without creating failure elsewhere. If an internal AI-assisted tool helps your team turn that experience into better performance, the trade secret value often sits in the method, not just the final output. Under trade secret law, that kind of technical and business process information can qualify for protection when properly safeguarded.

That is why I don’t tell contractors to stop using AI. I tell them to define the boundary between the deliverable and the engine that produced it. If that boundary is not clearly drawn, using AI can shift from a smart business question to an expensive dispute.

A real-world example contractors should recognize

Imagine a ship repair contractor managing overlapping availabilities across limited drydock space. The company uses an internal AI-assisted scheduling tool trained on its own proprietary historical labor patterns, supplier reliability data, rework history, and sequencing behavior. The contract requires the contractor to deliver an updated schedule, and that is exactly what the contractor provides.

At that stage, the issue is not simply that AI was used. The more important question is whether the contract clearly defines what must be delivered and what must be explained. Problems can start when performance pressure builds, and the government wants to know why one availability was sequenced ahead of another. If the contract includes broad or unclear language about AI transparency or explainability, the discussion can quickly move beyond the final schedule and into assumptions, scenario testing, internal weighting, or decision-making logic that the contractor never intended to disclose.

That is how this risk often develops in practice. It isn’t because AI automatically strips away protection. Unclear contract language can blur the line between the final work product and the proprietary methods behind it.

What general counsel and contract teams should do now

1. Map where AI is actually being used

You cannot protect what you have not identified. Many companies discover too late that program teams are already using AI in scheduling, forecasting, logistics, quoting, maintenance planning, document review, or reporting. Start with visibility. Determine what tools are in use, what data they touch, and whether any output is flowing into a contract deliverable. Recent federal AI guidance makes visibility and risk management a practical necessity, not just a governance exercise.

2. Define deliverables with precision

Be explicit about what the government receives and what remains internal. If your AI system is merely an internal support tool, the contract should say so where possible. If only the final schedule, report, or recommendation is deliverable, define that clearly.

3. Control explainability before it controls you

I encourage contractors to prepare an explanation framework that describes outcomes without disclosing proprietary logic. That may include business justification, process summaries, validation results, or performance metrics that answer the government’s concern without exposing the underlying method. In many disputes, the problem is not that an explanation was required. The problem is that no one defined the safe level of explanation in advance.

4. Mark and segregate proprietary data

If your company is going to assert limitations, it needs disciplined marking, clean documentation, and a process to support those assertions. Also, separate government data from proprietary training data wherever possible. If you blend everything together carelessly, you invite arguments later about rights, access, and scope.

5. Review vendor terms before adoption, not after a dispute

Your internal AI tool may not be as internal as you think if the vendor retains broad rights, stores prompts indefinitely, uses input for training, or imposes weak confidentiality terms. That is a trade secret issue and a contract risk issue.

6. Train program managers to stop oversharing

A surprising number of disclosure problems begin in meetings, status calls, slide decks, white papers, or well-intentioned technical explanations. If your team does not know the line between explaining a result and revealing a protected method, it’s much more likely that using AI can put trade secrets at risk. Internal training matters. So does a clear escalation path for disclosure questions.

The questions contractors are already asking

Does using AI put trade secrets at risk on a government contract?

It can, but not automatically. The main risk comes from what the contract requires you to deliver, disclose, validate, or explain, along with how well you protect secrecy in practice.

If I use AI in scheduling, does the Navy own my model?

Usually not just because you used it. Ownership and license rights depend on the contract, the applicable clauses, the source of development funding, and whether the software or technical data are actually delivered.

What counts as a trade secret in an AI workflow?

Potentially, your training approach, source code, prompts, assumptions, workflows, data curation methods, weighting logic, decision rules, or process architecture, if they derive value from secrecy, and you take reasonable steps to protect them.

Can explainability requirements force disclosure of proprietary logic?

They can if the contract language is broad and your company has not set boundaries around what explanation means. That is why precise drafting matters so much.

What is the safest first step for a contractor using AI today?

Do a contract and workflow review before the next proposal, modification, or deliverable cycle. That is the best time to narrow definitions, strengthen markings, and fix data practices before a dispute starts.

Protect the advantage before the contract gives it away

For contractors, the most useful answer to whether using AI puts trade secrets at risk is this: AI is not the automatic transfer event. Bad definitions, weak controls, careless disclosures, and unmanaged contract language are.

That is why I would treat AI workflows the same way I would treat any other valuable technical edge. Identify them. Protect them. Define them carefully in the contract. Control how they are explained. Keep your proprietary data cleanly separated. And do not assume that a smart internal tool will stay protected if your paperwork and process say otherwise.

If you are working through these issues now, you can review my experience handling complex commercial, technology, and AI related disputes, or contact me directly to talk through your contract language and workflow. Acting early gives you the best chance to protect your rights, preserve your competitive advantage, and avoid turning a useful AI tool into a disclosure problem later.

Introduction and Background

In Feb. 2026, a public-private partnership headed by the U.S. Department of the Treasury concluded an investigative process aimed at strengthening cybersecurity and risk mitigation for AI in the financial services sector. The partnership consisted of executives from over 100 financial institutions, U.S. and international agencies, federal and state financial regulators, and other key stakeholders. One of the partnership’s key deliverables announced at the conclusion of the investigation is the Financial Services AI Risk Management Framework (“Financial Services AI RMF”), which adopts and expands the AI Risk Management Framework provided by the National Institute of Standards and Technology (“NIST Framework”) for specific application to the financial services industry.

Framework Organization

The NIST Framework is organized into four “functions”: Govern, Map, Measure, and Manage. The Financial Services AI RMF adopts the NIST Framework’s functions, but then provides further controls under each function, which are aimed at tailoring the framework to the financial services sector. The Financial Services AI RMF contains 230 controls designed to be scalable and adaptable for financial institutions, including community banks, credit unions, national and multinational banks, insurers, investment firms, and their third-party providers.[1] Implementation of the Financial Services AI RMF is not mandatory; the framework is instead categorized as a tool that is “complementary to existing risk frameworks” and that “synthesizes global standards and supervisory expectations.”[2]

The Financial Services AI RMF consists of four components: 1) an AI adoption stage questionnaire, which businesses can fill out as a starting point to identify their current AI adoption stage; 2) a risk and control matrix, which lists the 230 controls; 3) a user guidebook for control adoption and implementation; and 4) a control objective reference guide, which provides further information on each control, as well as examples of “effective evidence” of implementation.

Key Controls

Below, we highlight and summarize a sample of certain controls that legal counsel can help financial services organizations assess and address:

  • Govern 1.1.1: The organization identifies, monitors, and integrates applicable laws, regulations, contractual obligations, and sector requirements into policies, procedures, and operations.
  • Govern 1.1.3: The organization implements procedures to validate AI system compliance with law, including audits and impact assessments.
  • Govern 6.1.1: The organization establishes processes for evaluating and selecting third-party AI technologies based on criteria that assess security and privacy implications, due diligence, and contracting practices.
  • Govern 1.2.3: The organization develops an AI Acceptable Use Policy.
  • Map 4.1.1: The organization documents processes for identifying, mapping, assessing, and managing potential legal risks associated with the AI systems, including risk related to data privacy, intellectual property, third-party rights, and use of service providers.
  • Map 4.1.3: The organization communicates identified legal risks associated with the AI system, and changes in laws, regulations, and industry standards, to relevant stakeholders.
  • Map 5.2.2: The organization engages with stakeholders to solicit insights and develop action plans that detect, prevent, and mitigate potential risks, costs, or adverse impacts.
  • Measure 2.10.1: The organization conducts an initial examination of the privacy risks associated with AI systems and documents the results. The organization establishes mechanisms for managing risks and incidents, such as data breaches.
  • Measure 2.10.3: The organization establishes procedures for tracking and managing data subject consent, including handling data subject rights requests.
  • Manage 3.1.5: The organization monitors AI risks associated with third-party resources, including monitoring contracts and contract compliance.

The Taft Privacy, Security, and AI team stands ready to assist financial services organizations in implementing the Financial Services AI RMF and otherwise assessing and managing enterprise AI risk.


[1] See a description of the Financial Services AI RMF online here: https://cyberriskinstitute.org/artificial-intelligence-risk-management/.

[2] Id.