A privacy incident does not always start with ransomware, a stolen device, or a malicious insider. Sometimes it starts with a marketing pixel, analytics tag, or audience-matching tool doing exactly what it was configured to do. That is the operational lesson privacy leaders should take from the FTC’s lawsuit against Hims & Hers. The FTC, … Continued
Large organizations scale Privacy Impact Assessments by turning them into repeatable operational workflows rather than one-off documents. As privacy teams review more applications, vendors, AI initiatives, and data uses, manual PIA processes become harder to manage. Spreadsheets, Word documents, shared drives, and email approvals may work for a small number of assessments, but they create … Continued
Artificial intelligence is quickly becoming part of healthcare operations, from clinical decision support and documentation to administrative workflows, patient engagement, and data analysis. But in healthcare, AI adoption cannot be separated from accountability. The Joint Commission–Coalition for Health AI guidance gives hospitals and health systems a practical foundation for responsible AI use. Its message is … Continued
Artificial intelligence, advanced analytics, and data mining have changed how organizations access and use personal information. Customer interactions, website visits, mobile app sessions, and connected devices can all generate data that supports personalization, product improvement, and business insight. They also create a broader privacy risk surface. Privacy class actions are no longer limited to traditional … Continued
AI guardrails are necessary, but they are not an AI response plan. As organizations deploy AI agents that can interpret instructions, use tools, access systems, and act at machine speed, static controls alone cannot account for every prompt, workflow, integration, or harmful outcome. A rule may block one risky action while missing a similar one … Continued
The bipartisan FRONTIER Act, introduced by Representatives Jay Obernolte and Lori Trahan, signals a practical shift in U.S. AI governance. Lawmakers are moving from broad principles for responsible AI to more concrete expectations for transparency, independent evaluation, risk management, and serious-incident reporting. For organizations adopting AI, the signal is clear: AI governance cannot be measured … Continued
The rapid adoption of artificial intelligence is creating a visibility gap inside the enterprise. Organizations may believe they know which AI systems process their data, only to discover that employees are using unapproved tools or that approved vendors have quietly introduced additional AI providers into their processing chains. As the IAPP reports, recent research found … Continued
OpenAI’s Health in ChatGPT experience gives eligible U.S. users the option to connect medical records and Apple Health data, including medications, lab results, clinical visits, sleep, and activity, to support more personalized health conversations. OpenAI says connected health information and conversations that use it are not used to train its foundation models or target ads, … Continued
AI vendor evaluations often start with the product demo. The features look useful. The workflow feels familiar. The platform integrates with systems teams already use. On the surface, the decision can seem straightforward. But a strong demo does not answer the most important governance question: can this AI system be used in a way that … Continued
AI Privacy Risks Need More Than Policies. They Need Privacy Incident Management. Artificial intelligence is now part of everyday business operations. Employees use AI to summarize documents, analyze data, draft communications, and automate routine work. Vendors are also embedding AI into enterprise applications, often changing how personal information is processed, retained, or shared. That shift … Continued
