One AI compliance program may need to account for several different legal frameworks. In this episode, Amy S. Mushahwar, partner and Chair of Lowenstein's Data Privacy, Security, Safety & Risk Management practice, and Kathleen A. McGee compare the approaches taken by the EU AI Act and emerging U.S. regulations and explain how organizations can manage their overlapping requirements.
- Amy S. Mushahwar, Partner; Chair, Data Privacy, Security, Safety & Risk Management
- Kathleen A. McGee, Partner, Data Privacy, Security, Safety & Risk Management
Lowenstein Sandler Cybersecurity Awareness Series
Kathleen A. McGee, partner in the firm’s Emerging Companies & Venture Capital (ECVC) group and White Collar Defense practice, and Ken Fishkin, manager of information security, share what you need to know to protect your organization’s information, how to prepare your company for the possibility of various data breaches, the most common points of entry for intruders, and other cybersecurity concerns that every organization should be aware of.
READ THE TRANSCRIPT
Amy S. Mushahwar: We remember doing this more than 20 years ago as security laws, security frameworks, overlapping sectoral frameworks creeped across the country and creeped across the world.
Kathleen A. McGee: One interesting feature in comparing the EU AI act with US side regulation, with respect to AI, is that the EU AI act is focused on the impact. What is it that you're doing and what risk does it present?
There are some prohibited actions under the EU AI act. Things that you may not do. There is some content and some impact that may be allowed, that is permissible under the EU AI act. Notably, for our stateside clients, it is anytime your content is available to someone within the EU. Whether or not you intended to be so is less of a concern for the European Union.
On the United States side, it is more about disclosures, consent, and informed knowledge in terms of data and security as it relates to AI. The EU AI act, and the stateside EU regulations, cover very different aspects of our clients’ AI development.
In that way, it's really important that a client consult with lawyers through the whole health of their development to make sure that they're covering not just impact, but also consent knowledge and documenting risk management.
That's why risk management is such a big component for AI.
Amy S. Mushahwar: In the case of AI, we had two frameworks that moved just inside 12 months. Colorado repealed its AI law and replaced it with a narrower one. Europe pushed its biggest deadlines to late 2027 and 2028.
However, the transparency piece and telling people that they're dealing with AI went live on schedule in August. Anyone who built a program, now, might be retooling it. The framing here isn't “which framework do I use?” Like security, build a set of very strong controls. And what evidence do you want to develop and then harmonize to the best of your ability.
