Insights
Practical perspectives on regulatory risk, AI governance, privacy and emerging technology.
Automated Decisions
A $2.25 million FTC penalty over tenant screening turned on reports that made histories look worse and disputes resolved without the required process. A corrected record and an unchanged recommendation can coexist.
Consumer Protection
Eight states allege the safety assurances did not describe a product whose design encouraged people to rely on it.
AI Governance
Subpoenas to OpenAI and Anthropic put a concrete question behind the inquiry: when a company tests software capable of acting, what keeps the test contained?
Automated Decisions
Colorado’s replacement law assigns duties to developers and deployers alike. An organization cannot explain a decision it was never given the information to explain.
AI Governance
OWASP’s runtime standard blocks a prohibited action before the tool runs. Its demonstration also shows what happens when the safeguard itself does not answer.
Fraud & Abuse
A $315 million settlement raises two practical questions: does escalation resolve a concern, and do performance targets leave time to investigate one?
Consumer Protection
FDA accepted that the patient’s account might be accurate and still found the advertisement misleading. A truthful testimonial can convey an unsupported claim.
Automated Decisions
Colorado’s draft rules would make organizations account for what their reviewers examined, understood and had authority to change. A human signature is only the beginning.
Consumer Protection
The FTC told 24 companies that the CMS transparency rules are not a safe harbour. A hospital can meet a disclosure requirement and still mislead about the cost of care.
Healthcare
California’s AB 1979 makes preserving a clinician’s independent judgment an organizational duty. An override button permits a different selection; it does not establish that the practitioner could evaluate the recommendation.
AI Governance
NIST’s agent identity work separates three tasks that are easily collapsed. Establishing which agent is asking is not the same as establishing what it may do.
Consumer Protection
The fee was on the page, below the button customers were told to press. If the interface routes people past a disclosure, what does putting it there accomplish?
Healthcare
California’s SB 503 assigns responsibility for biased clinical AI to developers and healthcare deployers alike. A favorable overall accuracy figure cannot answer what the tool does to a protected patient group.
Automated Decisions
The No Robo Bosses Act prohibits sole reliance on automated output for discipline or termination. The consequential step is what the employer may no longer do when the review fails to corroborate the recommendation.
Fraud & Abuse
A $22.5 million settlement showing how False Claims Act exposure reaches diagnosis data, the certifications supporting it, and what happens after an error is found.
AI Governance
A Manchester derby VAR failure shows how disclosure can preserve trust in automated decision support.
AI Governance
FDA has opened its drug safety regulations to computer modeling and other nonclinical methods. What makes a model’s prediction reliable enough to rely on remains a scientific question.
Healthcare
FDA’s warning letter to Empower Pharmacy turns on a narrow point: recording a patient-specific determination is not the same as establishing that one was made.
Fraud & Abuse
A revised Justice Manual section asks DOJ attorneys a second question when they decline a whistleblower case: should the litigation continue at all?
AI Governance
A disputed World Cup goal shows why organizations must explain what automated systems do and what people still decide.
AI Governance
Two new California laws put the spotlight on AI auditors. Being outside the company answers only one question about an assessment.
Fraud & Abuse
A $32 million settlement showing how charitable patient assistance loses its independence through the information that reaches the people recommending donations.
Healthcare
Missouri now lets a questionnaire help establish a physician-patient relationship. The same legislation broadened what must happen before a prescription follows.
Consumer Protection
Meta’s multistate settlement ties some of its stronger teen protections to what competitors do next. One settlement becomes a possible route to an industry benchmark without imposing one.
Consumer Protection
The Hims complaint and New York’s Thirty Madison settlement examine both ends of recurring billing: what authorizes the first charge, and whether cancellation actually works.
Healthcare
FDA’s pilot lets certain digital-health devices be used in chronic care while evidence is still being gathered. Selection is not a finding that they work.
AI Governance
FDA’s questions about generative AI devices reach a broader point: a model’s test score belongs to the model, and the patient encounters the product.
AI Governance
ORI’s guidance on generative AI asks researchers to account for the work they report, and institutions to account for the evidence behind a misconduct finding.
Automated Decisions
Illinois made discriminatory AI use an express civil-rights violation. A vendor can test a product without testing this employer’s use of it.
Fraud & Abuse
A $46 million settlement in which the agreements described data and adherence services, and the admitted purpose was inducing drug purchases.
AI Governance
Schools need to prepare students for AI, preserve independent learning and assess both fairly. A detector cannot resolve those obligations for them.
Privacy & Data
A genuine patient, valid credentials, and the wrong file. Verifying identity answers only part of the question a records request asks.
Privacy & Data
Refusing legitimate requests undermines care; accepting an unchecked assertion invites misuse. TEFCA tries to make that distinction work across many systems.
Automated Decisions
With the effects test removed from Regulation B, a disparity starts an inquiry rather than establishing a violation. An automated system makes the evidence harder to separate.
Healthcare
The software advises and the clinician decides — but authority to reject a recommendation is not the same as being able to assess its basis.
Privacy & Data
The EDPB’s draft guidelines turn an anonymity claim into something a reader can examine: what was tested, under which conditions, and what the evidence supports.
Education
Six states now require institutional AI policies in education. A statement of acceptable use, a process for selecting products and a system for overseeing their effects are different accomplishments.
Automated Decisions
A federal judge rejected the argument that a vendor’s liability depends on its customers'. Performing a function on an employer’s behalf can bring the vendor’s own conduct within the law.
Healthcare
Six states restrict automated coverage denials, and they do not adopt one uniform safeguard. Reading them all as human-in-the-loop rules obscures what each particular law requires.
AI Governance
Singapore’s guidance gives one agent different permissions for different work. Its ability to perform a task did not determine whether it was allowed to.
AI Governance
Federal guidance expressly anticipates a model card entry marked unknown. An empty answer is not a failed test, and it is not evidence that performance will carry over to this hospital’s patients.
Healthcare
A persona claimed a medical education and a psychiatric registration. Pennsylvania’s Board of Medicine sued the company whose software supplied the exchange.
Education
England’s expanded safety standards for educational AI ask how a product should behave while helping a student. A tool can answer correctly and still do the thinking the student was meant to practice.
Automated Decisions
An applicant knows what they submitted. They do not know what was collected, inferred or reported about them — and a rejection supplies none of those answers.
AI Governance
SB53 made publishing a safety framework a legal obligation. Whether those procedures governed an actual release is a separate question, and the law connects the two.
Automated Decisions
California’s ADMT regulations give people notice, access and opt-out rights for specified automated decisions. Neither a product label nor the presence of a human reviewer settles whether those rights apply.
Regulatory Risk
FDA restored the earlier regulatory text after a court vacated its laboratory-developed test rule. That implemented the judgment; it did not exempt every diagnostic test.
Regulatory Risk
A case study on why regulatory scoping matters from MVP to exit valuation.
Healthcare
How organizational decisions can shape which healthcare laws apply—and why you should define the boundaries before someone else does.
Healthcare
Understanding the layered origins of healthcare compliance burdens—so you can build smarter from day one.
AI Governance
As AI tools move rapidly into healthcare, most organizations aren’t developing new algorithms—they’re implementing third-party solutions into clinical, operational, or administrative workflows.
Regulatory Risk
Compliance-by-design isn’t just a legal safeguard—it’s a strategic advantage.
Consumer Protection
Healthcare marketing risks extend beyond clinical care to promotional messaging and substantiation.
Consumer Protection
A $1 million FTC order over a product sold as making any website compliant and keeping it so. Evidence that software performs useful tasks is not evidence it delivers the advertised result.
Privacy & Data
NIST’s guidance helps a customer establish what a differential-privacy promise actually protects. A promise about one record and one about a person’s whole contribution are different purchases.
Healthcare
HTI-1 let hospitals ask for structured information about a prediction’s population, validation and limitations. It makes the next question easier to investigate without deciding the answer.
No articles match that filter yet.
Not sure where to start?
Whether you have a specific question or want to explore how TrustCraft can help, we’re here to talk.
TrustCraft blog content is provided for general informational purposes and does not constitute legal advice.
