California Raises the Bar on Cybersecurity

So Some of the things we wanted to highlight at the top were, first off, the FTC proposal addressing the accuracy and steering of AI outputs.

There's a new executive order focused on frontier model security and AI-enabled cyber defense.

And of course, For Supreme Court watchers in the United States, the Supreme Court's recent decision in slaughter that it really could create some uncertainty for the EU-US data transfers under the data privacy framework.

And then we thought we would share a few quick takeaways from the Fortify Summit we had in London with clients on these topics.

All right, David, let's start with the FTC.

What is the agency proposing here?

The FTC has proposed a policy statement really just laying out some situations where an AI provider may deliberately distort or steer a system's outputs in a way that could conflict with the user's reasonable expectations.

And the agency's theory here is basically that undisclosed steering toward ideological or other objectives could constitute deception under Section 5 of the FTC Act.

This is not simply about hallucinations or ordinary technical errors.

The practical point here is that developers should examine whether their claims about accuracy, neutrality, and suitability are consistent with how their systems are actually designed and governed.

And you also mentioned this new executive order on AI and cybersecurity.

What's that about?

Yeah, so the executive order directs federal agencies to accelerate AI-enabled cyber initiatives and develop a voluntary framework for engaging with developers of frontier AI models before those models are released more broadly.

And I think for folks who watch this space closely, they know the word voluntary here is doing a lot of work.

Because ultimately, there is apparently a fair amount of pressure for companies to AI model developers to share what they have in advance.

So the particulars of this executive order, they do emphasize that AI enabled cyber defense and criminal enforcement against malicious uses of AI should really be a key focus for the administration and also for developers.

And so for developers in particular, the immediate questions concern how government engagement may affect model testing, security reviews, and release planning.

And then for other companies in the space, for example, deployers, it's another indication that the government expects AI to become important on both sides of the cyber equation.

And the other thing I wanted to shift gears and ask you, Bill, you know, the Supreme Court's decision in Trump versus Slaughter, I think folks who watch this carefully see many implications across a whole range of areas.

But in our world, what are the implications for the FTC itself? What happened there?

Yeah, it's always interesting when one of our Supreme Court case has implications for our practice area.

And so the technical, just the holding here, is the court held that the statutory restrictions on the president's ability to remove FTC commissioners was unconstitutional, meaning the commissioners must be removable by the president at will.

Now, from a U.S. perspective, that changes a bit on the FTC's institutional structure, but importantly, it does not invalidate its existing authority or enforcement actions.

Now, the potential European consequences are a bit more nuanced and more complicated.

That's right.