Hintze Law’s Global AI Update provides a curated overview of key AI-related legal and regulatory updates. We spotlight new developments and emerging trends to help organizations that are developing, deploying, or relying on AI technologies to stay ahead of what’s next.
Please also check out our latest Global Privacy Updates post.
If you’d like to receive email alerts for our blog posts, visit our blog page to sign up.
US AI Updates
Amazon v Perplexity and CFAA Injunction Ruling
Amazon had requested a preliminary injunction against Perplexity to prevent Perplexity's AI agent from accessing Amazon.com.
On August 4, 2026, the Ninth Circuit vacated a district court ruling granting the preliminary injunction and ruled that Amazon is "unlikely to succeed on the merits of the "access" prong of the Computer Fraud and Abuse Act (CFAA) and California’s Computer Data Access and Fraud Act (CDAFA) analysis and the equity factors do not otherwise favor an injunction." Rather, the Ninth Circuit held that the user “accesses” Amazon’s computers with the help of the AI agent—Perplexity’s servers never access Amazon’s.
In a footnote to this ruling, the Ninth Circuit confirmed that Amazon may have a separate claim regarding violation of its terms of use (consistent with recent Supreme Court rulings on similar CFAA claims): "This outcome does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users. On the facts before us, Amazon is simply unlikely to succeed in its attempt to regulate access by invoking the CFAA and the CDAFA."
Federal Court Denies Motion to Dismiss Class Action Against AI Notetaking Tool
On August 13, 2026, N.D. Cal. largely denied Otter.ai’s motion to dismiss, allowing most claims in a class action filed in 2025 to move forward. Plaintiffs had alleged Otter’s “Notetaker” tool recorded, transcribed, retained, and commercially used their private conversations without consent
Five major claims survived Otter’s motion to dismiss in full, alleging:
o ECPA § 2511 + California equivalent (CIPA § 631): Otter intercepted communications in real time and may have used those communications for its own purposes (e.g., machine learning and model training), not just for its users’ benefit, so the party exception would not apply.
o Illinois BIPA: Otter collected and retained identifiable voiceprints without required notice and consent.
o California unfair competition: Because individuals can sell or monetize their own data, Otter’s interception of their data and private conversations decreases the market value of such data.
o California unjust enrichment: Otter received and unjustly retained benefit of significant revenue by, e.g., using plaintiffs’ data for product improvement, at the expense of plaintiffs’ privacy rights
Court granted leave to amend all dismissed claims, for example:
o Federal CFAA claims and California state law counterpart (CDAFA)
§ Plaintiffs didn’t allege “facts explaining how Otter Notetaker supposedly [accessed] any part of their computers, such as ‘files, folders, or databases.’”
§ Alleged injuries of “emotional harm and the alleged loss of value of Plaintiffs’ personal information” are not valid injury for CFAA purposes.
o Washington equivalent of ECPA
§ Washington plaintiffs failed to allege facts “supporting the reasonableness factors to determine whether a communication is private.”
o State intrusion on seclusion, invasion of privacy claims
§ Dismissed to extent plaintiffs didn’t allege facts that the nature of the intruded-upon conversations meant that their alleged intrusion was “highly offensive to a reasonable person.”
Courts remain willing to scrutinize AI transcription and meeting-assistant tools, particularly where voice data, model training, retention practices, and consent are at issue. See Jennifer Ruehr’s 10 Ways To Avoid Privacy Risks Revealed In AI Notetaker Suits - Law360.
Meta AI Glasses Class Action Filed
On August 31, 2026, plaintiffs filed an amended complaint for a consolidated class action lawsuit filed against Meta and Luxottica in the northern district of California. The lawsuit alleges that Meta AI Glasses collect, transmit, and use sensitive user and bystander data in ways that were not adequately disclosed to consumers. The complaint challenges Meta's marketing claims that the glasses were "designed for privacy" and "controlled by you," alleging that recordings and captured content were routed to Meta's systems and reviewed by human annotators as part of AI development efforts.
The plaintiffs also allege that the glasses can be activated unintentionally, potentially capturing sensitive information, including private conversations, financial information, medical discussions, and images of individuals who were unaware they were being recorded. The lawsuit further raises concerns regarding bystander privacy, alleging that individuals may have been recorded without knowledge or consent.
The complaint asserts a broad range of federal and state law claims, including consumer protection, privacy, wiretapping, biometric privacy, product liability, and unfair competition causes of action. Plaintiffs seek damages, injunctive relief, and changes to Meta's data collection and AI training practices.
Character.AI Files for Bankruptcy
On October 12, 2026, Character.AI announced that it had voluntarily filed for Chapter 11 bankruptcy, citing significant legal, regulatory, and operational headwinds and leaving its platform available for now. A press release elaborated that bidding procedures "designed to achieve the highest or otherwise best offers for the Company’s assets and [seeking] approval to designate Disney a stalking horse purchaser for certain of the Company’s assets," have been proposed.
NIST Blog Identifies Five Identity and Authorization Risks in Agentic AI Deployments
On August 27, 2026, NIST's National Cybersecurity Center of Excellence (NCCoE) published a Cybersecurity Insights post "Back to the Future" on identity and authorization for AI agents, drawing on public comments to its concept paper on software and AI agent identity and authorization.
The argument is that agentic deployments are not generating wholly novel security problems so much as reintroducing familiar identity and access management (IAM) failures at machine speed. The post names five patterns:
1. Sharing human credentials with agents, which creates accountability gaps that matter most where non-repudiation is a control (financial transactions, health data);
2. Static, long-lived API keys and bearer tokens, which carry no proof of possession and often sit in the clear in config files and logs;
3. Broadly scoped entitlements, which agents will probe and act on more quickly and less predictably than humans;
4. Deploying agents under local user accounts, which lets them impersonate the user and defeats central identity management; and
5. Over-reliance on human-in-the-loop (HITL) approval, which breeds the same reflexive clicking as multi-factor authentication push bombing.
NIST's position is that existing standards—including OAuth 2.0, SPIFFE, and sender-constrained tokens—are adequate foundations today, and it points to NISTIR 8587 on token management (finalized on September 15, 2026, further posts and publications in the series are planned).
None of this is binding, but it is a workable baseline for an organization’s AI governance: give agents their own identities bound to a responsible human, scope and time-limit their credentials, and treat elicitation prompts as a channel that should never carry credentials or sensitive data.
NAI Published Voluntary Guidance on AI Use in Network Advertising
On July 20, 2026, the Network Advertising Initiative (NAI) published Key Do's & Don'ts for Using AI in Network Advertising, a voluntary guidance document for its ad-tech members. There is no compliance deadline or enforcement date.
The guidance does not add controls for the machine learning, optimization, and predictive modeling already governed by the NAI Framework. It targets two newer categories: generative and broadly adaptive systems, including natural-language audience creation tools, and agentic workflows in which systems access data, bid on inventory, and execute transactions without a human approving each step. Recommendations scale with a system's autonomy.
Nine topics are covered:
1. Inventory and enabling of AI use cases
2. Advertising audience/segment review and activation
3. Testing and monitoring of AI systems
4. Disclosures about how AI systems are used
5. Permissions and constraints applied to AI systems
6. Choice and signal handling
7. Oversight and logging for agentic AI systems
8. Contracting and risk allocation between AI users and AI vendors
9. Accountability
Ad-tech clients should inventory AI-enabled tools and categorize them by level of autonomy; screen AI-generated segments against a sensitive-vertical list before activation, including for inadvertent proxies; confirm that opt-out and preference signals such as Global Privacy Control (GPC) are preserved across intermediaries and orchestration layers; and revisit vendor contracts to allocate AI-specific responsibility, including whether workflow-exposed campaign and audience data may be reused for fine-tuning or general training. The guidance document closes with a one-page checklist of nine working questions.
CA Governor Issues AI Oversight and Safety Executive Order
On September 18, 2026, the CA Governor announced the issuance of Executive Order N-9-26 “to dramatically accelerate the implementation of new third-party oversight of safety and security risks in AI systems, as well as independent audits.”
In addition to summarizing enacted CA legislation and efforts relating to AI, the press release notes that the executive order convenes a group of experts to provide California a guide for its AI safety and security laws within two months and directs the Government Operations Agency to accelerate the implementation timelines for SB 813 and AB 1405.
SB 813 establishes “a framework for independent verification organizations that can assess AI systems and models for safety and risk.” Its requirements for the Government Operations Agency and AI auditors (“Independent verification organization” or “IVOs”) which the agency has designated as having demonstrated expertise in AI risk assessments include:
Requiring the agency, on or before January 1, 2028, to develop criteria for determining whether an AI auditor qualifies as a designated IVO and criteria for whether to grant or remove such designation.
Requiring a designated IVO to submit annual reports to the agency and legislature of its standards and methodologies and of any changes to its governance policies or sources of funding.
Beginning on January 1, 2029, AB 1405 creates “a state registry for AI auditors that assess AI systems and models for compliance with state law and establishing standards for their independence, transparency, and integrity.” A person may not offer, sell, or conduct a covered AI audit unless they have registered. The audits must also meet requirements as stated by the law.
California Passes Twin AI Transparency Laws
On September 30, 2026, California passed SB 1000 and AB 2713, amending the California AI Transparency Act. Key changes include:
SB 1000
Expanded covered-provider scope. SB 1000 removes the Act’s existing threshold of more than one million monthly visitors or users from the definition of “covered provider.”
Revised verification tool requirements. SB 1000 replaces the existing “AI detection tool” terminology with a “disclosure verification tool” and modifies its requirements by expressly permitting providers to rely on compliant third-party verification tools to meet the verification tool requirement. It also excludes alterations consisting only of specified “minor modifications” from the tool’s assessment of whether content was created or altered by the provider’s system. "Minor modifications" are defined as the following alterations: changes to brightness, contrast, or color; sharpening or saturation; resizing or scaling; cropping; file-format conversions; and certain audio denoising.
Expanded latent provenance disclosure requirements. SB 1000 expands the latent disclosure requirement by requiring:
o Providers to include latent disclosures in content that is created or altered by genAI systems, previously only applying to content "created by" genAI systems under SB 942. It also includes an exception for “minor modifications,” which do not need latent disclosures.
o Providers to include in the provenance data whether the system created or altered the content.
o Latent disclosures, where not permanent, to be extraordinarily difficult to remove or tamper with, adding tamper resistance to the existing requirement.
o Latent disclosures to be "compliant or interoperable" with widely recognized industry standards, replacing SB 942's requirement to be "consistent" with such standards.
Eliminated manifest disclosure requirement. SB 1000 eliminates the requirement that providers offer users the option to include a manifest disclosure identifying content as AI-generated.
Revised third-party licensing requirements. SB 1000 significantly revises the existing third-party licensing framework. It introduces an obligation for providers to notify licensees of their obligations under the Act. If a provider knows that a licensee modified the genAI system so that it no longer complies with the Act, the provider must, within 72 hours, either terminate the licensee's authorization or notify the licensee of the noncompliance and that continued noncompliance must be reported to the AG. If notified, the licensee must bring the system into compliance or cease using or making it available, and report the action taken to the provider within 96 hours. If the licensee fails to provide that report, or reports that it did not remediate or cease use, the provider must report the noncompliance to the AG. The Act does not require providers to monitor, investigate, or otherwise inquire into a licensee’s use or modification of a licensed system.
Other changes. SB 1000 also makes additional changes concerning the output of personal information by disclosure verification tools and requirements for genAI systems designed primarily to function as assistive technology.
AB 2713
Clarified applicable provenance standards. AB 2713 specifies that large online platforms are not required to take any action with respect to provenance data that is not compliant or interoperable with widely adopted specifications issued by an established standards-setting body.
Expanded platform provenance detection requirements. AB 853 requires large online platforms to detect provenance data that is embedded into or attached to content. AB 2713 expands this requirement to provenance data that is also "otherwise associated with" content. The law does not define what constitutes provenance data that is “otherwise associated with” content, leaving some uncertainty regarding the practical scope of this expanded requirement. The language may be intended to accommodate current or future additional technical methods of associating and tracking provenance information.
Expanded provenance preservation requirements. AB 2713 expands the existing prohibition on knowingly stripping provenance data from content uploaded to or distributed on a platform to also cover content downloaded from the platform, to the extent technically feasible.
California Workplace Surveillance Law AB 1883 Passed
On September 30, 2026, California enacted AB 1883, updating Division 2 of the Labor Code to prohibit employers' use of "workplace surveillance" tools that use AI for (1) "Recognizing, or making inferences or predictions about, an individual’s emotional state; or (2) Collecting neural data."
The law will be enforceable by either California's Labor Commissioner or a public prosecutor. Violations are subject to civil penalties of up to $500 for each violation.
CT AG Reminds Consumers of Privacy Rights Entering into Effect
On September 16, 2026, the Connecticut AG published a reminder that, under amendments entering into effect on October 1, 2026, of additional privacy rights, "related to artificial intelligence, Facial Recognition Technology (FRT), genetic data privacy, surveillance pricing, and data brokers, as well as through recent amendments to the Connecticut Data Privacy Act (“CTDPA”)."
Under SB4, the AG highlighted the following rights and requirements:
Limitations on surveillance pricing as well as disclosure requirements for businesses using personal data in price settings;
Limitations on and disclosure requirements for the use of FRT, including requiring that companies post clearly legible signage alerting consumers that FRT is in use on the premises and providing them with a conspicuous hyperlink or quick response code directing them to the company’s facial recognition technology policy;
Limitations and consent obligations for Direct-to-Consumer Testing Companies that are collecting consumer’s genetic data, including providing consumers with a property right and exclusive control over the collection, use, retention, maintenance, disclosure, and destruction of the sample and result;
Further limitations on what is considered publicly available information as well as expanded consumer data deletion rights related to consumer profiles generated from publicly available information;
A ban on the sale of consumer’s precise geolocation data; and
The creation of a data broker registry which requires data brokers to register with the Connecticut Department of Consumer Protection by January 1, 2027.
Under SB5, the AG highlighted the Connecticut Artificial Intelligence Responsibility and Transparency Act (“CART Act”) with the following rights and requirements:
Chatbots and Kids
o Companies that offer chatbots to children must put a protocol in place to detect and address chats indicating a risk of self-harm;
o Chatbot platforms must offer parental controls;
o Chatbots are prohibited from sending harmful communications to children;
o Chatbots cannot encourage children towards physical violence, substance abuse, or disordered eating; and
o Companies that offer chatbots to children cannot allow their chatbots to engage in romantic or sexual interactions with children or use manipulative engagement mechanics to keep them using the platform.
AI and Employment
o Employers must provide written notice when using AI to make a decision that impacts terms, privileges, or conditions of employment; and
o Employers are prohibited from using AI to discriminate against employees, and any such discrimination is considered employment discrimination that is also violative of the Connecticut Fair Employment Practices Act.
New Mexico Unveil Frontier AI Legislation Ahead of 2027 Legislative Session
On October 1, 2026, Attorney General Raúl Torrez and State Representative Linda Serrato announced the Frontier Artificial Intelligence Safety Act (summary here), in response to cybersecurity incidents where AI agents accessed systems without authorization or explicit instruction.
The proposal looks to complement other frontier AI model legislation, California's Transparency in Frontier Artificial Intelligence Act (SB 53, effective January 2026), New York's RAISE Act (effective January 2027), and the EU AI Act, and share many obligations while tightening others:
Framework, risk-assessment, and transparency-report obligations
Reporting within 72 hours of any critical safety incident, and 24 hours for a loss-of-control or autonomous cyber-offense incident.
Third-party audits of a developer's own risk assessment, narrowed to the specific risk categories tied to the incident.
Export-control-style know-your-customer and anomalous-use duty for large compute providers.
Pre-training notification.
Damage and liability based remedies, in contrast to NY and CA.
If the proposal passes, it will be effective July 1, 2027.
Colorado AG Publishes Interim Draft Rules for Chatbots & Automated Decision-Making Technologies (ADMT)
On October 6, 2026, the DOL released an interim draft of the ADMT and Chatbot Safety Rules, which clarify and implement Senate Bill 26-189 and House Bill 26-1263, and a cover page with additional considerations.
Notably, the ADMT rules state that a party that integrates existing Covered ADMT into its own Covered ADMT product and provides its own Covered ADMT product to another Developer or a Deployer and a Developer that integrates existing Covered ADMT into its own Covered ADMT and provides its own Covered ADMT product are considered "Developers." Along with examples for education, employment, real estate, and financial services, the rules have provisions for ADMT use including:
Requiring ADMT developers to create and maintain documentation and disclose to a Deployer (Deploy defined as use of Covered ADMT in, run directly or through a third-party, to make a Consequential Decision) the Covered ADMT’s known limitations, known risks, and circumstances under which the Covered ADMT should and should not be used.
Providing that the presumption that ADMT output Materially Influences a Consequential Decision may be rebutted with evidence that the output was a de-minimis factor in the decision.
Requiring Deployers to provide ADMT Adverse Outcome Disclosures, which must contain a plain language description of the Consequential Decision and the role the Covered ADMT played, instructions to request additional information about the Covered ADMT, an explanation of the Consumer Rights and how to exercise them.
Requiring Deployers to process Consumer Rights (Right to Access/Correct Personal Data used in the Consequential Decision and Meaningful Human Review) after the Deployer uses a commercially reasonable method for authenticating the consumer's identity.
The Rules also have provisions for Operators of Conversational Artificial Intelligence Services, including:
Requiring the use of commercially reasonable methods or generally accepted methods to estimate the age of Account Holders or Users of Conversational Artificial Intelligence Services, such as an ISO/IEC 27566-1:2025 and, where applicable, 5IEEE 2089.1 compliant age assurance system or method; a cryptographic technique, such as a zero-knowledge proof; matching a scan of a government-issued ID and live photo or video using facial recognition; or signing in with an authenticated, school-provisioned account.
Requiring the disclosure to the user that they are interacting with artificial intelligence.
Requiring the provision of tools to minors and their parents to control privacy and safety settings.
Requiring the submission of an Annual Report to the Attorney General’s office on or before July 1. The report must include the operator's size, the number of crisis service provider referral notifications reported, the protocols for responding to user suicidal ideation or self-harm risk, age-estimation measures and the sexual-content safeguards.
State AG Coalition Urges Congress to Regulate Large-Scale AI Models/Devs
On September 23, 2026, a bipartisan coalition of 25 state AGs, led by NY and NJ, sent an open letter to Congress urging them to regulate large-scale AI models and developers. The letter discusses the recently-reported AI safety incidents (e.g., Open AI / Hugging Face), the shortcomings of self-regulation, recent support for regulation by developers, and a list of recommended features that a national framework for regulating large-scale AI models would address (e.g., safety testing and standards, government-led incident response, no preemption of state laws).
The letter is signed by a mix of states with and without AI-specific or comprehensive privacy laws, such as AZ, CA, CO, CT, DE, IL, MD, MN, NV, VA, and WA. In announcing his signature on the letter, the California AG emphasized California's ongoing legislative/enforcement work to ensure AI safety.
Global Updates
European Telecommunications Standards Institute Publishes AI Data Quality Standard
On September 3, 2026, the European Telecommunications Standards Institute (ETSI) announced a framework to assess "the quality of data used across digital and AI ecosystems." The framework's 18 metrics can be put into four categories:
Fundamental data quality: including completeness, accuracy, reliability, consistency, precision, integrity, redundancy and uniqueness.
Usability: including availability, coverage, lineage, traceability and timeliness.
Fairness: including label quality, measurement bias and representation bias.
Privacy and responsible data use: including anonymity and confidentiality.
European Commission Designates ChatGPT as a Very Large Online Search Engine Under the DSA
On August 31, 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine (VLOSE), and designated Reddit and Roblox as Very Large Online Platforms (VLOPs). Each service declared that it reaches at least 45 million average monthly users in the EU, meeting the designation threshold.
According to IAPP: “The designation brings additional DSA requirements for systemic risk assessment and mitigation, children's online safety and preservation of fundamental rights, which take effect in January 2027.”
Interestingly, the Commission treated ChatGPT as a hybrid service that qualifies as an online search engine under the DSA because it responds to user prompts in part by searching the web. This appears to be the first time a conversational AI assistant has been designated as a VLOSE, with the designation based on its retrieval functionality rather than the underlying model. Reddit and Roblox were designated as platforms on the ground that users disseminate third-party content to the public.
The Commission will supervise compliance alongside Coimisiún na Meán in Ireland for ChatGPT and alongside The Authority for Consumers and Markets in the Netherlands for Reddit and Roblox. The Commission also gains investigative powers over the functionalities behind the services.
Ireland, Poland, and Greece Adopt AI Act Implementation Legislation
Over July 2026, Ireland, Poland, and Greece adopted laws implementing the EU AI Act. The laws establish these countries’ domestic regulatory structures for overseeing AI systems and supporting compliance with the EU AI Act. Organizations developing, deploying, or using AI systems in these countries should monitor implementation guidance and enforcement developments as authorities begin operationalizing the new framework and aligning national oversight with broader EU AI requirements.
On July 21, 2026, Ireland’s Regulation of Artificial Intelligence Act 2026 was signed into law.
On July 27, 2026, Poland adopted the Act on Artificial Intelligence Systems.
On July 20, 2026, Greece adopted Law 5321/2026.
China's Supreme People's Court Issues Nationwide Guidance on Artificial Intelligence Disputes
On September 7, 2026, China's Supreme People's Court (SPC) issued 24-article Opinions directing lower courts on how the Civil Code, Personal Information Protection Law, and other existing statutes apply to AI disputes.
China has no dedicated AI statute, so the Opinions show judges how current law maps onto specific AI fact patterns: face swapping and voice cloning, hallucinated content, AI-assisted doxxing, algorithmic price discrimination, driver-assist vehicles, and model training. The SPC calls the document the first set of AI adjudication rules issued by China's top court, deliberately leaving questions where no consensus has formed unaddressed.
Key Takeaways from the SPC Opinions:
Fault Liability. Where no strict-liability rule applies, courts will use ordinary fault principles and allocate responsibility among developers, providers, and users based on factors such as system autonomy, foreseeable risks, safeguards, and user control.
Privacy and Training Data. Publicly available personal information may generally be used for model training if the use is reasonable and the individual has not objected. Courts will assess necessity, proportionality, data sensitivity, and context. AI-enabled doxxing, surveillance, and other privacy intrusions remain unlawful.
Deepfakes and Synthetic Content. Unauthorized use of a person's likeness, name, or voice can infringe personality rights. Providers may face liability if they fail to act after receiving valid notice of infringing content, while users who intentionally generate infringing outputs remain responsible.
Consumer Protection and AI Products. Unreasonable algorithmic price discrimination may create liability. Product-liability rules apply to physical AI products such as robots and autonomous vehicles, with courts examining factors including self-learning capabilities, updates, user control, and risk disclosures.
Intellectual Property and Data. Courts will allocate copyright liability among developers, providers, and users. Developers may need to prove training-data provenance and model operations. Open-source contributors may receive limited protection if they disclose functions and risks. The SPC left unresolved whether AI-generated content is copyrightable and how unlicensed training on copyrighted works should be treated.
AI in Litigation. Courts may draw adverse inferences when parties withhold key electronic evidence. AI-generated evidence will be scrutinized, and fabricated AI evidence can result in sanctions. Parties using AI in court filings must verify accuracy and disclose AI assistance.
Implications for Companies. The Opinions make governance, recordkeeping, and training-data documentation increasingly important. Companies should maintain evidence of data sources and development processes, establish notice-and-takedown procedures, review pricing and consent practices, and ensure clear disclosures regarding AI capabilities and risks.
The Opinions apply as of their issuance on September 7, 2026, and do not state a separate effective date.
Slovenia Publishes Guidance on Art 50(2) Transparency Obligations Under EU AI Act
On September 21, 2026, the Agency for Communication Networks and Services of the Republic of Slovenia (AKOS) published guidance on the transparency obligations under Article 50(2) of the EU AI Act for providers of artificial intelligence (AI) systems that create or manipulate synthetic audio, image, video, or text content.
Per the guidance, the provider must highlight the output of the AI system (image, video, sound or text) so that it is labelled in a machine-readable format and detectable as artificially generated or manipulated, even if the output contains human generated or manipulated content. Possible marking techniques include:
Watermarks;
Metadata tagging;
Cryptographic methods for proving the origin and authenticity of the content;
Recording methods;
Digital fingerprints; or
Other appropriate techniques or combinations of those techniques.
These requirements entered into effect on August 2, 2026, and providers of relevant systems placed on the market before that date must comply by December 2, 2026.
Kazakhstan's National Standard for AI Applications Published
On October 8, 2026, Kazakhstan's Ministry of Artificial Intelligence and Digital Development announced the introduction of a national standard for the development and use of AI. The standard, ST RK ISO/IEC 5339-2025, has been in effect since January 1, 2026, and is identical to the ISO Standard ISO/IEC 3559:2024.
Malaysia's Personal Data Protection Department Launches Public Consultation on AI
On October 5, 2026, Malaysia's Personal Data Protection Department (PDP) published Public Consultation Paper No. 1/2026, an Artificial Intelligence and Personal Data Protection Framework, for comment until October 23, 2026. The framework is proposed as a primary reference document to clarify regulatory obligations when personal data is processed through AI, outline best practices regarding personal data processing across AI models, and strengthen data governance throughout AI system lifecycle.
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on AI, privacy, and data security. Hintze attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of AI, privacy, and data security.