Compliance Stuff

Building on Section 8 of the December 2025 Executive Order, [1]  the Trump administration’s “National Policy Framework for Artificial Intelligence,” (the “Framework”) released on March 20, 2026, provides a formal legislative blueprint for advancing the administration’s goal of a uniform, national policy for AI across the United States. [2]  While the Executive Order provided only the outline of a national legislative scheme, the current Framework provides greater specificity regarding the statutory goals of an AI bill. Yet an omnibus statute incorporating provisions meant to achieve all these goals will likely face a gauntlet of constitutional challenges. This article explores a series of questions to assess the viability of several of these goals. While this discussion addresses only a subset of the potential friction points, they are where the rubber hits the road for any legislation seeking to achieve the Framework’s goals. Question 1: Can Congress preempt AI “development” ...

Earlier this month, the United States District Court for the Eastern District of Texas approved a  consent judgment  vacating the Consumer Financial Protection Bureau’s (CFPB) Medical Debt Rule. T he decision holds that the CFPB exceeded its authority under the Fair Credit Reporting Act (FCRA) and violated the Administrative Procedure Act (APA) when enacting the Rule . This development has significant implications for healthcare providers and other entities involved in the reporting and use of medical debt information. Background: The Medical Debt Rule and FCRA The FCRA, permits Credit Reporting Agencies (CRAs) to report medical debt information—provided it is coded to protect patient privacy—i.e., it does not disclose the patient’s health condition or procedure.   Continuing with its efforts to  prioritize  medical debt rulemaking, the CFPB’s Medical Debt Rule, finalized in January 2025, sought to prohibit CRAs from including any medical debt information in con...

  According to a recent policy statement issued by the Consumer Financial Protection Bureau (the CFPB), employers that purchase or use certain reports generated about current or prospective employees—including those using AI-powered technologies to assess employees’ productivity—are required to comply with various requirements of the Fair Credit Reporting Act (the FCRA), including obtaining consent from employees prior to purchasing such reports and providing notices to employees before taking adverse employment actions based on such reports. What does the CFPB’s policy statement say? On October 24, 2024, the CFPB issued its latest circular ( Circular 2024-06 ). Many employers are familiar with the FCRA’s requirements in the context of employee background checks and credit reports. Circular 2024-06 states that the FCRA also applies to the use of other types of third-party employee reports. S pecifically, Circular 2024-06 describes various types of reports generated and sold by thir...

  The Consumer Financial Protection Bureau (CFPB) recently issued guidance that takes an aggressive position regarding the scope of the Fair Credit Reporting Act (FCRA) as covering certain employee monitoring and assessment tools used for hiring and to gauge employee productivity. This development affects virtually every employer using third-party vendors for employee screening, monitoring, or assessment. Quick Hits The CFPB’s recently issued guidance on the Fair Credit Reporting Act affects virtually every employer using third-party vendors for employee screening, monitoring, or assessment. The guidance serves as a reminder for employers that gather third-party information to vet job applicants to consider whether their third-party vendors’ practices trigger FCRA requirements. This guidance also highlights ongoing regulatory trends toward increased scrutiny of workplace monitoring and AI-powered assessment tools. What Makes a Tool Subject to the FCRA? The CFPB provides a (facially...