Compliance Stuff

On April 1, 2026, Governor Bill Lee signed  Senate Bill 1580  into law, making Tennessee among the first states to specifically regulate how AI can be marketed and used in the mental health space. The new law takes effect July 1, 2026. What Does the New Law Do? The new law is short and straightforward, providing that a person who develops or deploys an artificial intelligence system cannot advertise or represent to the public that such a system is, or is able to act as, a qualified mental health professional. Artificial intelligence  is broadly defined to mean “models and systems capable of performing functions generally associated with human intelligence, including reasoning and learning.”  Qualified mental health professionals are  defined in existing Tennessee mental health law to include certain licensed psychiatrists, psychologists, psychological examiners, social workers, and marital and family therapists. The new law establishes a private right of action...

  A new US National Cybersecurity Alliance   survey   shows that over one-third (38%) of “employees share sensitive work information with artificial intelligence (AI) tools without their employer’s permission.” Not surprisingly, “Gen Z and millennial workers are more likely to s hare sensitive work information without getting permission.” The problem with employees sharing workplace data with chatbots is that if a worker inputs sensitive personal information or proprietary information into the model, that information is then used to train the model. If another user enters a query that the original information is responsive to, then the sensitive or proprietary data is provided in the response. That’s how generative AI works. The data disclosed is used to teach the model and is no longer private. According to Dark Reading, several cases illustrate how significant the risk of employees sharing confidential information with chatbots is: “ A financial services firm integrate...

  Chatbots are likely to lead to a new wave of class action lawsuits. This is how are we helping our clients get ready. Claims include: Contemporaneous recording by the chat provider Chat provider uses the c hat transcripts to train and improve its AI Chat provider analyzes the chat to make determinations regarding the emotional state of the individual Causes of action: CIPA / wiretapping Invasion of Privacy Intrusion upon seclusion Quasi contract Things to consider: If you are using a third party to power your chat interactions, you must review the agreement with them and understand their role. Are they using any data for their own purposes? Could this be considered a “sale” or a “deceptive/unfair” practice? What is the AI involved? If AI is involved for behavior (emotion) analysis, this could be actionable “profiling” under data privacy laws and may require: DPIA, expanded disclosure etc. Disclose to your users that they are speaking with a robot and that a third party has acce...