Privacy Program, AI Governance and Board Reporting

The FBI's Internet Crime Complaint Center took in 1,008,597 complaints in 2025, with reported losses of $20.877 billion (IC3 2025 report, as of October 2026). Business email compromise alone accounted for 24,768 complaints and $3,046,598,558. IC3 also counted 22,364 complaints that referenced artificial intelligence, with adjusted losses above $893 million. Those numbers describe the two things this last lesson has to deal with. People are using AI tools on your data without telling you, and criminals are using AI tools on your people without asking.

Earlier lessons built the pieces. Lesson 01 said why management owns the risk. Lesson 02 laid out the technical layers, and lesson 10 the policies. Lesson 11 covered incidents and lesson 12 recovery and insurance. This lesson ties them together with the part that faces customers and employees, which is privacy, and the part that has grown fastest, which is AI, and then shows how to report the whole program upward. For the laws that apply to the general public, see the privacy and data security laws module. For hands-on steps at office scale, see the small business data security module.

A privacy program in nine parts

Security keeps outsiders away from data. Privacy decides whether you should have the data at all, what you may do with it, and what you owe the person it describes. A business can be well secured and still break privacy rules by collecting too much, using data for a new purpose without telling anyone, or keeping it for ten years. The table lays out the working parts, who should own each, and the evidence an auditor, a regulator or a customer will ask to see.

Part	What it means in practice	Typical owner	Evidence to keep
Data map	Where personal data enters, lives, moves and leaves; which systems and vendors touch it (see lesson 03)	Privacy lead with IT	Data inventory reviewed at least yearly
Data minimization	Collect only fields a stated purpose needs; stop collecting when the purpose ends; remove fields from forms nobody uses	Each business unit head	Form field review; purpose list per data type
Notice	A privacy notice that matches what you actually do, in plain words, on the website and at collection points; a separate employee and applicant notice where a law requires it	Privacy lead	Dated versions of each notice
Consent and choices	Ask for consent where a law or your own promise requires it; honor opt-outs and withdrawals; record what each person agreed to	Marketing and privacy lead	Consent log; opt-out processing times
Rights requests	Intake, identity checks, search across systems, answer on time, record the outcome	Privacy lead	Request log with dates received and closed
Retention and disposal	A schedule per record type with a destruction date, run on a calendar (see lesson 10)	Finance or compliance lead	Schedule; destruction certificates or system logs
Risk assessments	A written review before a higher-risk use of data, with benefits, risks and safeguards	Privacy lead with the project sponsor	Signed assessments
Vendors	Contracts that limit what vendors may do with your data and require breach notice (see lesson 09)	Procurement with security	Vendor register; signed data agreements
Training and accountability	Staff who handle personal data know the rules and who to ask; a named person answers for the program	HR with privacy lead	Training records; program charter

Not every business has legal duties for every row. Which row bites depends on your data and your customers, and lessons 06 and 07 sort that out. A company with no regulated data and no EU customers still faces contract terms, insurer questions and the Federal Trade Commission's authority over unfair or deceptive practices. A privacy notice that promises something you do not do is the cleanest way to hand the FTC a case. The cheapest privacy program is one that writes down what is already true and fixes the gaps.

Data minimization pays twice

Every field you do not collect is a field you cannot lose, cannot be asked for and do not have to search. A retailer that stopped asking for date of birth on a loyalty form and deleted old values has fewer rights-request hits, a smaller breach if one occurs, and one fewer sensitive field to protect. Ask each data owner a single question: what decision do you make with this field? If the answer is none, stop collecting it. The Safeguards Rule goes as far as requiring covered businesses to securely dispose of customer information no later than two years after it was last used for the transaction, unless it is needed for business or legal reasons (16 CFR 314.4(c)(6)(i), as of October 2026; the exceptions include business need, legal retention duties and cases where targeted disposal is not reasonably feasible).

Answering rights requests on time

Where a privacy law gives people the right to see, correct, delete or move their data, it also sets a clock. The clocks differ, so a company that serves several jurisdictions should run to the shortest and keep a log.

Law	Clock	Extension	Source
California Consumer Privacy Act, Civil Code 1798.130	45 days from receipt of a verifiable consumer request	Once, by up to 45 more days when reasonably necessary, with notice to the consumer inside the first 45 days	CCPA text
EU and UK GDPR, Article 12(3)	Without undue delay and within one month of receipt	Up to two further months for complex or numerous requests, with notice and reasons inside the first month	Article 12
Other U.S. state privacy laws	Several use 45 days. This lesson did not verify each state, and the list of states changes.	Varies	See lesson 07
Idaho	Idaho has a breach notice statute (Idaho Code 28-51-104 to 107). We found no enacted Idaho broad consumer privacy law in the sources checked for this lesson, so there is no Idaho consumer request clock to report. Confirm at the legislature's site.	Not applicable	Idaho Code 28-51-105

Start the clock on the day the request arrives anywhere in the company, including a sales rep's inbox. Verify identity in proportion to the risk, because handing someone else's purchase history to an impostor is a breach you caused. And log everything: date received, identity method, systems searched, date answered, what was withheld and why.

Risk assessments before risky uses

Some laws require a written risk assessment before certain data uses. The GDPR calls it a data protection impact assessment. California's regulations, approved by the state's Office of Administrative Law on September 22, 2025 and effective January 1, 2026, add risk assessments, cybersecurity audits and rules for automated decision-making technology to the CCPA (California Privacy Protection Agency). One law firm summary reports these dates: risk assessment compliance begins January 1, 2026, with an attestation and summary to the agency due by April 1, 2028, and cybersecurity audit certifications due April 1, 2028 for businesses over $100 million in revenue, April 1, 2029 for $50 million to $100 million, and April 1, 2030 for businesses under $50 million (Hunton). Those are secondary-source dates, so read the regulation text. They apply only to businesses that meet the CCPA's thresholds, which lesson 07 explains.

Even where no law demands it, the habit is worth having. Before a new use of personal data, such as profiling customers, adding facial recognition at the door or feeding support tickets to an AI model, write one page: purpose, data used, who sees it, what could go wrong for the person, what you did about it, and who signed. It takes an hour and it is the first thing an insurer or regulator asks for after something does go wrong.

Generative AI and shadow AI

Generative AI tools write, summarize, translate, code and answer questions. Staff use them because they save time, and they will keep using them whether or not you have a policy. The real question for management is what company data leaves the building when they do.

IBM's Cost of a Data Breach Report 2026 put the global average breach cost at $4.99 million, a record and up 12 percent (IBM). Trade press coverage of the same report gives a U.S. average of $11.5 million (eSecurity Planet) and reports that shadow AI was involved in 43 percent of breaches, up from 20 percent in 2025, that 68 percent of breached organizations had no AI governance framework, and that 92 percent of organizations with an AI-related breach lacked proper AI access controls (Forkast). We read those secondary summaries rather than the full IBM report, so quote IBM's own wording if you put the figures in a board paper. Baker Donelson's summary says the study analyzed 602 breaches at organizations across 17 industries between March 2025 and February 2026, and large organizations skew its averages upward. A 100-person firm should not expect an $11.5 million breach, though it should expect the same mechanisms.

Where the data goes

• Pasted text and uploaded files in a public chatbot. Depending on the service and the account type, the provider may keep prompts, use them to improve models, or let its staff review them. Business and enterprise plans usually say otherwise in their terms, and the terms differ by vendor.
• AI features inside tools you already own: meeting recorders, email summarizers, CRM assistants, design tools. They arrive by software update, often switched on by default.
• Browser extensions and plug-ins that read every page the user opens.
• AI agents that connect to mailboxes, drives and calendars with a user's permissions and can act on them.
• Outputs that go wrong: invented citations, wrong figures, code with flaws, text that copies protected material, and decisions about people made without review.

Governance in four moves

First, find out what is in use. Pull a month of web proxy or DNS logs, review the SaaS list from your identity provider, and ask each department head in writing. The result is the AI inventory. Second, sort tools into tiers. Third, set data rules by class, using the four-label scheme from lesson 10. Fourth, read the vendor terms before you approve anything.

Tier	What qualifies	Data allowed	Controls
Approved	Company-licensed business or enterprise accounts with written terms that bar training on your data, give you control of retention, and name subprocessors	Public and internal data. Confidential data only for tools the privacy lead has cleared for that class.	Single sign-on, MFA, admin console, logging, named owner
Limited	Useful tools with weaker or unclear terms, or free tiers	Public data only. No customer, employee, financial or health data.	Registered in the inventory; reviewed every six months
Prohibited	Tools that refuse business terms, store data in places you cannot accept, or have no named company behind them	None	Blocked at the web filter where possible

Restricted data, such as health records, payment card numbers, government identifiers and anything covered by a customer contract that bars outside processing, stays out of every tier unless a written exception says otherwise. Payment card data has its own rules (lesson 05).

Questions to ask an AI vendor

• Is customer content used to train or improve any model, yours or a third party's? Is that off by default for our account type, and where does the contract say so?
• Where is our data processed and stored, how long is it kept, and can we set the retention period and delete on demand?
• Which subprocessors, including the underlying model provider, touch our data?
• Do you have a current SOC 2 Type 2 report or ISO/IEC 27001 certificate, and may we read the report under a confidentiality agreement? (See lesson 04.)
• What is your breach notice commitment, in hours, and to whom?
• Who owns inputs and outputs, and what indemnity, if any, do you offer if an output infringes someone's rights?
• Can administrators see usage logs, restrict features, and turn off agents and connectors?

NIST AI RMF and ISO/IEC 42001 in plain words

The National Institute of Standards and Technology released AI RMF 1.0 on January 26, 2023. It is voluntary and built around four functions: Govern, Map, Measure and Manage. Govern is the culture, roles and policies. Map is finding where and how AI is used and who is affected. Measure is testing and tracking risks. Manage is acting on them. NIST published a Generative AI Profile, NIST AI 600-1, on July 26, 2024, and the NIST page was updated on April 8, 2026. NIST's own AI RMF page says the framework is being revised as part of the White House AI Action Plan, and it lists an April 7, 2026 concept note for a profile on AI in critical infrastructure (NIST, as of October 2026). Check the page for what version is current before you cite it.

For a small business the framework turns into a short list. Govern: one named owner, one policy, one approver. Map: the AI inventory. Measure: a review of each approved tool for accuracy, bias where decisions about people are involved, and data handling. Manage: an incident path for AI problems that plugs into your response plan from lesson 11.

ISO/IEC 42001:2023, published in December 2023, is the certifiable counterpart: a management system standard for organizations that provide or use AI (ISO). Nobody has to certify to it. A company that sells AI-enabled services to enterprise customers may be asked about it the way it is asked about ISO 27001 today. The same lesson from lesson 04 applies: use a free framework as your backbone and buy a certificate only when a buyer demands one.

State and federal AI rules, as of October 2026

This is the fastest-moving piece of the course. Read it as a dated snapshot, and check the official text before you act.

Rule	Status as of October 2026	What it asks of a business	Enforcement
Colorado SB 26-189 (replaces SB 24-205)	Signed May 14, 2026, per three law firm summaries (Goodwin, Constangy, Davis Wright Tremaine). Most provisions start January 1, 2027, and the date could move if the xAI challenge produces an injunction. The state's bill page, when we read it, still showed only the May 1 introduced version, so read the enrolled text.	Developers give deployers information on uses, limits and training data. Deployers give notice that covered automated decision-making technology is used and an adverse-decision notice (one summary says within 30 days), allow correction and human review, and keep records at least three years. Goodwin and Davis Wright Tremaine both say the 2024 Act's risk management program and impact assessment duties were dropped.	Attorney General only. No private right of action. 60-day cure right until January 1, 2030, except for knowing or repeated violations. The Attorney General is to adopt rules by January 1, 2027.
Texas Responsible AI Governance Act (HB 149)	Effective January 1, 2026	Bans developing or deploying AI with intent to incite self-harm or crime, to violate constitutional rights, to unlawfully discriminate (disparate impact alone is not enough), or to produce prohibited sexual content including deepfakes. Disclosure duties fall mainly on government agencies and health care providers.	Attorney General only; 60-day cure period. Civil penalties of $10,000 to $12,000 for curable violations, $80,000 to $200,000 for uncurable ones, $2,000 to $40,000 a day for continuing ones. A defense exists where a violation is found through internal review and the defendant substantially complies with the NIST Generative AI Profile or another recognized framework.
Illinois HB 3773 (Public Act 103-0804)	Effective January 1, 2026	Employers may not use AI in hiring, promotion, discipline, discharge or other employment terms in a way that has the effect of discriminating on protected grounds, may not use zip codes as a proxy for protected classes, and must notify employees when they use AI for those purposes. The Department of Human Rights is to write rules on notice.	Through the Illinois Human Rights Act process
New York City Local Law 144	Enforced since July 5, 2023	Automated employment decision tools need a bias audit within a year of use, public posting of audit information, and notice to candidates and employees (the city's slides say 10 business days before use).	City Department of Consumer and Worker Protection
California CCPA regulations on ADMT	Regulations effective January 1, 2026. Businesses using ADMT for significant decisions must comply from January 1, 2027, per one secondary summary.	Notices, opt-out and access rights tied to ADMT, plus risk assessments. Only for businesses that meet CCPA thresholds.	California Privacy Protection Agency and Attorney General
Federal executive order of December 11, 2025	In effect as policy direction	Directs an AI Litigation Task Force, a Commerce Department review of state AI laws, funding conditions for states, and a legislative proposal for one national standard. One summary says the order itself does not preempt state law.	Federal government challenges state laws; businesses remain bound by state law until a court or Congress says otherwise

The Colorado story is a lesson in why to build on principles rather than on one statute. The 2024 Act was delayed once by a special session and then, on April 9, 2026, challenged in federal court by an AI company, xAI. The U.S. Department of Justice joined about two weeks later, and on April 27 a magistrate judge granted a joint request to stay enforcement while the legislature acted (Squire Patton Boggs). Then the legislature wrote a different law. What happened to the lawsuit after the replacement is not something we verified. A company that had spent a year building to the 2024 Act's impact assessment model would have kept most of the value, because notice, inventory, human review and records are common to nearly every proposal in circulation.

Biometrics, deepfakes and voice cloning

Biometrics

Fingerprint time clocks, face-scan door entry and voiceprint call-center logins all collect biometric identifiers. Illinois' Biometric Information Privacy Act, 740 ILCS 14, requires a private entity to tell the person in writing what is collected, why and for how long, and to get a written release before collecting. It requires a public written retention schedule with destruction when the purpose ends or within three years of the person's last interaction, whichever comes first. A person can sue for liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, plus fees and costs (740 ILCS 14, sections 15 and 20). Public Act 103-769, effective August 2, 2024, limits recovery where the same identifier is collected repeatedly from the same person by the same method. Other states have biometric rules of their own, which this lesson did not verify one by one, and lesson 07 covers them. The management rule is simple. Do not roll out a biometric system in any state without reading that state's rule first, and prefer a badge or an authenticator key where biometrics are not necessary.

Deepfakes and voice cloning in fraud

FinCEN, the Treasury bureau that polices financial crime, issued Alert FIN-2024-Alert004 on November 13, 2024, saying it had seen more suspicious activity reports describing suspected deepfake media, especially fake identity documents used to get past identity checks (FinCEN). IC3 reported more than $30 million in business losses from business email compromise involving AI in 2025, and voice cloning in distress scams with claimed losses above $5 million (IC3). The Federal Communications Commission ruled in February 2024 that robocalls using AI-generated voices are artificial voices under the Telephone Consumer Protection Act (FCC). That helps with unwanted calls. It does nothing to stop a clone of your CEO's voice calling your controller.

You cannot train people to hear a good clone. A few seconds of audio from a conference talk or a video can be enough for a convincing one. So the control has to work even when the fake is perfect.

Scenario	Control that works	Control that fails
Urgent wire or gift card request from an executive by call, text or video	Hang up and call back on a number from the company directory. Second approver for any wire above a set dollar limit.	"It sounded exactly like her."
Vendor changes bank details	Call a contact already on file, not the number in the change request. Hold payment 24 hours. Two people approve.	Replying to the email that asked for the change
Help desk caller wants a password or MFA reset	Verify with a manager call-back or an in-person or video check against a record, and never reset on voice alone	Asking for the employee's date of birth
Job applicant on video seems off, or the references are thin	Verify identity with a live document check at onboarding; hold equipment shipment until verified; limit access in the first weeks	Relying on a single video interview
Fake video or audio of your leaders or products circulates	A named person and a script: preserve copies, report to the platform and to IC3, post a plain correction	Silence while rumor spreads

Put the dollar thresholds in writing and put them in the accounts payable procedure, where a clerk can point to them when a "CEO" gets angry. Stating that the company will never ask for a gift card purchase, and that any request for an exception is itself a red flag, gives employees permission to say no.

What the board needs to see

Boards are not asked to run a security program. They are asked to make sure one exists, is funded and is being watched. Some rules turn that into a duty. The FTC Safeguards Rule requires the Qualified Individual to report in writing, regularly and at least annually, to the board of directors or equivalent governing body, covering the program's overall status and compliance and material matters such as risk assessment, risk management decisions, service provider arrangements, test results, security events and the response, and recommended changes (16 CFR 314.4(i)). Where there is no board, the report goes to a senior officer. Public companies go further. SEC Regulation S-K Item 106 requires an annual description of the board's oversight of cybersecurity risk and of management's role, and Form 8-K Item 1.05 requires disclosure of a material incident within four business days after the company determines it is material (SEC release 33-11216). For the director-oversight idea in general terms, see lesson 01.

A one-page board dashboard

Pick four to six indicators, show the trend against the last quarter, name an owner and set a target. Technical counts without a target are noise. This sample uses Northgate Machining's invented numbers.

Indicator	This quarter	Last quarter	Target	Owner	Read as
Accounts with phishing-resistant MFA, privileged and finance	88%	71%	100% by Q1	IT lead	Improving; 12 accounts left
Critical patches applied within 14 days	91%	84%	95%	IT lead	Near target
Last successful full restore test, and result	Passed, 6 hours	Not run	Quarterly, under 8 hours	IT lead	On target
Phishing reports per 100 staff per quarter, and median minutes to triage	19 reports, 22 minutes	11 reports, 41 minutes	Rising reports, under 30 minutes	Security lead	Healthy
Consumer rights requests closed on time	33 of 36	28 of 35	100%	Privacy lead	Three late; cause is intake routing
Unapproved AI tools in use, by inventory	8	29	0 high-risk	Operations director	Down after approved tool rollout
Open high risks past their treatment date	3	5	0	CEO	Two need budget decisions
Vendors in the top tier with a current security review	9 of 12	7 of 12	12 of 12	Procurement	Three overdue

Add to the page three short items that are not numbers: incidents or near misses since the last report with what was learned, changes in law or customer demands that affect the company, and decisions the board is asked to make. A board can act on "approve $24,000 to finish MFA hardware for finance and retire two legacy servers." It cannot act on "we are making progress."

Budget and roadmap

No agency publishes a standard security budget for companies this size, and the rules of thumb that circulate vary widely and are often vendor marketing. Build the budget from the risk register instead: each line should answer a named risk. The numbers below are invented planning figures for a 140-employee firm with 160 endpoints and $38 million in revenue. Replace them with written quotes.

Line	Basis	Cost	Risk it answers
Phishing-resistant MFA keys	140 people x 2 keys x $50, one time	$14,000	Account takeover, payment fraud
Managed detection and response on endpoints	160 endpoints x $20 x 12 months	$38,400	Ransomware, undetected intruders
Immutable backup service	Annual subscription	$9,600	Ransomware recovery
Training and fair phishing simulation	140 people x $30	$4,200	Reporting culture, insurer questions
Rights request intake and data map upkeep	Tooling and part-time time	$6,000	Privacy law deadlines
Approved AI tool licenses	40 users x $30 x 12 months	$14,400	Shadow AI leakage
Fractional security leader (vCISO)	8 hours a month x $200 x 12	$19,200	Program ownership, board reporting
Tabletop exercise and outside test	Annual	$12,000	Response readiness, findings for the register
Total	14,000 + 38,400 + 9,600 + 4,200 + 6,000 + 14,400 + 19,200 + 12,000	$117,800	About $841 per employee, or 0.31 percent of revenue

Check: $117,800 / 140 = $841.43 per employee, and $117,800 / $38,000,000 = 0.31 percent. Cyber insurance premiums are separate and are covered in lesson 12. Part of the first-year total is one time, since the MFA keys are $14,000 of it, so the steady annual cost is closer to $103,800.

The 12-month plan

Quarter	Priorities	Evidence produced
Months 1 to 3	Name owners and a program charter; build the data map and AI inventory; finish the risk register; write the eight policies from lesson 10; turn on MFA everywhere it is free; run the first rights-request log; set up the board dashboard	Charter, inventory, register, signed policies, first dashboard
Months 4 to 6	Deploy phishing-resistant MFA for admins and finance; endpoint detection with someone watching alerts; immutable backups and a restore test; payment call-back and dual approval written into procedure; approved AI tools and tier list live	Settings evidence, restore test report, payment procedure, tier list
Months 7 to 9	Tabletop exercise using a ransomware plus deepfake scenario; vendor reviews for top-tier vendors; risk assessments for any new high-risk data use; retention schedule run for the first time	Exercise notes with actions, vendor review files, destruction logs
Months 10 to 12	Refresh the risk assessment; review the insurance renewal application against evidence; update policies for law changes (check Colorado rules, California ADMT, new state laws); annual written report to the board; plan year two	Updated register, renewal file, board report, year-two plan

Questions to ask your IT provider or vendor

• Can you give us a current list of AI tools and AI features in use on our network and in our software-as-a-service accounts, and tell us which ones can see company files or email?
• Can administrators turn off model training on our data and AI agents or connectors in each approved tool? Show us the setting.
• Which of our systems hold personal data on customers or employees, and can you search all of them for one person within a day?
• Can the bank portal and accounts payable system enforce two approvers and a hold on changed bank details?
• Can you build the board dashboard numbers from system data each quarter without manual counting?
• If a staff member pastes confidential data into an unapproved AI tool, how would we find out?

Questions and answers

Do we need a privacy program if we sell only to other businesses?

Yes, a lighter one. You still hold employee data, contact data for business customers and often data your customers gave you under contract. Many state privacy laws exempt or treat business-to-business data differently, but the exceptions vary and are being narrowed, so check each law. Your customers' contracts and security questionnaires will ask about retention, subprocessors and breach notice either way.

Who should own privacy: IT, legal, or the business?

A named person in the business, with IT and compliance as partners. IT can run the controls, but decisions about what to collect and why belong to the people who use the data. In a company of 10 to 500, that is often a finance, operations or compliance lead who spends a fraction of the week on it, helped by a fractional privacy or security leader.

How fast must we answer a consumer who asks for their data?

Under California's CCPA, within 45 days, extendable once by 45 more with notice to the consumer. Under the GDPR, within one month, extendable by two months in complex cases. Several other states use 45 days. Check the state law for each place you have consumers, and run to the shortest.

Is it legal for employees to use ChatGPT or similar tools at work?

No general law bans it. The questions are contractual and regulatory: whether your customer contracts allow outside processing, whether the data class is restricted by law (health records, card numbers, student records), and whether your privacy notice promised something different. A policy that names approved tools and bars restricted data handles most of it.

Does the NIST AI framework apply to us?

Only if you choose it, a customer requires it or a law points to it. Texas' act gives a defense to a defendant that finds a violation through internal review and substantially complies with the NIST Generative AI Profile or another recognized framework, which makes the profile useful evidence. It is not a safe harbor for everything.

What counts as an AI "consequential decision" in the new Colorado law?

According to the law firm summaries, decisions in education enrollment or opportunity, employment, residential real estate, financial or lending services, insurance, health care, and essential government services, where covered technology materially influences the outcome. Advertising and marketing are exempted, along with certain summarization and translation tools that present information for human review. Read the signed text for definitions.

Can we use facial recognition at the front door?

Possibly, but it is a biometric system, and some states regulate it tightly. Illinois requires a written notice, a written release and a public retention schedule, and allows private lawsuits with liquidated damages. If a badge or key does the job, use that instead.

How often should the board hear about this?

The Safeguards Rule sets at least annually for the businesses it covers. In practice most boards want a dashboard each quarter and a deeper review once a year, plus an immediate call for a material incident. Put the schedule in the board calendar so it does not depend on anyone remembering.

What should we do first if we have done nothing?

Turn on multi-factor authentication for email and finance, back up in a way ransomware cannot erase, write the call-back rule for payments, and take a week to find out what AI tools are in use. Then fill in the rest of the 12-month plan in order of the risk register.

Hard questions

The laws keep changing. Why build anything before they settle?

Because the moving parts sit on top of a stable base. Notice, an inventory of data and tools, human review of decisions about people, records and vendor terms show up in the old Colorado Act, its replacement, Illinois, New York City and California. Colorado is the case in point: a company that had begun an inventory and a notice process lost very little when the statute was replaced. The part that does shift is the legal detail, and you handle that with a dated line in the risk register and a quarterly check.

Isn't AI governance just a way to slow down innovation?

It can be, if it becomes a committee with a veto. The workable version is a short list of approved tools, a plain rule on data, and a fast path for asking. Staff who can get an approved tool in a week do not need a personal account. The IBM-reported finding that shadow AI rose from 20 to 43 percent of studied breaches suggests the slow-down is already happening in the form of incidents.

If a federal order is attacking state AI laws, why comply with them?

The December 2025 executive order creates a litigation task force, a Commerce review and funding conditions. It does not by itself repeal any state statute, per the summary we read, and the Colorado case shows that even a joint stay of enforcement came from a court order and the state's own agreement, not from the order alone. A business that stops complying on the strength of a policy announcement carries the risk if a court later disagrees. Watch the cases, and keep the low-cost basics that every version of the rules shares.

We are too small to be a target. Why spend $100,000 or more?

Fraud criminals work at volume. The IC3 figures above show more than a million complaints in a year, and the tools that make a cloned voice or a convincing invoice cost almost nothing. Most of the spend in the sample budget is a small set of basics that also answer insurer and customer demands. If the number is out of reach, rank the lines by risk and fund the top ones first: MFA, backups, payment controls and a watched endpoint. Write down what you chose not to fund and who accepted that risk.

Why not outsource all of this to a vendor and be done?

Because the duty stays with you. A vendor can run controls, produce reports and answer alerts, and a good one is worth paying for. It cannot decide what data you should collect, tell your customers what you do with it, accept your risks or sign your board report. The Safeguards Rule puts the Qualified Individual's report in front of your board even if a service provider does the work.

How do we know the dashboard is not just a comfortable story?

Make the numbers come from systems and not from the person being measured. Have someone outside the IT team, such as finance or an outside reviewer, spot-check two or three indicators each quarter against raw data. Report misses in the same table as hits. Publish the targets before the quarter, and never delete an indicator that turns red.

Verified figures and charts for this lesson

Verified figures used in this lesson

Figure	Value	Source and date	Note
IC3 complaints, 2025	1,008,597; reported losses $20.877 billion	FBI IC3 2025 report	Primary
Business email compromise, 2025	24,768 complaints; $3,046,598,558	FBI IC3 2025 report	Primary
Complaints referencing AI, 2025	22,364; adjusted losses $893,346,472	FBI IC3 2025 report	Primary
Ransomware complaints, 2025	3,611; losses above $32 million	FBI IC3 2025 report	Primary; counts only reported losses
Average breach cost, 2026	$4.99 million global, up 12%; $11.5 million U.S.	IBM (global); eSecurity Planet (U.S.)	U.S. figure from a secondary summary
Shadow AI in breaches, 2026	43%, up from 20%; 68% of breached organizations had no AI governance framework; 92% of AI-breach organizations lacked AI access controls	Forkast reporting IBM	Secondary; confirm in IBM's report
FTC Safeguards Rule notice to the FTC	Events involving at least 500 consumers; as soon as possible and within 30 days of discovery	16 CFR 314.4(j)	Primary
FTC Safeguards Rule board report	Regularly and at least annually	16 CFR 314.4(i)	Primary
HIPAA breach notice to individuals	Without unreasonable delay and no later than 60 calendar days after discovery	45 CFR 164.404(b)	Primary
SEC Form 8-K Item 1.05	Four business days after determining an incident is material	SEC release 33-11216	Public companies
GDPR breach notice and request clock	72 hours to the authority where feasible; one month to answer requests, plus up to two months	GDPR Articles 33 and 12	Primary
CCPA request clock	45 days plus one 45-day extension	Civil Code 1798.130	Primary
CIRCIA	72 hours for covered incidents; 24 hours for ransom payments; not yet in force	CISA; Paubox (October 8, 2026) on the October 1, 2026 submission to OMB	Final rule not published as of our check
Idaho breach notice	Most expedient time possible and without unreasonable delay	Idaho Code 28-51-105	Primary
NIST AI RMF 1.0; AI 600-1	January 26, 2023; July 26, 2024	NIST	Revision under way per NIST
ISO/IEC 42001	Published December 2023	ISO	Primary
Colorado SB 26-189	Signed May 14, 2026; most duties January 1, 2027; Attorney General enforces; 60-day cure until January 1, 2030	Goodwin; Constangy	Secondary; read the enrolled text
Texas HB 149	Effective January 1, 2026; penalties $10,000 to $12,000, $80,000 to $200,000, $2,000 to $40,000 a day	Enrolled text	Primary text via a legislative tracking site
Illinois BIPA damages	$1,000 negligent; $5,000 intentional or reckless	740 ILCS 14/20	Primary text via a code site

Picture 1: the layered defense stack, with privacy and AI added

Picture 2: which framework or rule is which

Picture 3: the incident notification clock