Legal Updates

Law Firms Are the Regulated Party Now: New Compliance and Disciplinary Exposure

Law firms have long counseled clients on cybersecurity compliance, but a shift is underway where firms themselves are the regulated party. Roughly 20 states now require risk assessments for high-risk data processing, and New Jersey's Data Privacy Act requires controllers to conduct risk-based assessments for activities like targeted advertising, data sales, profiling, and sensitive-data processing. N.J.S.A. 56:8-166.12. California has gone further, adopting the first mandatory independent cybersecurity audit requirement (effective in 2027) for businesses meeting defined risk thresholds. These laws apply based on data volume and sensitivity, not industry—meaning a firm handling enough client data can itself qualify as a regulated "business," not merely an advisor to one.

Meanwhile, state bars in California, New York, Florida, Texas, and Illinois have clarified that attorneys who skip risk assessments, written security policies, or staff training may face discipline under the duty-of-technology-competence standard, regardless of whether a breach occurs.

Together, firms now face dual exposure: regulatory obligations as businesses, and professional discipline as lawyers.

Generative AI and Attorney-Client Privilege: Emerging Federal Court Guidance

Federal courts are beginning to grapple with a new concern in litigation: whether the use of generative AI by clients and pro se litigants may waive attorney-client privilege. Three recent decisions give valuable insight into a range of judicial approaches: United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y Feb. 17, 2026), Warner v. Gilbarco, Inc., Case No. 2:24-cv-12333 (E.D. Mich. Feb. 10, 2026), and Morgan v. VX2, Inc., Civil Action No. 25-cv-01991-SKC-MDB (D. Colo. Mar. 30, 2026). 

In Heppner, a defendant used the consumer version of Anthropic’s Claude to analyze his situation independent of his counsel. The court found that communications with AI were not protected because the defendant lacked a reasonable expectation of privacy, and no privileged relationship existed with the AI service.

By contrast, the Warner and Morgan courts addressed whether pro se plaintiffs' use of generative AI constituted a voluntary disclosure to a third party sufficient to waive privilege. Both concluded that AI does not qualify as a third party for work-product purposes, but cautioned that uploading case materials to AI could expose sensitive information to adversaries.

These decisions indicate that several key factors may influence privilege analysis, including the involvement of counsel in directing the AI use, whether the AI tool was consumer-grade or enterprise-grade with contractual protections, and whether disclosure to AI should be treated as disclosure to an adversary. While the law remains unsettled, particularly regarding attorney work-product, federal courts are providing early guidance on the burgeoning role of AI in litigation.

“Months, Not Years": Five Eyes Agencies Issue Urgent Warning on AI-Driven Cyber Risk

On June 22, 2026, the cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand issued a rare joint statement warning that frontier AI models will fundamentally transform offensive and defensive cyber capabilities within months, not years. The agencies predict AI will dramatically accelerate attacks—speeding up vulnerability discovery, exploit development, and reconnaissance—while shrinking the window organizations have to patch before exploitation occurs. Nation-state actors and criminal groups are expected to be among the primary beneficiaries.

The Five Eyes warn that cyber risk is no longer purely an IT issue, but a boardroom and business-continuity concern. They urge organizations to reduce attack surface, strengthen identity and access management, accelerate patching, and prepare for inevitable breaches through resilience and incident-response planning.

The message for firms and clients is clear: cybersecurity fundamentals and governance are now urgent priorities, not future projects.

Threats and Advisories

The FBI’s warning serves as a call to action for law firms to be particularly vigilant against “unauthorized USB drives or external hard drives connected to company computers; unidentified individuals on the premises claiming to be IT support; unexpected remote desktop session requests from someone claiming to be an internal helpdesk; and phishing emails referencing subscription charges with instructions to call a support member.” Law firms are urged to reinforce staff training to recognize signs that a seemingly trustworthy figure may be a Trojan horse for a devastating cyberattack.

*This summer, the firm offered a designated internship in our Cybersecurity, Privacy, and AI Risk Group. We acknowledge the research and drafting assistance provided by Summer Intern Jillian Pursiano (1L) for the inaugural Cybersecurity, Privacy, and AI Risk Newsletter.