Cybersecurity

On June 2, 2026, President Trump signed an executive order called “Promoting Advanced Artificial Intelligence Innovation and Security” building on the cyber strategy his administration released in March 2026, which sets deadlines for federal agencies in three areas: using artificial intelligence (AI) to defend government and critical infrastructure systems, evaluating the most capable AI models, and prosecuting people who use AI to break into computers or commit fraud. It directs the Cybersecurity and Infrastructure Security Agency (CISA) to issue binding directives within 30 days, and the United States Department of Treasury to create an industry clearinghouse that coordinates vulnerability scanning and patching.

Within 60 days, agencies must build a classified benchmarking process to decide when a model counts as a covered frontier model, plus a voluntary program letting developers give the government early access before a wider release. For companies, the signal is that AI security and cybersecurity are being treated as one governance topic, and AI-enabled defenses may become a baseline expectation in government and critical infrastructure contracts.

On July 24, 2025, the California Privacy Protection Agency approved sweeping new regulations covering cybersecurity audits, risk assessments, and automated decisionmaking technologies (ADMT), pending review by California’s Office of Administrative Law. Certain businesses will be required to undergo annual independent cybersecurity audits beginning in 2027, phased in by company revenue, covering 18 components of a cybersecurity program and culminating in executive certification. Businesses must also conduct risk assessments before engaging in activities such as selling personal information, processing sensitive data, or using ADMT for significant decisions, with California uniquely requiring evaluation of “negative impacts” to consumers. Beginning April 1, 2027, businesses using ADMT for significant decisions must provide pre-use notices, access to information about how the ADMT works, and opt-out rights, though the regulations clarify that ADMT excludes technologies where a human retains authority to review and override the output. Additional provisions strengthen opt-out notification requirements and prohibit dark patterns in consent mechanisms, with several of these provisions already in effect as of January 1, 2026.

On May 21, 2026, the New York State Department of Financial Services (“DFS”) issued two coordinated Industry Letters: a letter on Heightened Cybersecurity Risks Associated with Frontier AI models (the “AI Advisory”) and accompanying Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (the “Guidance,” and together, the “May 2026 Publications”). The AI Advisory builds on DFS’s October 2024 guidance on cybersecurity risks arising from artificial intelligence (AI), but is narrower in focus. Specifically, it addresses frontier models that may materially increase the speed and effectiveness of vulnerability discovery and exploitation.

The May 2026 Publications are not new rulemaking — both Industry Letters explicitly state so — but they are meaningful supervisory guidance: DFS identifies frontier AI Models as a technological development that may materially change the threat environment and instructs covered entities to evaluate whether their existing Part 500 programs remain adequate in light of that changed risk. The publications merit attention from DFS-regulated entities because they identify a specific class of emerging technology that DFS views as material to cybersecurity risk management under Part 500. That attention is warranted not only because the May 2026 Publications identify risks DFS views as material under Part 500, but also because DFS has cited prior Industry Letters in Part 500 consent orders, underscoring that such guidance can have practical supervisory and enforcement significance.

Federal health regulators settled four ransomware investigations on April 23, 2026, with a health provider network, an imaging provider, a third-party benefits administrator, and a self-funded health plan. Together the breaches exposed health and financial data for more than 427,000 people, and the companies agreed to pay a combined US$1,165,000 and to follow corrective plans monitored for two years. The common thread was not how the companies responded after the attacks but what they had failed to do beforehand: none had a complete, current assessment of where sensitive health data lived, how it moved through their systems, and what could go wrong.

For a startup handling health data, or acting as a vendor to one, the practical signal is that regulators are judging security preparation, not just incident response. Expectations include an up-to-date inventory of systems and data flows, encryption, multi-factor login, logging, vulnerability scanning, and training. Pending amendments to the HIPAA Security Rule would make many of these steps mandatory, with roughly 240 days to comply once finalized.

On June 22, 2026, the White House issued two executive orders on quantum technology: “Ushering in the Next Frontier of Quantum Innovation” and “Securing the Nation Against Advanced Cryptographic Attacks.” Quantum computers can solve certain problems far faster than ordinary computers, which opens up new commercial possibilities but also threatens the encryption that protects most online communication and stored data today. The orders push federal agencies past pure research toward deployment, commercialization, workforce building, and national security uses.