Insights

New York Attorney General Letitia James has issued an industry-wide alert encouraging workers with knowledge of unsafe or illegal conduct at artificial intelligence (AI) companies to file confidential whistleblower complaints through the Office of the Attorney General’s (OAG) secure portal. This development signals a significant escalation in regulatory scrutiny of the AI sector and should be carefully considered by any company developing or deploying AI technology that has a nexus to New York.

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.

On July 28, 2026, the Federal Communications Commission (FCC) updated its Covered List, established through the Secure and Trusted Communications Networks Act to include foreign-produced connected power inverters and advanced robotic devices. The designation of these products to the Covered List follows an Executive Branch national security determination that they “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.” Equipment listed on the Covered List is ineligible for FCC equipment authorization, effectively prohibiting the import, sale, or marketing of those products absent an exception or approval. This action comes only months after the FCC added consumer-grade routers to the Covered List on March 23, 2026 and uncrewed aircraft systems (UAS) on December 22, 2025. Taken together, these actions reflect the FCC’s increasingly expansive approach to using its authorities to guard against foreign produced connected technologies that may create vulnerabilities enabling disruption of critical infrastructure, unauthorized access to sensitive information, or cyber intrusions. The shift is a departure from the FCC’s previous focus on equipment and services produced by certain PRC and Russian companies.

On July 17, 2026, the United States Department of Justice (DOJ) announced that it had entered into a Deferred Prosecution Agreement (DPA) with The Scoular Company (Scoular), an agricultural supply chain company based in Omaha, Nebraska, to resolve allegations that Scoular relied on customs brokers to bribe Mexican government officials to allow Scoular goods to pass customs inspections and be delivered to Mexico from the United States. As part of its resolution, Scoular agreed to pay a $9,769,521 criminal penalty and forfeit an additional $414,351. Scoular also committed to continue cooperating with DOJ on any ongoing or future criminal investigations, implement a compliance and ethics program designed to prevent and detect violations of the Foreign Corrupt Practices Act (FCPA), and periodically report to DOJ on remediation and implementation of compliance measures throughout the term of the DPA.

On June 17, 2026, the U.S. Department of Justice’s (DOJ( National Security Division (NSD) announced that it had issued a declination for Robert Bosch GmbH (Bosch) relating to potential violations of the Export Control Reform Act, 50 U.S.C. § 4819 (ECRA). Specifically, the DOJ declined to criminally prosecute Bosch’s violations of the Export Administration Regulations’ (EAR) Foreign Direct Product Rule (FDPR), which apparently resulted from two Bosch subsidiaries’ export of products and software manufactured with equipment that was the direct product of U.S. software or technology to Huawei Technologies Co., Ltd. and its “Entity List” affiliates, including Huawei Tech. Investment Co., Ltd., Hong Kong (collectively, Huawei). The same day, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a parallel civil administrative settlement with Bosch.

On June 4, 2026, the U.S. Supreme Court unanimously held that the U.S. Securities and Exchange Commission (SEC) can continue to pursue disgorgement as an equitable remedy in securities fraud cases without showing pecuniary loss by investors. The Court’s ruling in Sripetch v. SEC resolves a split between the U.S. Court of Appeals for the Second Circuit, which concluded that the SEC must demonstrate pecuniary loss, and the U.S. Courts of Appeals for the First and Ninth Circuits, which declined to require such a showing.

Last week, the U.S. Department of Justice (DOJ) Antitrust Division (the Division) revealed criminal charges against China International Marine Containers (Group) Co., Ltd. (CIMC) and several other major Chinese companies and executives involved in the manufacture and sale of standard dry shipping containers, which are used for shipping dry, unrefrigerated cargo on ships around the world. One of the executives was arrested at an airport in France and is awaiting extradition to the U.S. The indictment charged these defendants with violating Section 1 of the Sherman Act by conspiring to restrict output and fix prices of standard dry containers, including in the U.S. market, from 2019 to 2024.

As companies and individuals increasingly embed AI tools in legal practice, courts are grappling with how to treat communications with, and information generated by, these tools. Chief among these questions is whether and in what circumstances attorney-client privilege and work-product protections as they are applied in different jurisdictions extend to AI-generated content or communications with an AI tool.

On April 7, 2026, Acting Attorney General Todd Blanche issued a memorandum establishing the National Fraud Enforcement Division (NFED) within the U.S. Department of Justice (DOJ). This new division will be dedicated to the centralized, coordinated investigation and prosecution of fraud against taxpayer dollars and taxpayer-funded programs. AAG Blanche acknowledged that, while DOJ has a “storied history of combatting fraud,” DOJ has “never adopted a comprehensive and coordinated approach to investigating and prosecuting fraud against taxpayer dollars and tax-payer funded programs.” The NFED was created to close that gap with its core mission being to “zealously investigate and prosecute those who steal or fraudulently misuse taxpayer dollars.”

On March 10, 2026, the Department of Justice released the first-ever Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (the “Department-wide CEP” or “Policy”), which applies to all non-antitrust corporate criminal cases across the Department. The new policy has been anticipated since December 2025, when Deputy Attorney General Todd Blanche announced the Department’s plans to release a new, single corporate enforcement policy for all criminal matters. According to the Department, the new policy is designed to “help ensure consistency across the Department” and “transparently describe the Department’s policies and decisionmaking.”

On January 14, 2026, State Senator Zellnor Myrie proposed legislation in the New York State Senate that would amend New York law to make it a criminal offense to operate a virtual currency business in New York without the proper license. By introducing the possibility of criminal penalties, Senate Bill S. 8901, the Cryptocurrency Regulation Yields Protections, Trust, and Oversight Act (CRYPTO Act), would mark a significant regulatory shift in the state’s oversight of virtual currency businesses, given New York’s prominence in virtual currency regulation in the U.S.

AI tools have significantly transformed how companies operate, but they come with serious legal risks that are only now taking shape. A recent ruling by a federal judge in the U.S. District Court for the Southern District of New York highlights one such risk: certain inputs and outputs from commercial AI models may not be considered privileged attorney-client communications or protected by the work-product doctrine.

On January 29, 2026, the U.S. Department of Justice (DOJ) Antitrust Division (Division) and U.S. Postal Service announced the first-ever payment under the antitrust whistleblower rewards program, awarding $1 million to an individual whose information led to a $3.28 million fine as part of a deferred prosecution agreement with EBLOCK Corporation, an online auction platform for used vehicles.

On January 13, 2026, Miami-based pharmaceutical wholesaler Atlantic Biologicals Corporation entered into a two-year DPA, admitting to conspiracy to distribute and dispense controlled substances, including more than 14 million opioid doses to “pill mill” pharmacies in Texas at a markup. The DOJ and DEA underscored the company’s deliberate evasion of compliance checks and disregard for red flags signaling diversion.

On January 8, 2026, the Trump Administration announced the creation of a new Division for National Fraud Enforcement within the Department of Justice (DOJ). The division will be led by a newly appointed Assistant Attorney General (AAG), pending Senate confirmation, who will report directly to both the President and Vice President and operate out of the White House. Such a reporting structure is unprecedented in the history of the DOJ.

On January 5, 2026, District of Colorado Magistrate Judge Cyrus Chung issued a recommendation that the district court grant a motion to quash a Department of Justice (DOJ) administrative subpoena that sought records about the provision of gender-related care by Children’s Hospital Colorado (Children’s) in In re: Department of Justice Administrative Subpoena No. 25-1431-030, U.S. District Court for the District of Colorado, No. 1:25-mc-00063. The court concluded that the DOJ had failed to carry its “light” burden, noting that no other courts that had considered the more than 20 similar subpoenas issued by DOJ had ruled in the DOJ’s favor.  

On December 19, 2025, the Department of Justice (DOJ) announced a $54.4 million settlement with Ceratizit USA, LLC, a distributor of tungsten carbide products, resolving allegations that the company violated the False Claims Act (FCA) by evading customs duties on products imported from China. This settlement is believed to be the largest ever customs-related FCA resolution, and this high-water mark underscores the government’s heightened enforcement focus on tariff evasion.

On October 3, 2025, the Sixth Circuit reaffirmed that the attorney-client privilege and the work-product doctrine protections apply to materials created during attorney-led internal investigations. In re FirstEnergy Corp., No. 24-3654 (6th Cir. Oct. 3, 2025).

U.S. Government and private sector sources continue to report efforts by Democratic People’s Republic of Korea (DPRK) nationals to infiltrate companies around the world by posing as information technology (IT) professionals, in order to get hired by U.S. and other businesses and gain access to sensitive company systems. Crowdstrike, a U.S. cybersecurity company, has reported a 220% increase in the number of companies infiltrated by North Korean threat actors over the last 12 months. In particular, a DPRK-affiliated group known as “Famous Chollima” has leveraged artificial intelligence and deepfake technology to generate synthetic identities, as well as resumes and CVs, draft communications, and conduct job interviews. Enforcement actions brought by the U.S. Department of Justice identify victims in the cryptocurrency sector, including decentralized finance (“DeFi”) projects. In addition, media reports indicate that North Korean hackers are purportedly offering fake job offers targeting employees in the cryptocurrency sector, with the goal of stealing crypto.