Loading story…
The rapid adoption of artificial intelligence across industries, particularly in healthcare, is outpacing the development of unified regulatory frameworks in the United States. Legal and security experts highlight that AI use cases—ranging from clinical documentation to claims processing—introduce significant privacy, security, and legal risks. In the absence of comprehensive federal regulation, organizations are advised to rely on frameworks such as the NIST AI Risk Management Framework to guide governance and risk mitigation efforts, especially as AI becomes more deeply integrated into sensitive sectors like healthcare.
Simultaneously, the proliferation of state-level AI regulations has created a complex and inconsistent compliance landscape. In 2025, nearly every state introduced or enacted AI-related legislation, resulting in a patchwork of requirements that vary in definitions, compliance obligations, and enforcement. This fragmented approach complicates risk management for organizations operating across state lines, as they must navigate conflicting rules and adapt to a rapidly evolving regulatory environment without clear national standards.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
On 2025-12-29, published commentary and interviews highlighted growing AI adoption in healthcare for functions such as documentation, claims processing and decision support, while warning of privacy, security, legal and regulatory risks. The same day, advocates also argued that the fragmented state-by-state U.S. AI regulatory landscape requires a unified federal framework to improve security, trust and responsible innovation.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprises are rapidly integrating artificial intelligence (AI) into their core operations, leading to a significant increase in both the scale and complexity of cybersecurity risks. Autonomous AI agents, once limited to providing suggestions, now act independently within enterprise systems, accessing sensitive data, executing transactions, and triggering downstream workflows without human oversight. These agents, often deployed by individual teams or embedded in third-party software, can inadvertently ingest confidential information, such as customer credit card data, even if the data is only briefly accessible. Unlike human users, AI agents lack contextual understanding and ethical judgment, acting continuously and at scale, which introduces a new category of 'Shadow AI' risk. Multimodal AI systems, which process multiple input streams to generate more human-like outputs, further expand the attack surface. Adversaries can exploit these systems by manipulating data inputs, such as subtly altering images or text, to deceive the AI and bypass security controls. Research has demonstrated that these attacks are not merely theoretical; adversarial manipulations can evade detection and cause significant harm, especially in critical sectors like defense, healthcare, and finance. Organizations are increasingly aware of the dangers posed by AI-augmented threats, including deepfakes and AI-driven social engineering, but many lag in implementing effective technical defenses. Surveys indicate that while a majority of firms have experienced deepfake or AI-voice fraud attempts, more than half have suffered financial losses as a result. Despite this, investment in detection and mitigation technologies remains inadequate, and many companies overestimate their preparedness. The surge in AI adoption is reflected in corporate disclosures, with over 70% of S&P 500 firms now reporting AI as a material risk, up from just 12% two years prior. Reputational and cybersecurity risks are the most frequently cited concerns, followed by legal and regulatory challenges as governments move to establish AI-specific compliance requirements. However, only a minority of corporate boards have formally integrated AI oversight into their governance structures, highlighting a gap between risk awareness and actionable governance. The lack of comprehensive frameworks for managing AI risk leaves organizations vulnerable to both technical and compliance failures. As AI becomes more deeply embedded in business processes, the need for robust governance, continuous education, and responsible-use frameworks becomes increasingly urgent. Security and governance leaders must adapt to this new frontier by developing strategies that address the unique risks posed by autonomous and multimodal AI systems. Failure to do so could result in significant financial, operational, and reputational damage as adversaries continue to exploit the evolving AI landscape.
Jun 29, 2026
Organizations worldwide are accelerating their adoption of artificial intelligence (AI), but most are struggling to ensure their infrastructure and security measures can keep pace with the demands of these new technologies. According to a Cisco report, the rapid deployment of AI is exposing significant gaps in existing IT systems, a phenomenon described as 'AI infrastructure debt.' This debt arises when companies attempt to implement AI on legacy systems not designed for such workloads, leading to increased friction, higher costs, and growing security vulnerabilities. Only a minority of organizations, termed 'Pacesetters,' are proactively integrating AI readiness into their long-term strategies, focusing on scalable infrastructure and robust security. The majority, however, lack confidence in their ability to protect AI systems, with data protection and access control identified as persistent weak points. The emergence of agentic AI—autonomous systems capable of making operational decisions—further expands the attack surface, as these agents can potentially propagate security incidents across interconnected systems if compromised. Many organizations have yet to establish effective controls or monitoring for these agents, and few have plans for ongoing human oversight once AI systems are operational. This lack of preparedness is already manifesting in visible security gaps, even before widespread deployment of agentic AI. In parallel, regulatory compliance is a mounting concern for IT leaders, with over 70% citing it as a top challenge in deploying generative AI, according to a Gartner survey. The evolving landscape of AI regulations, including the EU AI Act and various state-level laws in the US, is creating a complex and sometimes conflicting patchwork of requirements. Less than a quarter of IT leaders feel very confident in their organizations' ability to manage security, governance, and compliance for generative AI. Gartner forecasts a 30% increase in legal disputes related to AI regulatory violations by 2028, and anticipates that new categories of illegal AI-informed decision-making will result in over $10 billion in remediation costs by mid-2026. The regulatory environment is still in its early stages, but the pressure on organizations to adapt is intensifying. The combination of technical debt, expanded attack surfaces, and regulatory uncertainty underscores the urgent need for organizations to reassess their AI strategies, invest in secure and scalable infrastructure, and develop comprehensive governance frameworks. Without these measures, the risks associated with rapid AI adoption—including security breaches, compliance failures, and operational disruptions—are likely to escalate. The findings highlight the critical importance of integrating security and compliance considerations into every stage of AI deployment, from initial planning to ongoing operations.
Jun 29, 2026
Organizations are rapidly integrating AI technologies into their cybersecurity and business operations, but this shift introduces new risks and regulatory complexities. CISOs are urged to assess organizational risk tolerance, vendor viability, and the security implications of AI-powered solutions, as adversaries exploit AI for advanced attacks such as deepfakes, phishing, and prompt injection. The rise of shadow AI—unauthorized or poorly governed AI use—has led to increased breach costs and operational risks, while established vendors and startups alike are embedding AI into security tools for threat detection and incident response. Research indicates that extensive AI deployment can significantly reduce breach recovery times and costs, but also highlights the dangers of unmanaged AI adoption. Simultaneously, compliance is evolving from a procedural hurdle to a strategic enabler in regulated industries, with frameworks like HIPAA, SOC 2, and the EU AI Act shaping how AI and data are managed. CIOs face mounting pressure to establish robust AI and data foundations that ensure sovereignty, regulatory readiness, and operational resilience. Enterprises that act quickly to unify data governance and AI readiness are seeing substantial returns, while those lagging behind risk falling short of compliance and security expectations. The convergence of AI adoption, data sovereignty, and regulatory mandates is redefining digital transformation, making security and compliance central to enterprise innovation strategies.
Jun 29, 2026