USA – TEXAS Trends and Developments Contributed by: Christina Morgan, Jason Blackstone and Matthew Yarbrough, Buchalter LLP
Privacy and Cybersecurity in a “Model-First” World: What Changes, What Stays The most important change is that models become regulated assets. The NIST AI Risk Management Framework frames AI risk management as a socio- technical discipline with core functions to govern, map, measure, and manage. It explicitly calls for accountable and transparent systems, explainability, privacy enhancement, and security and resilience. Those are not optional qualities if you want to survive regulatory scrutiny. The second change is that privacy programmes can - not stop at data inventories and retention schedules. You now need model inventories, training data prov - enance, documentation of intended use, and monitor - ing of drift and downstream integrations. The EU AI Act’s emphasis on documentation, transparency, and risk categorisation is consistent with this trajectory. In many organisations, the best privacy policy in the world will fail if the model supply chain is a black box. The third change is that cybersecurity must extend to the AI life cycle. Traditional security focuses on net - works, endpoints, and data stores. AI introduces new attack surfaces, including prompt injection, model inversion, data poisoning, and supply chain compro - mises through third-party components. Even when using privacy-preserving approaches like federated learning, literature recognises that model updates can leak sensitive information without additional protec - tions. What stays the same is the core legal narrative. Rea - sonable care. Foreseeability. Good faith controls. Truthful disclosure. If you can show that your organi - sation collected only what it needed, protected what it kept, disposed of what it did not need, and governed AI decisions with documentation and oversight, you are building a posture that survives both regulators and juries. Flexibility as a Compliance Strategy, Not a Buzzword An organisation cannot hard code privacy and cyber - security into rigid systems because future threats and regulations cannot be predicted. The next wave of enforcement will reward organisations that can adjust
mitigation, even when the technology stack is still in flux. The winning move is not to hard-code today’s require - ments into brittle systems. The winning move is to build an adaptable governance and technical archi - tecture that lets you change quickly, prove what you did, and explain why it was reasonable. That is the posture that translates across regulators and juries, even when statutes and threats mutate. The Core Idea: AI Can Reduce the Need to Retain Detailed Personal Data, but It Cannot Eliminate Accountability Instead of retaining detailed consumer data, create virtual consumer avatars, score interactions, and use that scored experience to test marketing and deliver personalisation while retaining only contact informa - tion and regulatory essentials. The strategic objective is clear. Minimise retained personal data while pre - serving the ability to learn, optimise, and personalise. This is directionally aligned with data minimisation principles. Regulators, including the FTC, have framed good security and privacy as collecting only what you need, keeping it safe, and disposing of it securely. That is both a compliance theme and a litigation risk theme. The less you retain, the less you lose in a breach and the less you must defend in discovery. But legal counsel for an organisation should also see the trap. Even if you delete raw event-level con - sumer data, you may still be “processing” personal data through models, derived profiles, and inferences. Many regimes treat inferences as personal data if they can be linked to a person, even indirectly. AI does not make personal data disappear. It changes its shape. That is why a “data-light” strategy must be paired with governance that addresses profiling, transpar - ency, discrimination risk, and security of the model life cycle. So the practical answer is to refine the avatar con - cept into a defensible privacy-enhancing architecture. You can reduce retention while keeping learning and personalisation, but you have to do it in a way that is explainable, auditable, and adaptable.
617 CHAMBERS.COM
Powered by FlippingBook