|
Welcome
Welcome to our sixth issue of 2026 of Decoded -- our technology law insights e-newsletter.
We are pleased to announce that several of the firm’s practice groups and attorneys, including many from our Technology Practice Group, were recognized in the 2026 edition of Chambers USA, a directory of leading law firms and attorneys. Chambers and Partners annually researches the strength and reputation of law firms and individual lawyers across the globe. The evaluation process includes interviewing lawyers and their clients, including influential general counsel at Fortune 100 companies, high-profile entrepreneurs, and significant purchasers of legal services. Considerable credence is given to the opinions of clients. Click here to learn more.
As always, thank you for reading.
Nicholas P. Mooney II, Co-Editor of Decoded; Chair of Spilman's Technology Practice Group; Co-Chair of the Cybersecurity & Data Protection Practice Group; and Co-Chair of the Artificial Intelligence Law Practice Group
and
Alexander L. Turner, Co-Editor of Decoded and Co-Chair of the Cybersecurity & Data Protection Practice Group
| | |
“The security agencies of Britain, the United States, Australia, Canada and New Zealand urged governments and businesses to act swiftly to prepare themselves as AI evolves.”
Why this is important: The Five Eyes, the name given to the security alliance among Britain, the United States, Australia, Canada and New Zealand, is sounding the alarm that advanced AI models, like Anthropic’s Mythos and Fable 5, are improving so rapidly they are outsmarting prevailing cybersecurity protocols, rendering the protocols obsolete in a matter of months. The worry is that threat actors will deploy these AI tools to outpace defenses. Commentators warn businesses to revisit their cybersecurity defenses, make themselves harder targets, and ensure they are prepared for what commentators call a coming “vulnerability tsunami.” --- Nicholas P. Mooney II
| | |
“AI notetaking tools can automatically join virtual company meetings and begin recording or transcribing without verifying that all participants (i.e. Illinois employees) have provided consent.”
Why this is important: Artificial intelligence notetaking and transcription tools are increasingly used to document virtual meetings, training sessions, employee discussions, and operational reviews. Although these technologies improve efficiency, they can create significant legal risks for Illinois employers under the Illinois Biometric Information Privacy Act (BIPA). AI tools that analyze voices to distinguish speakers may generate voiceprints, which are protected biometric identifiers under the law.
BIPA requires employers to provide written notice, disclose the purpose and duration of biometric data collection, obtain written consent before collecting biometric information, and maintain a publicly available retention and destruction policy. Employers may face substantial statutory damages for noncompliance, even if no individual suffers actual harm. Liability can arise when AI tools automatically record or transcribe meetings without confirming that all participants have provided the required consent, including when the technology is supplied by a third-party vendor.
Reducing legal exposure requires a comprehensive compliance program. Employers should assess whether AI tools collect biometric data, adopt written policies governing approved technologies and consent procedures, obtain informed written consent, and disable speaker recognition or similar biometric features whenever possible. Access to AI notetaking tools should be limited to authorized personnel who verify that required safeguards are in place.
Additional safeguards include implementing and enforcing data retention and destruction policies, conducting due diligence on third-party vendors, training employees and managers on appropriate use and consent requirements, establishing standardized meeting procedures that include participant disclosures and consent verification, and regularly monitoring and auditing AI tool usage. Strong governance, transparency, and careful oversight allow employers to realize the benefits of AI notetaking technology while reducing the risk of liability under BIPA. --- Shane P. Riley
| | |
“Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium.”
Why this is important: Klue, a market intelligence platform used by hundreds of companies, was breached on June 12 after attackers exploited a compromised legacy credential tied to a third-party integration dating back to 2022. The hackers used their access to steal customers' OAuth authentication tokens and log into their own clouds and databases, mainly Salesforce instances. Roughly two dozen Klue customers have confirmed impact, including Gong, Jamf, HackerOne, LastPass, Recorded Future, and Tanium, with the incident reportedly affecting 195 customers in total.
The situation has continued to evolve. A group calling itself Icarus initially threatened to leak the stolen data, then reportedly began deleting it after negotiating with Klue. Klue then warned customers that a second, unrelated group claimed to have obtained a sample of the stolen data from Icarus and launched its own extortion attempt, threatening to leak everything if not paid.
For many, the lesson is less about Klue specifically and more about the pattern. A vendor's integrations and stored credentials are part of your own risk surface, and stale or legacy tokens tied to old integrations are a recurring root cause in these breaches.
If your company connects any market intelligence, CRM, or sales tools to Salesforce or other client data systems, this is a good prompt to confirm those integrations are still active and necessary, and that the credentials behind them are current. --- James E. Dunlap, Chief Information Officer, Spilman Thomas & Battle
| | |
“Rocket company cites data center cooling demands as major infrastructure challenge.”
Why this is important: The largest private company in the world, SpaceX, just transitioned to a publicly traded company after debuting its IPO in June, which was the largest IPO in history. SpaceX has been generally viewed as a rocket and space exploration company. However, it has since warned investors that a specific material risk may hinder the company’s growth. That resource is none other than water. This signals a significant deviation from the company’s extraterrestrial background into the world of complex computing via AI.
This disclosure further signifies that SpaceX may fall into the same sphere of scrutiny for abundant water consumption for AI use as Microsoft, Google, Meta, and Amazon. Tesla, which is also spearheaded by Elon Musk, is already involved in the development of a massive supercomputer to be used for autonomous driving and is facing similar challenges. With environmental concerns and operational realities at the forefront, a company as scientifically ambitious as SpaceX may be able to get to Mars, but it cannot create water out of thin air. --- Nathan T. Ellis, Summer Associate
| | |
“Norton Rose Fulbright’s midyear litigation pulse survey highlights greater disputes exposure for energy, healthcare, tech and finance companies.”
Why this is important: At the end of 2025, a survey found that 29 percent of in-house counsel in the financial, energy, healthcare and tech industries reported they expected to see greater exposure to cybersecurity and data privacy litigation in 2026. A mid-year survey now reports that number has increased to 56 percent. Those responding to the survey cite AI and class action exposure as significant concerns. One commentator noted the survey highlights “how quickly the litigation environment is evolving” and this is undoubtedly true when considering cybersecurity incidents and AI-related lawsuits. What does this mean for the average business? It underscores what many have said before – ensure that you are taking the steps necessary to implement a robust cybersecurity defense plan, follow that plan, and revisit it periodically to update it where needed. Also, be deliberate about how you want to implement AI into your business operations. Know the benefits and dangers of the various public AI platforms and where a private licensed platform makes the most sense for your company.
--- Nicholas P. Mooney II
| | |
“As neighbors of the data center construction site in Mason County say they face issues with a lack of communication, disruptions and damage from the construction, and a lack of input, the state’s data center liaison said he is working to address those concerns.”
Why this is important: Mason County, West Virginia residents and other advocates have not only raised concerns about the noise of construction and the future noise or other environmental concerns that an operational data center could create, but they have also raised concerns about the efficacy of the data center certification process. Many of their concerns center around open communication and informing communities about what new data center projects have found their way into their backyards.
Issues with construction, like noise, traffic, road damage, and other concerns, are not isolated to data centers. Any construction project taking up hundreds of acres, like a data center, is likely to cause some interruptions to the day-to-day feel of a community. Beyond construction-related concerns, the pushback most communities have with incoming data centers is regarding the transparency of their planning and operation. Data centers are still largely an unknown for many, particularly with technology rapidly evolving. Further, there are no or minimal alerts to the general public that developers of data centers must make regarding data center certifications (the high-impact data center program provides for confidentiality of applications). Especially for areas outside of city zoning, developers could get away with no notices to the general public about what is being constructed. While there may not be legal requirements for notice to neighboring communities, the idea of being a good corporate citizen stands as a concern for future data centers. Providing advance notice to neighboring communities could be the difference for a data center that gains community approval as compared to widespread pushback. --- Andrew B. Komorowski, Summer Associate
| | |
“As legislators in both parties — but especially in blue states — pitch everything from cost restrictions to water standards to outright bans on new data centers, unions are pushing back to protect what they see as the best opportunity for work they’ve had for years.”
Why this is important: Artificial intelligence (AI) has become one of the defining drivers of economic growth in the twenty-first century, fueling unprecedented investment in digital infrastructure across the United States. As demand for AI continues to accelerate, so too does the need for data centers. At the same time, these data centers have become topics of increasingly contentious debates over energy consumption, water usage, environmental impacts, and tax incentives. Recognizing the enormous economic potential of this emerging industry, organized labor has emerged as one of the strongest advocates for expanding data center construction. As Caleb Max, CEO of the National Artificial Intelligence Association, observed, “American AI leadership depends on data centers, and data center construction depends on skilled trades.” Rather than viewing AI infrastructure solely as a technology issue, labor organizations increasingly see it as a once-in-a-generation opportunity to create thousands of high-paying construction jobs, strengthen apprenticeship programs, and ensure that the benefits of the AI economy are shared by American workers.
Between March 2025 and March 2026, data center construction increased by more than 34 percent, accounting for nearly 30 percent of the total value of all construction projects nationwide. This rapid expansion has prompted states to reconsider how they regulate and incentivize these developments. California, for example, has advanced legislation designed to streamline permitting for data centers that satisfy specified environmental and labor standards without shifting additional costs onto consumers. Meanwhile, private industry is investing heavily in the future workforce, with companies such as Microsoft partnering with North America's Building Trades Unions (NABTU) to expand AI education and workforce training initiatives. Although fewer than 11 percent of construction workers belong to unions, the growing demand for skilled labor places increasing pressure on state lawmakers to strike a careful balance between environmental stewardship and the need to deliver the infrastructure necessary to sustain America's leadership in artificial intelligence. --- Carter P. Capehart, Summer Associate
| |
“The proposal would add conditions for the projects to receive a major state tax exemption and participate in preferential tax zone programs.”
Why this is important: As data centers are becoming increasingly more popular, governors are continually balancing the need to attract these centers for economic gain while managing concerns of potential environmental impacts on air and water quality, water supply, and energy prices. Governor Josh Shapiro is no different.
In Pennsylvania, Governor Shapiro has published a full version of proposed incentives to draw in data center developers. This includes major state tax exemptions on the 6 percent sales tax on purchases related to building and maintaining their campuses, participation in preferential tax zone programs and potential faster permitting for developers. To receive these GRID (Governor's Responsible Infrastructure Development) benefits, centers will need to meet certain GRID standards in their applications. This, while still in a preliminary stage, includes escalating requirements for the amount of clean energy data centers must build or buy to power their operations, creating a minimum of 200 construction jobs that involve hiring and training workers, submitting environmental sustainability plans, and paying $1.5 million annually in total wages following four years of operation. Data centers will have to submit their applications to the state Department of Revenue and the Office of Transformation and Opportunity for assessment.
Some call this proposal “strictly performative” because of evidence that large companies, such as Amazon, were told these GRID standards would be voluntary and were not intended to discourage data centers that would not comply with or implement these stipulations. However, individuals within the Shapiro administration stated that these communications were necessary to receive feedback as guidance on how to move forward with the policy development process.
While some remain unsure about the plan’s legislative prospects in making it through Pennsylvania’s Senate, they believe that this proposal is important for maintaining environmental, labor, and economic development. Conversely, others believe that this will introduce complexities that would ultimately make Pennsylvania less appealing for potential data centers. Others have also expressed concerns about the impact on communities, utility bills, and the environment.
These potential incentives were created ahead of Pennsylvania’s June 30, 2026 budget deadline. Their significance cannot be overstated for Pennsylvania’s economic development and environmental stability. Shapiro said in a statement earlier this summer that “this is about setting a higher bar for projects and ensuring development happens responsibly and in a way that benefits Pennsylvanians.” --- Stefany A. Kaminski, Summer Associate
| |
“This comes as the North Carolina General Assembly moves forward with discussing statewide data center regulations and restrictions that cap energy and water use.”
Why this is important: As universities and businesses invest more in artificial intelligence, decisions about building data centers have become increasingly significant. Community involvement and public policy play an important role in major development projects. According to surveys conducted by CBS News, many Americans oppose building new data centers because of concerns about their impact on natural resources, utility costs, and the environment. In the first quarter of 2026, U.S. businesses invested $44.7 billion in data centers, a 28 percent increase compared with the same period in 2025. This rapid growth demonstrates how quickly AI infrastructure is expanding. The growth of AI is not only driving technological innovation but also raising important environmental, social, and political questions. --- Jessica Blevins, Summer Associate
| |
“The amended bill presented to the Senate Health Committee would prohibit software developers from designing, training, or modifying AI systems for use in healthcare coding if the AI system is designed to ‘promote, incentivize or result in upcoding.’”
Why this is important: Some North Carolina lawmakers are attempting to address growing concerns of many regarding the use of AI in the medical field. Senator Amy Galey (R-Alamance) has introduced an amended bill (HB 565) to the North Carolina Senate Health Committee to prohibit AI from being used by medical care providers to “promote, incentivize or result in upcoding.” The problem, some detractors argue, is that the practice of upcoding (electing a higher billing code over a lesser code) is already illegal in North Carolina.
North Carolina faces a billion-dollar gap in Medicaid funding for the upcoming year and North Carolina Republicans believe this bill is one measure to address the budget issue. Democratic representatives contend that the bill is not needed. The bill requires medical care professionals to attest that they agree to comply with AI upcoding standards. Some lawmakers believe this requirement to be unnecessary. Most hospitals and doctors argue that AI is used solely for transcribing notes and that the requirements of this bill will limit the power of medical professionals to make independent decisions regarding patient care.
Senator Galey asserts that the Bill is not meant to limit the medical judgment of professionals; it is designed to look at the actual computer codes being used to ensure that higher codes are not auto-selected to produce higher payments to providers. North Carolina Republicans have expressed concerns that AI bots will be the first line of care for Medicaid and Medicare patients. North Carolina is at a crossroads between increased healthcare costs and the autonomy of medical care professionals in providing care. The North Carolina Senate Judiciary will now review this bill and attempt to address all concerns. --- Lynn P. Michael
| |
“Powered by artificial intelligence, the program — called the Wasteful and Inappropriate Service Reduction Model, or WISeR — is intended to save the federal government money and protect patients from potentially unsafe or unneeded care.”
Why this is important: The Centers for Medicare & Medicaid Services (CMS) launched the Wasteful and Inappropriate Service Reduction (WISeR) Model in January 2026 as a pilot program in six states—Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington—to test the use of prior authorization in traditional Medicare. The initiative applies to 13 medical services considered vulnerable to fraud, waste, or overuse, including epidural injections, skin substitutes, and kyphoplasty procedures. Powered in part by artificial intelligence, the program is intended to reduce unnecessary care, lower Medicare spending, and expedite approval of medically appropriate services.
Despite these goals, the program's implementation has generated significant concerns among patients and healthcare providers. Many participants report confusion, administrative burdens, treatment delays, reimbursement backlogs, and inconsistent authorization decisions. Physicians indicate that the rapid rollout left little time to prepare, requiring practices to adapt to new submission systems and documentation requirements with minimal guidance.
Although CMS states that AI is used to streamline approvals and that most qualifying requests receive prompt authorization, providers report delays extending for weeks, postponed procedures, and denials they believe are based on factual inaccuracies or flawed AI-assisted reviews. Some patients have experienced additional office visits, delayed treatment, or sought more costly emergency care while awaiting authorization.
The program has also increased administrative responsibilities for providers, who must submit extensive documentation, respond to repeated information requests, and pursue appeals when claims are denied. These additional appeals create further costs for Medicare while increasing burdens on physicians and patients. Critics question whether the program reduces overall healthcare spending or simply shifts costs through longer wait times and greater administrative complexity.
CMS maintains that WISeR is designed to prevent inappropriate care without delaying necessary treatment and continues to monitor provider feedback to improve the program. While officials have stated that no expansion is currently planned, many healthcare providers believe the pilot could eventually lead to broader use of prior authorization throughout traditional Medicare if it demonstrates measurable cost savings. --- Shane P. Riley
| |
“Hospices need to carefully weigh the opportunities alongside potential impacts on clinical documentation, operational burden and organizational culture.”
Why this is important: President Trump issued an executive order mandating that hospitals make pricing information available to patients for 300 commonly provided services. This order took effect on February 25, 2025, so failure to comply by now seems curious and should certainly be corrected by the 11 hospitals in North Carolina that have been called out by the Trump administration for their failure to comply. Transparency in billing is and has been gaining steam for many years, and with private insurance providing less and less coverage for procedures, it is becoming even more critical that medical providers provide transparency in billing. Indeed, as medical providers compete for patients/services, transparency in billing will be paramount in those competitive efforts. --- H. Dill Battle III
| |
“Current medical licensing laws require clinicians to have separate certifications depending on the state they’re treating patients in, Miller added.”
Why this is important: Health system leaders believe that artificial intelligence and virtual care technologies can help address persistent workforce shortages, rising rates of chronic disease, and limited access to care in underserved communities. Technologies such as telemedicine, ambient AI medical scribes, automated referrals, and AI-powered clinical decision support are improving efficiency, reducing administrative burdens, and allowing clinicians to spend more time with patients.
Several large health systems have expanded their use of these tools. Virtual care platforms enable providers to determine which patients can safely receive care remotely, while AI assistants help patients understand health information and automate routine administrative tasks. Ambient AI scribes reduce documentation time, allowing clinicians to reclaim significant portions of their workday. Other AI applications are improving clinical decision-making by analyzing patient records to identify health risks, increasing diagnostic accuracy, and generating more effective referrals. Health systems are also exploring technologies such as robotic surgery to further enhance patient care.
Despite these advances, healthcare executives contend that technology alone cannot resolve structural challenges within the healthcare system. They argue that reimbursement policies should better support preventive care, care navigation, and value-based payment models that reward improved patient outcomes rather than the volume of services provided. They also advocate for modernization of physician licensing requirements, noting that state-by-state licensure limits the expansion of telemedicine and restricts patients' access to qualified providers across state lines.
Health system leaders conclude that realizing the full benefits of AI and digital health technologies will require complementary regulatory reforms, including updated reimbursement policies and streamlined licensing frameworks that allow providers to deliver care more efficiently and expand access to patients regardless of location. --- Shane P. Riley
| |
“The findings could ease concerns that the expansion of telemedicine would trigger spikes in usage and the nation’s already high health care costs.”
Why this is important: The CMS telemedicine flexibilities adopted during the pandemic, including payment parity, waived geographic restrictions, and eliminated cost-sharing, are set to expire in 2027, and lawmakers must decide whether to make them permanent. Opponents have raised concerns that easier access to virtual care would drive runaway utilization and cost growth. However, a new UCLA-led research study found that telemedicine use did not significantly increase visits or medical spending across Medicare fee-for-service, Medicare Advantage, dual-eligible Medicaid or commercial insurance populations. At the same time, the findings suggest telemedicine has functioned more as a substitute for in-person care than as a true expansion of access, tempering optimism that it would meaningfully close gaps for underserved populations. For policymakers, the study provides empirical grounding—rather than speculation—for a decision with implications for healthcare access and federal spending. --- Brienne T. Marco
| | |
This is an attorney advertisement. Your receipt and/or use of this material does not constitute or create an attorney-client relationship between you and Spilman Thomas & Battle, PLLC or any attorney associated with the firm. This e-mail publication is distributed with the understanding that the author, publisher and distributor are not rendering legal or other professional advice on specific facts or matters and, accordingly, assume no liability whatsoever in connection with its use.
Responsible Attorney: Michael J. Basile, 800-967-8251
| | | | |
