Topic starter
10/07/2026 9:19 pm
TL;DR: State privacy and AI laws are moving from policy language to operational enforcement, with Connecticut, California, Texas, and Oklahoma each adding requirements for rights handling, transparency, risk assessments, and accountability across systems, according to OneTrust. Governance now depends on whether controls actually work across websites, applications, data stores, and AI workflows, not on whether the policy exists.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Regulatory Draft Picks: March Madness Meets US Privacy and AI Laws”.
Key questions
Q: What fails when privacy policy does not translate into system execution?
A: Policy fails when rights handling, opt-outs, and deletions depend on manual coordination across disconnected systems.
Q: Why do AI transparency rules require inventory and traceability?
A: Because transparency is not just a disclosure layer.
Q: What are the signs that personal data governance is failing in practice?
A: Common warning signs include incomplete data inventories, weak or absent classification, personal data stored in unexpected locations, and no clear retention or deletion process.
Practitioner guidance
- Map privacy obligations to executable workflows Translate rights handling, opt-out suppression, deletion, and AI review requirements into systems that can be tested end to end across web, application, and backend layers.
- Build a living AI inventory Record every automated decision process, the data it consumes, the owner accountable for it, and the evidence retained for review or challenge.
- Prove control execution across archives and legacy stores Test whether requests, deletions, and explanations reach archived records, dormant datasets, and older operational tools that sit outside the active stack.
Bottom line: US privacy and AI laws are increasingly testing whether organisations can execute governance across live systems, not just document it in policy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Execution is now the real privacy control plane: state privacy and AI laws are increasingly testing whether organisations can make governance behave inside live systems. That shifts the centre of gravity from policy approval to workflow reliability, especially for rights requests, opt-outs, and AI decision traces. The practitioners who succeed will be the ones who can show control execution, not just control design.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Accountability should sit with a clearly named business or system owner, not be left spread across IT, security, and the product team. That owner should approve purpose, scope, and access, and ensure periodic certification and transfer of responsibility when staff move or leave. Shared execution is acceptable, but shared accountability usually creates gaps.
👉 Read our full editorial: US privacy and AI laws are shifting from policy to execution