This Week in AIand Cyber Governance

Four things worth knowing this week, and what to do about each. First, a correction.

1. CMMC Phase 2 is on hold, but the cyber rules for contractors are not

On July 13, the Department of War suspended Phase 2 of CMMC, which would have made Level 2 certification by a third-party assessor a condition of award in many contracts from November 10. A reform task force delivered its recommendations in September, and reporting on October 27 described one option: restarting Phase 2 for a narrower group of contractors while longer-term changes go through rulemaking. No restart date has been set.

What has not changed: DFARS 252.204-7012 still requires NIST SP 800-171 safeguards and cyber incident reports to DoD within 72 hours, and contractors still submit SPRS scores and annual affirmations. With fewer third-party assessments, those self-attestations carry more False Claims Act risk, not less.

What to do: keep preparing as if the assessment is coming. Make sure your SPRS score and affirmation match what you can show, and that every AI tool your engineers use is either approved for CUI or blocked from it, and documented in your System Security Plan.

2. Federal health IT drops its AI "model card" requirement

On October 26, the federal health IT office (ONC) finalized its HTI-5 rule. Among other cuts, it removed the requirements for certified electronic health record systems to show "source attributes" for predictive AI tools: how a model was trained, validated and tested for fairness. It also removed the related risk management requirements. Privacy and security certification criteria were not removed.

What to do: if you are a hospital or health system, don't assume your EHR vendor will keep publishing this information. Ask for it directly in contracts and renewals: training data, validation results across patient groups, and how the vendor monitors performance. Section 1557 still requires you to identify clinical tools that use protected characteristics and reduce the risk of discrimination.

3. New York bans unsafe AI companion features for minors

On October 28, Governor Hochul signed S9051-B. Operators of AI companions may not offer features such as pretending to be a real person or to have human emotions, or promoting self-harm, to users under 18. Operators must verify age, offer at least one method that doesn't rely only on a government ID, and delete the age data afterward. The Attorney General can seek up to $25,000 per violation. The law takes effect after a transition period.

What to do: if you run a consumer chatbot that minors could use, inventory its features against the law's list and plan your age assurance now.

4. Pennsylvania requires disclosure of AI-generated advertising

Pennsylvania's AI Deceptive Advertising Act (Senate Bill 806, signed October 22) takes effect December 21, 2026. Advertisers that use AI-generated or AI-modified content in a way that could mislead consumers about a product must disclose it clearly, in the same medium and at first view. Financial services marketing is a particular focus. The Attorney General and district attorneys enforce it.

What to do: add an AI-content check to your marketing review, and keep a record of which assets used generative AI.

Coming up

• Before year end: CIRCIA final rule expected; it has been under White House review since October 1
• December 21, 2026: Pennsylvania AI advertising disclosure law takes effect
• January 1, 2027: California's automated decisionmaking rules begin
• April 26, 2027: state and local governments serving 50,000 people or more must make websites and apps meet WCAG 2.1 AA, including vendor chatbots