Trust Issues: November 2026

In This Issue

• California Legislative Update: Child Safety, Privacy, and AI
• CISA and NSA Issue Quantum Computing Security Guidance for Vendor Management
• Déjà Vu All Over Again: CISA 2015 Heads Toward Another Expiration Cliff
• SEC's FY2026 Exam Priorities Highlight Cybersecurity and "Super Intelligence"

California Legislative Update: Child Safety, Privacy, and AI

California continues to be a legislative leader in child safety, data privacy, and AI oversight and regulation. During the month of September, Governor Gavin Newsom signed the following pieces of legislation into law and issued one executive order.

Child Safety

1. Assembly Bill 1709 prohibits a covered platform from providing an "addictive feature" (including an addictive feed, autoplay, or any other feature the Attorney General designates by regulation) to a user who is under 16 years old and requires the platform to implement reasonable measures to ensure that such users are not provided any addictive feature, although users under 16 may still create or maintain accounts if no addictive feature is provided. Before providing an addictive feature, a covered platform must verify the user's age under the Digital Age Assurance Act and, except where an under-16 account is permitted without addictive features, must delete the account and associated personal information of a user under 16. The bill authorizes the Attorney General to adopt regulations to implement and enforce the bill to protect minors online, including by altering the scope of "covered platform" if necessary to ensure that it applies to internet websites, online services, online applications, or mobile applications that make addictive features available to users under 16. Under the bill "covered platform" excludes those websites and services that operate a feed for cloud storage, commercial transactions, or consumer reviews. There are civil penalties of up to $50,000 per affected minor for a knowing violation and up to $25,000 per affected minor for a negligent violation, enforceable only in a civil action by the Attorney General or a local public prosecutor. The bill takes effect January 1, 2027.
2. Assembly Bill 2 makes a "social media platform" (limited to platforms generating more than $100 million per year in gross revenues) liable for statutory damages if the platform fails to exercise ordinary care or skill by causing injury to a "child"—meaning a minor under 18 years old. Damages are the greater of $5,000 per violation (capped at $1 million per child) or three times the child's actual damages. The bill applies prospectively only and does not apply to cases pending on or before January 1, 2027. The bill sunsets on January 1, 2035.
3. Assembly Bill 2246 repeals and replaces the California Age-Appropriate Design Code Act with similar provisions without the prior act's exceptions and a revised civil penalties' framework for violations. The bill requires a business that provides an online service, product, or feature likely to be accessed by children—meaning a consumer under 18 years old—to take reasonable steps to prevent specified risks of harm to children, including reasonably foreseeable physical or financial harm, severe psychological or emotional harm, highly offensive privacy intrusions, and unlawful discrimination. It also makes any provision of a contract entered into by the child or their parent or guardian as a result of a design feature of the online service, product, or feature voidable at the child's election even if the contract was entered into by the child's parent or guardian. The bill imposes civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation, recoverable only in a civil action by the Attorney General or a public prosecutor The bill takes effect January 1, 2027.
4. Assembly Bill 1856 amends the existing California Digital Age Assurance Act (DAAA), which, beginning January 1, 2027, requires an operating system provider to provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store. "Covered application store" means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users. The bill deletes the DAAA's original limiting definition of "user" (specified as "a child that is the primary user of a device") to include all users of a device; specifies that the interface requirement applies if an operating system operates on a device and has an account setup feature; requires the age-bracket signal to be provided to a covered application store or application developer; and prohibits a person from requesting an age-bracket signal with respect to a particular user from an operating system provider or a covered application store if not required to do so by the DAAA or any other applicable law. Violations carry civil penalties of up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation, enforceable only by the Attorney General.
5. Senate Bill 1119 ("Adam's Law") deletes existing companion chatbot requirements that applied when an operator knows a user is a minor and instead, beginning July 1, 2027, imposes a series of child safety-related obligations on an operator before making a new or substantially modified companion chatbot available to users in California, including performing and documenting a comprehensive risk assessment with respect to minor users that contains a summary of the results of any evaluation of each covered harm and a high-level description of the operator's methodology. Operators must either determine user age under the Digital Age Assurance Act or apply the child protections to all users, and must submit to independent child safety audits of their compliance. The auditor's report must describe whether the operator has established and adhered to policies and practices to comply with the bill and include the lead auditor's signature certifying the results under penalty of perjury. The bill authorizes certain public prosecutors to bring a civil action to enforce its provisions and authorizes a child who suffers actual harm as a result of a violation, or a parent or guardian acting on that child's behalf, to bring a civil action against the operator.
6. Senate Bill 867 prohibits the manufacture, sale, exchange, possession with intent to sell or exchange, and exposition or offer for sale or exchange to a retailer of a "toy" (a physical product designed, marketed, or manufactured for use in play by children under 16 years of age) that includes a companion chatbot until January 1, 2031. Companion chatbots do not include customer service or operational chatbots, certain video game features, or limited voice command interfaces. Violations are subject to the same civil liability as violations of the provisions applicable to operators of companion chatbots in existing law.

Data Privacy

7. Assembly Bill 1159 amends the existing K–12 Pupil Online Personal Information Protection Act (KOPIPA) and the Early Learning Personal Information Protection Act (ELPIPA) to apply to an operator, or an entity working on its behalf, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes (previously, the site had to be used primarily for, and designed and marketed for, those purposes). It also, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibits an operator from using "covered information," including persistent unique identifiers, created or gathered by the operator's site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system. Finally, it enacts the Higher Education Student Information Protection Act (HESIPA), operative July 1, 2027, which would generally protect the personal information of a student enrolled in a "higher education institution" in a similar manner as KOPIPA and ELPIPA. The bill authorizes a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator for damages, injunctive relief, and attorneys' fees, unless after a required notice 60 days before filing an appropriate correction and remedy has been made or agreed upon.

AI Oversight & Regulation

8. Senate Bill 813 establishes a framework for "independent verification organizations" (IVOs) designated by the Government Operations Agency as having demonstrated expertise in assessing the risks posed by AI systems or models. The agency must develop and publish IVO application requirements, designation criteria (including technical expertise, conflict-of-interest management, and independence from assessed parties), and procedures for suspending or terminating designations, and must convene stakeholder working groups and report their findings to the Legislature, while each designated IVO must report annually to the agency and the Legislature. The framework is voluntary and builds on existing law, including the state's inventory of high-risk automated decision systems used by state agencies and the Transparency in Frontier Artificial Intelligence Act, which requires large frontier developers to publish a frontier AI framework. The deadline for developing the IVO application requirements, procedures, and criteria was accelerated from January 1, 2028, to May 1, 2027, by Executive Order N-9-26.
9. Assembly Bill 1405 requires the Government Operations Agency to establish the AI Auditor Registry, set annual registration fees, and create a misconduct reporting mechanism, after which no unregistered person may offer, sell, or conduct a "covered AI audit," defined as an audit conducted to assess internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law. Registered auditors must disclose specified information (including a standard operating procedure), display their registration number on advertising, deliver audit reports with a signed and dated statement of compliance, avoid conflicts of interest, and refrain from retaliating against whistleblowing employees. Violations are grounds for removal from the registry and referral to the Attorney General. The deadline for establishing the AI auditor registry was accelerated from January 1, 2029, to December 1, 2027, by Executive Order N-9-26.
10. Executive Order N-9-26 "dramatically accelerate[s]" implementation of California's newest AI oversight laws in the face of growing safety concerns and inaction by Congress. In addition to moving up deadlines for key actions under Senate Bill 813 and Assembly Bill 1405 described above, the Executive Order also directs the Government Operations Agency to submit recommendations to the Governor by November 16, 2026, on the technical feasibility and potential efficacy of amending state AI safety and security laws to: (a) require large frontier developers to embed designated IVOs onsite in their labs for periodic audits and evaluations; (b) require independent verification of frontier AI companies' safety frameworks, transparency reports, and risk assessments; (c) require a frontier model "kill switch," with its efficacy verified on an ongoing basis by an IVO; and (d) update the definition of "critical safety incidents" to include a range of "loss-of-control incidents."

Contact: Kara K. Trowell

Back to top

CISA and NSA Issue Quantum Computing Security Guidance for Vendor Management

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Australian Signals Directorate's Australian Cybersecurity Centre (ASD) recently issued guidance on evaluating vendors' readiness to adopt post-quantum cryptography (PQC).  The November 4, 2026, guidance (Guidance), titled Post-Quantum Questions to Ask Your Vendors, provides vendor-neutral questions for use in procurement, contract renewals, and ongoing vendor assurance.

Why PQC Matters for Cybersecurity: Public-key cryptography is essential to keeping information confidential and trustworthy across the internet and other computer networks. Using a pair of cryptographic keys (one private and one public), it secures website and virtual private network (VPN) communications. It also underlies digital signatures, which confirm that a message, document, or piece of software is authentic and has not been tampered with. A powerful enough quantum computer could break today's most secure cryptographic algorithms, exposing data and allowing attackers to forge signatures, alter transactions, and push malicious software updates. Although no such quantum computer is known to exist now, experts worry that one could be developed in a matter of years. Post-quantum cryptography (PQC) is designed to withstand attacks from both today's computers and future quantum computers. DWT and FTI Consulting recently hosted a webinar discussing quantum computing's risk to cybersecurity and how companies can approach mitigation to PQC.

Overview of the Guidance: The Guidance proposes sets of questions organized around five phases of a PQC transition: locating cryptographic dependencies, assessing risk, triaging systems, implementing PQC algorithms, and communicating with vendors and stakeholders. Among other things, the questions ask whether the vendor maintains a cryptographic bill of materials (CBOM) or similar inventory of its cryptographic dependencies, which data flows rely on public-key cryptography, whether the vendor's roadmap supports a PQC transition by the end of 2030 (a key PQC transition date for the federal government under a recent executive order), whether PQC is included in a product's base licensing, and which PQC algorithms will be supported.

Contact: Michael T. Borgia

Back to top

Déjà Vu All Over Again: CISA 2015 Heads Toward Another Expiration Cliff

The Cybersecurity Information Sharing Act of 2015 (CISA 2015), a law that grants private-sector entities significant liability protections for sharing "cyber threat indicators" and "defensive measures," is once again approaching sunset. 

CISA 2015 was enacted with a 10-year sunset clause and expired on September 30, 2025. The law has since been granted three short-term extensions, in November 2025, February 2026, and most recently September 2026 via House approval of a continuing resolution (CR) that funds federal agencies and extends key federal cybersecurity authorities and tech programs past their expiration date. CISA 2015 is now set to expire on December 11, 2026. The law authorizes companies to monitor their systems and to share cyber threat indicators and defensive measures "notwithstanding any other provision of law," and it shields compliant sharing of cyber threat indicators and defensive measures from liability, antitrust exposure, regulatory use, and Freedom of Information Act (FOIA) disclosure. Our prior blog post discusses CISA 2015 and strategies for responding to the law's expiration. 

A long-term fix is under consideration, but whether that fix will pass is unclear. The FY2027 National Defense Authorization Act (NDAA), which the House passed in July 2026, includes a 10-year reauthorization of CISA 2015. On November 1, more than 30 industry groups urged the Armed Services Committees to keep that reauthorization in the final conference bill. But renewal could again get wrapped into larger debates about the role of the Cybersecurity and Infrastructure Security Agency (CISA). Sen. Rand Paul, who chairs the Senate Homeland Security and Governmental Affairs Committee, continues to condition his support for long-term reauthorization on limits on the agency's counter-disinformation work, including an amendment that "would protect freedom of speech and prevent the government from trying to restrict speech." CISA was created by the Cybersecurity and Infrastructure Security Act of 2018, several years after the enactment of CISA 2015. And because December 11 is also when the current CR expires, whether CISA 2015 lapses again may depend on government funding negotiations, just as it did when the law lapsed for the first time ahead of last fall's government shutdown.

Contact: Michael T. Borgia and Andrew M. Lewis

Back to top

SEC's FY2026 Exam Priorities Highlight Cybersecurity and "Super Intelligence"

The Securities and Exchange Commission (SEC) is poised to focus on cybersecurity and artificial intelligence—referred to as "super intelligence" (SI)—during its 2027 examinations of SEC-registered entities. The SEC's Fiscal Year 2027 Examination Priorities, published by the Division of Examinations (Division) on October 23, 2026, lists both among its top priorities. Registered entities subject to these examinations include investment advisers, investment companies (i.e. mutual funds and ETFs), broker-dealers, self-regulatory organizations, clearing agencies, and others.

Cybersecurity

The cybersecurity section largely tracks prior years' focus on information security and operational resiliency. Examiners will review governance, data loss prevention, access controls, account management, and incident response and recovery, including for ransomware. They will also look at risks from third-party service providers and shared technologies. Related sections add specificity:

• Regulation S-P: With recent amendments to Reg S-P now in effect (we discussed those amendments in a prior blog post and update), examiners will test incident response programs, customer notification procedures, and service provider oversight.
• Regulation S-ID: Examiners will focus on red flags tied to account takeovers and fraudulent transfers, and on whether identity theft programs address "super intelligence" and stolen credentials.
• Regulation SCI: Exams will cover SI, tokenization, extended trading hours, and quantum computing, plus reliance on cloud and other vendors.

Super Intelligence

Although the SEC's examination priorities document does not have a dedicated section on super intelligence (SI), it addresses SI-related considerations in several sections (the document uses "super intelligence," or SI, instead of AI, following a September 2026 executive order directing federal agencies to adopt that term):

• Leadership message: The document notes registrants' growing use of generative SI and describes the Division's own plans to integrate SI into examinations and risk assessment.
• Emerging Financial Technology: Examiners will assess preparation for SI-enabled threats like phishing and deepfake social engineering. They will review policies for monitoring SI used in fraud detection, back-office operations, AML, Regulation BI (a "best interest" conduct rule for broker-dealers), and trading. They will also test whether representations about automated tools are accurate.
• Regulation S-ID and SCI: As noted above, examiners will assess how registrants are addressing emerging risks, such as those related to SI, in their Reg S-ID and Reg SCI compliance programs. 

Contact: Michael T. Borgia and Michael Butowsky

Back to top