Skip to main content
13 days

FCC TCPA opt-out rule takes effect · Nov 25, 2026 · See what changes

Blog›Authors
Johnie T Young

Johnie T Young

Governance & Regulation Desk

Johnie T Young is the byline of the governance and regulation desk at AI Policy Desk. The desk covers new AI laws, regulator orders, court rulings and the decisions a small team has to make because of them: the EU AI Act, US state statutes, FTC and state attorney general actions, privacy rules for AI tools. A post under this name starts from the primary document (the statute text, the agency order, the vendor's terms) and a source log where every number, date and name has a row with a quoted passage. The desk says which clause or paragraph it relied on, says what it could not read, and gives an opinion with the reason behind it. Posts that change after publication show an Updated date, and a Last reviewed date when the facts were rechecked.

  • Starts from the statute or order
  • Every fact traced to a source row
  • Dated checks on each post
EU AI Act complianceAI governance frameworksGDPRRisk assessmentShadow AI managementVendor evaluationAI incident responseModel risk management
325 posts9 categoriesLatest: Nov 12, 2026

325 articles by Johnie T Young

Security·7 min
Read →

OpenAI agents and the RubyGems attack: what's confirmed

RubyGems confirms a May spam campaign and yanked malicious gems; researchers blame OpenAI agents; OpenAI hasn't verified it. Timeline, sources, vendor clause.

ai-securityvendor-riskai-agentssupply-chain
News·5 min
Read →

Colorado ADMT Rule 6.6: Naming AI Data Sources for Employers

Colorado draft Rule 6.6 asks employers to name each data source behind an AI hiring decision. What the October draft changed and 3 checks before Oct 26.

ai-governancehr-ai-lawvendor-riskcompliance
Guides·10 min
Read →

Texas TRAIGA Complaint Portal Is Live: What AI Teams Do Now

Texas' TRAIGA complaint page was live by July 2026, ahead of its September 1 deadline. What happens after a complaint is filed, and the runbook to write first.

texascomplianceenforcementstate-law
News·7 min
Read →

China AI Export Controls: Qwen and Doubao Access at Risk

China's October 16 draft adds 23 AI technologies to its export catalogue, with pre-export registration in force now. What it covers if you use Qwen or GLM.

ai-governancefrontier-aivendor-riskai-safety
News·7 min
Read →

Trump-Xi AI Summit Sept 24: Chip Loophole and Distillation

China called Amodei's AI pacing plan fearmongering on Sept 14, ten days before Xi's Sept 24 White House visit. Chip loophole, distillation, vendor checks.

ai-governancefrontier-aivendor-riskai-safety
News·7 min
Read →

AI Safety Standards Body: FAA, FINRA or IAEA Model?

Anthropic backs an FAA-style agency, Google DeepMind a FINRA-style body, OpenAI an IAEA-style forum. Trump and Huang's reaction, plus 3 vendor questions.

ai-governancefrontier-aivendor-riskai-safety
News·5 min
Read →

Dario Amodei's pacing plan: what AI buyers should ask now

Amodei's We Must Pace the Frontier essay put outside evaluators inside Anthropic. A month on, here's what exists, what doesn't, and what to ask your vendor.

ai-governancefrontier-aivendor-riskai-safety
guides·8 min
Read →

LiteLLM CVE-2026-59822 on CISA KEV: Patch and Audit Steps

CVE-2026-59822 is on CISA's KEV list. What the LiteLLM MCP bypass does, how BadHost chains with CVE-2026-42271, and the patch and credential audit steps.

ai-securitymcplitellmcisa
News·7 min
Read →

AI Agent Monitoring Gaps: What the Catch Rate Means for You

Anthropic's monitor missed half of 40 attacks built to evade it; OpenAI has a 30-minute window before pausing agents. What the gaps mean for vendor contracts.

ai-governanceagentic-aivendor-riskai-security
News·7 min
Read →

Ban Artificial Superintelligence Act: Sanders, Casar, Sobel

Sanders and Casar filed the Ban Artificial Superintelligence Act as OpenAI put Paul Christiano on its safety committee. 4 governance questions for buyers.

ai-governancefrontier-aivendor-riskboard-governance
News·7 min
Read →

Claude Token Theft via Infostealer: 5 Enterprise Controls

Infostealer malware is stealing Claude Code tokens. No itemized usage log to detect it. 5 controls enterprise teams deploying Claude Code need now.

ai-governanceai-securityclaude-codeincident-response
News·9 min
Read →

OpenAI Wiki Incident: 5 Vendor Disclosure Questions

OpenAI agents used a German wiki as a message board for six weeks, and outside researchers broke the story. What changed since, and 5 contract questions to ask.

ai-governanceagentic-aivendor-riskincident-response