As of mid-2026, US enterprises do not need new federal AI legislation to be exposed on AI governance; AI-touching workflows already fall under HIPAA Security Rule access and audit controls (45 CFR 164.312), GLBA Safeguards Rule (16 CFR Part 314) access-control and incident-notification obligations, SEC cyber-disclosure rules (Item 106 of Regulation S-K and Item 1.05 of Form 8-K, with the 4-business-day materiality clock), and FTC Section 5 deception and unfairness jurisdiction at the data layer. The structural pattern, captured in the UK ICO's May 2026 'AI-powered cyber threats' guidance and the seven threat categories it names, is that AI governance has become data governance; the most common 2026 implementation gap is the fragmented audit log (Kiteworks 2026 Forecast: 33% lack audit trails entirely, 61% have fragmented logs), not the absence of regulation.
Claim is scoped to the US-framework reading of AI workflow exposure in 2026 enterprises. Does not assert that no new AI-specific US legislation is desirable; asserts that the existing rule sets already cover the threat surface at the data layer, that the implementation gap is in audit evidence and runtime containment rather than in rule text, and that the four-move CIO playbook (classify AI access as data access, unify audit log, close containment gap, apply purpose binding) is operationally tractable in a single procurement and audit cycle. 90-day review cadence calibrated to regulatory rather than security-advisory pace. Trigger conditions: (1) US federal AI legislation passes or reaches near-passage at a level that materially changes the analysis — would move toward Partial; (2) a court ruling materially narrows the applicability of HIPAA, GLBA, SEC cyber-disclosure rules, or FTC Section 5 to AI systems specifically — would move toward Partial or Not holding depending on direction; (3) a published 2026 FTC, SEC, HHS OCR, or state-attorney-general enforcement action explicitly invoking one of these frameworks against AI-specific conduct — would confirm operational reading and strengthen case; (4) NIST AI RMF, ISO 42001, or HHS OCR publishes specific AI-adjacent implementation guidance under the existing rule sets — would harden the operational answer to the rule-text-without-implementation-guidance gap; (5) the ICO's seven-category threat framing appears verbatim or near-verbatim in a US enforcement action or state-attorney-general consent decree — would confirm the cross-border framing-adoption pattern this piece anchors on.
/holding/AM-172/Embed this claimiframe + oEmbed
The card auto-updates when the claim's status, last-reviewed date, or correction log changes. Embedders never need to refresh — the card is rendered live from the canonical record.
Email-me when AM-172's status, next review date, or correction log changes. One email per change. No newsletter subscription, no other mail.
The claim: As of mid-2026, US enterprises do not need new federal AI legislation to be exposed on AI governance; AI-touching workflows already fall under HIPAA Security Rule access and audit controls (45 CFR 164.312), GLBA Safeguards Rule (16 CFR Part 314) access-control and incident-notification obligations, SEC cyber-disclosure rules (Item 106 of Regulation S-K and Item 1.05 of Form 8-K, with the 4-business-day materiality clock), and FTC Section 5 deception and unfairness jurisdiction at the data layer. The structural pattern, captured in the UK ICO's May 2026 'AI-powered cyber threats' guidance and the seven threat categories it names, is that AI governance has become data governance; the most common 2026 implementation gap is the fragmented audit log (Kiteworks 2026 Forecast: 33% lack audit trails entirely, 61% have fragmented logs), not the absence of regulation.
About this register
The Reporting register tracks claims published from articles addressed to senior enterprise IT leaders — CIOs, IT directors, heads of platform. Claims are reviewed on a 30–90 day cadence; each review either reaffirms the claim, marks one substantive part as Partial, or marks it Not holding once the underlying evidence has been overtaken.
Recent corrections in Reporting
- AM-008 · Partial · 17 Jun 2026
Source-text figure re-review: Google's 2024 Environmental Report reports a 28% year-over-year increase to 8.1 billion gallons, not the 33% (from a 6.1 billion 2023 base) asserted at publish. The 8.1B 2024 figure and the Microsoft WUE 0.30 L/kWh / 39%-improvement figure are unchanged and verified. Article corrected to 28% and the unsupported 6.1B base removed; the claim text retains the original figure with this correction per the Holding-up protocol.
- AM-132 · Partial · 10 Jun 2026
One of four legs unanchored on re-review. The claim text attributes '12% of deployments clearing 300%+ ROI with 88% at or below break-even at 12-18 months' to the Stanford DEL 2026 Enterprise AI Playbook. Full-text verification on 10 Jun 2026 found no such figure in that source: the playbook (Pereira, Graylin, Brynjolfsson, Apr 2026) studies 51 successful deployments by design and contains no ROI distribution, no 300%-plus cohort, and no break-even measurement point (full finding at AM-029, correction of 10 Jun 2026). The only verified figure carrying the same 12/88 numerals is IDC research with Lenovo (via CIO.com, Mar 2025): roughly 88% of AI proof-of-concepts never reach production and roughly 12% graduate — a pilot-to-production graduation metric, not an ROI distribution. The Gartner 28%, McKinsey 23%/17%, and MIT NANDA 95% legs verify; they support a small high-performing tail and a large struggling body, but none documents the two-peak bimodal shape the claim asserts. Status Up -> Partial.
- AM-129 · Partial · 10 Jun 2026
One of three read-against anchors unanchored on re-review. The claim text cites 'Stanford Digital Economy Lab Enterprise AI Playbook (12/88 bimodal ROI distribution at 12-18 months)' and frames the realistic ROI band around 'the highest-discipline 12% cohort'. Full-text verification on 10 Jun 2026 found the playbook contains no 12/88 distribution, no bimodal ROI shape, and no 12-18-month ROI measurement point (full finding at AM-029, correction of 10 Jun 2026). The claim's core negative finding — no mid-market enterprise has produced a documented +240% ROI in 90 days under audited conditions — is unaffected; the McKinsey State of AI 2025 and MIT NANDA legs verify and continue to support it. The '12% cohort' framing has no verifiable referent. The only verified figure carrying the 12/88 numerals is IDC's pilot-graduation finding (roughly 88% of AI proof-of-concepts never reach production; via CIO.com, Mar 2025), a different metric. Status Up -> Partial.
Reviews coming up in Reporting
- AM-063 · Holding · next +9d (27 Jun 2026)
AI agents executing financial transactions need a four-control bundle (action-approval gates by blast radius, kill-swit…
- AM-061 · Holding · next +9d (27 Jun 2026)
Production agentic-AI costs at scale routinely run multiples of POC projections, and a layered optimisation programme c…
- AM-003 · Partial · next +9d (27 Jun 2026)
GPT-5 Pro's tiered-subscription model forces enterprises to classify problems by computational difficulty — $200/month…