Articles

The Agent Can Bind the Company. Decide Whose Authority It Spends.

The engineering team wants an AI coding agent working in the repository. Procurement wants a buying agent that can request quotes and place orders under a dollar limit. Both teams will tell you the agent "just assists." And both, almost in the same breath, will ask that it keep working when nobody is at the keyboard.

That second request is the one that should bring counsel into the room. An assistant that waits for a person to click "send" is a productivity tool. An agent that acts on its own, with the company's credentials, is spending somebody's authority. The legal question is whose, and whether anyone wrote down how much.

Federal law saw this coming a quarter-century ago. The Electronic Signatures in Global and National Commerce Act (E-SIGN) defines an "electronic agent" as a computer program or other automated means used independently to initiate an action or respond to electronic records or performances, in whole or in part, without review or action by an individual at the time of the action or response. [1] It then provides that a contract or record relating to a transaction in or affecting interstate or foreign commerce may not be denied legal effect, validity or enforceability solely because an electronic agent helped form, create or deliver it, so long as the agent's action is legally attributable to the person to be bound. [2] That is binding federal law, and it was written for exactly the unattended program engineering and procurement are now asking for.

The states got there at the same time. Section 14 of the Uniform Electronic Transactions Act (UETA), approved in 1999, allows a contract to be formed by the interaction of the parties' electronic agents "even if no individual was aware of or reviewed" the agents' actions or the resulting terms. [3] Every state but one has enacted some version of it. I use Washington's enactment as the working example below because it tracks the uniform text closely. [4] The holdout is New York, a point the New York City Bar made in a January 2026 report urging the legislature to adopt UETA. [5]

In August I wrote about what a company owns when an AI agent writes its product, and before that about patents as the remaining moat once AI makes cloning cheap. Those pieces were about ownership. This one is about authority. It is written for the general counsel, and for the outside counsel sitting beside them, when a client is about to connect an agent to email, money, code or a personnel file, or has already done so. The first question in that conversation is not whether the tool is safe. It is whose authority the agent will be spending, and whether anyone approved that in writing before the connection went live.

The statute already assumes nobody is watching

If an agent can send a purchase order, open a pull request or answer a customer while its operator sits in another meeting, it fits E-SIGN's definition. [1] That does not make everything the agent does enforceable. Section 7001(h) is a rule of non-discrimination: a record cannot be denied effect solely because a machine was involved, provided the act is attributable to the person to be bound. [2] And § 7001(b) leaves the rest of substantive law in place, displacing only requirements that a record be written, signed or in nonelectronic form. [2] A statute that demands a particular form, a consumer consent no one obtained or a signature a court will not treat as the company's is not cured by the presence of an agent.

So the practical work is attribution. UETA § 9, enacted in Washington as RCW 1.80.080, says an electronic record or signature is attributable to a person if it was the act of that person, which "may be shown in any manner," including by the efficacy of a security procedure. The legal effect of that attribution is then judged from the context and surrounding circumstances, including the parties' agreement. [6] Other states must be read in the words they actually enacted, but the direction of the uniform rule is clear: the record attaches to a person, not to the machine. A company that connects an agent to a vendor portal, hands it credentials and lets it transact will have a hard time explaining why the resulting order was not its own act.

Nor will the error rule rescue the company from its own agent. UETA § 10, enacted in Washington as RCW 1.80.090(2), lets an individual who deals with someone else's electronic agent avoid a record that resulted from the individual's own mistake, if the agent offered no way to prevent or correct the error and the individual promptly gives notice, returns or destroys what was received and has taken no benefit from it. [7] That protection belongs to the person on the other side of the company's agent. It is not a button the company can press after its agent orders ten thousand units instead of ten.

I have not found a reported appellate decision applying § 7001(h) to a large-language-model agent that committed its principal to terms no one at the company read. I would not wait for one. The statutory text already reaches a program acting without contemporaneous human review, [1] [2] and the first litigated case will turn on facts that exist today: a wrong price, a wrong counterparty or a term nobody saw, accepted by a counterparty who reasonably believed it was dealing with the company.

Agency law decides how far the company is bound

E-SIGN validates the record. It does not make the software an agent in the legal sense. Under the Restatement (Third) of Agency, agency is a relationship between persons, [8] and its commentary is explicit that a computer program cannot act as a principal or an agent; it is an instrumentality of the person who uses it. [8] That sounds like it helps the deployer. It does not. If the agent is the company's instrument, then what the agent does is, in the counterparty's eyes, what the company did.

The closer fit is apparent authority. Section 2.03 defines it as the power of "an agent or other actor" to affect a principal's legal relations with third parties when a third party reasonably believes the actor is authorized, and that belief is traceable to the principal's manifestations. [8] Section 3.03 adds that apparent authority is created by the principal's manifestation to the third party, not by private instructions the third party never saw. [8] Connecting an agent to a company domain, a vendor portal and a payment credential is a manifestation. A line in the system prompt that says "never spend more than $5,000" is not, unless the counterparty had reason to know about it.

The counterparty's side of the equation still matters. Its belief has to be reasonable, and an order that is wildly out of pattern may put it on inquiry. But a company should not plan on winning that argument. What it will want, when the brief is written, is evidence that the limit was real: a dollar ceiling enforced outside the model, a security procedure and a log showing who connected the agent and what it was allowed to do.

Section 3.11 is why decommissioning an agent is a legal step and not just an IT ticket. Ending actual authority does not, by itself, end apparent authority; that lasts until it is no longer reasonable for the third party to believe the agent is still authorized. [8] An agent still holding a departed employee's token, still logged into a supplier's portal, is an authority problem before it is a security finding.

New York is the exception worth flagging

Because New York never enacted UETA, a purely intrastate New York transaction is governed by the Electronic Signatures and Records Act, N.Y. State Technology Law §§ 301–309. [9] ESRA gives legal effect to electronic signatures and records, but it contains no counterpart to UETA's electronic-agent definition or its automated-transaction rule. [9] For anything in or affecting interstate commerce, E-SIGN applies unless a state law qualifies for the exception in § 7002, and the principal route to that exception is enacting UETA. [10] New York did not take it, and the City Bar committee reads the result as E-SIGN governing interstate deals and preempting ESRA where the two conflict. [5] That is a bar committee's view, not a holding. If a client's form contracts choose New York law, counsel should say so out loud before anyone tells the business that the agent can sign.

A control incident is not a break-in

On October 16, 2026, NIST's Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), the NSA's Super Intelligence Security Center and CISA jointly published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (PP-26-4396). [11] It sets out 10 voluntary practices, and its stated audience is organizations training or evaluating highly capable agents on long-horizon tasks with limited human supervision, though it notes the practices may also apply to deployers. It does not regulate a mid-market procurement bot. Counsel should still read its central definition, because a plaintiff will.

The document defines an "SI control incident" as one in which one or more agents take "significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator to define the intended task scope or to ensure human oversight." [11] The distinction it draws is useful well beyond frontier labs. A cybersecurity incident is aimed at a system or its data. A control incident originates from the agent. The agent may cause a cybersecurity incident along the way, but the two are not the same event. The document's examples include an agent initiating unauthorized communications with outside parties, executing unauthorized financial transactions or manipulating a physical actuator, including where the opening was a misconfiguration introduced by human error rather than an outside attacker. [11] (One wrinkle: actions driven by adversarial prompt injection or a deliberately backdoored model are treated as instructed, so they fall on the security side of the line.) [11]

The 10 practices follow the familiar incident cycle of preparation, detection, response, recovery and reporting. Design the controls before the run. Train the people who will respond. Watch for activity nobody asked for, and protect the monitor so the agent cannot switch it off. Preserve the evidence, stop the activity and do not turn the agent back on until containment holds. Then notify the people affected and decide, under the document's own terms, when a government notice or public statement is warranted. [11] The guidance is voluntary. It is also a fair preview of the record a plaintiff, a regulator or an acquirer's diligence team will ask for after an agent does something no one told it to do.

NIST's broader agent work points the same way. Its Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February 2026, [12] and its May 2026 summary of public comments, NIST AI 800-5, reported wide agreement that agents present novel security threats and that established cybersecurity practice remains relevant but will need adapting to address them. [13] None of this is regulation; there is no NIST rule telling a client how to deploy a coding agent. But the direction is clear enough to act on. Identity, tool scope and the off switch belong outside the model. A prompt that says "do not spend more than $5,000" is not a control. A system that refuses the tool call is.

The OWASP Top 10 for Agentic Applications, released in December 2025, is a threat list, not a statute or government guidance. [14] Three of its entries map directly onto the legal problem: agent goal hijack, where hidden instructions redirect the agent; tool misuse and exploitation, where the agent uses a permitted tool to do something the company did not want; and identity and privilege abuse, where the agent runs on credentials broader than its job. Give that list to the security lead. Do not put it in a board resolution and call it a safe harbor.

Write the delegation before you connect the tool

The implementation work is unglamorous. It is also the advice that matters most, and it applies with equal force to an agent that is already running.

Start with an inventory a general counsel can read. For each agent, identify the owner, the job, the systems it can reach, the identity it runs under, whether it can act with no one watching and whether it can spend money, send mail outside the company, change production code or touch personnel, health, or customer data. If engineering cannot fill in those fields, the agent is not ready to connect. Agents an employee wired up on a personal account belong on the list too; counsel cannot supervise a tool the company has not found.

Read the delegation-of-authority policy before drafting a new AI policy. If a manager can approve $10,000, and an agent can approve $10,000 on that manager's credentials, the company has doubled a signing power without asking the people who own the policy. Lower the agent's limit or amend the policy. Do not leave both in place and hope the agent behaves. Under the Restatement, the credential and the portal access are the manifestations a counterparty will point to; the internal policy it never saw is not. [8]

Separate the model from the authority. The model proposes; something outside the model decides whether the tool call is allowed. Use short-lived credentials, and never leave a standing administrator token on an agent that reads untrusted email or web pages. A person should approve payments, external messages, production changes, personnel actions and anything else that leaves the building, and that approval should be a record counsel can produce in six months, not a chat message no one can find. That record is the evidence of attribution under UETA § 9. [6]

Log the instruction, the tool call, the result and the identity it ran under. Keep the logs long enough to cover a contract dispute and the employment and privacy obligations discussed below. If the company cannot reconstruct what the agent did, it will struggle to show the act was authorized, and struggle to show it took reasonable measures to protect any trade secret that passed through the tool. That second point is not a best-practice slide; it is an element of the Defend Trade Secrets Act. [15]

Put the limits in two places. Internally: who may connect an agent, what dollar and action limits apply and what happens when the agent exceeds them. In the vendor contract: no training on the client's inputs, an enforceable retention period, named subprocessors, exportable logs, a duty to notify when the agent acts outside the agreed scope, an assignment or license that covers the outputs the client needs, and the right to disable tools without waiting for the vendor's next release. A SOC 2 report describes the vendor's environment. It is not an authority matrix for the client's agent.

Revoke the identity the day the owner changes jobs. Restatement § 3.11 is the reason: terminating the employee's actual authority does not, by itself, end the apparent authority a vendor is already relying on. [8]

When the agent decides about people, different statutes apply

Most of the new AI statutes do not regulate a coding agent. They regulate systems that help decide whether a person gets a job, credit, housing, insurance, health care, an education or a public benefit. If a client's agent starts scoring applicants or recommending a termination, it has become the product these laws cover, and the compliance checklists drafted in 2024 are the wrong ones to follow.

Colorado is the clearest example of why. The 2024 Colorado AI Act, Senate Bill 24-205, never took effect as written. Its effective date was pushed back in the 2025 special session, and the law was then repealed and reenacted by Senate Bill 26-189, which Governor Polis signed on May 14, 2026, as 2026 Colorado Session Laws chapter 131. [16] The new part 17 of title 6, article 1, drops the old duty of reasonable care, the mandatory risk-management program and impact assessments. It regulates automated decision-making technology used to materially influence a consequential decision about education, employment, housing, financial or lending services, insurance, health care or essential government services, and it applies to decisions made on or after January 1, 2027. [16] From that date, developers must give deployers documentation of intended uses, training-data categories, known limitations, and instructions for appropriate use and meaningful human review. Deployers must give notice before using covered technology and, within 30 days after a decision that produces an adverse outcome, a plain-language explanation, along with instructions for correcting inaccurate personal data and, to the extent commercially reasonable, a path to human review and reconsideration. Both keep records for at least three years. [16] The Attorney General has exclusive enforcement authority, treats violations as deceptive trade practices and until January 1, 2030, must give 60 days' notice and a chance to cure where a cure is possible, except for knowing or repeated violations. The act creates no new private right of action, but it does allocate fault between developers and deployers in existing discrimination claims. [16] The Attorney General's implementing rulemaking, which also covers Colorado's new chatbot-safety law, is set for a public hearing on October 26, 2026. [17] If a client is still working from a 2024 impact-assessment calendar, retire it and read chapter 131.

California runs on a different clock, with two regimes that do not line up. The California Privacy Protection Agency adopted its automated-decisionmaking technology (ADMT) regulations on July 24, 2025; the Office of Administrative Law approved them on September 22, 2025; and the package took effect January 1, 2026. [18] The duties that matter for a "significant decision" sit in Article 11, beginning at Cal. Code Regs. tit. 11, § 7200, and a business already using ADMT for those decisions before 2027 has until January 1, 2027, to comply. [18] A significant decision includes one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or health care services. [18] Keeping a person "in the loop" does not take a tool outside the rules if that person merely rubber-stamps the score. To count, the reviewer must know how to interpret and use the output, must review it alongside other relevant information and must have authority to make or change the decision. [18]

Then, on September 30, 2026, Governor Newsom signed Senate Bill 947 (chapter 859), which adds a new part 5.5.5 to the Labor Code, beginning at section 1520, operative July 1, 2027. [19] It restricts the purposes for which employers may use automated decision systems and bars relying solely on such a system to discipline or terminate. Where an employer has primarily used one for that purpose, the employee may request a meaningful description of the employee's own data the system used, and the employer must give written notice when it communicates the decision. [19] The Labor Commissioner and public prosecutors can enforce it, with civil penalties of $500 per violation, and a collective bargaining agreement can waive it only in clear and unambiguous terms and only if the agreement itself provides protection from algorithmic management. [19] SB 947 is not the same test as the CPPA rules, and the statute says so: a CCPA-covered employer remains subject to the Agency's ADMT regulations. [19] A tool can sit outside one regime and inside the other. Map both before approving an HR agent.

If the agent will be offered to people in the European Union, do not brief the board on the original August 2026 high-risk deadline. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. [20] It moved the Annex III high-risk obligations, which include hiring, credit and education, to December 2, 2027, and the Annex I product-related obligations to August 2, 2028. [20] The Article 50 transparency duties, including telling people they are interacting with an AI system, have applied since August 2, 2026; providers of systems generating synthetic audio, image, video or text that were on the market before that date have until December 2, 2026, to meet the machine-readable marking requirement in Article 50(2). [20] The Commission's AI Act Service Desk summarizes these dates conveniently, but cite the Official Journal text, not the FAQ. [21] If EU residents are in scope, classify the system now. The heavy conformity file can wait; the disclosure cannot.

None of these laws bans agents. A coding agent that never makes a decision about a person sits outside all of them. The same coding agent, repurposed to rank engineers for promotion, does not. Other states also regulate electronic monitoring and automated employment decisions, and I am not surveying them here; a multistate workforce needs that survey before an agent reads employee email or scores performance.

Privilege, secrets, and the firm's own agents

ABA Formal Opinion 512, issued July 29, 2024, remains the opinion I hand any lawyer who wants to drop a client file into an AI tool. [22] It is ethics guidance under the Model Rules, not a court holding, and state opinions may differ. It creates no new rule; it applies the ones lawyers already have. Competence means a reasonable, current understanding of the specific tool, not a degree in machine learning. Confidentiality means learning what happens to the input before client information goes in, and, for a tool that learns from its inputs, obtaining informed consent first; boilerplate in an engagement letter is not enough. Supervision means a written policy, training and the same diligence the firm would apply to any vendor that sees client information. Candor means a person reads the output before it reaches a court. And fees mean billing for the time actually spent, including time checking the draft, not the time the tool saved. [22]

Opinion 512 does not decide attorney-client privilege. Whether a given upload waives privilege depends on the jurisdiction, the vendor terms and who at the vendor can see the prompt. That is not a question to answer by guessing, or for the first time in a deposition. If a client's outside-counsel guidelines forbid a tool, the guidelines control even where the opinion would permit it. And when the client is the one deploying agents, the question runs the other way: ask what the firm is allowed to put into them.

Trade secret law has the same shape on the business side. Under the Defend Trade Secrets Act, information is a trade secret only if its owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known or readily ascertainable. [15] An engineer who pastes an unreleased design into a consumer tool that trains on inputs, under terms that let the vendor keep the prompt, has handed the other side an argument that the company's measures were not reasonable. Enterprise terms that prohibit training, a policy people have actually read and a log showing the policy was followed are the measures. A policy on an intranet page nobody opened is not.

Copyright, meanwhile, is thinner than most product teams assume. I have written about that at more length elsewhere, so two citations will do, and they do different work. Thaler v. Perlmutter holds that the Copyright Act of 1976 requires a work to be authored in the first instance by a human being, and that a machine cannot be the recognized author. [23] The decision binds the D.C. Circuit. It does not decide how much human involvement with an AI tool makes a person the author; Thaler claimed the machine as sole author, so the court had no occasion to draw that line, and it held waived his alternative argument that he was the author because he built and used the machine. [23] The Supreme Court denied certiorari on March 2, 2026, which leaves the decision in place but does not make it the law of every circuit. [23] For the practical question the court left open, the Copyright Office's January 2025 report remains the citation I use: given current technology, prompts alone do not give the user enough control to be the author; purely AI-generated material is not copyrightable; and a company can claim what a person created, selected, arranged or modified. [24] The takeaway for the agreement file is straightforward. Update assignment and contractor agreements so they reach AI-assisted output, and read the vendor's assignment clause before treating any output as the client's.

What to finish before the connection goes live

Here is the short version: the steps I want completed, in this order, before I tell a client an agent can be connected, or left running if it already is.

1. Name an owner who still works there, and an executive who can turn the agent off. "The platform team" is not an owner.
2. Write the job in one paragraph. Say what the agent may do with no one watching and what it may never do. Payments, external messages, production changes, personnel actions, and transfers of customer or employee data stay on the forbidden list unless a named person approves the specific act. If counterparties will see the agent acting for the company, treat that access as a manifestation under Restatement § 3.03, not an internal preference. [8]
3. Give the agent its own identity, not a shared human password. Limit its tools to the job, make its credentials expire and revoke them when the owner leaves or the job ends, in a way that reaches the counterparties who can still see the credential. [8]
4. Put the permission check outside the model, where the agent cannot talk its way past it. Have the company's own security team try to defeat it in a test copy of the system, on systems the company controls, before the agent touches a live account. The OWASP list is a good attack menu for that exercise, not a legal standard. [14]
5. Log the instruction, the tool call, the result and the identity, and keep the logs for at least the limitations period the company actually faces, long enough to prove attribution under E-SIGN § 7001(h) and UETA § 9, and longer if a privacy schedule requires it. [2] [6]
6. Match the vendor contract to the internal authority matrix. Confirm whether the vendor trains on inputs, who can read prompts and who owns outputs. If the contract is silent, do not connect the tool to anything the company would not put in an email to a stranger.
7. Classify any use that touches a decision about a person, whether employment, credit, housing, insurance, education, health care or benefits, under Colorado's chapter 131, the CPPA's ADMT regulations, California Labor Code part 5.5.5 and, if EU residents are in scope, Regulation (EU) 2026/1744. [16] [18] [19] [20] Do not bury that analysis inside the coding-agent review.
8. Apply Formal Opinion 512 before lawyers use the agent on client matters. [22] Get informed consent where the rules require it, keep client information out of tools the client has forbidden and have a person read the output before it becomes advice.

Outside counsel should send those eight items back to the client as questions, not as a policy to adopt unread. What can this agent do with no one watching? Whose credentials does it use? What is the largest commitment it can make before a person sees it? Where is the log, and how long is it kept? What does the vendor keep? Which statute, if any, treats this use as a decision about a person? If the client cannot answer, the deployment is not ready, and a working demo is not a substitute for the answers.

I would not tell a board that the law prohibits AI agents. It (of course) does not. For an interstate transaction, § 7001(h) points the other way once the act is attributable to the company. [2] But that is exactly the point. When an agent transacts in the company's name, a court is likely to treat the company as the actor. The record of who allowed that, and of what the agent was not allowed to do, needs to exist before the first unattended act, because a policy nobody can enforce is not the record counsel will want later.

Sources and Authorities

1. Binding. Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7006(3) (definition of "electronic agent"). https://www.law.cornell.edu/uscode/text/15/7006

2. Binding for a transaction in or affecting interstate or foreign commerce. 15 U.S.C. § 7001(b)(1), (h). Subsection (h) is the electronic-agent rule; subsection (b)(1) preserves other substantive law except a requirement that a record be written, signed or in nonelectronic form. https://www.law.cornell.edu/uscode/text/15/7001

3. Uniform text; binding only as enacted in a given state, in that state's words. Uniform Electronic Transactions Act §§ 2(6) (electronic agent), 9 (attribution and effect of electronic record and electronic signature), 10 (effect of change or error), 14 (automated transaction) (Unif. L. Comm'n 1999). https://www.uniformlaws.org/committees/community-home?CommunityKey=2c04b76c-2b7d-4399-977e-d5876ba7e034

4. Binding in Washington. Wash. Rev. Code § 1.80.130(1) (automated transaction; contract may be formed by interaction of electronic agents even if no individual was aware of or reviewed their actions or the resulting terms); id. § 1.80.010(8) (electronic agent), enacted by 2020 Wash. Sess. Laws ch. 57. https://app.leg.wa.gov/RCW/default.aspx?cite=1.80.130

5. Persuasive; a bar committee report, not a statute or holding. N.Y.C. Bar Ass'n, Commercial Law & Uniform State Laws Comm., Enacting the Uniform Electronic Transactions Act in New York (Jan. 16, 2026) (New York is "the only state that has not adopted" UETA; E-SIGN preempts ESRA for interstate and international transactions). https://www.nycbar.org/reports/modernizing-new-york-electronic-signatures-esra-ueta/

6. Binding in Washington; uniform analogue is UETA § 9. Wash. Rev. Code § 1.80.080 (attribution and effect of electronic record and electronic signature). https://app.leg.wa.gov/RCW/default.aspx?cite=1.80.080

7. Binding in Washington; uniform analogue is UETA § 10(2). Wash. Rev. Code § 1.80.090(2) (individual's error in dealing with another person's electronic agent). https://app.leg.wa.gov/RCW/default.aspx?cite=1.80.090

8. Persuasive common-law synthesis. Restatement (Third) of Agency §§ 1.01 (agency defined), 1.04 cmt. e (computer programs are instrumentalities of the persons who use them, not principals or agents), 2.03 (apparent authority), 3.03 (creation of apparent authority), 3.11 (termination of apparent authority) (Am. L. Inst. 2006). https://www.ali.org/publications/restatement-law-third/agency

9. Binding in New York for the matters it covers. N.Y. State Tech. Law §§ 301–309 (Electronic Signatures and Records Act). Section 302 defines only "electronic," "electronic record," "electronic signature," "person," and "governmental entity"; the article has no electronic-agent definition or automated-transaction rule. https://www.nysenate.gov/legislation/laws/STT/A3

10. Binding preemption rule. 15 U.S.C. § 7002(a) (state law may modify, limit or supersede § 7001 only by enacting UETA as approved in 1999, subject to stated limits, or by adopting consistent, technology-neutral alternative procedures that, if enacted after June 30, 2000, specifically reference E-SIGN). https://www.law.cornell.edu/uscode/text/15/7002

11. Persuasive; voluntary guidance for a stated audience, not a regulation of enterprise software. NIST Ctr. for Advancing Innovation & Standards for Super Intelligence (CAISSI), NSA Super Intelligence Security Ctr., & CISA, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation, PP-26-4396 (Oct. 16, 2026) (definition of "SI control incident"; examples at n.2; prompt-injected and backdoored actions treated as instructed at n.1). https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training

12. Persuasive. NIST Ctr. for AI Standards & Innovation (CAISI), Announcing the "AI Agent Standards Initiative" for Interoperable and Secure Innovation (Feb. 17, 2026). https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure

13. Persuasive. NIST, Summary Analysis of Responses to the Request for Information Regarding Security Considerations for AI Agents, NIST Trustworthy and Responsible AI 800-5 (May 18, 2026). https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai

14. Persuasive threat taxonomy; not law. OWASP Gen AI Security Project, OWASP Top 10 for Agentic Applications for 2026 (Dec. 9, 2025) (ASI01 Agent Goal Hijack; ASI02 Tool Misuse and Exploitation; ASI03 Identity and Privilege Abuse). https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

15. Binding federal definition. 18 U.S.C. § 1839(3)(A)–(B) (trade secret; reasonable measures and independent economic value). https://www.law.cornell.edu/uscode/text/18/1839

16. Binding in Colorado on its own dates. S.B. 26-189, 2026 Colo. Sess. Laws ch. 131 (approved May 14, 2026) (repealing and reenacting Colo. Rev. Stat. tit. 6, art. 1, pt. 17; applies to consequential decisions made on or after Jan. 1, 2027), see §§ 6-1-1701(5), (6), (13), 1702–1707, 1709. The earlier delay is S.B. 25B-004 (2025 1st Extraordinary Sess.). https://leg.colorado.gov/bills/sb26-189; https://leg.colorado.gov/laws/session-laws/SB26-189/131/download

17. Informational; not the session law. Colo. Att'y Gen., rulemaking under S.B. 26-189 and H.B. 26-1263 (public hearing Oct. 26, 2026). https://coag.gov/ai/. See also Colo. Div. of Real Estate, SB26-189 Summary, https://dre.colorado.gov/sb26-189-summary.

18. Binding on covered businesses, on the phase-in the text states. Cal. Privacy Prot. Agency, CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Regulations (adopted July 24, 2025; approved by Office of Admin. Law Sept. 22, 2025; effective Jan. 1, 2026), Cal. Code Regs. tit. 11, §§ 7001(e)(1) (human-involvement criteria within the ADMT definition), 7001(ddd) (significant decision), 7200(b) (compliance by Jan. 1, 2027, for pre-2027 uses). https://cppa.ca.gov/regulations/ccpa_updates.html; text at https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf

19. Binding in California from its operative date. S.B. 947, 2025–2026 Reg. Sess., ch. 859 (Cal. 2026) (approved Sept. 30, 2026), adding Cal. Lab. Code pt. 5.5.5 (commencing with § 1520), see §§ 1522 (purpose limits; no sole reliance; data-description right), 1524 (post-use notice), 1526–1526.1 (penalties; enforcement), 1526.4 (CPPA regulations preserved), 1526.5 (CBA waiver), 1526.7 (operative July 1, 2027). https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947

20. Binding in the European Union on the dates in the text. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026 (in force July 27, 2026), amending Regulation (EU) 2024/1689, arts. 111(4), 113. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

21. Informational restatement of dates; cite the regulation for the binding text. European Commission, AI Act Service Desk, When does enforcement start? https://ai-act-service-desk.ec.europa.eu/en/ai-act/faq/when-does-enforcement-start

22. Persuasive ethics guidance under the Model Rules; not a privilege holding, and state opinions may differ. ABA Standing Comm. on Ethics & Prof'l Responsibility, Formal Op. 512, Generative Artificial Intelligence Tools (July 29, 2024). https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf

23. Binding in the D.C. Circuit; persuasive elsewhere. Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025) (No. 23-5233, decided Mar. 18, 2025), cert. denied, No. 25-449 (U.S. Mar. 2, 2026). A denial of certiorari is not a ruling on the merits. https://law.justia.com/cases/federal/appellate-courts/cadc/23-5233/23-5233-2025-03-18.html; https://www.supremecourt.gov/docket/docketfiles/html/public/25-449.html

24. Persuasive agency analysis; not a holding. U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (Jan. 29, 2025). https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-2-Copyrightability-Report.pdf