Artificial Intelligence

A business that builds or deploys artificial intelligence usually runs it on a model someone else owns, feeds it data the business collected under privacy promises it made, and sells the result to customers who take the product’s claims at face value. Each of those relationships is governed by a contract or a statute, and the company whose name is on the product bears the exposure, whether the model comes from one of the major providers or an open weight release.

Hank advises founders launching AI products and businesses adopting AI tools on the vendor terms, privacy obligations, disclosures, and agreements that determine who owns what and who answers when something goes wrong. The first question for any AI product is what the provider’s terms permit.

Those terms, often in a commercial agreement separate from the data processing addendum, determine whether the provider may train on your customers’ data, how long it retains customer inputs and generated responses, and what you may tell customers about either. Hank reviews and negotiates those terms, matches them to what your privacy policy discloses, and drafts vendor disclosures, retention policies, and deletion procedures to address the privacy laws that apply to your business.

Children’s privacy requires a separate assessment. The Children’s Online Privacy Protection Rule applies to covered operators of websites and online services directed to children under 13 that collect personal information from them. It also applies to other covered operators with actual knowledge that they collect personal information online from children under 13. Information supplied by adults about children doesn’t, by itself, trigger COPPA. Hank advises on whether the Rule applies and on the consent, notice, retention, and security obligations that follow.

Under the amended Rule, covered operators must obtain separate verifiable parental consent before disclosing children’s personal information to a third party for AI training or development. Parents must be able to consent to collection and use without consenting to that disclosure. Hank reviews provider restrictions on training, advises on any required parental consent, and drafts the written retention policies and information security programs the Rule requires.

Product and marketing claims must be truthful, nonmisleading, and supported by appropriate evidence. Section 5 of the FTC Act applies to claims that a product uses artificial intelligence, performs a task with a stated accuracy, or verifies a user’s age or identity.

In In re Workado, LLC, the FTC’s 2025 final order addressed claims that an AI content detection product was 98% accurate. The order requires competent and reliable evidence supporting accuracy and efficacy claims. Hank reviews product and marketing copy for compliance with these advertising requirements.

Hank drafts development, training, and consulting agreements that define the deliverables, allocate ownership, and specify licenses for models, model parameters, training data, and other materials when you hire an outside developer. He also writes the internal policies that govern what employees may put into an AI tool.

Texas businesses covered by the Responsible Artificial Intelligence Governance Act must also comply with that statute, effective January 1, 2026, which prohibits specified uses of AI systems and amended the biometric identifier statute. California’s automated decisionmaking technology regulations apply to covered businesses beginning January 1, 2027.

Hank has counseled software and SaaS companies, consumer app developers, marketers, and the businesses that buy their products on how these rules apply before launch and after a regulator or a customer asks. Every engagement works toward the same result, an AI product or program you can describe accurately, contract for on terms you understand, and defend if challenged.