Artificial Intelligence

A business that builds or deploys artificial intelligence usually runs it on a model someone else owns, feeds it data the business collected under privacy promises it made, and sells the result to customers who take the product’s claims at face value. Each of those relationships is governed by a contract or a statute, and the company whose name is on the product bears the exposure, whether the model comes from one of the major providers or an open weight release.

Hank advises founders launching AI products and businesses adopting AI tools on the vendor terms, privacy obligations, disclosures, and agreements that determine who owns what and who answers when something goes wrong. The first question for any AI product is what the provider’s terms permit.

Those terms, often in a commercial agreement separate from the data processing addendum, determine whether the provider may train on your customers’ data, how long it retains prompts and outputs, and what you may tell customers about either. Hank reviews and negotiates those terms, matches them to what your privacy policy discloses, and drafts vendor disclosures, retention policies, and deletion procedures to address the privacy laws that apply to your business.

Children’s privacy requires a separate assessment. The Children’s Online Privacy Protection Rule applies to covered operators of websites and online services directed to children under 13, and to other covered operators with actual knowledge that they collect personal information online from children under 13. Information supplied by adults about children doesn’t, by itself, trigger COPPA. Hank advises on whether the Rule applies and on the consent, notice, retention, and security obligations that follow.

Under the amended Rule, which required full compliance by April 22, 2026, covered operators must obtain separate verifiable parental consent before disclosing children’s personal information to a third party for AI training or development. Parents must be able to consent to collection and use without consenting to that disclosure. Hank reviews provider restrictions on training, advises on any required parental consent, and drafts the written retention policies and information security programs the Rule requires.

Beyond the data, you may claim for the product only what you can support. Section 5 of the FTC Act applies to a claim that a product is powered by artificial intelligence, that it performs a task with a stated accuracy, or that it verifies a user’s age or identity.

The Commission has brought enforcement actions, including its 2024 Operation AI Comply sweep and its 2025 order against an AI detection tool advertised as 98% accurate, against companies whose products didn’t perform as the copy described. Hank reviews product and marketing copy against that standard.

He drafts the development, training, and consulting agreements that settle who owns the model, the weights, the training data, and the deliverables when you hire an outside developer. He also writes the internal policies that govern what employees may put into an AI tool.

Texas businesses covered by the Responsible Artificial Intelligence Governance Act must also comply with that statute, effective January 1, 2026, which prohibits specified uses of AI systems and amended the biometric identifier statute. California’s automated decisionmaking technology regulations apply to covered businesses beginning January 1, 2027.

Hank has counseled software and SaaS companies, consumer app developers, marketers, and the businesses that buy their products on how these rules apply before launch and after a regulator or a customer asks. Every engagement works toward the same result, an AI product or program you can describe accurately, contract for on terms you understand, and defend if challenged.