A two-stage ransomware attack discovered in July 2026 exploited software widely used to develop and operate AI systems, enabling attackers to destroy a trained model. The attack irretrievably wiped an AI model’s training set and other components, rendering the model unusable, cybersecurity strategist Crystal Morin of Sysdig, the company that found the attacks, told the Cybersecurity and AI Law Report.

The damage came from a previously unseen ransomware program designed specifically to lock up AI and machine learning infrastructure. To retrain and engineer a destroyed model typically costs from $75,000 to $500,000, Morin said. The attacks are “targeting this kind of infrastructure because this operator realizes how valuable it is to victims,” she observed.

For attackers constantly searching the cyber landscape for new revenue sources, “holding the AI workflow hostage is a great place to focus, especially now that everyone is all in on AI,” said Ronald Lewis, head of cybersecurity governance at Black Duck, a security vendor. This incident’s clarion call to security leaders is to secure AI-support tools and infrastructure that are widely used but weakly protected.

This article examines how AI middleware, which helps connect and orchestrate AI systems, has become an attractive target class for ransomware attacks. With insights from Lewis, Morin, and experts at Fisher Phillips, JFrog, Snyk and ZwillGen, it also offers several practical steps for strengthening security across AI development and deployment.

See “How the Whole-of-State Movement Is Protecting the Community Organizations the Private Sector Depends On” (Jul. 15, 2026).

Details of the Jadepuffer Two-Part Attack

Sysdig named the ransomware Jadepuffer. To carry out the exploit against an unidentified company, the attacker relied on a vulnerability, first cataloged in May 2025, in LangFlow, a popular open-source framework for building large language model (LLM)-driven applications and agent workflows. An AI agent apparently conducted the attacks end-to-end.

Files Were Encrypted and Deleted in the Attacks

In the first attack, Jadepuffer harvested cloud and cryptocurrency credentials, encrypted 1,342 items and left a ransom table demanding payment in Bitcoin, Sysdig reported. Yet, “there was no evidence of exfiltration,” Morin elaborated. The attacking agent’s ransom note promised an encryption key using one type of encryption, but “the encryption used was a different kind. So that was hallucinated. If the victim were to have paid, there was no encryption key,” she detailed.

The second attack again entered through LangFlow, but it was more destructive. A script swept through the victim systems and deleted all files associated with 180 file extensions, including AI models, vector databases used in training and other components of AI operations, Morin explained. The attack affected “every aspect of AI infrastructure” and “any model that an organization is using,” she said.

Incident Analysis Revealed Agent Involvement

Sysdig researchers could analyze these incidents because they “had access to the host. That’s how we were able to capture the payloads from the attacker,” Morin said.

Telltale signs an agent steered the attack included the incident’s speed and the instantaneous recovery from obstacles. It was illogical that, despite ransomware’s financial goal, the attacker created no structures for exfiltration. As for the clincher, the ransom note included the agent’s reasoning for its extortion steps.

See “When the Classroom Goes Dark: Lessons From the Canvas Breach for Corporate Cyber Preparedness” (Jul. 8, 2026).

Costly Damage to AI Operations

In the end, Jadepuffer served only as destructive malware. But the attackers wasted months of the company’s development and investment resources by encrypting model weights – the trained components that allow an AI model to operate. “That’s the intellectual property that has significant value,” Lewis pointed out.

The destruction of AI-related artifacts across 180 file categories suggests that cybercriminals have come to understand the broader AI supply chain and believe they can profit from that. Threat actors used to stealing data are “changing what they consider the crown jewels of an organization,” Lewis highlighted.

The AI supply chain offers many junctions for extortionists to hold AI hostage. Instead of destroying or locking up AI models, ransomware purveyors might start making modifications to produce malicious AI models that could affect the wider operational environment unless the victim pays the ransom, Fisher Phillips partner Daniel Pepper told the Cybersecurity and AI Law Report. “If the training data and the datasets that are used for fine tuning become poisoned and you have a compromised model, there are no alarms that go off. There’s no indication of a compromise. The integrity of that data now is lost,” he cautioned.

See “Navigating Insurance Coverage Issues for AI‑Related Losses” (May 20, 2026).

AI-Adjacent Tools a Prime Target

Jadepuffer ransomware and an earlier operation in 2026 illustrate how cybercriminals could disrupt the AI supply chain by targeting a fast-expanding class of software for building and managing AI.

LangFlow’s Attractiveness to Companies and Attackers

“Plenty of companies are building AI capabilities using LangFlow” because it simplifies development and centralizes workflows, Lewis explained. “LangFlow is Legos for AI,” he said, describing it as a platform that lets users connect multiple AI tools and orchestrate them through a single interface.

Having a single orchestrator also simplifies attacks. “All the parts of the AI workflow that can be exploited are in one stack together,” in “one layer and one attack surface,” Lewis noted. LangFlow “wasn’t designed to be secure. It was designed to be easy to operate,” he cautioned.

Accordingly, LangFlow creates attractive targets throughout the AI ecosystem as developers at organizations of all sizes have embraced it to build quickly, Jey Kumarasamy, AI legal director at ZwillGen, told the Cybersecurity and AI Law Report.

The two Jadepuffer attacks appear novel, although cyber criminals in 2026 have been targeting other LangFlow vulnerabilities, Morin noted.

See our two-part series on AI agent security: “Companies See Rogue Incidents but Lag on Controls” (Mar. 18, 2026), and “What CISOs and GCs Need to Know to Defend the Enterprise” (Mar. 25, 2026).

Security Vulnerabilities and Risks of AI Middleware

The LangFlow incidents fit a broader pattern of attacks on AI middleware. In March 2026, hackers targeted the popular LiteLLM gateway, which provides a single interface for accessing and managing multiple AI models. LiteLLM’s centralization makes it easier for developers to switch among models and manage AI traffic through one layer, Kumarasamy explained. In the attack, the perpetrators forced LiteLLM to send out a malicious update. “It was only online for 40 minutes before it was discovered and brought down. But within those 40 minutes, it was estimated that thousands of organizations downloaded it automatically,” he said.

LangFlow and LiteLLM were “attractive entry points for attacks” because they act as central connectors within AI environments, Pepper explained. “Their servers connect with the AI tooling [and often] hold provider [application programming interface (API)] keys and cloud credentials” to facilitate AI development, he added. They interconnect AI systems with sensitive data, other data repositories, workflows and external applications.

AI middleware is at a volatile stage where it is popular and it gives attackers access to wide swaths of AI systems, but neither its developers nor its deployers give it enough security attention. “These low code AI builders and agent frameworks are designed to be stood up quickly,” Pepper noted, so many “organizations [start using them] quickly without any typical network controls.”

“Free or very low-cost tools that are used now to build applications and agents” are a systemic risk “because they do a generally poor job on security management and vulnerability management,” Pepper said.

Newer AI apps also may be less familiar terrain for patching teams. The LangFlow vulnerability was announced in 2025 as a critical one, rated at 9.8 out of 10 on the Common Vulnerability Scoring System. “It is not surprising to me that something found and patched about a year ago might still not be updated in certain production systems,” Kumarasamy noted.

Another issue is that less-experienced developers now commonly use AI middleware to quickly validate ideas, but they may not have significant experience and resources for hardening a system, Kumarasamy observed.

See “Defending Against Faster, Stealthier and More Sophisticated Cyber Adversaries” (Sep. 10, 2025).

Practical Steps for Companies

With the proliferation of AI middleware and new AI components, companies can protect themselves by creating inventories, adapting their vendor risk practices and strengthening security across the AI development process.

Build a Complete Inventory of AI Assets and Access

Companies should inventory their AI environments fully. Experts say many organizations still cannot answer fundamental questions about their AI operations. “Most companies cannot list all their AI development tools, where they run, what credentials they hold” or whether they are internet-facing, Pepper observed.

Although many companies have developed AI model inventories since 2023’s generative AI breakthroughs, they still need to expand them to detail where models can reach, what data they consume and who is accountable for those connections, security leaders advised. Those more comprehensive inventories also should track model versions, training pipelines, weights and open-source libraries, Morin urged.

Other components that organizations should inventory include all the connections to APIs and model context protocol servers, as well as agent permissions and limits. Morin also recommended tracking key details about datasets, including their format, classification and version history, along with itemizing storage devices, processing units and servers, as well as other hardware that supports AI operations.

Most importantly, companies should evaluate inventory items for their risks, JFrog field CISO Paul Davis recommended. Yet, practically, the first step is keeping up with internal activity. “I had one customer say that it takes them five days to find out who developed a piece of software,” he told the Cybersecurity and AI Law Report.

See “Ransomware Enforcement Trends Under Trump 2.0” (Jan. 7, 2026).

Strengthen Third-Party and Supply Chain Management

Third-party risk management programs need to evolve for the newest generation of AI development tools. Many organizations still rely on vendor questionnaires built for securing conventional software. The types of questions in vendor assessments are generally rooted in security concerns from a few years ago, including those that ask about encryption, access control and SOC 2 reports, Pepper said. While those topics remain relevant, questionnaires should be broadened to include AI-specific governance concerns.

In general, AI risk management needs to focus outside the organization. Many AI development environments contain more dependencies than the companies realize. “A lot of what’s being integrated right now is external connections. Most of it is third-party, open-source supply chain,” Morin noted.

Vendors often rely on providers behind the scenes. In one due diligence review, Kumarasamy recalled, his team discovered that the tool under review routed nearly all customer data through a third-party integration provider that had not initially been disclosed.

Security teams should ask questions so they can map both data flows and software dependencies to understand how AI applications interact with external services and open-source components. As part of that process, companies should put AI applications into risk tiers, Pepper recommended.

As organizations endeavor to uncover the risks, they also should require greater visibility into service providers’ data lineage and software dependencies. Asking for AI bills of materials (AI-BOMs) can reveal unexpected liabilities, like “dozens of models, including DeepSeek and other things that maybe the organization didn’t want to use,” Snyk director of product management Ezra Tanzer told the Cybersecurity and AI Law Report.

Moreover, because AI tools and models change rapidly, companies should request regular AI-BOM updates from vendors, Morin recommended, because “AI models are being updated so quickly that it’s really hard to keep a pulse on what’s operating in our environments.”

As incidents like Jadepuffer underscore the need for forensic investigation, AI procurement teams likewise should ask vendors what security logs they provide and how long they retain those records, Pepper recommended. With vendors claiming they contain their testing of agent capabilities, Kumarasamy cautioned that due diligence teams should recognize that “there are different types of sandboxes, and some are more secure and robust for agents than others.”

See “Contracting With Vendors to Mitigate Third-Party AI Risk” (Feb. 18, 2026).

Elevate Security for the AI Development Process

Companies should protect their AI development and experimentation environments with the same rigor as core business applications. “Treat your AI tooling as a production system,” Pepper recommended. Companies should consider the following steps to protect key AI assets and manage security risks associated with AI development.

Back Up and Secure AI Infrastructure

Companies should regard their AI development artifacts, model weights, vector databases and training datasets as irreplaceable assets on par with source code repositories. The organizations that build or tune their own models should “have backups of their data and of their model [kept] separately on different hosts,” Morin advised.

Lock Down Credentials and Secrets

“The credentials and the API keys that are held by the AI tools are probably the most critical assets that need to be addressed,” Pepper said. Those credentials often include cloud access tokens, database connections and other secrets that can unlock large portions of an enterprise environment. As the Jadepuffer incidents demonstrated, attackers tend to harvest credentials.

Protect the Agent Logs

Developers are using AI observability tools to log prompts, agent activity, outputs and operational metadata, Kumarasamy noted. These logs improve troubleshooting and governance, but they become attractive data storehouses for attackers. The logs “become a potential single target for all this very sensitive, important information” moving through the AI system, he warned.

Create Controls on Coding Agents and Dependencies

As coding agents are increasingly used for AI development, they could be fooled by malicious activities rippling through the AI supply chain. “Typosquatting is generally happening on open-source software packages” that agents might use for their projects, Tanzer pointed out.

“I have to worry about the developer because the developer’s workstation can be used for an attack point,” as LiteLLM and Jadepuffer showed, Davis said.

Combat Approval Fatigue

More monitoring is needed because agents are increasing developers’ supervisory burden, creating approval fatigue, which makes it more likely that risky actions will be approved without sufficient scrutiny, Davis noted. “With agentic coding, people spend so much time waiting. I have two agents running in parallel and am context switching between different problems,” he shared. At other times, eight agents are running that periodically need approvals. The volume of those requests can lead developers to approve actions reflexively. “A lot of people get bored,” he observed.

Strengthen Patching and Management of Updates

Jadepuffer relied on a known vulnerability, not a zero-day one, Kumarasamy highlighted. Accordingly, companies should track the published vulnerabilities affecting the AI development infrastructure and focus on patching those.

The LiteLLM exploit also demonstrates the value of requiring a waiting period before developers install updates automatically. “Have a cool down period so that, if there is some attack, the greater community might have some time to detect it,” Kumarasamy recommended.

Add Security Gates Before Experiments Move to Production

Developers’ informal experiments are increasingly making their way into production environments, often with security treated as an afterthought, Kumarasamy reported. “Teams are putting together early-stage AI products based on, ‘Hey, I have an idea. Let’s build something.’” In this AI-first era, a little bit of enthusiasm for a promising result may push an experimental product into production before appropriate security controls are in place, he observed, recommending overseers “try to at least implement the most important security practices” before permitting experiments to move forward.

Implement Safer Vibe Coding for All

As AI-assisted development expands beyond professional programmers, Lewis recommended organizations should create companywide guardrails for agent-assisted coding. Employees working with coding agents to build software and apps should instruct the agents to only provide a description of the coded product, not begin development. This allows the employee to edit out extraneous features and connections that bots tend to throw into apps. Employees also must require agents to provide design documentation that “lists all of the security controls” included in the resulting products, he advised.

Companies that have been racing to prepare for the European Regulation on Artificial Intelligence, or Regulation (EU) 2024/1689, (E.U. AI Act or AI Act) now have more time to comply with many of its most significant requirements – but the compliance burden remains largely intact. Regulation (EU) 2026/1744, the E.U. Digital Omnibus on AI (AI Omnibus), entered into force on July 27, 2026. This AI-specific component of the European Commission’s Digital Omnibus Package amends the E.U. AI Act in several respects with the stated goal of streamlining regulation and supporting innovation and competitiveness. The extent to which it will achieve these goals, however, is an open question, as the fundamental regulatory requirements remain and additional guidelines and standards that will further inform those requirements have yet to be finalized.

With analysis and insights from European legal experts from Bird & Bird, Freshfields, Gibson Dunn, Orrick and Taylor Wessing, this first article in a two-part series provides an overview of the AI Omnibus. It covers revised compliance deadlines, substantive changes regarding the generation of nonconsensual sexual imagery, bias detection, small and medium-sized enterprises (SMEs), safety components, AI training, the role of the E.U. AI Office and intended reductions of administrative burden. Part two will discuss what companies can do to prepare for the new compliance deadlines and the impact of the AI Omnibus on enforcement.

See our three-part series answering top questions about the E.U. AI Act: “Reach and Unique Requirements” (Apr. 24, 2024), “Risk Tiers and Big-Player Transparency” (May 1, 2024), and “Practical Steps and What’s Next” (May 8, 2024).

Extended Compliance Time Frames

The AI Omnibus extends deadlines for complying with several of the AI Act’s most significant obligations, particularly those governing high-risk AI systems.

Revised Schedule for High-Risk AI System Obligations

The AI Omnibus extends the compliance timelines for different categories of high-risk AI systems under the AI Act.

First, the compliance deadline for AI systems that are products, or safety components of products, that are regulated by E.U. harmonization legislation listed in Annex I of the AI Act and required to undergo a third-party conformity assessment pursuant to that legislation, has been extended to August 2, 2028.

Second, the compliance deadline for high-risk AI systems identified in Annex III of the AI Act – including AI systems used in biometrics, critical infrastructure, education, employment, access to public benefits and law enforcement – has been extended to December 2, 2027.

Compliance with the high-risk rules by the original August 2026 deadline was “just not feasible” because the European standardization bodies have not issued the harmonized standards for high-risk Annex III AI systems on which compliance will depend, Toby Bond, a partner at Bird & Bird, noted. Also, the European Commission (Commission) failed to finalize guidelines for classifying high-risk AI systems, with draft versions published only in May, he told the Cybersecurity and AI Law Report. It was impossible to expect compliance with standards and guidelines that “don’t exist. It was just a bit of a mess,” he said.

Because Annex III of the AI Act describes high-risk AI use cases only in broad terms, the guidance will be important in clarifying which AI systems were covered, Julia Apostle, a partner at Orrick, told the Cybersecurity and AI Law Report. And with respect to technical standards for high-risk obligations, “basically, nothing was ready,” she added. Since the use cases for AI technologies are quickly evolving, providers and deployers will need to be vigilant about whether the final guidance expands the Commission’s interpretation of what constitutes high-risk AI under the existing use cases, she advised.

Overall, the extended deadlines for high-risk AI systems will have a “huge impact” on organizations’ ability to get ready for compliance, Theresa Ehlen, a partner at Freshfields, told the Cybersecurity and AI Law Report.

Additional Time for Watermarking

The AI Omnibus also gives providers of AI systems that generate synthetic audio, images, video or text an additional four months – until December 2, 2026 – to comply with the AI Act’s watermarking requirements, provided those systems were placed on the market before August 2, 2026. Those providers must mark AI-generated or manipulated content in a machine-readable format and make it detectable as artificially generated or manipulated.

This extension is significant because the required technology, especially for text, is not fully developed, Bond said. It has been an especially “big challenge” for downstream providers of AI systems who do not control the underlying model and are integrating it into their own system, he explained.

See “Navigating the Patchwork of Federal and State AI Deepfake Laws” (Oct. 8, 2025).

Prohibition on Nonconsensual Intimate Imagery

One of the more significant amendments introduced by the AI Omnibus concerns the generation of nonconsensual intimate material or child sexual abuse material. The amendment prohibits both technologies intended to generate or manipulate such material, and AI systems for which such output is a “reasonably foreseeable and reproducible outcome” absent reasonable safeguards to reliably prevent and correct such outcomes. Two exceptions include material that does not depict identifiable natural persons and images generated for medical diagnosis or treatment where the person is incapable of giving consent.

The deadline for compliance with the aforementioned obligations is December 2, 2026.

The new prohibition will not surprise responsible providers that already have trust and safety teams for whom the compliance effort should be “quite low,” Bond predicted. The measure is aimed primarily at bad actors, including dark web operators, rather than responsible AI providers, he said.

Providers are already very much aware that they should not produce these images, Taylor Wessing partner Fritz-Ulli Pieper added. “I don’t think it changes much in practice, but a clear statutory prohibition is a welcome development” he told the Cybersecurity and AI Law Report.

Expansion of Permitted Bias Testing

The AI Omnibus expands who can process certain special categories of personal data when strictly necessary to detect, prevent and correct “biases likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under [European] Union law.” Under the amendment, in addition to providers of high-risk systems, deployers of such systems, as well as providers and deployers of other AI systems, can engage in such testing.

It “makes sense” that the ability to use special categories of data for bias detection and correction should not be limited to high-risk AI providers, Ehlen said.

Narrowed Scope of Safety Component Brings Fewer AI Systems Under High-Risk Definition

The AI Omnibus narrows one pathway by which AI systems can fall within the AI Act’s high-risk regime. The amendment refines the definition of “safety component” to limit it to a component or product that has an “intended purpose . . . to prevent or mitigate risks to health and safety of persons or property.” AI systems “solely used for non-safety aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control” do not qualify as safety components unless their failure or malfunction would endanger health and safety.

This amendment addresses a concern that the definition of safety component was slightly overreaching, Bond explained. Before the definition was refined, it arguably included AI systems that had some impact on safety but lacked an intended safety purpose, he said. This narrows the scope, he added.

To determine whether the AI Act’s obligations apply to them, organizations that provide or deploy a product covered by Annex I must determine if any embedded AI system is a safety component, Pieper noted. The new definition will have a “broad impact” and result in many fewer AI systems being deemed high-risk, he said.

Support for AI Literacy

The AI Omnibus removes the AI Act requirement that providers and deployers ensure that employees have a “sufficient level” of AI literacy and instead requires them to implement measures to “support the development” of AI literacy. It further requires the Commission to “support and facilitate” these efforts but does not set forth any guidelines for such efforts.

New Sandbox Provisions

The AI Omnibus extends the time for Member States to establish at least one AI regulatory sandbox by one year to August 2, 2027. It further expands testing in real-world conditions by providers or prospective providers of high-risk AI systems covered by E.U. harmonization legislation listed in Annex I of the AI Act.

General Measures to Reduce Administrative Burdens on Companies

Certain AI Omnibus amendments were targeted at eliminating duplicative regulation, harmonizing applicable E.U. regulations and reducing compliance burdens.

Extension of Lighter Regulation Requirements to SMCs

The AI Act includes measures designed to reduce compliance burdens for smaller businesses, including streamlined documentation requirements and proportionate application of certain obligations. The AI Omnibus extends those simplified documentation requirements and proportionality principles from SMEs to small mid-cap enterprises (SMCs).

This amendment is a compliance burden relief initiative, Apostle said. SMCs will have less documentation to prepare and fewer compliance exercises to undertake, she stated.

The AI Omnibus removes some administrative burdens that companies feared would hinder innovation because smaller and medium-sized companies lack the ability, means and resources for AI Act compliance, Ehlen explained.

Harmonizing Protection of Health, Safety and Fundamental Rights

The AI Omnibus provides that where any E.U. harmonization legislation identified in Section A of Annex I to the AI Act provides an equivalent or higher level of protection for health, safety and fundamental rights than the AI Act, the application of the AI Act can be correspondingly limited. By August 2, 2027, the Commission must adopt delegated acts specifying when compliance with other E.U. legislation can limit the application of the equivalent AI Act requirements, as well as the conditions and scope of those limitations.

This amendment acknowledges E.U. companies’ complaints that the E.U. has gone “too far” with overregulation and that “regulating the same product twice was not sustainable,” Ahmed Baladi, a partner at Gibson Dunn told the Cybersecurity and AI Law Report. However, the real test will be what the delegated acts provide, and it remains to be seen whether the amendments not only “clarify the path” to compliance but also reduce the burden, he stated.

Clarifications Regarding Conformity Assessment Procedures

Another set of amendments is intended to reduce duplication and streamline the conformity assessment procedures used to demonstrate compliance with the AI Act and other E.U. regulations.

For certain high-risk AI systems covered by the harmonization legislation listed in Section A, Annex I of the AI Act, the AI Omnibus clarifies that providers need only follow the conformity assessment procedure under the applicable sector-specific E.U. legislation. That assessment must also evaluate compliance with the AI Act’s high-risk AI requirements, including risk management, data governance, technical documentation, recordkeeping, human oversight, cybersecurity and quality management obligations.

Again, the amendment may clarify the path, but it does not necessarily reduce the administrative burden, Baladi said. “The Commission is just saying, ‘I have good news, you won’t have to satisfy the same requirements twice under two parallel legislations,’” he explained, which is “the minimum that the Commission owes to these players. At the end of the day, you still have to satisfy the same set of requirements.”

The AI Omnibus also eliminates uncertainty over whether separate conformity assessments are required if an AI system falls under both the sector-specific E.U. harmonization legislation listed in Annex I, Section A and an Annex III use category. If a system is subject to a conformity assessment under the former, providers do not need to complete a separate conformity assessment under the AI Act simply because the system also falls within a covered Annex III use category.

Streamlined Requirements for Machinery Product Manufacturers

To reduce administrative burdens on producers of machinery, the AI Omnibus moves the E.U. harmonization legislation for machinery from Section A to Section B of Annex III. This change eliminates most of the AI Act requirements for machinery products and subjects them instead to sectoral regulation under the E.U. harmonization legislation. However, the Commission will adopt delegated acts amending the Machinery Regulation to reflect relevant AI Act requirements by August 2, 2028.

This was one of the sticking points in negotiations over the AI Omnibus, Ehlen noted. Manufacturers, especially German ones, were concerned about regulation hindering innovation and leaving Europe behind, she explained. “The push by the German manufacturers illustrates the wider goal of the AI Omnibus to simplify E.U. regulation for businesses and enable them to scale up to the new obligations,” she surmised.

Satisfying AI Act Compliance With Other Compliance Work

The AI Omnibus allows deployers to satisfy part of their obligations for AI Act fundamental rights impact assessments by cross-referencing relevant sections of GDPR data protection impact assessments (DPIAs). Also, where high-risk AI systems fall within the scope of and satisfy the conditions of Article 12(1) of the Cyber Resilience Act, the cybersecurity requirements of the AI Act will be deemed fulfilled.

This GDPR-related amendment is well-intended but does not reflect the reality and complexity of DPIAs, because the GDPR’s approach to DPIAs is not even harmonized, Baladi said.

See “Assessing and Managing AI’s Transformation of Cybersecurity in 2025” (Mar. 19, 2025).

Does the AI Omnibus Accomplish Its Goal?

The AI Omnibus does not significantly reduce compliance burdens, the experts agreed.

The AI Omnibus is part of the E.U.’s digital simplification agenda and was intended to alleviate compliance burdens, but “I do not think it has achieved that objective,” Bond lamented.

Pieper agreed while also acknowledging the decreased burdens on machinery manufacturers. The primarily accomplishment of the AI Omnibus is giving organizations more time to comply, he said.

Apostle had a different view. While the AI Omnibus does not meaningfully reduce the regulatory burden for companies outside of Europe, it could have a beneficial impact on many European companies because of the reduced requirements for SMCs, she noted.

“There is still a very large amount of compliance work to be done,” especially for providers of high-risk AI systems, Bond emphasized.

See “AI Governance: Striking the Balance Between Innovation, Ethics and Accountability” (Feb. 12, 2025).

Compliance representations (reps) and warranties can be an underestimated element of a merger, acquisition or third-party contract, often reduced to boilerplate afterthoughts. However, in a moment of rapid political, cultural and technological change, cut-and-paste language runs the risk of being woefully out of date by the time a deal closes.

Compliance reps and warranties should not be mere static recitations of regulatory adherence. They should be adaptive, calibrated to the risks that actually attach to a transaction and sufficiently precise to surface problems before they metastasize. Ideally, compliance reps and warranties reflect not just what the law requires but the culture of an organization itself. When conscientiously drafted, these provisions allocate risk as well as provide a window into the maturity and integrity of a corporation’s compliance framework.

This fourth article in a series about compliance reps and warranties covers how language in third-party contracts has evolved as supply chain issues represent a larger portion of companies’ risk profile, and how reps and warranties should evolve in response to other geopolitical, technological and regulatory shifts. The first article in the series reported on the continuing relevance of compliance reps and warranties, the second article suggested negotiation strategies, and the third article addressed their verification and enforcement.

See “Key Terms and Negotiation Issues in Data Processing Agreements” (Sep. 13, 2023).

Evolving Third-Party Risk

Whether reps and warranties are being drafted for inclusion in a contract with a third party, such as a vendor or supplier, or in the context of a merger or acquisition, the overarching goal “often is to facilitate an information exchange, get assurances about compliance with applicable laws and regulations, and allocate risk,” said Daniel Bernstein, counsel at Arnold & Porter.

Because M&A has historically been considered a more serious business undertaking than engaging a third party, more attention was paid to its reps and warranties. However, as third-party risk represents larger and larger portions of a company’s overall risks, that has changed.

Forward-Looking Third-Party Reps and Warranties

The reps and warranties in an M&A contract serve a different purpose than those in a third-party contract. M&A reps and warranties are backward looking in that they aim to protect an acquirer against inheriting issues that have happened in the past. Third-party reps and warranties, on the other hand, govern the relationship the two contracting parties will have in the future. “With third parties, representations and warranties may have more of a focus on forward-looking compliance – compliance during the course of the relationship,” Bernstein said.

For example, “if a company is hiring someone as its agent, the company wants to make sure that, while working with the agent, the agent is not exposing the company to an unacceptable level of risk,” Bernstein said. “In that situation, the company may not be quite as concerned with what happened years before the agent began working with the company, though past misconduct can certainly raise risk levels,” he explained.

The distinction between compliance reps and warranties in third-party contracts and those in M&A turns on timing and exposure. “Third-party contracts are less focused on historical issues and more focused on work to be done under the third-party contract,” said Adam Goldberg, a partner at Pillsbury. An entity that is acquiring a business will “want protection against the liability that could arise if historical misconduct comes to light after the acquisition,” he noted. In contrast, with a third party, “a company is more focused on promises that no compliance violation will occur in connection with the parties’ contract for services,” he said.

See “Expedia and Lululemon Privacy Pros Discuss Scaling Vendor Contracting for New Privacy Laws” (Apr. 19, 2023).

Leveraging Bargaining Power

More focused compliance reps and warranties found in third-party contracts are attributable, in part, to differences in bargaining power. “A company engaging a vendor generally has more leverage to impose its preferred provisions than a company seeking to acquire or invest in a target, where compliance considerations will be just one part of a wide set of negotiated commercial terms,” Goldberg said.

Moreover, the language in reps and warranties in some measure reflects the amount of due diligence conducted. “With a typical third-party vendor or supplier agreement, a company will not have had the opportunity to conduct the same level of diligence that would be done in an M&A context,” Cynthia Cole, a partner at Alston & Bird, told the Cybersecurity and AI Law Report. In contrast, in a merger or acquisition, “there will be an opportunity to flesh out some of the issues that surface during diligence and then address them specifically in the agreement,” she added.

See “Negotiating Reps, Warranties and Remedies in Technology Contracts” (May 19, 2021).

Matters of Degree

As companies become more aware of third-party risks, the level of due diligence has increased and “become more robust,” Cadwalader partner Martin Weinstein told the Cybersecurity and AI Law Report.

With more intense third-party due diligence, the distinction between the two types of reps and warranties has eroded some. “Often the demands that firms place on targets of acquisitions far outstrip those directed to vendors, suppliers, and distributors, because an acquiror is literally buying the target’s problems,” said Andrew Adams, a partner at Steptoe. However, “in an environment where supply-chain vulnerabilities are increasingly the source of a firm’s risk – risk of sanctions violations; risk of export and tariff control violations – that distinction is decreasingly relevant,” he explained.

Content-Specific Reps and Warranties

In addition to being impacted by the nature of the relationship between the parties, risk is also impacted by the industries, geographies and regulatory regimes involved. To address these risks, contracts will often include content-specific reps and warranties that each address particular types of risks.

Deciding Which Content-Specific Clauses to Include

Which subject-specific compliance reps and warranties are included will depend on their relevance to the deal being made. For example, a deal “that involves only a U.S. target engaged solely in the domestic U.S. sale of paper products would likely not need specific export controls reps and warranties,” Goldberg said. In contrast, a “deal involving the acquisition of an overseas semiconductor manufacturer with Russian clients would be a different story,” he continued.

The reps and warranties that correspond to the transaction’s most significant and plausible risk exposures should be prioritized. As part of the negotiation process, the team should determine which content-specific terms “are required, good to have, or unnecessary based on the specifics of the deal,” Goldberg observed.

In M&A contracts, “part of a strategy can be to throw in a lot of content-specific representations and warranties and then tailor them after diligence is done,” Cole suggested. Of course, one party may be better versed in risk awareness than another. “If an acquiring company is in a business similar to that of the one being acquired, then it knows its compliance obligations and can seek to impose those on the other party,” she said.

Practitioners might also remember to include forward-looking and operational elements in compliance reps and warranties. “Consider incorporating a dynamic compliance clause that requires ongoing screening and immediate notification of changes,” Randy Grossman, a partner at Manatt, recommended. “Relatedly, it would be prudent to have warranties covering not only direct dealings but also indirect exposure through third parties, with termination rights and indemnity for breaches tied to sanctions violations,” he added.

Data, Privacy and Consumer Protection

Data privacy and cybersecurity, areas that tend to carry latent liability as well as reputational risk, increasingly merit their own carefully crafted compliance reps and warranties.

For some transactions, the catalyst has been geopolitical exposure. “There has been some increased interest in provisions related to data security, especially when an entity has exposure to China,” F. Joseph Warin, a partner at Gibson Dunn, told the Cybersecurity and AI Law Report. This can be particularly motivated by national security sensitivities, such as concerns about government access to proprietary information or PI, he said.

For broad protection, reps and warranties should address privacy, data use and data breaches. “Basically, any kind of misuse or infiltration of IT systems,” Cole said. Language regarding compliance with applicable privacy laws, the existence of adequate information security programs and incident response protocols, and the absence of undisclosed data breaches might be included, as well.

A company might also want reps and warranties that touch on consumer protection data regulations, Cole noted. These might address compliance with laws addressing consumer-facing disclosures about data practices such as data collection, subscription terms and the use of PI.

See “Drafting Data and Cybersecurity Provisions in Third-Party Vendor Agreements” (Mar. 30, 2022).

AI and Emerging Technologies

Given the extraordinary growth in AI use in the last couple of years, compliance reps and warranties should include language that reflects this shift, the experts agreed.

Reps and warranties “might specify that the company complies with AI-related laws including the E.U. AI Act and that data used to train or operate AI systems was collected lawfully and the company has rights to use it,” Cole suggested.

Contractual language might go beyond the legality of data acquisition to address operational and reputational risks associated with AI use, as well, Cole said. “Mention might be made that a company has taken steps to identify and mitigate potential bias in any AI models and training data,” she added.

See “Contracting With Vendors to Mitigate Third-Party AI Risk” (Feb. 18, 2026).

Anti-Corruption and AML Clauses

Anti-corruption and anti-money laundering (AML) reps and warranties continue to be necessary in multinational contracts notwithstanding the approach of President Trump’s second administration (Trump 2.0) to enforcement.

“Noncompliance with applicable anti-corruption laws continues to be relevant to managing risks in M&A and third-party transactions,” Warrin said. “Notably, we have not seen much change in anti-corruption representations and warranties, despite the administration’s seeming recalibration of Foreign Corrupt Practices Act (FCPA) enforcement priorities, because their focus is on compliance with laws, and the FCPA itself, with its five-year statute of limitations, has not changed,” he continued.

Moreover, “numerous foreign jurisdictions have robust anti-corruption laws and have continued – or, in some cases, increased – their own anti-corruption enforcement efforts to fill the perceived gap in U.S. enforcement,” added Oleh Vretsona, a partner at Gibson Dunn.

Now would not be the moment to be cavalier about anti-corruption and AML reps and warranties. Companies with global operations should “continue their practices of including FCPA and other anti-bribery law compliance” reps and warranties, said Grossman, “particularly in areas of the world that DOJ has identified as high-risk, including countries in Latin America and Asia.”

Trade Controls, Sanctions and Supply Chains

Even as familiar risks persist, the gravitational pull has shifted. What once might have read as steady-state compliance language is now experiencing pressure thanks to a rapidly recalibrating trade environment. Against that backdrop, some content-specific reps and warranties, such as those related to supply chain risks, merit more attention.

Reps and warranties related to tariffs, sanctions and export controls compliance are increasingly important in contracts, Warin said. Additionally, reps and warranties to limit terrorist financing risk “have risen in prominence” particularly since the U.S. Department of State has designated a slew of transnational criminal organizations as foreign terrorist organizations, he explained.

Trump 2.0’s “emphasis on trade has resulted in some elevated focus on provisions related to compliance with tariffs, sanctions and export controls,” Vretsona observed. As a result, practitioners expect that parties may want to include reps and warranties “regarding raw materials or other inputs used in the seller’s business, given the potential negative impact tariffs may have on the viability of existing sources,” he said. What once might have been addressed through diligence alone increasingly is finding expression in contract clauses.

Ripple effects from shifts in the U.S. government’s regulatory and enforcement regime are particularly noticeable in multijurisdictional deals. “Given the current administration’s stated priorities, a lot of international companies are now paying more attention to tariffs, export controls and sanctions,” Bernstein said. Although the compliance risks created by these are “not necessarily new risks,” they are evolving, he noted.

As enforcement focuses sharpen, so, too, should drafting precision. “It is important to note that OFAC is emphasizing the disclosure of ultimate beneficial owners to prevent evasion through layered structures,” Grossman pointed out, which makes reps and warranties that a counterparty and its affiliates are not on OFAC’s list of Specially Designated Nationals or other restricted lists “crucial.”

Of course, trade enforcement is not restricted to traditional goods. Companies should “consider the administration’s priority on sensitive technologies like AI, semiconductors and defense-related software,” Grossman advised. Compliance reps and warranties should specify that all exports comply with Export Administration Regulations and International Traffic in Arms Regulations, including classification and licensing obligations, he added. There should be “notification obligations for any re-export or transfer to restricted jurisdictions, and warranties ensuring that goods and services will not be used for prohibited end-uses or by restricted end-users,” he advised. To reinforce those assurances, companies should also consider including audit rights “to verify compliance with export control restrictions.”

Taken together, these suggestions signal a shift in the center of gravity for compliance reps and warranties, from static confirmations of regulatory adherence to dynamic tools calibrated to trade policy, enforcement strategy and supply chain vulnerability.

Ashurst Perkins Coie has welcomed Prava Palacharla as a partner in its complex litigation practice in Chicago. She joins from the National Security Cyber Section of the DOJ’s National Security Division (NSD), where she was a trial attorney.

Palacharla advises clients navigating cybersecurity and national security issues such as material cybersecurity incidents and insider threats, as well as sanctions and export control compliance. She works with leading cybersecurity firms and guides multidisciplinary teams through litigation and investigations involving cybersecurity, national security and white-collar crime.

In her role at the DOJ, Palacharla managed multidisciplinary teams handling complex, cross-border cybersecurity prosecutions. She collaborated with global law enforcement agencies, intelligence communities, financial institutions and private sector entities. She also participated in working groups addressing the legal and national security implications of emerging technologies, such as AI and quantum computing.

Before joining the NSD, Palacharla served as an assistant U.S. attorney and a senior assistant U.S. attorney for the District of Columbia, where she managed a portfolio of cybersecurity, national security and white-collar crime matters involving wire fraud, computer fraud, international financial crime, economic espionage, export controls and sanctions evasion. 

For insights from Ashurst Perkins Coie, see “Enforcement Lessons From Disney and Four Other FTC Children’s Privacy Actions” (Jan. 28, 2026); and “Reference Guide to 2025 Executive Orders for Compliance Professionals” (Apr. 9, 2025).