Georgia Still Doesn't Have a Comprehensive Privacy Law — But Don't Mistake That for Safety
May 2026 Georgia's SB 111, originally introduced as the Georgia Consumer Privacy Protection Act, passed the Senate but was substantively rewritten by the House before Governor Kemp signed it in May 2026 — the enacted version addresses rural hospital tax credits, not consumer privacy. Georgia currently has no comprehensive consumer privacy statute, though Florida, Tennessee, and Alabama — all neighboring states — already do. Organizations that wait for a law to force the issue typically end up building a compliance program under deadline pressure, rather than on their own timeline.
What this means for you: even without a state law forcing your hand, breach notification and FTC rules already apply — and neighboring states show where Georgia is likely headed. See if this affects you — take our free assessment
EU AI Act High-Risk Provisions — Effective August 2026
Penalties for high-risk AI system violations can reach €35 million or 7% of global turnover — exceeding GDPR's maximum. Organizations deploying AI in hiring, credit, healthcare, or other high-risk categories should assess conformity requirements now.
What this means for you: if you deploy AI in hiring, credit, healthcare, or another high-risk category and touch the EU market, conformity assessment isn't optional. See if this affects you — take our free assessment
U.S. State Privacy Enforcement Accelerating
U.S. states issued $3.425 billion in privacy-related fines in 2025 alone, with Gartner projecting continued acceleration through 2028. Multi-state operators should map applicable thresholds — several states including Delaware, Montana, and Nevada apply privacy laws with no minimum size threshold.
What this means for you: "we're too small" isn't a reliable defense in several states — size thresholds don't apply everywhere. See if this affects you — take our free assessment
FTC AI Enforcement Under Section 5
The FTC has settled 8+ AI-related enforcement actions since 2022 using Section 5 authority, without any AI-specific federal law. Deceptive AI claims and inadequate privacy practices remain enforceable regardless of organization size.
What this means for you: there doesn't need to be an AI-specific law for your AI claims or data practices to draw enforcement. See if this affects you — take our free assessment