Author: Michael Volkov

The EU AI Act: The Digital Omnibus, the Current Timeline, and What to Do Now (Part II of II)

Part 1 of this series covered where EU AI Act enforcement genuinely stands today: prohibited practices enforceable since February 2025, general-purpose AI obligations running since August 2025, the Commission’s first formal investigations opened in June 2026 into hiring, credit scoring, and student monitoring AI systems, and full enforcement and fining authority active since August 2026. In Part 2, we look at what the Digital Omnibus...

The EU AI Act: Enforcement Is No Longer Theoretical (Part I of II)

For years, compliance officers could talk about the EU AI Act as a looming, mostly future obligation, something to plan for rather than something actively enforced. That era is over. As of August 2, 2026, the European Commission, acting through its European AI Office, holds formal investigative and enforcement authority over general-purpose AI model providers and over the Act’s prohibited AI practices, and the agency...

When Does Board Oversight Become Bad Faith? (Part 2)

Lo and behold, Boeing gets sued over another safety crisis, and this time Boeing actually won. Want to know why? They kept the receipts. Yesterday I told you about two cases where Delaware let Caremark claims move forward. Today, the case where the board won, and its most important Caremark decision in years. Boeing again. New litigation, this time over the 2024 Alaska Airlines door...

Episode 450 — Your Vendor Contract Template Was Not Built for AI

In this episode of Corruption, Crime and Compliance, Michael Volkov explains why standard software procurement templates fail to protect organizations in AI vendor relationships, and what to do about it. He walks through the structural differences that make AI vendors riskier than traditional software vendors, multi-layered data flows through underlying foundation models, frequent model swaps, and vendors’ commercial incentive to train on customer data, and...

When Does Board Oversight Become Bad Faith? (Part 1)

Hiring someone to investigate misconduct isn’t always going to save your board. The line between bad management and bad faith just got real. Here’s a question every board member should be losing sleep over: when does a board’s failure to catch corporate misconduct cross the line from bad management into an actual breach of fiduciary duty? Delaware just gave us two new answers, and they...

Congress Sends a Major New Russia and Iran Sanctions Bill to the President: What Compliance Teams Need to Know

The House of Representatives voted 262 to 159 on the night of September 16 to approve a sweeping Russia and Iran sanctions bill, sending it to President Trump for his expected signature. The legislation, renamed the Lindsey O. Graham Sanctioning Russia and Iran Act after the late South Carolina senator who championed it for more than a year before his death in July, cleared the...

Vendor Management and AI Risks: The Clauses to Actually Negotiate (Part II of II)

Part 1 of this series explained why AI vendor relationships break the assumptions built into most standard software procurement templates, and where those legacy templates leave organizations exposed: silent or vague data training rights, indemnification that doesn’t reach AI-specific harms, no meaningful audit rights, and liability caps that quietly undercut whatever protections do exist. Part 2 gets specific about what to actually put in the...

Modifying Vendor Contracts for AI Risk (Part I of II)

Every organization that’s adopted AI tools over the past few years has also, whether it realized it or not, been signing a new category of vendor contract, one that carries risks your standard software or services agreement template was never built to address. This is Part 1 of a two-part series on modifying vendor contracts to build in real protections against AI risk. Here, we...

Episode 449 — The EU AI Act Is No Longer Theoretical

In this episode of Corruption, Crime and Compliance, Michael Volkov breaks down why the EU AI Act has moved from a future planning exercise to an actively enforced regulatory regime, with the European Commission’s AI Office holding full investigative and fining authority since August 2026, having already opened its first formal investigations in June 2026 into hiring tools, credit scoring systems, and student monitoring applications....

Two Important Webinars: Third-Party Risk and Sanctions & Effective Compliance Programs in the Age of AI

Third-Party Risk and Sanctions: Screening, Diligence, and Enforcement September 30, 2026, 12 Noon EST Sign Up HERE ___________________________________________________________________________ Building an Effective Ethics and Compliance Program in the Age of AI October 14, 2026, 12 Noon EST Sign Up HERE ____________________________________________________________________________ Join Michael Volkov for Two Important Webinars: Third-Party Risk and Sanctions: Screening, Diligence and Enforcement: Sanctions enforcement is accelerating, and the U.S. and its allies are...