The GC Brief — Issue No. 1

A weekly read for general counsel and in-house teams: what moved, and why it matters.

In this issue: the SEC’s proposal to scale back disclosure for most public companies; the twelve-state suit to block the Paramount–Warner Bros. merger after DOJ cleared it; what Loper Bright is doing to compliance positions built on agency preambles and FAQs; California’s first data broker action under the Delete Act; the FTC’s move against state AI laws; new accounting questions raised by AI spending and data-center financing; and the congressional inquiry into companies using Chinese AI models. One deadline to note up front: comments on the proposed Trump Accounts employer regulations close September 25.

1. The SEC would exempt four in five public companies. The comment window has already closed.

On May 19 the Commission proposed to recalibrate filer status and extend emerging growth company accommodations.¹ The proportions are the SEC’s own: 19.2% of registrants would be large accelerated filers and 80.8% would be non-accelerated filers.² Non-accelerated filers would not be required to obtain auditor attestation on internal control over financial reporting; executive compensation disclosure would be scaled, with no pay-versus-performance and no say-on-pay; and companies could present fewer years of financial statements. The large accelerated float threshold would rise from $700 million to $2 billion, and a company would need 60 consecutive months of reporting before entering that status regardless of float. Comments closed July 20. The AFL-CIO called the combination of reduced compensation disclosure and lost auditor attestation “a particularly dangerous and volatile deregulatory combination”; NYSE, Nasdaq, and SIFMA also filed.³

Why it matters. The advocacy window has closed; the planning question has not. For companies that would fall out of accelerated filer status, the question stops being what must be disclosed and becomes what will be disclosed anyway — proxy advisers, index-eligible funds, and underwriters will hold views the rule no longer compels. That decision tends to get made by default unless it is made deliberately, and dropping say-on-pay is a different conversation with a compensation committee than never having had one. Most relevant to: securities counsel with the CFO and, if an IPO is contemplated, the lead underwriter.

2. DOJ cleared the largest media merger in history. Twelve states sued 31 days later — after sitting in on DOJ’s depositions.

The Antitrust Division closed its eight-month investigation of Paramount Skydance’s acquisition of Warner Bros. Discovery on June 12, finding no likely harm in subscription streaming, linear television, or theatrical film.⁴ On July 13, California and eleven other states sued in the Northern District of California under Section 7 of the Clayton Act to block what the complaint calls “the largest in Hollywood history” at $110 billion, alleging combined shares near 27% in wide-release theatrical distribution and in basic cable channel licensing.⁵ The detail worth absorbing: the states had participated in DOJ’s investigation under the parties’ confidentiality waivers and attended DOJ’s depositions before filing.

Why it matters. State review has always existed, so the accurate lesson is not that a new gate appeared — it is that federal clearance may not resolve it, and that the mechanics of federal review can equip the eventual plaintiff. In live deals, that argues for treating state review as an independent workstream with its own timeline, reflected in the outside date, the ticking fee, termination rights tied to a state injunction, the allocation of defense and litigation-control rights, and whether a hold-separate obligation could actually be performed across systems, sales, and branding rather than only on paper. Most relevant to: antitrust counsel with corporate development.

3. Loper Bright is not a one-way ratchet — and the distinction that matters is regulation versus preamble.

Two developments a month apart show both edges. On July 21 the D.C. Circuit held that the NLRB’s “successor bar” exceeds the Board’s statutory authority, with Judge Rao writing that the court’s duty is to “police the outer statutory boundaries” of delegated power and noting the Board “cites no statutory provision” for its claimed authority to make national labor policy. Senior Judge Randolph dissented, arguing the panel had never relied on Chevron and that labor-specific deference survives.⁶ Employers are on the other end of the same shift. More than 75 proposed class actions now target tobacco surcharges on health plans. The binding regulation requires only that “the full reward … be available to all similarly situated individuals” and that a reasonable alternative standard exist.⁷ The retroactive-reimbursement theory comes from the 2013 preamble, which gave an example: where a participant satisfies an alternative standard on April 1, the plan “must provide the premium discounts for January, February, and March.”⁸ The theory drew a motion-to-dismiss ruling in the Southern District of New York in February.⁹

Why it matters. Be precise about what changed. Loper Bright did not weaken legislative regulations; it removed mandatory deference to agency interpretations, which matters most for material that never had the force of law — preambles, FAQs, opinion letters, and sub-regulatory guidance, now assessed for persuasiveness rather than accepted.¹⁰ The practical sorting is between compliance positions grounded in regulatory text, where the statutory basis and best reading can be documented, and those resting on interpretive material, where the question is whether it actually persuades. On the surcharge question specifically, the rest of that preamble repays reading: it also says plans have “flexibility to determine how to provide” the reward for the earlier period “as long as the method is reasonable and the individual receives the full amount.” That sentence sits a few lines from the one being used against employers. Most relevant to: benefits counsel, then compliance leads in environmental, employment, and safety.

4. California fined a data broker $116,490 for asking too much of people trying to opt out.

The order against LocateSmarter, LLC — the first action brought under both the CCPA and the Delete Act — breaks down as $30,600 for failing to register by the January 31, 2026 deadline and $79,890 under the CCPA.¹¹ The CCPA piece is the instructive one: the opt-out form demanded full name, mailing address, and the last four digits of the requester’s Social Security number, which the agency treated as a data-minimization failure. The order records that only “a mere handful” of Californians ever submitted an opt-out. The penalty came anyway. Separately, on July 21 the agency’s new Audits Division opened its first sectoral audit, covering app-based transportation, delivery, and task platforms, focused on access rights for both consumers and independent-contractor workers and on the 45-day response window. No companies were named.¹²

Why it matters. The lesson is in the intake form: a privacy request flow that collects more than is needed to authenticate the requester is itself the exposure — independent of whether anyone was harmed and independent of how few requests arrive. The audit item reads differently than it looks, too: an audit is not an investigation, but it is how an agency decides where to investigate. For gig platforms operating in California, the 45-day response rate is now a number someone else is measuring. Most relevant to: privacy counsel with the product owner of the request-intake flow.

5. The FTC proposed to preempt state AI law. The comment fight was not the one you would expect.

The Commission voted 2-0 on July 1 to seek comment on a proposed policy statement concerning the suppression of accuracy in AI systems, published at 91 Fed. Reg. 41638, which states that Colorado’s AI Act is impliedly preempted.¹³ Comments closed July 31. The Consumer Technology Association did not oppose it — it asked the Commission to go further and call on Congress to “more broadly and expressly preempt state law,” while seeking a safe harbor for good-faith design choices and different treatment of developers and deployers.¹⁴ The opposition came from the other direction, in joint comments from EFF, Public Knowledge, and Fight for the Future raising First Amendment, preemption, and vagueness objections.¹⁵

Why it matters. For companies that built governance programs around the Colorado AI Act and the statutes modeled on it, a federal agency has now said in the Federal Register that it considers part of that regime preempted — without a rule and without litigation testing it. That is not a reason to stop complying. It does sharpen a useful distinction: some controls exist because a state statute requires them, and some exist because they are good controls. Only the first category is exposed if preemption is ever sustained; the second survives either way. Most relevant to: AI governance lead with product counsel.

The next two items belong together. Read separately they are a technical accounting change and a financing footnote. Read together they describe a company making large, undocumented judgments about AI spending while holding material exposure to entities it does not consolidate — which is the shape of a securities complaint, not two housekeeping items.

6. FASB rewrote the software rules and expressly declined to tell you how to treat AI training costs.

ASU 2025-06, issued in September 2025, replaced the project-stage model in Subtopic 350-40 with a probable-to-complete recognition threshold, effective for annual periods beginning after December 15, 2027, with early adoption permitted.¹⁶ The consequential part is in the basis for conclusions. Commenters asked the Board to clarify whether the guidance reaches training an AI model and data conversion costs. The Board’s answer: “Subtopic 350-40 does not provide specific guidance for AI development costs, and the amendments in this Update do not specifically address how to apply the current guidance to those costs … The Board decided not to provide specific guidance.” So the single largest technology outlay many companies will make this decade is governed by a standard that declines to address it.

Why it matters. These judgment calls arrive before the effective date for any early adopter, and the record will matter more than the answer: who decided, on what definition of a “project,” what alternatives were considered, and why. Legal departments often learn of capitalization decisions when the auditors do; the project-definition methodology and documentation standard are set well before then. A judgment made under a written standard is defensible; an undocumented judgment made without one is the kind that later reads like a choice. Most relevant to: the controller or chief accounting officer, with securities counsel, before the disclosure committee.

7. Meta discloses $45.99 billion of exposure to a data center it does not consolidate.

In its first-quarter 2026 Form 10-Q, Meta describes a venture entered into in October 2025 to co-develop a data center campus in Louisiana in which it holds a 20% membership interest, concluding it is “not the primary beneficiary and, therefore, do[es] not consolidate the variable interest entity,” while providing construction management, administrative, and property management services to it. The carrying value of the equity investment was $2.37 billion. Maximum exposure to loss — equity, lease commitments, estimated future funding commitments, and a residual value guarantee — was $45.99 billion.¹⁷ Alphabet separately discloses backstops of payment obligations relating to data centers with remaining terms up to 15 years.¹⁸ None of this is improper, and both companies disclosed it. But Item 303 of Regulation S-K requires disclosure of obligations “that arise or could arise from variable interests held in an unconsolidated entity” even where the arrangement produces nothing on the balance sheet.¹⁹

Why it matters. For issuers financing compute or power through unconsolidated entities, the more immediate litigation risk is likely to come from incomplete or inconsistent disclosure rather than from the structure itself. The gap to watch is between the MD&A language and the underlying agreements — omitted contingencies, unclear risk allocation, guarantees described in one document but not the other. Meta reported both a $2.37 billion carrying value and a $45.99 billion maximum exposure. The company to worry about is the one that reports only the first. Most relevant to: securities counsel with treasury and the disclosure committee.

8. Congress wants to know which companies run on Chinese models. Your employees may have already answered.

The House Select Committee on the CCP and the Committee on Homeland Security opened a joint investigation on April 29 into Airbnb’s use of Alibaba’s Qwen for customer service and Anysphere’s use of a Moonshot AI open-weight model in Cursor’s Composer 2,²⁰ and extended it to DoorDash on July 31.²¹ The security premise is not hypothetical. CrowdStrike research published in November 2025 found DeepSeek-R1 produced vulnerable code 19% of the time at baseline, rising to 27.2% when the prompt mentioned the requester was “based in Tibet” — a near 50% increase attributable to nothing but political context in the prompt, across a test of 30,250 prompts per model.²²

Why it matters. Most AI policies treat as one problem what is really two. An employee pasting text into a chat interface is a data-egress question — classification rules, whether company inputs can be used for training, what happens with personal accounts. An agent holding credentials to company systems is an access-control question — which systems it can reach, what gets logged, who reviews the log. Hosting location, subprocessors, retention terms, and code-security testing sit underneath both. Two audiences eventually ask for the log — a congressional committee or a customer’s security questionnaire — and “we had a policy” is a weaker answer than the log itself. Most relevant to: the CISO jointly with legal, plus procurement and data governance.

9. An AI firm says it will insure its agents. California’s bar has already said what it thinks.

Crosby, a venture-backed firm, says it will buy professional liability insurance for its AI agents so they can perform “autonomous legal work.” Its founder concedes that “today, our lawyers review every single work output” but says “it’s become clear this won’t be necessary in the future.” No insurer has been identified, and the firm has published nothing of its own.²³ Meanwhile the State Bar of California revised its generative AI guidance in 2026, at the California Supreme Court’s request, specifically to address agentic systems. It is not ambiguous: lawyers “must not deploy agentic systems in a manner that allows the system to make substantive legal determinations, communicate legal advice, prepare and file pleadings, or otherwise act in a representative capacity without meaningful lawyer supervision and review,” and “the greater the level of system autonomy, the greater the lawyer’s obligation to implement oversight mechanisms.”²⁴

Why it matters. Insurance is not authority — a policy that pays a claim does not make the underlying work a permissible practice of law. The allocation that matters sits in the engagement letter rather than in the firm’s coverage: which AI systems are used on a matter, whether output receives human review before delivery, confidentiality and privilege treatment, whether client data may train a vendor’s model, data location and subcontractors, audit and incident-notice rights, and responsibility for inaccurate output. Firms are often reluctant to share policy documents; the substitute appearing in the market is a written representation from the firm or its broker that the policy does not exclude the AI-assisted work described. Most relevant to: legal operations and outside counsel management, with risk or insurance.

Key dates

September 25, 2026 — Written comments are due on the proposed Trump Accounts employer-contribution regulations, REG-101355-26, 91 Fed. Reg. 51,611 — the Treasury proposal governing how employers may facilitate contributions to the new child savings accounts created by the 2025 tax law.²⁵ The same date is the deadline to request to speak at the public hearing; if no speaking requests are received, the hearing will be cancelled.

October 13, 2026 — Deadline to request to attend the October 15 hearing on the Trump Accounts proposal. This attendance deadline is frequently mis-stated in secondary coverage as the comment deadline; the comment period actually closes earlier, on September 25.

October 15, 2026, 10:00 a.m. ET — The IRS holds its public hearing on the Trump Accounts proposal. For employers weighing whether to facilitate contributions — the proposal requires a separate written plan and applies eligibility-classification and nondiscrimination rules — the hearing will be the first public read on where Treasury is willing to adjust before finalizing.

December 15, 2027 — FASB’s ASU 2025-06, the internal-use software standard discussed in item 6, takes effect for annual reporting periods beginning after this date — meaning fiscal 2028 for calendar-year companies. Because early adoption is permitted, the capitalization judgments the standard creates, including how to treat AI development costs it expressly declines to address, arrive well before then for any company that adopts early.

Two details in the Trump Accounts proposal are widely mis-stated and worth getting right before anyone briefs your benefits committee. The $5,000 annual cap is per account beneficiary under IRC § 530A(c)(2)(A). The $2,500 employer figure is an income exclusion under IRC § 128(b)(1) that runs per employee — not per child and not per employer — so an employee with three children gets one $2,500 exclusion and an employee with two jobs does not get it twice. Employer contributions count against the $5,000. The requirement that an employer program sit in a separate written plan is statutory, not merely regulatory.²⁶