AI Regulation and Data Privacy: What Small Businesses Should Do Now

Hackers & Hooks | Season 1, Episode 13

Business owners keep asking Nick Gipson the same questions about AI: what happens to the data we put into these tools, and which rules apply to us? For this panel episode, Nick and co-host Isaac Reed brought in three people who see those questions from different sides.

Sean O’Rourke is a cyber liability consultant at an insurance brokerage and consultancy, with 25 years in technology before that. Chris Feamster is with Nexus Systems, a full stack IT consultancy that has moved into AI governance, which it calls AI stewardship. Richard Schreiber founded Secure Justice AI and builds AI agent solutions, mostly for the legal field. Here is what they said, and what it means for you.

A Patchwork of State Laws and No Federal Standard Yet

Nick opened with the contrast between Europe and the US. The EU has a single data protection regulation, the GDPR, which has applied across member states since May 2018. In the US, your protections depend largely on where you live.

Richard filled in the details. There is no comprehensive federal privacy law, and roughly two dozen states have passed their own. The leading federal proposal, the SECURE Data Act, was introduced in the House in April 2026 and has not become law. Richard called federal override of stronger state laws the sticking point, and he sees the same fight over AI.

Sean noted that these state laws generally protect a state’s residents wherever the business is located. Most also apply only above certain size or data thresholds.

When Nick voiced frustration that some small organizations lose personal data and never tell the people affected, Sean offered the other side: notifying people is the right thing morally, but it can invite lawsuits that sink an underinsured small practice. Breach notification rules vary by state and industry, and many apply to small businesses, so talk with counsel before an incident, not during one.

Insurance Shapes Security More Than Most Laws Do

Nick observed that insurance shapes which security services companies buy, then refined it after hearing Sean: the fear of being sued drives insurance, and insurance drives the business.

Sean pointed to the gray areas. That week, hackers had tampered with refrigeration controls at hundreds of French supermarkets and spoiled food. Is that spoilage a property claim or a cyber claim? It is not settled.

On AI, Sean said some carriers have recently moved to confirm that AI-related risks fall under existing cyber and professional liability (errors and omissions) policies. The market is mixed, though, and AI exclusions have also started appearing in some general liability policies. Sean expects court cases over the next three to five years to settle much of this.

What AI Regulation Could Look Like

Nick argued that because the internet is global, data protection needs international coordination, something like a world cyber treaty. He compared today’s AI moment to the early nuclear era, before the risks were understood.

Sean doubted anyone can regulate AI well yet, partly because people can run open source models on a laptop with no internet connection. Still, he believes some rules beat none because they set a baseline, and that more transparency into how models work would help regulators target real problems without stifling innovation.

“AI regulation is going to be a moving target, unlike anything that we’ve ever seen, because it’s just no longer fixed.”

Sean O’Rourke, Hackers & Hooks

Richard noted that without a federal mandate, AI rules are arriving state by state, so a firm operating in fifteen states could face up to fifteen sets of them. He predicts a Sarbanes-Oxley moment for AI, after the 2002 law passed in the wake of the Enron scandal: businesses in fields like law and finance required to audit, record, and report their AI use.

Chris focused on culture. Too many organizations stay reactive, and the challenge is breaking the “maybe next time” loop. Drawing on the Cold War story Fail-Safe, he warned about systems that move faster than human checks, and about assuming you can always turn them off. He also argued that security is shared.

“In order to be more secure for you, sometimes you need to make somebody else more secure as well.”

Chris Feamster, Hackers & Hooks

For context: as of October 2026, the US has no comprehensive federal AI law, and Congress is still debating whether a national standard should override state AI laws. The EU’s AI Act became law in August 2024 and is phasing in over several years.

The AI Risk Already Inside Small Businesses

In Chris’s view, small businesses are where much of the real AI adoption is happening, because AI helps teams short on hands and hours. Richard warned that the same group carries the highest risk. People are vibe coding (building apps by prompting an AI tool) and releasing them without testing or code review. Employees are building their own tools too, so businesses need policies that keep personal information from leaking through them.

Nick hears about this often: apps people vibe coded, running on automation platforms and open to the public. He expects more incident response calls from people who put their information into an AI tool or homegrown app and lost control of it.

Lessons for Small Businesses

• Write a one-page AI use policy. Name the approved tools and the data that never goes in: customer records, employee files, health or financial details, and passwords.
• Find the AI tools already in use. Ask staff, including about free accounts and browser add-ons, and check each tool’s data retention and training settings.
• Review anything built with AI before it touches real data. Have someone qualified check who can reach it, what it connects to, and where the data goes.
• Know which privacy and breach rules apply. Ask counsel which state and industry rules cover you, based on where your customers and employees live. Small does not mean exempt.
• Ask your broker how your policies treat AI. Check your cyber, professional liability, and general liability policies for AI exclusions or affirmative coverage.
• Add AI to your incident response plan. Decide who to call if an AI tool exposes data or a homegrown app is left open, and how you will preserve logs.

How Gipson Cyber Helps

Nick put the practical message simply: “You’re going to pay for security either way.”

Gipson Cyber is not a law firm or an insurer, so work through privacy and coverage questions with your counsel and broker. Our role is security. Business SOCaaS provides 24×7 monitoring with real human responders, working with the tools you already have and alongside your IT team or MSP, with clear reporting. If data is exposed, Business DFIR provides small business incident response. No rule or tool removes risk entirely, but these basics reduce it.