Lawmakers have failed to extend a surveillance law that allows US intelligence agencies to monitor targets abroad without a warrant.

Congress rejected a vote to extend Section 702 of the Foreign Intelligence Surveillance Act to July 2, which means, for a few days at least, some surveillance will be put on hold, for the first time since the Act was passed in 2008. The next possible chance for a vote will be June 28.

This has significance for CISOs because they need to be aware of how communication between the US and other countries is being monitored. The Act permits US intelligence agencies to collect texts and emails sent to and from foreigners living outside the US without a warrant — and when those communications are to or from an US citizen, it allows them to scoop them up too.

“For too long, the FBI has been able to piggyback on a major national security tool as an unconstitutional backdoor way of reading Americans’ communications,” Electronic Frontier Foundation Senior Policy Analyst Matthew Guariglia wrote in article about the renewal vote this week.

It is uncertain what will happen next. Some commentators expect things will proceed as if the Act had been extended, possibly through an executive order.  However, the industry may well revolt against this and we could see some tech providers take legal action.

This article first appeared on CSO.

A German court has sparked a legal controversy by ruling that Google is responsible for defamatory comments generated by its own AI system. The search giant had argued that it couldn’t be blamed for the false results, but a Munich court has deemed that not to be the case and has ruled in favor of the two unnamed plaintiffs, both publishing companies, who the Google AI Overview inaccurately said engaged in shady business practices.

Google is required to remove the comments and ensure that they are not repeated. The case is certainly going to raise some questions globally. Will this mean that other courts are going to rule against AI vendors?

Bernhard Buchner, a partner at Lausen Rechtsanwälte, the legal firm that acted for the plaintiffs, said, “I believe it shows that online providers such as Google cannot hide behind the fact that a statement was generated by AI, but rather that they can be held liable for its output. It is an important step towards ensuring that providers of AI systems have to take responsibility for their outputs.”

So, does this mean that the decision could be replicated in the US or elsewhere? Alex Shahrestani, managing partner at Austin-based Promise Legal, said, “the short answer is ‘yes’:  the Munich ruling travels, because US courts are already making the same move.”

He explained that Section 230 of the US Communications Decency Act, which has been applied to protect online service providers like social media companies from lawsuits based on their decisions to transmit or take down user-generated content, was built for computer bulletin boards, “not for a model that writes its own answers. Once the AI is the author, the company is the publisher.”

This means, he said, “businesses now need named humans at accountability nodes, verification gates before AI output ships, and audit trails that survive discovery, because ‘the model recommended it’ is a legally empty sentence.”

Does the decision mean that other AI providers could find themselves in the same position? Buchner believes it’s possible, although, he said, the situation in this case is unusual; it does not involve a classic chatbot scenario, but one where the AI-generated statements are published as an ‘AI overview’ of a search query.

“Google’s liability here is based not so much on the fact that it operates the underlying AI, but rather on the publication of its output. However, it seems entirely conceivable to me that this could also be applied generally to inaccurate or defamatory AI,” he pointed out.

Nonetheless, said Carolyn Shelby, head of SEO at Yoast, the German ruling should ensure that companies will be more circumspect in how they handle AI in the future, to protect themselves from any legal action. The first thing they should do  is to separate low-risk use of AI from major decision-making.

“Using AI to summarize meeting notes, brainstorm campaign ideas, or create a first draft of something is very different from using it to make decisions about customers, employees, finance, compliance, health, legal claims, competitive positioning, or public communications,” she noted.

She pointed out that the effects of AI use could be devastating for companies. “The consequences could include customer complaints, reputational damage, regulatory attention, legal claims, correction costs, loss of trust, and internal disruption,” she said. “Even when a mistake does not become a lawsuit, the operational cost of correcting bad information can be significant.”

However, she noted, things may not change immediately.  “Many companies will wait until there is a high-profile court case, regulatory action, or major corporate embarrassment before they take this seriously. That is usually how governance catches up with technology. But the better-run organizations will start treating AI governance as part of normal business risk management now.”

And, said Shahrestani, after the Google decision, everything has changed. It will become more important to ensure that employees remain part of the process.