Episode Details

In March 2024, the Securities and Exchange Commission fined two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., a combined 310,000 dollars for telling investors their artificial intelligence did more than it actually did. Two years later, that enforcement logic has moved from the asset management industry into the venture capital term sheet. A founder who cannot document what a third-party large language model vendor does with customer data, which state privacy statutes apply to that data, and what the board actually reviewed before relying on artificial intelligence now faces the same category of scrutiny a public company faces from the Commission’s Enforcement Division.

The mechanism is simple once traced to its source. Section 17(a) of the Securities Act of 1933 and Rule 10b-5 under the Securities Exchange Act of 1934 make a false statement about a product’s artificial intelligence fraud, whether the security is a public share or a Regulation D private placement sold under Rule 506(b) or 506(c). The Commission’s Enforcement Division built a Cyber and Emerging Technologies Unit in February 2025 specifically to read artificial intelligence disclosures inside Forms 10-K, 10-Q, and 8-K, and the North American Securities Administrators Association named artificial intelligence marketing claims a 2026 examination priority for state registered advisers. None of that authority is limited to companies that have already gone public. It reaches the representations a founder makes in a subscription agreement the same day the wire arrives.

How does a third-party large language model vendor create diligence risk

The answer sits in two documents most founders have never read closely: the vendor’s Data Processing Addendum and its training exclusion policy. OpenAI does not use API or Enterprise data to train its models by default. Anthropic reduced API log retention from thirty days to seven days as of September 14, 2025, and deletes inputs and outputs automatically unless a customer negotiates a longer window through its own Data Processing Addendum. Both vendors offer a zero data retention agreement to qualifying enterprise customers, removing stored inputs beyond what abuse screening requires. A startup that cannot produce a signed Data Processing Addendum, a documented training exclusion election, and a written record of its retention window is handing a diligence team an open item, and diligence teams in 2026 are trained to find it. The Federal Trade Commission’s settlement with DoNotPay, a 193,000 dollar final order approved in February 2025 over an AI product marketed as performing to the standard of a licensed attorney without substantiating testing, and its separate 18 million dollar stipulated judgment against Air AI, show what happens when a company’s public claims about its artificial intelligence outrun what it can prove. Both actions rested on Section 5 of the Federal Trade Commission Act, the same statute that reaches a startup’s own claims about its vendor relationship.

Which state privacy statutes actually apply to a startup’s customer base

Twenty states had comprehensive consumer privacy statutes in effect at some point during 2026. Indiana, Kentucky, and Rhode Island took effect January 1, 2026, and Connecticut, Arkansas, and Utah added amendments effective July 1, 2026. California added its own layer on top of the existing California Consumer Privacy Act: the Privacy Protection Agency finalized rules on automated decisionmaking technology, risk assessments, and cybersecurity audits effective January 1, 2026, phased by revenue through April 1, 2030 for the smallest covered businesses. Colorado’s approach to artificial intelligence specifically has changed twice since 2024. Senate Bill 24-205 was set to take effect February 1, 2026. Colorado’s governor signed Senate Bill 25B-004 in August 2025, moving that date to June 30, 2026, then signed Senate Bill 26-189 in May 202