Legal & Compliance — August 3, 2026 Weekly
Legal & Compliance news & updates — every claim linked to a primary source.
Key Findings
Executive Summary (5)
- •This week's most consequential development is the simultaneous activation of the EU's Digital Omnibus on AI and Cyber Resilience Act guidance — organizations that have been deferring EU AI and cybersecurity compliance planning on the basis of awaiting regulatory clarity no longer have that justification, as obligations are now legally in force.
- •The FTC's telehealth privacy lawsuit against Hims & Hers confirms that the agency's portfolio-enforcement model has now reached digital health — a sector that had largely escaped direct FTC privacy enforcement — while the Supreme Court's Sripetch disgorgement ruling strengthens the SEC's enforcement toolkit in ways that will reshape settlement calculus across all securities enforcement matters.
- •Delaware corporate law produced two significant rulings this week that pull in opposite directions for corporate defendants: the Section 220 post-demand evidence ruling expands stockholder inspection rights and increases litigation exposure, while the Paragon Metals M&A fraud ruling clarifies that seller concealment — not buyer due diligence gaps — is the determinative factor in fraud reliance analysis.
- •The SEC's new activist fund disclosure guidance under Schedules 13D and 14A closes a structural transparency gap that activist campaigns have exploited for decades, materially increasing disclosure obligations for single-issuer SPV structures and signaling that the SEC's deregulatory agenda does not extend to activist disclosure.
- •The 2026 proxy season data — settlement-dominated activism, record CEO pay alongside record Say-on-Pay support, and spiking golden-parachute vote failures — combined with the Shareholder Rights Group's Rule 14a-8 petition, illustrates a governance landscape where formal voting mechanisms are increasingly secondary to private negotiation, while the institutional framework governing shareholder proposals faces its most significant structural challenge in decades.
Key Points (13)
- 1.The FTC sued Hims & Hers on July 29, 2026 for sharing consumers' sensitive health information, joined by Utah and California — the agency's first major telehealth privacy enforcement action, extending its portfolio-enforcement model into digital health [1].
- 2.The FTC granted early termination of its review of IonQ's proposed acquisition of SkyWater Technologies on July 31, 2026, signaling regulatory openness to quantum computing sector consolidation [1].
- 3.The EU's Digital Omnibus on AI entered into force on July 27, 2026, and the European Commission published practical Cyber Resilience Act guidance on the same date, making EU AI and cybersecurity compliance obligations immediately operative [4].
- 4.The Delaware Supreme Court issued a 3-2 split ruling allowing post-demand evidence in Section 220 books-and-records actions under exceptional circumstances, expanding stockholder inspection rights in the context of the Paramount Global sales process [5a].
- 5.The SEC Staff issued three new Corporation Finance Interpretations on July 9, 2026 requiring company-specific activist SPVs to disclose investor identities in Schedule 13D filings and treating investors contributing more than $500 as proxy solicitation participants under Schedule 14A [5b].
- 6.Multiple Harvard Law School Forum analyses confirmed that the Supreme Court's Sripetch v. SEC ruling eliminates the investor pecuniary loss requirement for SEC disgorgement, while Justice Thomas's concurrence flagged a developing circuit split on whether disgorgement is a legal remedy entitling defendants to jury trials [5c].
- 7.The Delaware Supreme Court in Paragon Metals v. Smith held that a seller's active concealment defeats anti-reliance provisions and that Delaware fraud claims are subject to the preponderance standard, not a heightened clear-and-convincing standard [5d].
- 8.The 2026 proxy season review documented that 57 of 58 activist board seats were gained through settlement rather than contested vote, average Say-on-Pay support reached 92% despite record CEO pay of approximately $17.5 million, and golden-parachute vote failures spiked to a record ten (~26% failure rate) [5e].
- 9.The Shareholder Rights Group filed a rulemaking petition on August 2, 2026 urging the SEC to retain Rule 14a-8's no-action process, warning that the Commission's Spring 2026 Unified Regulatory Flexibility Agenda may severely circumscribe or rescind the rule [5f].
- 10.The Law Library of Congress published a new report on the legal obligations and liability of producers of large language models on July 29, 2026, providing the first comprehensive comparative legal analysis of LLM producer liability [3].
- 11.USCIS announced an asylum backlog rule change on July 27, 2026, while a Massachusetts federal court issued an administrative stay of certain USCIS policies based on H.R. 1 on July 21, 2026, creating a complex and uncertain immigration compliance environment [6].
- 12.The ICJ announced public hearings on Germany's preliminary objections in Nicaragua v. Germany (Occupied Palestinian Territory) to be held September 7–10, 2026, advancing a significant case on third-state responsibility in international humanitarian law [8].
- 13.Colorado revised its AI law, changing compliance expectations for businesses, adding to the state-level AI regulatory patchwork alongside Illinois's recently enacted Artificial Intelligence Safety Measures Act [10].
Market Trends
FTC Enforcement Broadens Into Telehealth Privacy and Ticketing Compliance
The FTC's portfolio-enforcement model continued its expansion this week with two new enforcement vectors. On July 29, 2026, the FTC — joined by Utah and California — sued Hims & Hers, alleging the telehealth provider shared consumers' sensitive health information in violation of privacy laws, marking the agency's first major telehealth privacy action [1]. On July 27, 2026, ticket broker Elite Events was ordered to pay $300,000 in civil penalties for bypassing ticket purchase limits under the Bet…
SEC Structural Reform Agenda Advances: 24-Hour Trading and Small Business Capital Formation
The SEC continued its capital markets modernization agenda this week. On July 23, 2026, the SEC announced a roundtable on preparations for 24-hour trading, and on July 30, 2026, announced continuation of its Small Business Advisory Committee meeting [2]. On July 31, 2026, the FTC granted early termination of its review of IonQ's proposed acquisition of SkyWater Technologies, signaling regulatory openness to quantum computing sector consolidation [1]. These developments collectively indicate a re…
AI Legal Liability Crystallizes: LLM Producer Obligations and Disgorgement Doctrine Evolve
Two significant legal developments this week advanced the framework for AI and securities liability. The Law Library of Congress published a new report on the legal obligations and liability of producers of large language models on July 29, 2026, providing the first comprehensive comparative legal analysis of LLM producer liability across jurisdictions [3]. Separately, the U.S. Supreme Court's unanimous ruling in Sripetch v. SEC (June 4, 2026) — analyzed extensively this week by multiple Harvard…
Global Legal Developments Signal Accelerating Regulatory Fragmentation
The Library of Congress Global Legal Monitor documented a cluster of significant national legal changes this week. Indonesia's presidential regulation designated the spread of LGBTQ culture as a nonmilitary state threat (July 27, 2026); Israel's cabinet declared it would not abide by a High Court ruling regarding a broadcast media regulator (July 31, 2026); and South Korea's Special Act regulating Korean investments in the U.S. took effect as part of a bilateral trade deal (July 30, 2026) [3]. T…
Shareholder Proposal Governance Under Intensifying Legal and Institutional Pressure
The 2026 proxy season review published by Anteris Advisors on July 29, 2026 documented that of 98 activist campaigns concluding in 2026, only six went to a shareholder vote, with 57 of 58 board seats gained through settlement rather than contested vote [5e]. Separately, the Shareholder Rights Group filed a rulemaking petition on August 2, 2026 urging the SEC to retain Rule 14a-8's no-action process while reforming procedural mechanics, warning that the Commission's Spring 2026 Unified Regulatory…
Competitor Trends
Delaware Supreme Court Expands Section 220 Inspection Rights via Post-Demand Evidence Ruling
In a 3-2 split decision issued March 25, 2026 and analyzed this week, the Delaware Supreme Court held that in exceptional circumstances, the Court of Chancery may consider post-demand evidence in Section 220 books-and-records actions when analyzing whether a stockholder had a credible basis to suspect wrongdoing — arising from the Paramount Global sales process [5a]. The majority held that nothing in Section 220's text prohibits post-demand evidence, while the dissent argued for a bright-line ba…
SEC Issues New Guidance Tightening Activist Fund Disclosure Under Schedules 13D and 14A
On July 9, 2026, the SEC Staff issued three new Corporation Finance Interpretations (CFIs) targeting activist special-purpose vehicles. CFI 110.09 requires entities formed specifically to acquire a named issuer's securities to disclose the identities of their investors under Item 3 of Schedule 13D; CFI 110.10 confirms that Instruction C to Schedule 13D requires disclosure in addition to, not in place of, reporting person information; and CFI 155.02 confirms that investors contributing more than …
Delaware M&A Fraud Doctrine Sharpened: Seller Concealment Defeats Anti-Reliance Clauses
The Delaware Supreme Court's ruling in Paragon Metals v. Smith — analyzed July 30, 2026 — reversed a trial court and held that a buyer's imperfect due diligence does not defeat justifiable reliance where the seller's CEO actively concealed critical customer-loss information and responded untruthfully when pressed [5d]. The Court confirmed that Delaware fraud claims are subject to the preponderance of the evidence standard, not a heightened clear-and-convincing standard, and that willful blindnes…
EU Digital Omnibus on AI Enters Into Force; Cyber Resilience Act Guidance Published
On July 27, 2026, the EU's Digital Omnibus on Artificial Intelligence entered into force, and on July 27, 2026, the European Commission published practical guidance on the application of the Cyber Resilience Act [4]. The European Commission had also issued EU AI Act transparency guidelines on July 20, 2026, intended to assist providers and deployers of AI systems in complying with the transparency requirements of the EU AI Act [4]. These developments collectively accelerate the EU's AI and cyber…
Executive Compensation Governance Faces Compounding Structural Pressures in 2026–2027 Cycle
Analysis published July 27, 2026 by Pay Governance documented that compensation committees are entering the 2026–2027 meeting cycle amid economic uncertainty, evolving SEC disclosure priorities, and a changing proxy voting landscape [5g]. The 2026 proxy season review found average Say-on-Pay support reached 92% — the highest in three seasons — even as median S&P 500 CEO pay hit a record approximately $17.5 million, while golden-parachute vote failures spiked to a record ten (~26% failure rate) […
Regulatory Trends
EU AI Regulatory Stack Reaches Operational Force: Omnibus, Transparency Guidelines, and CRA Guidance Converge
Three EU AI and cybersecurity regulatory instruments became operationally active in a single week. The EU Digital Omnibus on AI entered into force on July 27, 2026; the European Commission issued EU AI Act transparency guidelines on July 20, 2026 to assist providers and deployers with compliance; and the Commission published practical guidance on the Cyber Resilience Act on July 27, 2026 [4]. The simultaneous activation of these instruments means organizations can no longer treat EU AI and cyber…
EDPB Web Scraping Guidelines Signal GDPR Constraints on Generative AI Training Data
The European Data Protection Board adopted Guidelines 03/2026 on web scraping in the context of generative AI for public consultation on July 7, 2026, analyzed by Privacy World Blog on July 29, 2026 [9]. The guidelines address the limits of GDPR orthodoxy in regulating data collection practices that are technically irreversible once training datasets are assembled. This development signals that the EDPB is actively working to constrain generative AI training data practices under existing GDPR fr…
USCIS Implements Asylum Backlog Rule Change; Court Issues Administrative Stay of Related Policies
On July 27, 2026, USCIS announced a rule change designed to reduce the backlog in the asylum system [6]. However, on July 21, 2026, the U.S. District Court for the District of Massachusetts issued an administrative stay of certain USCIS policies based on H.R. 1, the Reconciliation Act of 2025 (the One Big Beautiful Bill Act), in the case Venez. Ass'n of Mass. v. USCIS [6]. The simultaneous implementation of new asylum rules and judicial stay of related policies creates a complex and uncertain co…
ICJ Schedules Public Hearings on Nicaragua v. Germany Palestinian Territory Case
On July 31, 2026, the International Court of Justice announced that public hearings on Germany's preliminary objections in the case Alleged Breaches of Certain International Obligations in respect of the Occupied Palestinian Territory (Nicaragua v. Germany) will be held from September 7 to September 10, 2026 [8]. This case, addressing state responsibility for alleged facilitation of international law violations, has significant implications for the developing doctrine of third-state responsibili…
Colorado Revises AI Law; State AI Compliance Expectations Continue to Diverge
Colorado revised its AI law, changing compliance expectations for businesses, as reported by OneTrust Blog during the week [10]. This follows Illinois's enactment of the Artificial Intelligence Safety Measures Act on July 6, 2026, making it the third state with comprehensive AI safety requirements [4]. The pattern of state-by-state AI law revision — with each state adopting distinct requirements — is accelerating the compliance fragmentation that makes a centralized AI governance infrastructure …
Sources Activity
Since last week
FTC Sues Hims & Hers for Telehealth Privacy Violations
On July 29, 2026, the FTC — joined by Utah and California — filed suit against Hims & Hers alleging the telehealth provider shared consumers' sensitive health information in violation of privacy laws, marking the agency's first major telehealth privacy enforcement action and extending the FTC's portfolio-enforcement model into digital health [1].
Supreme Court Sripetch v. SEC Disgorgement Ruling Analyzed; Jury Trial Question Flagged
Multiple Harvard Law School Forum analyses published July 27–31, 2026 examined the Supreme Court's unanimous June 4, 2026 ruling in Sripetch v. SEC, confirming the SEC need not prove investor pecuniary loss to obtain disgorgement. Justice Thomas's concurrence raised whether disgorgement is now a legal remedy entitling defendants to jury trials under the Seventh Amendment — a circuit split identified as ripe for future SCOTUS review [5c].
EU Digital Omnibus on AI Enters Into Force; CRA Guidance Published
The EU's Digital Omnibus on Artificial Intelligence entered into force on July 27, 2026, and the European Commission published practical guidance on the Cyber Resilience Act on the same date. The Commission had also issued EU AI Act transparency guidelines on July 20, 2026 [4]. These instruments are now legally operative, removing the 'awaiting clarity' justification for delayed compliance implementation.
Delaware Supreme Court 3-2 Split Allows Post-Demand Evidence in Section 220 Actions
In a March 25, 2026 ruling analyzed this week, the Delaware Supreme Court held 3-2 that courts may consider post-demand evidence in Section 220 books-and-records actions under exceptional circumstances, arising from the Paramount Global sales process. The ruling expands stockholder inspection rights and increases litigation risk for corporations facing books-and-records demands [5a].
SEC Issues Activist Fund Disclosure Guidance Under Schedules 13D and 14A
On July 9, 2026, the SEC Staff issued three new Corporation Finance Interpretations requiring company-specific activist special-purpose vehicles to disclose investor identities in Schedule 13D filings and to treat investors contributing more than $500 as 'participants' in contested proxy solicitations under Schedule 14A, closing a long-standing disclosure gap [5b].
Watchlist — Upcoming Deadlines
Law Commission (UK) consultation response deadline for homicide offences reform project
Source: Harvard Law School Forum on Corporate GovernanceStrategic Insights (12)
- 1.The FTC's Hims & Hers telehealth lawsuit signals that digital health platforms handling sensitive health data are now in the agency's active enforcement perimeter. Telehealth operators should immediately audit their data-sharing practices — particularly any sharing with advertising partners, data brokers, or analytics providers — against FTC health privacy standards, treating this action as a sector-wide enforcement signal rather than an isolated case [1].
- 2.Justice Thomas's Sripetch concurrence identifying a developing circuit split on whether SEC disgorgement is a legal remedy entitling defendants to jury trials is the most strategically significant element of the ruling for enforcement defense. Defendants in active SEC enforcement matters should immediately assess whether a jury trial right argument is available and preserve it, as the concurrence reads as an open invitation for a future petitioner to bring the question to SCOTUS [5c].
- 3.The Delaware Section 220 post-demand evidence ruling materially changes the risk calculus for corporations facing books-and-records demands. The majority's case-by-case 'exceptional circumstances' standard — rather than a bright-line bar — means corporations cannot reliably predict whether post-demand evidence will be admitted, making early and comprehensive document production strategies more important than ever in Section 220 proceedings [5a].
- 4.The SEC's new activist SPV disclosure guidance under CFI 110.09 and CFI 155.02 requires activists to name underlying investors in 13D and contested proxy filings for company-specific vehicles — a structural change that will increase the cost and complexity of single-issuer activist campaigns and may deter some institutional investors from participating in purpose-built activist structures [5b].
- 5.The Paragon Metals ruling's confirmation that Delaware fraud claims use the preponderance standard — not clear-and-convincing — combined with its holding that seller concealment defeats anti-reliance provisions, means M&A sellers face a lower evidentiary bar for fraud liability than previously assumed. Sellers should treat forward-looking MAE representations as requiring affirmative disclosure of known adverse developments, not merely the absence of formal notice [5d].
- 6.The EU Digital Omnibus on AI entering into force this week, combined with the Cyber Resilience Act guidance and AI Act transparency guidelines, means EU-facing organizations now have three simultaneously operative AI and cybersecurity compliance frameworks. Organizations should prioritize mapping their AI systems against the transparency requirements and their connected products against CRA obligations before enforcement actions begin [4].
- 7.The EDPB's web scraping guidelines for generative AI training data signal that GDPR constraints on AI training datasets are being actively developed under existing law — without waiting for new AI-specific legislation. AI developers using web-scraped training data should assess their data collection practices against the EDPB's emerging framework before the consultation period closes [9].
- 8.The 2026 proxy season's record golden-parachute vote failure rate (~26%) and the advisory nature of those votes suggest institutional investors may escalate to 'submit-severance-to-a-vote' shareholder proposals in 2027, particularly targeting smaller-cap companies most exposed to acquisition. Compensation committees should proactively review change-in-control pay structures before the 2027 proxy season rather than waiting for a failed vote [5e].
- 9.The Shareholder Rights Group's Rule 14a-8 rulemaking petition — filed August 2, 2026 — documents that the Commission's Spring 2026 Unified Regulatory Flexibility Agenda includes a rulemaking that may severely circumscribe or rescind the rule. Companies planning to exclude shareholder proposals in the 2027 proxy season should develop independent legal exclusion strategies now, as the no-action process remains suspended and any new rulemaking will face litigation risk [5f].
- 10.The Law Library of Congress's new report on LLM producer liability provides the first comparative legal framework for assessing AI developer obligations across jurisdictions. Organizations deploying or developing LLMs should use this report as a baseline for their AI liability risk assessments, particularly given the concurrent German court ruling holding Google liable for incorrect AI overviews [3].
- 11.The simultaneous USCIS asylum rule change and Massachusetts federal court administrative stay of related policies creates a bifurcated immigration compliance environment. Employers and immigration practitioners should monitor the Massachusetts litigation closely, as the stay may affect the operational implementation of the new asylum backlog reduction rule [6].
- 12.The ICJ's scheduling of public hearings in Nicaragua v. Germany for September 7–10, 2026 advances a case that could significantly develop the doctrine of third-state responsibility for international humanitarian law violations. States and multinational organizations with arms export or aid programs should monitor this case as a potential source of new international legal obligations [8].
Trust Summary
12 sources cited this weekDetected across 30 monitored URLs you selected — one URL can surface multiple articles.
Each source is weighted by its trust level. Single-source claims are flagged as unverified during AI synthesis.
Sources
Primary source for FTC enforcement actions this week including the Hims & Hers telehealth privacy lawsuit (July 29), Elite Events ticketing penalty (July 27), and IonQ/SkyWater early termination grant (July 31).
Source for SEC announcements including the 24-hour trading roundtable (July 23) and Small Business Advisory Committee continuation (July 30).
Source for the new Law Library report on LLM producer liability (July 29), Indonesia presidential regulation (July 27), Israel cabinet ruling defiance (July 31), South Korea bilateral trade act (July 30), and Germany digital safety recommendations (July 28).
Source for EU Digital Omnibus on AI entering into force (July 27), EU AI Act transparency guidelines (July 20), Cyber Resilience Act guidance (July 27), and CISA CIRCIA September 2026 finalization timeline. Note: company announcement — may reflect promotional framing.
Primary source for Delaware Section 220 post-demand evidence ruling analysis, Sripetch v. SEC disgorgement analysis, SEC activist fund disclosure guidance (CFIs 110.09, 110.10, 155.02), Paragon Metals M&A fraud ruling, 2026 proxy season review, executive compensation boardroom analysis, and Rule 14a-8 rulemaking petition. Note: company announcement — may reflect promotional framing.
Source for USCIS asylum backlog rule change (July 27) and Massachusetts federal court administrative stay of certain USCIS policies (July 21).
Source confirming the CJEU press releases from July 16, 2026 remain the most recent published rulings, with no new press releases issued during this reporting week.
Source for ICJ press release No. 2026/21 (July 31) scheduling public hearings in Nicaragua v. Germany (Occupied Palestinian Territory) for September 7–10, 2026.
Source for analysis of EDPB Guidelines 03/2026 on web scraping in the context of generative AI (July 29). Note: company announcement — may reflect promotional framing.
Source for Colorado AI law revision and California AI Transparency Act compliance steps. Note: company announcement — may reflect promotional framing.
Source for legal profession news including Washington bar exam cancellation after NextGen UBE tech issues, appeals court sanctions for AI misuse, and ABA Commission on Women in the Profession findings.
Source for ongoing UN coverage of Middle East civilian casualties, Ukraine conflict, and trafficking network warnings during the reporting week.
Get Legal & Compliance monitored every week
This report was built from primary sources only — no aggregators. Pick your themes and sources, and OriginBrief delivers a cited report like this every week. Start your 7-day free trial — plans from $33/mo.
Start your 7-day free trial