July 1, 2026 | By: Jason T. Seay, AIGP, CIPP-US

Artificial intelligence is rapidly transforming how companies operate, but with that transformation comes increasing legal scrutiny, regulatory complexity, and operational risk. AI is no longer an emerging issue—it is a current business and legal priority.

Here are seven key takeaways from my presentation at the BSidesOK AI Security Summit.

1. AI Risk Is Broad, Immediate, and Business-Critical

Organizations must evaluate AI beyond technical performance, focusing on legal, reputational, and operational consequences.

• AI-related harms can include:
  • Reputational damage
  • Regulatory exposure
  • Discrimination and bias risks
  • Data privacy violations
  • Economic and societal impacts
• AI amplifies existing risks due to its scale, speed, and automation capabilities

Why does it matter?
Failure to proactively identify and mitigate these risks can lead to enforcement actions, litigation, and brand damage—often before issues are fully understood.

2. There Is No Single AI Law, But Significant Legal Exposure Exists

In the U.S., AI is governed through a patchwork of existing laws and emerging state regulations, not a single comprehensive statute.

• Existing laws already apply, including:
  • Consumer protection (e.g., misleading AI claims)
  • Anti-discrimination laws (e.g., hiring, lending)
  • Privacy and data governance laws
• Regulators such as the FTC are actively taking enforcement action for AI-related misconduct

Why does it matter?
Companies cannot assume they are “unregulated” simply because there is no omnibus AI law. Legal exposure already exists across multiple fronts.

3. State-Level AI Regulation Is Accelerating Quickly

Several states have already enacted AI-specific laws with immediate and near-term compliance obligations:

• California (2026):
  • AI transparency requirements for training data
  • Disclosure obligations for chatbots and synthetic content
• Colorado (2026):
  • Anti-discrimination and reporting requirements for high-risk AI (subject to change under new legislation currently under consideration in Colorado; see SB 26-189)
• Texas (2026):
  • Comprehensive AI governance framework and regulatory sandbox
• New York & Illinois (2026):
  • Reporting, safety, and civil rights implications for AI systems

Why does it matter?
Businesses operating across multiple jurisdictions must manage inconsistent and evolving compliance obligations, increasing operational complexity and risk.

4. Your Role in the AI Ecosystem Determines Your Liability

Regulatory frameworks increasingly distinguish between different participants in the AI lifecycle, such as:

• Providers: Design and develop AI systems (highest regulatory burden)
• Deployers: Use AI within business operations (compliance and oversight obligations)
• Importers/Distributors: Ensure systems meet regulatory requirements before market entry

Why does it matter?
Understanding your role is critical. Liability and compliance obligations vary significantly depending on how your business interacts with AI.

5. AI Governance Must Span the Entire Lifecycle

Effective AI governance is not a one-time exercise; it must be embedded across the full AI tool lifecycle:

• Planning and problem definition
• Data collection and bias mitigation
• Model development and documentation
• Testing for fairness and accuracy
• Deployment with oversight and reporting
• Ongoing monitoring and maintenance
• Proper decommissioning and data handling

Why does it matter?
Regulators and stakeholders increasingly expect “governance by design,” not retroactive fixes after deployment.

6. Risk-Based Frameworks Are Becoming the Global Standard

Most regulatory approaches categorize AI systems by risk level, such as:

• Prohibited: Banned uses (e.g., certain biometric surveillance)
• High Risk: Subject to strict oversight and documentation
• Limited Risk: Transparency and disclosure requirements
• Minimal Risk: Voluntary standards

Why does it matter?
Companies must assess where their AI tools fall within these categories to determine compliance obligations and acceptable use cases.

7. Data, Cybersecurity, and Liability Are Emerging Pressure Points

Key trends shaping AI-related risk include:

• Data quality and bias: AI outputs are only as reliable as training data
• Cybersecurity and confidentiality: Increased threat exposure through the use of AI systems
• Product liability questions: Whether AI systems will be treated as “products” under existing product liability laws
• Internal governance gaps: Lack of policies, training, and oversight structures

Why does it matter?
These issues are likely to drive the next wave of enforcement and litigation, particularly for companies deploying AI at scale.

What Businesses Should Do Now

To stay ahead of regulatory and operational risk, organizations should:

• Conduct an AI risk assessment across all business functions
• Map AI use cases to applicable laws and regulatory frameworks
• Implement governance policies covering development, deployment, and monitoring of AI tools
• Establish internal accountability (legal, compliance, IT, and business stakeholders)
• Audit data sources and outputs for bias, accuracy, and compliance
• Prepare for disclosures and transparency requirements

AI presents significant opportunities, but also heightened legal, regulatory, and reputational risk. Organizations that take a proactive, structured approach to AI governance will be best positioned to innovate confidently while minimizing exposure.

This Alert was prepared by Jason Seay, AIGP, CIPP-US, a member of GableGotwals’ Cybersecurity and Data Privacy Team. For more information, please contact Jason or a member of the team.

Jason T. Seay, AIGP, CIPP-US

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

June 11, 2026 | By: Jason T. Seay, AIGP, CIPP-US

Cybersecurity and privacy are no longer back-office concerns for the energy sector; they are front-line legal and operational risks. With expanding federal directives, evolving threat tactics, and an increasingly aggressive privacy litigation landscape, some energy companies are rethinking how they manage cyber and data risk. This Alert highlights the latest developments and what they mean for your business.

Key Takeaways

1. Federal Cybersecurity Mandates Are Expanding Rapidly

• The Transportation Security Administration (TSA) continues to roll out mandatory cybersecurity directives for critical pipeline infrastructure.
• These apply to designated pipeline owners and operators and are evolving annually.
• Expect more assets to be classified as “critical infrastructure,” increasing regulatory reach.

2. Compliance Now Requires a Structured, Documented Cyber Program

• TSA directives establish a two-layer framework:
  • Governance and Reporting (01 Series):
    • Designated cybersecurity coordinator (24/7 availability)
    • Mandatory incident reporting to the Cybersecurity and Infrastructure Security Agency (CISA)
    • Formal risk assessments and governance structures
  • Mitigation and Testing (02 Series):
    • Cybersecurity Implementation Plans
    • Incident response and recovery planning
    • Ongoing testing, validation, and documentation
• Key shift: Regulators now expect audit-ready evidence of compliance, not just policies.

3. 2025–2026 Updates Signal a Move Toward Continuous Oversight

• Recent TSA updates emphasize:
  • Performance-based compliance
  • Real-time monitoring and detection capabilities
  • Stricter reporting timelines and remediation tracking
• Implication: Cybersecurity is now an ongoing operational obligation, not a periodic exercise.

4. Threat Actors Are Targeting Identity, Not Just Systems

• Attack strategies are evolving quickly:
  • Help desk impersonation and social engineering
  • Multi-factor authentication (MFA) fatigue (“push-bombing”)
  • Identity provider (IdP) compromise (e.g., centralized access systems)
  • Exploitation of non-human identities (API keys, service accounts)
• Generative AI is accelerating:
  • Phishing sophistication
  • Malware development
  • Attack scale and speed
• Takeaway: Traditional perimeter defense is becoming obsolete.

5. Privacy Litigation Is Expanding Beyond Traditional Targets

• The California Invasion of Privacy Act (CIPA) is being applied to:
  • Website tracking technologies (cookies, pixels)
  • Chatbots and AI tools
  • Session replay and user interaction tracking
• Plaintiffs argue that third-party tools “intercept” user communications—triggering potential liability under California state law.
• Risk exposure: Up to $5,000 per violation, with broad applicability to any site accessible in California.

6. New Privacy Laws Add Another Layer of Compliance

• The Oklahoma Privacy Act (effective 2027) introduces:
  • Enforcement by the Attorney General
  • Penalties up to $7,500 per violation
• At the same time, updated California Consumer Privacy Act regulations require:
  • Risk assessments for high-risk data processing
  • Cybersecurity audits for covered businesses
• Notably: Sensitive data like precise geolocation is a key focus.

7. Proactive Risk Management Is Now a Business Imperative

• Leading practices include:
  • Comprehensive data and AI tool inventory (chatbots, analytics, tracking tools)
  • Vendor contract scrutiny (data use, model training, reuse rights)
  • Regular audits (at least every 6 months)
  • Stronger consent frameworks (clear disclosures and enforceable terms)

The Bottom Line

Legal, IT, and operations teams must work in lockstep as cybersecurity and privacy risks in the energy industry are converging and intensifying. Federal mandates, sophisticated cyber threats, and expanding privacy litigation, are creating a complex, high-stakes environment.

Companies that treat cybersecurity and data governance as core business functions, not just compliance exercises, will be best positioned to manage risk, maintain operational resilience, and avoid costly enforcement actions.

This series covers topics featured during GableGotwals’ Annual Energy Market Drivers and Current Legal Issues Seminar. To receive Alerts and information on future Firm events, subscribe to our mailing list.

Jason T. Seay, AIGP, CIPP-US

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

May 27, 2026 | By: Jason T. Seay, AIGP, CIPP-US and Francesca A. Walentynowicz

Emerging technologies are actively transforming how energy companies operate, transact, and compete. From blockchain-enabled digital tokens to the rapid rise of generative AI, these tools offer significant upside, but also introduce legal, regulatory, and operational risks. This Alert explores what energy companies need to know now.

1. Technology Is Now a Core Driver of Performance and Value

Adoption of advanced technologies is directly impacting:

• Operational efficiency
• Emissions reduction
• Cost control and uptime

Companies leveraging AI, sensors, and analytics are:

• Producing more efficiently
• Reducing compliance risk
• Gaining a competitive edge

2. Digital Tokens Go Far Beyond Cryptocurrency

Digital tokens are used to create blockchain-based representations of:

• Asset ownership (e.g., royalties, working interests)
• Contract rights
• Units of value or access rights

Built on distributed ledger technology, they enable:

• Secure, transparent recordkeeping
• Programmable transactions and automated settlement

Key distinction: Tokens can be fungible or non-fungible, depending on their structure.

3.Tokenization Can Help Transform Energy Transactions

Practical use cases include:

• Fractional ownership of energy assets
• Tokenized royalty or production interests
• Streamlined commodity trading and settlement

Platforms like VAKT demonstrate:

• Faster settlement cycles
• Reduced administrative burden
• Improved auditability

Business impact: Lower transaction costs and broader market participation.

4. Adoption Barriers for Digital Tokens Remain Significant

Key challenges include:

• Regulatory uncertainty (securities, tax, and financial regulations)
• System fragmentation across energy data platforms
• Integration complexity with existing infrastructure

Successful implementation requires targeted use cases and strong governance, not wholesale transformation.

5. Generative AI Is Unlocking New Operational Capabilities

Tools like ChatGPT and Microsoft Copilot enable:

• Natural-language querying of complex operational data
• Predictive maintenance insights
• Automated reporting and documentation

AI can also:

• Identify anomalies in equipment performance
• Translate data into actionable insights
• Serve as a knowledge repository for field and office teams

6. AI Use Cases Span the Entire Energy Industry

• Operations:
  • Equipment monitoring and failure prediction
  • Maintenance automation and workflow generation
• Business and Legal Functions:
  • Contract review and due diligence
  • Market analysis and reporting
  • Regulatory and compliance documentation
• Cybersecurity:
  • Threat detection and incident response support
• Customer & Vendor Interaction:
  • AI-driven chatbots and communication tools

7. AI Introduces New Legal and Risk Considerations

Key concerns include:

• Liability exposure (e.g., whether AI outputs create legal risk)
• Data quality and reliability
• Cybersecurity and confidentiality risks
• Rapidly evolving regulatory frameworks

Takeaway: Governance and internal policies are essential for responsible deployment.

8. Competitive Advantage Will Favor Strategic Adoption

Companies that move beyond experimentation and:

• Integrate AI into workflows
• Identify high-value tokenization use cases
• Invest in data infrastructure

Will benefit from:

• Faster decision-making
• Lower operational costs
• Better resource allocation

The Bottom Line

Digital tokens and generative AI are shifting how energy companies operate and transact. While both technologies offer meaningful efficiency gains and new business models, they also introduce complexity across legal, regulatory, and operational domains.

Energy companies that take a measured, strategic approach, focusing on governance, targeted implementation, and risk management, are best positioned to unlock value while avoiding costly missteps.

This series covers topics featured during GableGotwals’ Annual Energy Market Drivers and Current Legal Issues Seminar. To receive Alerts and information on future Firm events, subscribe to our mailing list.

Jason T. Seay, AIGP, CIPP-US
918-595-4832
jseay@gablelaw.com

Francesca A. Walentynowicz
918-595-4889
fwalentynowicz@gablelaw.com

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

April 14, 2026 | By: Jason T. Seay, AIGP, CIPP-US

Professional associations typically function as member-focused organizations responsible for advocacy, education, professional standards, and engagement. Many professional associations, such as those for real estate professionals, have affiliated entities that are often structured as separate corporate organizations charged with operating and maintaining technology platforms used by the professional association members.

Although such affiliated entities exist to serve the broader membership, operational separation is intentional. Independent governance helps address legal, contractual, antitrust, and data-security requirements while allowing the organization to remain responsive to innovation and industry change. Strategic alignment between entities is maintained through governance practices rather than day-to-day management overlap.

Board Governance and Fiduciary Duties

Board members across associations and affiliated organizations share fundamental fiduciary obligations, including the duty of care, the duty of loyalty, and the duty of obedience. These duties require directors to act in the best interests of the organization, make informed and prudent decisions, avoid conflicts of interest, and ensure compliance with governing documents and applicable laws. Boards are responsible for governance, not management. Their role centers on strategic direction, policy oversight, financial stewardship, and executive leadership support and evaluation. Operational execution is delegated to professional staff. Preserving this distinction is critical to accountability and effective leadership.

Strategic Oversight and Financial Stewardship

A core responsibility of any board is long-term strategic planning. This includes establishing priorities, approving budgets, monitoring financial performance, and ensuring adequate reserves to support future operations. For technology-focused entities, this oversight often extends to major system investments, vendor relationships, and infrastructure decisions that affect a wide range of users. Board members are expected to understand the organization’s financial model, including revenue sources, expense drivers, and internal controls, so they can ask informed questions and exercise sound judgment. Transparency, risk management, and fiscal responsibility are central to this role.

Data Governance, Compliance, and Risk Management

Organizations that manage large volumes of member or consumer data face heightened compliance and risk considerations. Board oversight typically includes ensuring adherence to applicable policies, licensing agreements, privacy standards, and security protocols. Decisions involving data access, system rules, and technology enhancements must balance innovation with fairness, consistency, and legal compliance. As data systems increasingly integrate with third-party platforms and expand into new use cases, governance challenges continue to evolve. Boards play a critical role in safeguarding data integrity, organizational credibility, and public trust.

Collaboration and Aligned Leadership

When associations and affiliated organizations operate within a shared ecosystem, collaboration among boards and leadership teams is essential. Clear communication, aligned strategic goals, and coordinated decision-making help ensure that actions taken by one entity support the broader mission and membership. This unified approach reduces duplication of effort, strengthens organizational resilience, and positions all entities to adapt effectively to regulatory, technological, and market changes.

Conclusion

Effective governance depends on informed and engaged board members who understand both their fiduciary responsibilities and the broader organizational ecosystem in which they operate. By focusing on strategic leadership, financial stewardship, compliance oversight, and collaborative governance, boards help ensure their organizations remain stable, compliant, and well-positioned to serve their members now and in the future.

This Alert was prepared by Jason Seay. The Corporate Compliance and Risk Management team at GableGotwals regularly advises clients on governance, fiduciary responsibilities, compliance frameworks, and risk management. For assistance, please contact the author or visit our Corporate Compliance and Risk Management Practice page.

Jason T. Seay, AIGP, CIPP-US

918-595-4832

jseay@gablelaw.com

This article is provided for educational and informational purposes only and does not contain legal advice or create an attorney-client relationship. The information provided should not be taken as an indication of future legal results; any information provided should not be acted upon without consulting legal counsel.

June 18, 2025 | By:  Jason T. Seay

As artificial intelligence transforms industries, the legal field faces both unprecedented challenges and opportunities. As discussed in a recent webinar hosted by ACC Houston, experts from legal, corporate, and AI governance spheres explored how legal professionals can adapt to and lead in this evolving landscape. Here are the key takeaways:

1. Essential AI Terms for Legal Professional
   
   Understanding core terminology, including machine learning, generative AI, natural language processing (NLP), and large language models, is foundational for ethical and informed AI adoption in legal work.

2. AI’s Current Legal Impact

• • AI tools are already being used for contract review, legal research, and compliance analysis.
  • Legal professionals must learn not only to use AI but to question and validate its outputs.
  • “Trust but verify” becomes essential when dealing with automated legal content.

3. Future Opportunities for Lawyers

• • AI will not replace lawyers, but lawyers who leverage AI will replace those who don’t.
  • Attorneys will increasingly serve as “AI supervisors” – ensuring accountability, ethical use, and legal soundness of AI-driven processes.
  • Specialized roles will emerge in AI governance, algorithmic auditing, and regulatory compliance.

4. Ethical and Regulatory Considerations

• • Bias in AI outputs, data privacy, and explainability are critical issues.
  • Legal professionals must stay current with evolving regulations (e.g., EU AI Act, U.S. AI policy efforts).
  • Corporate legal departments must take a leadership role in setting responsible AI policies.

Conclusion

The integration of AI in law is inevitable. Those who proactively educate themselves and embrace change will not only future-proof their careers but help shape a more just, efficient, and ethical legal system.

GableGotwals’ Technology and Cybersecurity and Data Privacy teams will continue to monitor developments and keep our clients informed.

Jason T. Seay

918-595-4832

jseay@gablelaw.com

This alert is provided as a summary for information purposes. It does not contain legal advice or create an attorney-client relationship. It is not intended or written to be used and may not be used by any person to avoid penalties imposed under Oklahoma laws. The information provided should not be taken as an indication of future legal results; any stated information should not be acted upon without consulting legal counsel.

June 2, 2025 | GableGotwals is pleased to announce that Jason Seay has joined the Tulsa office as Of Counsel. He has extensive experience advising clients on healthcare regulatory compliance, data privacy and security, artificial intelligence governance, and broader regulatory matters.

Prior to joining the Firm, Jason held in-house legal and compliance leadership roles at companies including GeneDx, a global genetics and diagnostics company, and DaVita, a leading healthcare provider. He also served as Associate General Counsel for a regional health system in Alaska and represented state agencies as an Assistant Attorney General for the State of Oklahoma. He has additional private practice experience in healthcare law, civil litigation, and administrative law.

“Jason brings valuable experience in HIPAA compliance, breach response, data governance, and AI implementation, which will be a great addition to our Healthcare and Cybersecurity and Data Privacy teams,” said Trent Shores, Managing Shareholder of GableGotwals’ Tulsa office. “His background in both the public and private sectors strengthens our ability to support our clients across a range of industries.”

Jason earned his J.D. from the University of Tulsa College of Law, where he completed the Health Law Certificate, received a CALI Award in Philosophy of Law, and was a member of the Board of Advocates. He received his B.A. in Philosophy from the University of Oklahoma.

He is a Certified Information Privacy Professional (CIPP/US) and is licensed to practice in Oklahoma and Alaska.

About GableGotwals

GableGotwals® is a full-service law firm with nearly 100 attorneys and more than 70 other business professionals in Oklahoma and Texas. We represent a diversified client base across the nation, and our connections and reach are global. Fortune 500 corporations, privately owned companies, entrepreneurs, foundations, and individuals entrust us every day with the stewardship and strategic management of their legal challenges.