.png){kind=logo}
.png?width=50&height=50&name=Untitled%20design%20(6).png)
October is Cybersecurity Awareness Month, and for attorneys, the timing is a useful reminder of how far data security has moved from the IT department into the center of legal practice. Client data sits in cloud platforms, vendor systems, and increasingly in AI tools. Federal rules now restrict how certain categories of sensitive data can cross borders. A single security failure at a service provider can shut down a client's business overnight. And the questions attorneys face about liability, compliance, contracts, privilege, and disclosure are arriving faster than most practitioners have had time to prepare for.
The five courses below cover that ground from different angles, from litigating a vendor breach to drafting a privacy policy that actually matches what a company does with its data. Each one is practical, current, and built for attorneys who need to advise on these issues now.
Litigating Technology Disputes
When a managed service provider suffers a security failure, the fallout for its clients can include days of downtime, stolen data, and ransom demands. Recovering those losses is harder than it should be, because MSP contracts tend to be written heavily in the vendor's favor, with liability caps, disclaimers, and terms buried in website fine print.
In this two-hour program, cyber litigation attorney Sarah W. Anderson of Cybersecurity Law and Policy walks through the full lifecycle of a technology vendor dispute using a realistic scenario: a compromised remote access tool, an encrypted client network, and a $500,000 ransom demand. Attorneys will learn how to handle pre-suit steps like litigation holds, insurer subrogation, and information sharing with federal law enforcement under the Cybersecurity Information Sharing Act. Anderson then covers pleading strategies for getting past limitation-of-liability clauses, including claims for gross negligence and bad faith breach of contract, how to use NIST frameworks, FTC guidance, and SOC 2 standards to establish the standard of care, and how to draft targeted discovery aimed at audit logs, firewall telemetry, and internal vendor security policies. For plaintiffs' counsel handling these cases, it is a detailed and highly usable playbook.
How to Comply with the Bulk Data Rule for Restricted Transactions
Under Executive Order 14117 and the DOJ's Data Security Program (28 C.F.R. Part 202), some transfers of Americans' sensitive data to countries of concern are prohibited outright. Many others, including routine vendor arrangements, employment relationships, cloud services, and internal data access, fall into a middle category: restricted transactions, which are permitted only if specific security safeguards are in place. With DOJ enforcement now fully active and grace periods expired, knowing the difference is no longer optional.
In this follow-on program, Charles R. Macedo and Lewis Derenzis III of Amster, Rothstein & Ebenstein LLP focus on the most practical question attorneys face under the rule: how organizations can lawfully engage in restricted transactions. They cover sensitive data categories and bulk thresholds, how to distinguish prohibited from restricted transactions, the security controls the Data Security Program requires, and the role of CISA standards and guidance. Attorneys will come away able to evaluate common business arrangements for compliance risk and advise clients on how to document and defend their compliance in an active enforcement environment. It is especially relevant for attorneys in privacy, national security, corporate, employment, and regulatory practice, as well as in-house counsel responsible for data governance.
Contracting in the Age of AI and Emerging Technologies: Legal Frameworks, Risk Allocation, and Practical Drafting Strategies
AI is now embedded in enterprise software, vendor relationships, and client deliverables, but most commercial contracts were written for a world without it. Standard provisions were never designed to handle opaque decision-making, hallucinated outputs, models whose behavior shifts over time, or open questions about who owns what an AI system produces.
Jordan L. Fischer of Fischer Law, LLC gives attorneys a concrete framework for spotting AI-related risk in commercial agreements and drafting language that actually addresses it. Attorneys will learn why boilerplate representations, warranties, and limitation-of-liability clauses often fall short when applied to AI systems, how to negotiate AI-specific terms covering output accuracy, training data provenance, and performance benchmarks, and how to allocate liability between vendor and customer, including when indemnification carve-outs for AI outputs are likely to hold up. Fischer also covers how to translate data privacy and security obligations under GDPR, CCPA, and emerging state AI laws into enforceable contract terms. Whether you are reviewing a SaaS agreement with embedded AI features or negotiating an AI licensing deal, this is a practical, drafting-focused session.
Think Before You Prompt: AI, Privilege, and the Perils of Disclosure
Most attorneys who use generative AI have had the thought at least once: after asking a tool to tighten an argument section or summarize a deposition, are those prompts and outputs now discoverable? And what about AI material generated by a client or an expert? Privilege and work product protections do not disappear because AI was involved, but two recent court decisions show that the way traditional disclosure standards apply to these tools is far from settled.
Jin Yoshikawa of Butler Snow and Margaret Smith examine when AI-generated communications and outputs are likely to be protected and when those protections are at risk. They cover the important distinction between consumer and enterprise AI tools for confidentiality purposes, how to counsel clients on the disclosure risks of public AI platforms, how protective orders and discovery rules apply to AI-generated materials, including those shared with experts, and the practical safeguards and workflows that make AI use defensible. For litigators and any attorney using AI on client matters, the course addresses a risk that is easy to overlook until it shows up in a discovery dispute.
Five Steps to Building a Privacy Policy
A privacy policy is often treated as a formality: something copied from a template, posted to a website, and forgotten. That approach creates real exposure, especially when what the policy says no longer matches what the organization actually does with personal data.
Clara Duffield of Croke Fairchild Duarte & Beres walks attorneys through a clear, five-step process for drafting, updating, and evaluating privacy policies that hold up. Attorneys will learn how to identify the legal and regulatory obligations that apply, including key requirements of major U.S. and international privacy laws, how to assess an organization's internal data-handling practices and check them against its external statements, and how to tailor policies to changing business models and jurisdictional requirements. By the end, attorneys will be equipped to guide clients or internal stakeholders through building a policy that is accurate, compliant, accessible, and adaptable as the privacy landscape keeps shifting.
Keep Learning This Cybersecurity Awareness Month
Data security and privacy now touch nearly every practice area, and the rules governing them are changing quickly. Lawline's Privacy and Cybersecurity CLE catalog brings together courses on data protection, breach response, AI risk, regulatory compliance, and more. Browse the full collection and find your next course today.
Watch Any Course for Free
Start a no-risk free trial today to watch any Lawline On Demand course for free. Choose from over 2,000 courses, including privacy and cybersecurity, technology law, ethics, and 40+ practice areas.
Stay up to date! Receive updates on new content, promotions, and more: