What’s New

European Parliament votes to delay EU AI Act implementation (CIO)

The European Parliament voted to delay application of the EU AI Act's rules on high-risk AI systems, pushing key deadlines to as late as 2027 and 2028, though the delay still requires approval from the Council of the European Union. Analysts broadly cautioned CIOs against treating the delay as a reprieve, warning that the operational, legal, and reputational risks of poorly governed AI are already present and that organizations should use the extra time to strengthen compliance and governance frameworks rather than wait for final regulatory clarity.

Deep Dive

Last edition of the newsletter referenced two different visions of what federal law in the U.S. should look like: the Trump Administration’s White House National Policy Framework for Artificial Intelligence Legislative Recommendations (March 2026) and the Artificial Intelligence Regulation and Safeguards Act, introduced by Sen. Blackburn (the “Act”). As each would have different impacts on the geospatial sector, I have prepared a comparison of the key points:

Comparison Chart

(Generated by Harvey AI)

Key Considerations for Geospatial Professionals

Key considerations for geospatial professionals include the following:

• The Act, draws a statutory distinction between “precise geolocation information” (location within 5 miles or less) and “approximate geolocation information” (greater than 5 miles precision) in the context of algorithmic ranking and content personalization systems. While these definitions are scoped to consumer-facing online platforms and the Filter Bubble Transparency subtitle, they signal a Congressional willingness to regulate the use of location data in AI systems broadly, which could foreshadow future restrictions on how geospatial AI models ingest, process, and act upon precise location data derived from connected devices. Geospatial practitioners should monitor whether these definitional frameworks migrate into future AI or privacy legislation with broader sectoral application.

• The duty of care and product liability provisions in of the Act carry significant operational implications for geospatial professionals who develop or deploy AI systems used in high-stakes decision-making environments. The Act imposes negligence-based liability, encompassing design defects, failure to warn, and breach of express warranty, as well as strict liability for unreasonably dangerous AI products. AI-driven spatial analysis tools used in “high-risk” sectors, such as critical infrastructure assessment, land use planning supporting law enforcement decisions, or emergency management, could expose their developers to liability under these provisions. This is in contrast to the White House Framework’s caution against open-ended liability that could stifle innovation.

• The Act directs the Office of Science, Technology and Policy to prioritize Federal investment in curated, publicly available datasets for AI training, explicitly listing agriculture, transportation, weather services, and other sectors where geospatial data plays a foundational role. The White House Framework similarly calls for making federal datasets accessible in AI-ready formats for industry and academia. For geospatial professionals, these provisions could unlock expanded access to satellite imagery, environmental monitoring data, census geographic files, and infrastructure datasets maintained by agencies such as USGS, NOAA, and the Census Bureau thereby accelerating the development of geospatially-trained AI models for environmental monitoring, urban planning, disaster response, and national security applications.

• The intellectual property and content provenance provisions of the Act have direct implications for geospatial professionals who create, license, or rely on AI-generated spatial content. The Act’s exclusion of AI training from fair use means that organizations using commercially licensed satellite imagery, proprietary map datasets, or curated geographic databases to train geospatial AI models could face copyright infringement claims if they have not secured explicit authorization from data rights holders. The proposed subpoena mechanism further empowers data owners to discover exactly what training datasets AI developers used, making due diligence in data licensing a critical compliance priority for geospatial AI developers.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• Why the “Trump AI Act’s” expanded geolocation definition could reshape how geospatial companies collect and use location data.

• How the White House’s push for a unified federal AI standard could upend the state-level regulatory landscape for geospatial companies.

• Why the GSA’s proposed AI contract clause could be the most consequential shift in federal procurement for geospatial vendors in years.

What’s New

Artificial Intelligence Regulation and Safeguards Act (Senate.gov)

The Artificial Intelligence Regulation and Safeguards Act (commonly referenced as the “Trump AI Act”) is a sweeping, omnibus legislative framework that seeks to regulate artificial intelligence across numerous domains, including minimum safety standards for AI developers, liability standards for AI systems, copyright and training data transparency, and content provenance requirements for synthetic media.

Analysis:

Of particular note to geospatial professionals, the Act includes a definition of “precise geolocation information” (information identifying an individual’s location to within a range of 5 miles or less) than in existing privacy regimes (generally between 1,750-1,850 feet). It also includes provisions related to “approximate geolocation information”, defined as information that identifies an individual’s location with a precision of less than 5 miles. Moreover, the Act permits treatment of a user’s current precise geolocation but puts restrictions on the use of previous geographical locations.

National Policy Framework for Artificial Intelligence (Whitehouse.gov)

The White House’s National Policy Framework for Artificial Intelligence: Legislative Recommendations, published this week, outlines the Trump Administration’s priorities for Congressional action on AI across seven thematic areas. The framework broadly seeks to protect children, safeguard communities, respect intellectual property, defend free speech, drive American AI dominance, develop an AI-ready workforce, and establish a unified federal AI regulatory standard that preempts a fragmented patchwork of state AI laws.

Analysis:

The framework’s emphasis on making federal datasets accessible in AI-ready formats for industry and academia, combined with its push to streamline AI infrastructure development, could benefit geospatial professionals by broadening access to government-held geospatial data for use in AI training and applications.

Deep Dive

GSA’s Proposed AI Contract Clause: What Geospatial Companies Need to Know

The U.S. General Services Administration (GSA) has released a draft contract clause , designated 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems, that, if finalized, will be inserted into every GSA solicitation and contract for AI capabilities. For geospatial companies selling AI-powered products and services to the federal government, this proposed clause represents a consequential shift in the procurement landscape. From strict data ownership rules to an outright prohibition on foreign AI components, the clause touches many aspects of geospatial AI vendors’ products and pipelines. Companies that move early to understand and adapt to these requirements will be better positioned to take advantage of the huge market opportunity the U.S. government provides.

One important consideration is that the proposed terms would vest the U.S. Government with full ownership of all “Government Data”, defined broadly to include not only data submitted to the AI system (such as satellite imagery, sensor feeds, or mission-specific queries) but also all outputs generated by the system, including analyses, derivative data, metadata, and logs. “Custom Development”, meaning any modification, fine-tuning, configuration, or enhancement to an AI system made specifically for a government client, also belongs to the Government, with contractors retaining only ownership of their underlying base models. For geospatial companies whose competitive edge lies in proprietary models trained or refined on rich geospatial datasets, this distinction is commercially vital. Any customization performed under contract becomes a government asset, and contractors are expressly prohibited from using that customized work or the government’s data to improve their commercial products, train other models, or inform their broader business strategy. Consequently, the common commercial practice of using client interactions to iteratively improve an AI platform will be a prohibited use under federal contracts.

The clause’s operational and security requirements will also demand significant investment from geospatial vendors. Contractors and their service providers must i restrict human review of government data, maintain logical segregation of government data from all other customer data, comply with strict data localization requirements, and securely delete all government data upon contract expiration. Compounding this, the clause mandates that AI systems using agentic or reasoning processes provide a full, summarized audit trail of intermediate processing steps, model routing decisions, and data retrieval methods, complete with source attribution and direct links to materials used in generating outputs. For geospatial AI tools that synthesize data from multiple sensor streams or perform complex spatial analyses, building that level of explainability and traceability into the system architecture will be a non-trivial engineering challenge.

Two other important provisions include careful consideration. First, the clause requires that contractors use only “American AI Systems”, defined as AI systems developed and produced in the United States per OMB Memorandum M-25-22, and expressly prohibits the use of any foreign AI components or systems controlled by non-U.S. entities. Geospatial companies that rely on foreign-sourced AI components, whether for image processing, object detection, or natural language interfaces, will need to audit and potentially overhaul their supply chains to remain eligible for federal work. Second, the clause imposes “Unbiased AI Principles” requiring that AI systems be truthful, neutral, and nonpartisan. Combined with the government’s reserved right to conduct automated benchmark assessments of deployed AI systems at any time, without any obligation to disclose its methodologies, this creates a regime of ongoing performance accountability that geospatial vendors selling AI to the federal government must be prepared to sustain for the full duration of any contract.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

Part 539 - Acquisition of Information and Communication Technology 539.71 Clauses (GSA Federal Acquisition Service)

The GSA's proposed AI FAR clause for federal AI system acquisitions would introduce significant compliance obligations around matters such as data localization, human oversight and traceability for agentic workflows, mandatory use of American AI systems, and adherence to "unbiased AI" performance standards. For geospatial firms pursuing federal contracts, the clause would require careful review of existing GeoAI architectures and vendor agreements.

NIST Trustworthy and Responsible AI: Challenges to the Monitoring of Deployed AI Systems (National Institute of Standards and Technology)

NIST's new AI 800-4 report documents significant gaps in validated methodologies, information sharing, and incident monitoring practices across the AI ecosystem. For GeoAI developers and deployers, these gaps are particularly acute given that spatial AI systems operating across dynamic real-world environments are especially susceptible to several identified risks, such as “unforeseen outputs” that occur due to, “dynamic input conditions”. Organizations developing or procuring GeoAI systems should treat this report as both a compliance signal and a design checklist, particularly as federal customers increasingly expect post-deployment monitoring practices consistent with the NIST AI Risk Management.

Deep Dive

EU AI Act Compliance for High-Risk Geospatial AI Systems: What You Need to Know Before August 2026

With the EU AI Act’s (the AI Act) August 2026 compliance deadline now just five months away, geospatial AI providers face a narrowing window to address the regulation’s most demanding obligations. This isn’t simply a matter of updating privacy policies. The Act’s “replayability” requirement for high-risk AI creates technical and legal challenges. Replayability mandates that providers maintain the ability to reconstruct and audit AI decision-making processes after the fact, requiring comprehensive logging of input data, model states, and outputs. For geospatial systems processing continuous streams of satellite imagery, sensor data, or location information, this could translate into significant infrastructure investments and careful architectural planning that cannot be implemented overnight.

High-risk AI systems are those the EU has determined could significantly impact citizens’ health, safety, or fundamental rights. Despite the potential risk they are allowing them to be deployed because their benefits (such as improved disaster response or infrastructure planning) outweigh the risks. But such high-risk AI systems are subject to substantial compliance requirements. The EU categorizes AI as high-risk based upon both the product’s safety implications and its application domain. Annexes I and III of the AI Act provide specific examples. Many of these directly affect GeoAI-including systems used for critical infrastructure management, environmental monitoring that informs emergency decisions, or location-based identification technologies. Providers should begin conducting a thorough classification analysis, recognizing that the boundary between “limited risk” transparency obligations and “high-risk” conformity requirements can turn simply upon intended use and deployment context.

For systems classified as high-risk, conformity assessment is the central compliance hurdle. For many high-risk AI systems, self-assessment of compliance is sufficient. But others will require assessment by independent third-party organizations (known as notified bodies). Geospatial companies should be tracking guidance published by notified bodies on documentation requirements, technical standards, and audit methodologies specific to AI systems. Geospatial providers subject to third party assessment can anticipate rigorous examination of data governance practices, particularly around training data provenance, geographic representativeness, and bias testing across different regions and populations.

Finally, geospatial professionals should be aware of an emerging compliance gap that has received attention from policy analysts: the divergence between military and civilian AI governance frameworks. Many advanced GeoAI capabilities originated in defense contexts where different rules apply. As these technologies migrate to civilian applications, providers face the challenge of retrofitting compliance measures onto systems not originally designed with the EU AI Act’s transparency and accountability requirements in mind. Organizations with dual-use geospatial AI portfolios should prioritize a clear-eyed assessment of which systems require civilian compliance measures and develop transition roadmaps that account for both technical modifications and documentation gaps inherited from their military-origin architectures.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Subscribe now

I recently reviewed the Artificial Intelligence Governance Professional (AIGP) Body of Knowledge and Exam Blueprint, published by the International Association of Privacy Professionals, in anticipation of becoming AIGP certified. The AIGP covers technical, legal, operational, policy, and ethical issues, highlighting that effective AI governance requires cross-disciplinary coordination and professionals willing to venture outside their comfort zones.

Given the uniqueness of geospatial data as compared to other types of data used to train models (its power, versatility, numerous types), the wide range of applications that use geospatial information, the increased focus on world models, and the complexity of the legal and governance issues, I decided to begin creating an ancillary Body of Knowledge for Geospatial AI Governance to be used in conjunction with the AIGP Body of Knowledge. Geospatial organizations occupy complex roles in the AI value chain, often simultaneously acting as developers, deployers, and users of AI-enabled services. This demands governance across the entire lifecycle: from use-case definition and data sourcing through training, testing, deployment, monitoring, and system retirement. In the domain, where models must continuously evolve to address new geospatial information sources and types, update map features, and novel applications using geospatial information, these governance obligations require sustained attention.

With global standards and AI-specific regulations now classifying risk levels and imposing escalating compliance obligations, geospatial professionals must apply risk-based governance approaches that remain jurisdiction-aware and technology-agnostic. By adapting established AI governance domains to the specific context of spatial data and analytics, this body of knowledge can help provide accountability obligations as regulatory landscapes continue to evolve.

This is very much a work in progress. So, I welcome your comments and plan to update it periodically as technology, applications, and the law continue to develop.

Geospatial AI Governance Body of Knowledge

Domain I — Foundations of Geospatial AI Governance

Domain II — AI Laws, Standards, and Frameworks for Geospatial Use Cases

Domain III — Governing the Development of Geospatial AI Systems

Domain IV — Governing the Deployment and Use of Geospatial AI

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• Why AI-generated geospatial analyses and reports may not be protected by attorney-client privilege.

• How the FTC’s crackdown on exaggerated AI marketing claims raises legal risk for geospatial companies promoting “AI-powered” analytics.

• How emerging federal AI literacy standards are likely to shape training expectations for geospatial professionals using GeoAI systems

• How GeoAI “world models” will expand cybersecurity, data governance, and liability risks.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

AI-generated Docs Aren't Covered by Attorney-Client Privilege, Judge Says (Mashable)

A federal judge ruled that documents created by AI tools and shared with attorneys are admissible in court and not protected by attorney-client privilege, establishing that geospatial firms using AI to analyze satellite imagery, generate location intelligence reports, or create spatial risk assessments for litigation cannot assume those AI-generated materials will remain confidential even when shared with counsel.

Analysis:

This ruling raises some complex legal issues. But for geospatial professionals it could increase documentation risk for GeoAI organizations that rely on AI tools to prepare defensible analyses of spatial data for regulatory compliance, land-use disputes, or environmental litigation, making it critical to segregate privileged legal strategy from AI-assisted technical work products.

FTC Resolves Another Case Involving “AI-Washing” (The AI Counsel)

The FTC's settlement with Growth Cave prohibits misrepresenting that products use AI or that AI will enhance profitability and efficiency, signaling that geospatial firms marketing "AI-powered" location analytics, automated spatial analysis, or intelligent mapping tools must substantiate claims about the degree of automation, the role of AI in processing spatial data, and the performance improvements AI actually delivers.

Analysis:

For GeoAI developers, this enforcement pattern makes exaggerated claims about autonomous feature extraction, predictive spatial modeling, or AI-driven decision-making legally risky, particularly where manual processes, rule-based systems, or limited machine learning actually underpin the geospatial workflow.

US Department of Labor Releases AI Literacy Framework Providing Foundational Content Areas, Delivery Principles to Guide Nationwide Efforts (U.S. Department of Labor)

The Department of Labor's new AI Literacy Framework establishes five content areas and seven delivery principles to guide workforce development in AI skills, signaling that geospatial professionals will need structured training pathways to understand how AI systems process spatial data, interpret location-based patterns, and generate automated geospatial decisions.

Analysis:

For GeoAI organizations, this creates an opportunity to shape sector-specific literacy standards around spatial AI capabilities. But it also raises a potential compliance expectation that workers handling geospatial AI systems demonstrate foundational understanding of model behavior, data provenance, and algorithmic limitations.

Deep Dive

Security (and Legal Considerations) for World Models

I have following “world models” with increasing interest both because of the geospatial context as well as the legal implications. While GeoAI applications built on “world models” that reason over the physical environment are still emerging, their direction is becoming clearer. As geospatial computer vision, foundation models, and agentic AI systems converge, future GeoAI platforms will increasingly integrate satellite imagery, maps, sensor feeds, and enterprise geospatial data into unified systems capable of supporting operational decision-making and, in some cases, initiating actions.

My sense is that as these systems move from pilots into enterprise and government deployments, security, privacy, and export control obligations will shape core design choices around system architecture, data pipelines, access control, hosting environments, and product scope. U.S. government cybersecurity frameworks (e.g., the NIST Cybersecurity Framework (CSF), NIST SP 800-53 security controls, and emerging NIST AI Risk Management Framework (AI RMF) guidance) already provide a baseline for how GeoAI systems will be expected to manage risk. At the same time, commercial contracts will increasingly allocate responsibility for data security, model behavior, and regulatory compliance through representations and warranties, liability caps, indemnities, audit rights, and service-level commitments. The design opportunity today is to anticipate these technical and legal constraints early, so that compliance, resilience, and safety are engineered into GeoAI platforms rather than bolted on after broad operational deployment.

Looking ahead, GeoAI world models will combine multiple technical layers: computer vision models that extract features from imagery and point clouds; foundation or multimodal models that reason across geospatial and non-geospatial context; and agentic components that orchestrate tools across mapping platforms, tasking systems, and analytic services. This convergence materially expands the attack surface. Training pipelines will become more exposed to data poisoning, tainted third-party geospatial datasets, and license or provenance conflicts. Inference-time workflows will increasingly involve tool use, retrieval from large geospatial knowledge bases, and automated reporting, creating new vectors for indirect prompt injection, unauthorized data access, and goal hijacking. As GeoAI systems are integrated into enterprises, these risks will intersect directly with contractual obligations. For example, large enterprise customers will expect vendors to warrant that systems are developed and operated in accordance with recognized security standards, that access controls prevent cross-tenant data leakage, and that model outputs do not expose restricted or export-controlled content. This suggests that GeoAI platforms should treat external data sources and user inputs as untrusted by default and enforce least-privilege access at the API and tool layer and implement testing, red-teaming, and assurance practices consistent with NIST-aligned secure development lifecycle expectations.

Future GeoAI systems will also operate in a physical sensing environment that is already contested. GNSS jamming and spoofing, now well documented in conflict zones and increasingly observed in civilian aviation and maritime operations, illustrate the conditions under which some GeoAI world models may function. As GeoAI platforms fuse positioning, timing, imagery, and sensor metadata into higher-level situational awareness, silent reliance on single-source GNSS could become an architectural liability. Consequently. forward-looking GeoAI designs will assume that PNT inputs may become degraded, manipulated, or unavailable and will incorporate uncertainty modeling, anomaly detection, and multi-source sensor fusion from the outset. These design choices are not only good engineering practice; they also matter for liability and risk allocation. As GeoAI outputs inform safety, compliance, or operational decisions, vendors may be asked to represent in their contracts that systems are securely designed and/or disclose known limitations and failure modes.

The forward-looking design challenge, therefore, is to align emerging GeoAI architectures with the regulatory, cybersecurity, and contractual environment they will soon inhabit. Teams developing early world-model should adopt provenance-rich training sources; modularize pipelines so export-controlled or sensitive components can be isolated; and integrate practices such as uncertainty representation and human validation for high-impact outputs. In parallel, legal and compliance teams should map these technical controls to contractual commitments around security controls, auditability, incident response, and allocation of liability. Organizations that internalize these constraints early will be better positioned to market their GeoAI systems to large enterprises that are by their nature are risk adverse and security conscious.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

In this issue, you will navigate the escalating legal complexities of Agentic AI, starting with an analysis of how Amazon v. Perplexity could define the boundaries of authorization, transparency, and access for autonomous geospatial systems. You will also explore the European Parliament’s pivotal move to link data governance directly to copyright compliance, alongside insights from the 2025 Federal Agency AI Use Case Inventory that reveal how the US government categorizes high-impact AI risks. Finally, our Deep Dive equips you with a framework for managing liability in autonomous geospatial workflows, detailing the critical governance, contracting, and technical safeguards needed as AI shifts from passive tool to active agent.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Perplexity v. Amazon (Court Listener)

Amazon has brought a lawsuit against Perplexity framing agentic AI not as a novel interface issue, but as a question of authorization, transparency, and computer access under existing federal and state law, particularly the Computer Fraud and Abuse Act and California’s computer access statutes. The lawsuit emphasizes Perplexity’s alleged concealment of automated activity, evasion of technical controls, and continued access after explicit notice.

Analysis:

For GeoAI developers, the case has implications well beyond e-commerce. Spatial AI systems that rely on autonomous agents to interact with third-party platforms, APIs, or protected datasets, often at scale and across jurisdictions, increases legal risk as agentic GeoAI tools blur the line between user-authorized access and independent system action. This makes clear disclosure, platform consent, and technical traceability increasingly critical to avoiding liability as autonomous geospatial systems become more capable and widespread.

Protect Copyrighted Work Used by Generative AI, Say Legal Affairs MEPs (European Parliament)

The Legal Affairs Committee of the European Parliament has proposed a decisive shift toward treating training data governance as a core copyright compliance obligation for generative AI systems placed on the EU market, regardless of where training occurs. The report will be put to a Parliament vote in plenary in March. By linking transparency failures directly to potential copyright infringement, the report reframes disclosure of training sources, crawling records, and opt-out mechanisms from soft governance measures into enforceable legal duties.

Analysis:

For GeoAI developers, the implications are particularly acute given the reliance on maps, imagery, and other spatial datasets that are frequently protected by copyright and distributed across public and private sources. The proposals point toward rising compliance risk where training data provenance is unclear, opt-out signals are ignored, or licensing terms are insufficiently granular. This makes dataset inventories, provenance tracking, and licensing documentation central to lawful GeoAI development in the EU. As these expectations harden, geospatial firms may need to reassess data sourcing strategies, training pipelines, and cross-border model deployment to ensure that spatial content used in AI systems is both transparent and properly authorized.

2025 Federal Agency AI Use Case Inventory (Office of the Federal Chief Information Officer — GitHub)

The 2025 Federal Agency AI Use Case inventory operationalizes recent statutory and executive AI mandates that requires federal agencies to maintain detailed, public-facing inventories of AI use cases, with heightened disclosure and risk-management obligations for systems deemed “high-impact.” This results in standardized reporting fields across the AI lifecycle, including training data descriptions, outputs, testing, impact assessments, and ongoing monitoring.

Analysis:

The Use Case tool not only provides GeoAI vendors and partners with valuable business insight into how the federal government is using AI products and services. It is also can be used to help identify uses of AI that are high risk (and subsequently might require additional technical safeguards) or that involve data that might not be suitable for that use.

Deep Dive

Agentic AI in Geospatial Applications

Autonomous software that initiates actions, sequences workflows, and interacts with external systems with minimal human oversight (Agentic AI) will transform geospatial operations. Unlike traditional AI tools that wait for user commands, agentic systems autonomously decide when to act, chain multiple operations together, and integrate directly with databases and APIs. For GIS professionals, this means systems that might automatically update property boundaries from new imagery, trigger evacuation alerts from flood models, or modify zoning recommendations without per-decision human review.

The use of AI agents in the geospatial sector will result in heightened risk exposure in several domains: property and land records (where automated cadastral updates could disrupt transactions or create title issues), emergency management (where false positives waste resources and false negatives cost lives), environmental compliance (where autonomous reporting could penalize innocent parties or miss violations), autonomous navigation (where misclassified road conditions create safety hazards), and urban planning (where encoded biases could perpetuate historical discrimination patterns like redlining).

When agentic AI causes harm, the question arises as to liability. Should it attach to the deploying organization under agency principles? To answer this questions, courts will examine whether a company delegated authority, could have controlled the system, and whether affected parties reasonably believed the AI acted on the company’s behalf. The multi-party nature of these deployments (foundation model providers, system developers, enterprise deployers, and data providers) complicates but does not eliminate this exposure. Additionally, statutory risks span anti-discrimination laws, environmental regulations, consumer protection, and privacy statutes, and these will likely apply based on outcomes, not intent.

Organizations should implement concrete safeguards: define precise boundaries for autonomous versus human-approved decisions, build genuine (not rubber-stamp) review checkpoints for high-stakes outputs, maintain comprehensive audit trails of all inputs and decisions, and establish incident response protocols. Contractually, companies that build or deploy AI agents should negotiate audit and logging rights, model update approval requirements, clear indemnification terms, and guaranteed human override capabilities.

The core message for geospatial professionals is that agentic AI doesn’t change longstanding concerns about data accuracy and professional responsibility. Rather it accelerates how fast errors propagate and expands the scale of potential harm. Liability follows delegation and control: the more autonomous the system, the more critical the need for governance.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• How AI liability is beginning to reshape insurance underwriting and what that means for insurability of GeoAI systems.

• Why the federal–state conflict over AI regulation is likely to create layered compliance uncertainty for nationwide geospatial operations.

• How the Department of War’s “AI-first” strategy is driving new expectations for interoperable geospatial data pipelines and modular architectures.

• Why documented governance, provenance, and technical controls are becoming critical to both legal compliance and risk management in GeoAI.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

How AI Liability Risks are Challenging the Insurance Landscape (IAPP)

The IAPP article describes how emerging AI liability risks are reshaping the insurance market, with insurers beginning to scrutinize AI governance practices, data controls, and human-in-the-loop safeguards before underwriting coverage, while also experimenting with new endorsements for deepfakes and chatbot-related harms.

Analysis:

The article shows that AI liability is beginning to reshape underwriting practices even before clear legal rules exist, with insurers informally probing governance, data controls, and human-in-the-loop safeguards as proxies for risk. This blurs the line between legal compliance and insurability: firms that cannot demonstrate disciplined AI practices may find coverage narrower, more expensive, or unavailable, effectively making insurance markets a parallel form of private regulation.

For GeoAI organizations, this dynamic is particularly salient because spatial systems often combine sensitive data, cloud infrastructure, and automated decision tools. Insurers are likely to focus on documentation, access controls, incident logging, and safeguards against deepfakes or misuse of imagery, meaning that governance artifacts are becoming not only compliance tools but also prerequisites for maintaining cyber, E&O, and professional liability coverage.

DOJ Creates Task Force to Challenge State AI Regulations (CBS News)

The Department of Justice has created a new AI Litigation Task Force to challenge state-level AI laws on preemption and interstate-commerce grounds, signaling a likely period of federal–state conflict over how AI systems may be regulated in the United States.

Analysis:

The creation of a DOJ AI Litigation Task Force signals that federal–state conflict over AI governance is likely to intensify, with the federal government prepared to challenge state laws on preemption and interstate-commerce grounds rather than waiting for comprehensive federal legislation. This suggests that AI regulation in the United States may evolve not only through new statutes, but through litigation that reshapes the boundaries of what states can require of AI developers and deployers. For GeoAI firms operating across multiple states, this does not eliminate compliance obligations but rather introduces a period of layered uncertainty: companies must prepare for diverging state rules on transparency, data use, and deployment while also anticipating that some of those rules could be narrowed or invalidated through federal challenges.

Accelerating America's Military AI Dominance (Secretary of War)

The Department of War’s new Artificial Intelligence Strategy directs the military to become an “AI-first” force through seven Pace-Setting Projects, massive expansion of AI compute and federated data access, and a wartime approach to removing bureaucratic barriers to rapid AI deployment.

Analysis:

The Department of War’s Artificial Intelligence Strategy articulates an explicit shift to an “AI-first” posture, pairing aggressive experimentation with a systematic build-out of foundational enablers. For commercial GeoAI and dual-use spatial technology providers, the strategy signals sustained and likely expanding demand for interoperable geospatial data pipelines, real-time catalogs, and modular systems that can plug directly into government architectures. At the same time, the emphasis on rapid model updates, edge compute, and federated data access raises compliance stakes around security controls, export restrictions, and data governance, making alignment with DoD data standards and rigorous documentation increasingly important for firms seeking to participate in this ecosystem or support military AI applications.

Deep Dive

Insurers reportedly are narrowing coverage for AI-related losses through new exclusions, higher retentions, and sublimits, thus treating AI as a specialty exposure rather than a risk absorbed by legacy cyber or tech E&O lines. Coverage is increasingly contingent on demonstrable AI governance (e.g., inventories, testing, bias/drift monitoring, change control), with underwriters using governance maturity to decide appetite, pricing, and whether to narrow exclusions or offer affirmative endorsements. The market posture mirrors early coverage of other insurance, suc has cyber. As a result, claims placement may seem unsettled, as capacity is cautious, and carriers are experimenting with bespoke endorsements while they gather loss data.

Carriers report uncertainty over where AI-caused losses “fit,” especially when bodily injury or property damage is tied to automated decisioning, which can fall awkwardly between CGL and cyber or into tech E&O with new AI carve-outs. At the same time, insurers have begun to launch targeted affirmative solutions (for example, deepfake endorsements with incident response and crisis communications), even as others pursue “absolute AI” or training-data/content-use exclusions that materially narrow coverage for AI outputs. Claims trends also show privacy litigation risk tied to embedded tools (e.g., chatbots cited in a measurable share of web privacy suits under state “digital wiretapping” statutes), reinforcing that AI incidents are already flowing into cyber/privacy programs.

For geospatial applications where models analyze imagery, infer location attributes, or power mapped decision tools the market’s exclusions heighten three exposures: location privacy, data provenance/IP, and analytic misstatement. Privacy claims tied to precise geolocation or automated collection/inference are most likely to route to cyber/privacy coverage but may meet standard coverage carve-outs, such as statutory-violation, or AI-specific carve-outs. Training-data and content-use exclusions mean geospatial firms will need to evidence clean license chains and provenance for satellite/aerial imagery, base maps, and derived datasets to preserve IP and contractual liability coverage for model training and outputs. Finally, absent explicit E&O grants for AI-generated outputs, errors in probabilistic classifications or forecasts (e.g., risk mapping, asset condition scoring) resulting in losses could be characterized as excluded algorithmic “misconduct.”

Documented AI governance (model inventories, pre-deployment testing, human-in-the-loop for consequential inferences, drift monitoring, and audit logs linking outputs to model versions and data sources) is now a lever for insurability, narrower exclusions, and claims defensibility. On coverage wording, seek affirmative grants for AI outputs in tech E&O, confirm cyber/privacy treatment of precise geolocation, and negotiate carve-backs where training/data-use exclusions would otherwise hurt licensed geospatial workflows.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• How the AI LEAD Act could convert GeoAI “engineering choices” into product-liability exposure

• How “global AI governance” is converging on lifecycle controls even as laws fragment

• Why robots.txt is not a legal “gate”and what actually reduces scraping and training-data misuse risk

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

AI LEAD Act — Bill S. 2937 (Congress.gov)

By defining training data selection, model tuning, and unexpected behaviors as part of a system’s “design,” the AI LEAD Act could make GeoAI developers legally accountable for harms linked to how spatial models are built, trained, and deployed. For geospatial companies, this raises the stakes around dataset choice, model validation, warnings, and post-deployment monitoring.

Analysis:

The AI LEAD Act would extend traditional product-liability doctrines into the AI context by treating AI systems as regulated products and defining “design” to include training data selection, tuning, testing, and even emergent behaviors. This shifts legal risk upstream into technical and operational choices that GeoAI developers have historically treated as engineering or research decisions rather than legal ones.

For GeoAI companies, the practical implication is that dataset choice, validation, documentation, warnings, and post-deployment monitoring become central to legal defensibility, not just governance best practices. The bill also clarifies when deployers assume developer-level liability through substantial modification or unanticipated use, creating incentives to define intended uses, system limits, and responsibility allocation with much greater precision.

Global AI Governance Law and Policy 2025 Series (IAPP)

The report maps how jurisdictions are shaping AI governance through legislation, regulatory guidance, and standards, while showing that many are operationalizing oversight through lifecycle controls (testing, monitoring, transparency, accountability) rather than AI-specific bans. For GeoAI deployments, this means that risk assessments, documentation, traceability, and vendor diligence are becoming baseline compliance expectations across markets.

Analysis:

The Global AI Governance Law and Policy 2025 Series illustrates that AI governance is fragmenting into a patchwork of national approaches built on shared principles but very different institutional and legal architectures, ranging from comprehensive, risk-based statutory regimes (EU, China) to standards-led, sectoral, and voluntary frameworks (Australia, UK, U.S., Singapore). Rather than convergence on a single global model, the series shows increasing functional interoperability: jurisdictions are aligning around similar governance tools (e.g. risk classification, transparency, accountability, human oversight, and lifecycle governance) even as they embed them into different legal systems.

For GeoAI actors operating across borders, this means that compliance is less about mapping to one “global rulebook” and more about managing a layered governance stack: product liability, privacy, cybersecurity, IP, sectoral regulation, and public-sector rules combine differently in each jurisdiction. The emergence of agentic and foundation models as governance focal points also signals that regulatory attention is shifting from narrow application risks to system-level capabilities, autonomy, and scale thus increasing the importance of governance design, documentation, and risk controls as portable compliance assets across markets.

Links to each jurisdiction’s overview are available here: Global AI Governance Law and Policy 2025 Jurisdiction Overviews

Are Robots.txt Instructions Legally Binding?–Ziff Davis v. OpenAI (Technology & Marketing Law Blog)

A federal court in Ziff Davis v. OpenAI rejected the argument that ignoring a website’s robots.txt constitutes “circumvention” under the DMCA, holding that robots.txt functions more like a “keep off the grass” sign than an access control that “effectively controls” access. For GeoAI platforms concerned about scraping or model-training misuse, the decision reinforces that robots.txt is best treated as notice and evidence, and should be paired with contractual restrictions and real technical gates (authentication, rate limits, API controls) to strengthen both security and legal posture.

Analysis:

The court’s ruling clarifies that robots.txt does not qualify as a “technological measure that effectively controls access” under the DMCA, characterizing it as a request rather than a technical gate and rejecting the argument that ignoring it constitutes circumvention. This narrows the legal effect of robots.txt to signaling and notice, while leaving open its relevance under other doctrines such as contract, trespass to chattels, or the CFAA, but in each case only where actual technical or legal “gates” are present.

As discussed in more detail in the Deep Dive, for GeoAI platforms, the decision reinforces that scraping risk management cannot rely on robots.txt alone: if control over training data, model inputs, or downstream reuse matters, it must be implemented through enforceable licenses, authentication, rate-limiting, API controls, and monitoring that create real access barriers and legal leverage. Robots.txt remains useful as evidence of intent and scope, but not as a standalone access control or liability trigger.

Deep Dive

Recent court cases suggest geospatial platforms should treat robots.txt as a signaling tool (rather than as a gate) and pair it with real access controls and clear contracts to reduce scraping risk and strengthen enforcement options. Courts have recently held that robots.txt does not qualify as a “technological measure that effectively controls access” under the DMCA’s anti-circumvention provisions, likening it to a “keep off the grass” sign that can be ignored without any affirmative bypassing step. The practical takeaway is simple: robots.txt alone is unlikely to carry a 17 U.S.C. § 1201(a) theory, so use it to put scrapers on notice while building genuine “gates up” protections.

For map tiles, imagery, and feature services, that means preferring authenticated APIs and gated endpoints over open URLs, and supported with rate limits, CAPTCHAs/challenges, user authentication, anomaly detection, API key controls (including rotation), request signing, and server-side throttling. The goal is to deploy controls that actually constrain automated access to tiles, feature collections, and elevation rasters, so that a scraper must avoid or defeat something concrete to operate at scale. Recent litigation suggests the most promising DMCA-style theory is not “they ignored robots.txt,” but “they circumvented bona fide technical controls”. This translates for geospatial providers into session-bound tokens, signed URLs, and challenge flows that require additional information or processes.

Contracts remain a central lever when technical gates are combined with well-presented terms. Courts can be skeptical of browsewrap, but allegations of actual notice (especially for sophisticated parties) and evidence that a scraper bypassed an available licensed API can strengthen breach-of-contract theories. For geospatial workflows, consider binding access to clickthrough or token-gated terms that expressly prohibit unlicensed scraping, bulk extraction, and AI training; cross-reference robots.txt and API terms; and clearly delineating approved bulk channels (APIs, feeds, data shares) versus prohibited extraction routes. Finally, logging and attribution tools that tie user agents, IPs, tokens, and request patterns to ignored directives and defeated controls can be used to distinguish authorized API use from scraping, show knowledge and intent, and support claims ranging from contract to unfair competition.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• Why human conception still governs AI-assisted inventorship and why companies must document human decision-making in model design, training choices, and system architecture to preserve patent rights.

• How data-license restrictions can undermine AI systems, such as why legacny “internal use” and non-competitive clauses may prohibit model training, embeddings, or customer-facing AI outputs, even if raw data is never disclosed.

• What Texas’s new Responsible Artificial Intelligence Governance Act means in practice, including new disclosure, transparency, and oversight expectations for AI systems deployed in or affecting Texas starting in 2026.

• How emerging NIST AI cybersecurity guidance could shape GeoAI procurement and contracts, particularly around data supply-chain risk, model integrity, and AI-specific attack vectors such as data poisoning and model inversion.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Revised Inventorship Guidance for AI-Assisted Inventions (Federal Registrar)

The USPTO has issued revised guidance clarifying that AI systems can never be named as inventors and that inventorship for AI-assisted inventions turns entirely on whether a human conceived the claimed invention under traditional patent law standards, with AI treated strictly as a tool. For GeoAI companies, this reinforces the need to document human decision-making and conception in model design, training choices, and outputs to preserve patentability.

Analysis:

The USPTO’s revised guidance reinforces that inventorship for AI-assisted inventions turns exclusively on human conception, with AI treated as a tool rather than a co-inventor. For GeoAI companies, this heightens the need to clearly document human decision-making around model design, training choices, and system architecture, as weak evidence of conception could undermine patentability for AI-driven geospatial innovations.

Fastcase, Inc. v. Alexi Technologies Inc. (LawSites)

A newly filed lawsuit in federal court alleges that an AI legal-research company breached a narrowly scoped data-license agreement by using licensed legal data to train and power a commercial generative AI product, alleging breach of contract, trade-secret misappropriation, and trademark infringement. For GeoAI and data-driven AI companies, the case underscores that using licensed datasets for model training or downstream AI products can trigger significant legal exposure if the license limits use to “internal use” or prohibits competitive or commercial deployment.

Analysis:

This case squarely tests the legal boundary between licensed data use and impermissible AI commercialization, with the complaint framing model training, embeddings, and user-facing outputs as derivative uses that can violate narrow “internal use” licenses. For GeoAI companies, the lesson is structural rather than sector-specific: as AI products evolve from human-in-the-loop tools into autonomous, customer-facing platforms, legacy data licenses may no longer fit the operational reality, creating significant breach, IP, and trade-secret exposure unless license scope, training rights, and downstream uses are expressly renegotiated.

Texas Responsible Artificial Intelligence Governance Act (LegiScan)

Texas has enacted the Texas Responsible Artificial Intelligence Governance Act, establishing a broad, state-level framework that imposes disclosure, anti-manipulation, anti-discrimination, and transparency obligations on developers and deployers of AI systems. For GeoAI companies operating in or serving Texas, the law signals heightened scrutiny beginning January 1, 2026 of AI systems while also offering a regulatory sandbox for testing GeoAI applications.

Analysis:

Texas’s Responsible Artificial Intelligence Governance Act establishes a broad, enforceable state framework that emphasizes transparency and centralized oversight. For GeoAI companies, the key takeaway is operational: developers and deployers should be prepared to justify data sources, disclosure practices, and post-deployment monitoring.

Cybersecurity Framework Profile for Artificial Intelligence (NIST)

NIST’s Cybersecurity Framework Profile for AI (NIST IR 8596, initial preliminary draft) proposes CSF 2.0–aligned, technology-neutral guidance to manage cybersecurity risk in AI systems and to identify where AI can strengthen cyber defense.

Analysis:

As models in many GeoAI systems depend on complex data supply chains, distributed compute, and automated decision-making, the draft profile highlights the need to anticipate AI-specific failure modes such as data poisoning, model inversion, and AI-enabled cyber-attacks on geospatial infrastructure. Over time, even in the absence of binding regulation, this framework is likely to shape procurement requirements, audits, and contractual expectations for GeoAI providers.

Deep Dive

Why Data Licenses In Matter in AI Training

As GeoAI systems grow more powerful, many companies are discovering, sometimes too late, that access to data does not equal permission to use it for AI training. As noted above, the recently filed federal complaint noted above, Fastcase, Inc. v. Alexi Technologies Inc. provides a timely illustration of how traditional data-license restrictions can collide with modern AI development practices.

At the center of the dispute is a familiar licensing construct: a restricted data license limited to “internal research purposes,” with explicit prohibitions on commercial use, competitive use, and redistribution. According to the complaint, the licensee allegedly used the licensed dataset not merely to support internal workflows, but to train and power a commercial, generative AI legal-research platform, which is a use the licensor claims was never authorized and directly violated the agreement’s core restrictions. While the merits will be decided by the court, the facts alleged mirror issues emerging across the GeoAI ecosystem.

For geospatial companies, the lesson is straightforward but often overlooked: AI training is rarely “neutral” from a licensing perspective. Many data licenses, especially legacy agreements drafted before broad use of large language models, draw sharp distinctions between internal use, derivative works, publication, and competitive products. Training a model on licensed geospatial data can implicate all of these concepts at once. Even if the underlying data are never directly exposed to end users, training may still be characterized as a commercial or competitive use, particularly where the resulting model substitutes for the licensor’s own products or services.

The complaint also underscores a second risk. In geospatial datasets, much of the commercial value lies not in raw data alone, but in curated layers, metadata schemas, normalization, and harmonization across sources. Licensors increasingly argue that these compilations constitute protectable trade secrets or proprietary assets, even when individual data points may be publicly available. Training an AI system on such curated datasets can therefore raise not only contract claims, but also trade-secret and unfair-competition exposure.

Perhaps most importantly, the dispute highlights a governance gap common in AI development: licenses are static, but business models evolve. The agreement at issue was allegedly negotiated when the licensee operated a human-in-the-loop research service. As the service evolved into a fully automated, AI-driven platform, the license terms remained unchanged. From a legal standpoint, that mismatch can be fatal. Courts tend to interpret licenses based on their text, not on how technology later evolves or how the licensee subjectively understood AI training to fit within “research.”

For GeoAI developers, this case reinforces several practical takeaways.

1. Training rights should be treated as a distinct, negotiated permission, not assumed to fall within general research or internal-use clauses.

2. Companies should inventory not only the data they ingest, but also the license lineage attached to each dataset used in training, fine-tuning, or retrieval-augmented systems.

3 Where business models are shifting from internal analytics to external products licenses must be revisited before models are deployed, not after.

As GeoAI systems increasingly monetize insights derived from licensed data, understanding the limits of license agreements is a core architectural requirement for building legally sustainable AI systems.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

This week, you will learn how Australia’s new AI policy is reshaping the regulatory environment for GeoAI by relying on existing laws rather than AI-specific rules. You will also see why AI agents present a new category of risk for geospatial systems and what safeguards are emerging to manage autonomous, multistep workflows. You will gain clarity on how different classes of AI are being adopted across the space and Earth-observation enterprise. Finally, you will learn why geospatial sovereignty increasingly will depend on the alignment of technical architectures with enforceable legal and governance controls.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Australia Unveils AI Policy Roadmap (IAPP)

Australia’s new National AI Plan shifts away from strict, AI-specific regulation and instead relies on existing legal frameworks and a forthcoming AI Safety Institute, creating a more investment-friendly environment but leaving ambiguity around high-risk uses of spatial and sensor-derived data. For GeoAI, the roadmap signals that governance expectations, such as provenance, privacy protections, and risk-assessment duties, will be enforced through general laws and institutional oversight rather than sector-specific mandates.

Analysis:

By avoiding AI-specific regulation, Australia is betting that general, technology-neutral laws combined with a central AI Safety Institute will provide enough flexibility for innovation. For GeoAI, this creates a mixed environment: compliance may be simpler in the short term, but the absence of clear obligations could lead to uncertainty and increased reliance on contractual obligations between parties. standards.

Understanding AI Agents: New Risks and Practical Safeguards (IAPP)

AI agents introduce far greater autonomy, system access, and operational variability than traditional AI models, creating new security, privacy, and decision-risk exposure that directly affects geospatial systems that rely on automated data retrieval, tool use, or multistep spatial reasoning. For GeoAI, this means agent-based workflows require stronger safeguards around data provenance, access control, logging, and human-in-the-loop decision boundaries to prevent unintended propagation of errors across spatial datasets and analytic pipelines.

Analysis:

Because AI agents can trigger multistep operations, access external tools, and act on incomplete or ambiguous instructions, they present higher-risk failure modes than traditional GeoAI models. For geospatial organizations, this means agent deployments should include sandboxed training environments, enhanced auditing, human decision checkpoints, and clear limits on which datasets and APIs an agent may access. As agents become integrated into mapping, mobility, and satellite-analysis workflows, governance will need to shift from model-level oversight to full system-level controls.

Artificial Intelligence and the Space Enterprise: Taxonomy and Emerging Opportunities (Center for Space Policy and Strategy)

The report highlights how AI is rapidly reshaping the space enterprise, including remote sensing by enabling autonomous onboard decision-making, large-scale sensor data analysis, and mission optimization. But the impact varies widely across mission areas due to uneven data availability, compute constraints, and organizational readiness. For geospatial professionals, the paper underscores that the most transformative opportunities arise when AI is applied to high-volume Earth observation data and when agencies precisely define which AI technologies are being used and why.

Analysis:

The Aerospace Corporation stresses that “AI” is not a single capability but a spectrum of tools with varying maturity, technical requirements, and operational risk. For GeoAI, this reinforces the need to distinguish between classical ML, foundation models, autonomous agents, and onboard inferencing, as each introduces different governance, transparency, and reliability challenges. As space agencies adopt more advanced AI, geospatial organizations may need stronger lifecycle oversight, to include model cards, data sourcing and mission-specific performance thresholds.

Geospatial Sovereignty in the Age of AI: A Layered Approach (CARTO)

The article argues that true geospatial sovereignty in the AI era requires a layered architecture (e.g., open data formats, flexible compute environments, portable AI models, and interoperable semantics) to avoid vendor lock-in and ensure national control over spatial data and AI-driven decision systems. For GeoAI, the piece underscores that sovereignty is not isolation but the ability to run geospatial analytics and AI pipelines anywhere while preserving provenance, resilience, and strategic independence.

Analysis:

The article reframes sovereignty not as restricting access but as preserving the ability to run geospatial data and AI workflows anywhere, without dependency on a single commercial stack. For GeoAI, the tools include open standards, transparent provenance, cloud-agnostic deployment models, and AI architectures. These facilitate models, embeddings, and inference workflows to move freely across environments. As governments adopt stricter requirements around data control and autonomy, these design principles may increasingly determine which GeoAI solutions can be deployed at national scale.

Deep Dive

Digital Sovereignty From a Legal Standpoint

As GeoAI systems increasingly shape infrastructure planning, emergency response, transportation, finance, and national security, digital sovereignty has become an operational requirement rather than a political aspiration. Organizations are investing in sovereign clouds, open formats, and diversified analytics stacks. But technology alone does not ensure sovereignty. True geospatial sovereignty requires an alignment between technical architecture and legal rights, regulatory obligations, operational controls, and institutional accountability. Without that alignment, digital sovereignty remains fragile, no matter how advanced the platform.

As Javier de la Torre notes in his excellent blog post described above, at the technical level, modern sovereignty depends on layered architecture across data, compute, and AI. Open and interoperable data formats preserve ownership and portability. Modular compute environments reduce dependency on any single cloud or jurisdiction. Configurable AI layers prevent lock-in to opaque, non-substitutable models. But technical optionality is only capacity. It does not establish enforceability. Governance is what transforms architectural freedom into legally defensible control.

Governance challenges track these same layers. At the data layer, sovereignty hinges on whether organizations actually hold the rights to use, combine, train, commercialize, or transfer geospatial information across borders and applications. At the compute layer, jurisdiction, access controls, backups, administrative visibility, and government access all shape regulatory exposure. At the AI layer, accountability becomes central, covering explainability, bias, model drift, training provenance, automated decision-making risks, and the real-world consequences of erroneous spatial outputs. Regulators and customers increasingly expect documented oversight structures, human-in-the-loop controls, and traceable model governance.

Digital sovereignty is built, and sustained, through continuous alignment between architecture, law, contracts, and institutional responsibility. Documentation, auditability, vendor oversight, and contractual alignment are now critical to GeoAI governance.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

What You’ll Learn This Week

• How the EU’s new Digital Omnibus proposal could reshape GeoAI development, including stricter rules on data provenance, lawful training bases, and cross-border data handling across the EU AI Act, Data Act, GDPR, and related frameworks.

• How a potential U.S. federal preemption of state AI laws could impact GeoAI compliance, and what geospatial companies should prepare for as transparency, bias-testing, and data-handling obligations may shift, or disappear, under a national framework.

• Why AI-specific contract clauses are becoming unavoidable for geospatial professionals, and the key responsibilities emerging around data rights, training-data documentation, accuracy, bias testing, privacy, and national-security-related data restrictions.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Regulation of the European Parliament and of the Council (European Commission)

This European Commission “Digital Omnibus” proposal streamlines and consolidates major EU data and digital laws (including the EU AI Act, the Data Act, GDPR) in ways that directly affect how GeoAI systems access, share, and reuse public-sector and commercial data, and how they lawfully train models on personal and non-personal data.

Takeaway for Geospatial Professionals:

The Digital Omnibus proposal would reshape how GeoAI teams handle data access, reuse, and compliance by consolidating major EU digital laws and tightening rules around data provenance, training on personal or mixed datasets, and cross-border data handling. Geospatial organizations operating in Europe will want to track this proposal to understand documentation and governance requirements across models, datasets, and data-sharing workflows.

Guidance for Risk Management of Artificial Intelligence Systems (European Data Protection Supervisor)

The EDPS’s Guidance for Risk Management of AI Systems outlines a rigorous, ISO-aligned framework for identifying, mitigating, and documenting data-protection risks across the full AI lifecycle—emphasizing fairness, accuracy, minimization, security, and explainability. For GeoAI, the guidance reinforces that spatial AI models relying on personal or location-linked data must incorporate transparent provenance, bias controls, and continuous monitoring to prevent rights-impacting errors or discriminatory outputs.

Takeaway for Geospatial Professionals:

The EDPS guidance underscores that GeoAI systems using location-linked personal data must embed strong, end-to-end risk controls, including provenance tracking, fairness testing, and continuous monitoring. Geospatial teams should treat these requirements as core compliance obligations when deploying spatial models that influence decisions or services.

What to Know About Trump’s Draft Proposal to Curtail State AI Regulations (AP)

The draft executive order would pressure states to halt or roll back their AI regulations, creating a single federal framework that overrides state-level rules. This shift could directly affect geospatial AI systems that must comply with state privacy, transparency, and anti-discrimination requirements. For GeoAI companies, this could reshape compliance obligations, particularly around data provenance, automated decision-making, and geospatial models used in high-impact contexts such as lending, housing, or public services.

Takeaway for Geospatial Professionals:

The proposal highlights the growing tension between innovation-driven federal policy and risk-mitigation-focused state laws. GeoAI organizations should monitor whether preemption will create regulatory gaps, shifting liability and risk-management responsibilities back onto companies until a federal framework is established.

Deep Dive

As geospatial professionals increasingly integrate AI into imagery analysis, mapping, routing, and predictive modeling, the contractual landscape surrounding these tools is shifting just as quickly as the technology itself. Governments are building new AI regulatory regimes, such as the EU AI Act, and various national laws in the U.S. and Asia, that rely heavily on documentation, data governance, and accountability. At the same time, customers are requiring AI-specific representations and warranties be written into contracts. For those working in GeoAI, these parallel trends mean that understanding contractual obligations related to AI is no longer optional; it is becoming a core professional responsibility.

The pressure is increasing because AI introduces risks that traditional geospatial contracts were never designed to address. For example, many GeoAI models depend on complex training datasets that often include satellite imagery, aerial photography, LIDAR, or web-scraped geospatial layers. In some instances, these materials are licensed, restricted, or copyright-protected. If any portion of this data is used without the appropriate rights, both developers and downstream users may face claims of copyright infringement or breach of licensing restrictions. Buyers and investors now routinely demand assurances that the data used to train a model was lawfully obtained, properly licensed, and appropriately documented. In short: you will be asked to assert in your contracts that data governance is real, not aspirational.

Quality, accuracy, and bias are emerging as additional contractual pressure points. Because GeoAI systems rely on high-precision inputs, even small defects in training data (e.g., an outdated imagery layer, mislabeled building footprint, or inaccurate coordinate reference) can ripple outward into flawed outputs. And flawed outputs can lead to operational, financial, or regulatory harm. For this reason, AI clauses in contracts will increasingly require geospatial organizations to disclose data sources, demonstrate the accuracy and provenance of training datasets, and explain how models are tested for bias or error. These obligations will tie directly to broader AI governance requirements, including human-in-the-loop oversight and robust monitoring procedures.

Privacy and data protection concerns add another layer of contractual complexity. Location traces, facility coordinates, and mobility data can contain highly sensitive insights about individuals and critical infrastructure. When this kind of information is fed into public or third-party generative AI tools, companies lose control over how the data is stored, retained, or reused. As a result, many contracts will now include strict promises that employees will not enter sensitive or proprietary geospatial information into public AI systems, and that internal policies exist to enforce these restrictions. For organizations working with regulated location data or operating across borders, these privacy-related contract terms often interplay directly with data sovereignty and national security rules, including export controls.

For all these reasons, AI clauses are becoming standard components of data licenses, model-as-a-service offerings, procurement contracts, and even insurance policies. They serve as both a risk-allocation tool and an accountability mechanism. Companies unable to articulate how their AI systems are built, what data they rely on, or how they comply with emerging regulations will increasingly be seen as high-risk partners. The takeaway is clear: GeoAI success now depends not only on technical capabilities but also on the ability to demonstrate contractual, operational, and governance maturity. Understanding and shaping the AI terms in your contracts is quickly becoming just as important as understanding the models themselves.

Support the Next Generation

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals. Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What You’ll Learn This Week

This issue explores how courts and policymakers across the world are reshaping the legal landscape for GeoAI in areas such as copyright and data provenance to governance, liability, and compliance frameworks.

• Copyright and Model Training:
  Two landmark rulings reach different conclusions on whether use of training data constitutes infringement. You’ll learn what these cases mean for GeoAI models trained on licensed imagery, maps, or sensor data, and how to mitigate infringement risk through lawful data sourcing and provenance controls.

• Governance and Accountability Frameworks:
  Australia’s Voluntary AI Safety Standard and India’s AI Governance Guidelines (2025) highlight global moves toward “techno-legal” frameworks emphasizing transparency, provenance, and human oversight. This issue explains how GeoAI developers can operationalize these principles by embedding auditability, ethical safeguards, and compliance readiness into geospatial workflows.

• Emerging State-Level AI Regulation in the U.S.:
  The Future of Privacy Forum’s latest report shows U.S. states shifting toward targeted, disclosure-based AI laws. Learn how these narrower, use-specific rules could affect GeoAI applications in sectors like mobility analytics, environmental modeling, and automated decision support.

• The Legal Complexity of Embeddings:
  A deep dive into the legal issues surrounding embeddings, the mathematical “vectors” powering GeoAI reasoning. You’ll understand how embeddings blur the line between data and inference, raising questions around accuracy, liability, and IP ownership. The article offers practical guidance on contractual protections, audit rights, and governance mechanisms to manage these evolving risks.

What’s New

GEMA Ruling Against OpenAI (Justiz in Bayern — Justice in Bavaria)

The Munich I Regional Court ruled that OpenAI’s models unlawfully reproduced copyrighted German song lyrics, finding that “memorization” within language models constitutes a copyright-relevant reproduction not protected by text and data mining exceptions. For GeoAI, the case signals growing legal scrutiny around embedded reproductions of training data and raises questions about whether geospatial models trained on licensed satellite or sensor data could similarly infringe when internal model parameters “store” the underlying data

Takeaway for Geospatial Professionals:

GeoAI developers using copyrighted imagery, mapping layers, or sensor data in model training should treat “internal storage” of those materials as potentially infringing. Moving forward, data provenance and lawful basis documentation will be as essential as accuracy and performance metrics.

Analysis:

This ruling is among the first to suggest that model training can trigger copyright liability. For GeoAI teams, it reinforces the importance of licensed or synthetic training data, strong data provenance records, and legal vetting before integrating third-party spatial datasets into AI workflows.

AI Companies Get a Big Legal Win in the U.K. as Getty Images Loses Stability Lawsuit (Forbes)

The U.K. High Court’s dismissal of Getty Images’ copyright claims against Stability AI clarifies that training AI models on copyrighted materials doesn’t necessarily constitute infringement if the models don’t reproduce or store exact copies.
For GeoAI, this signals that using geospatial datasets for AI model training may face lower legal risk provided outputs and embeddings don’t replicate proprietary imagery or map data

Takeaway for Geospatial Professionals:

This decision offers cautious reassurance that using geospatial data for AI training may be permissible where the model does not “memorize” or reproduce the underlying data. However, clear documentation of lawful data sources remains essential.

Analysis:

The ruling favors innovation over restriction, but highlights how the boundary between inspiration and reproduction remains fact-specific. GeoAI developers should continue to maintain data use records and avoid generating outputs that too closely mirror proprietary datasets.

White Paper on AI Governance: Leadership Insights and the Voluntary AI Safety Standard in Practice (Governance Institute of Australia)

Australia’s Governance Institute white paper outlines a national framework for responsible AI adoption, emphasizing data governance, provenance, risk management, and human oversight through the Voluntary AI Safety Standard’s ten guardrails. For geospatial and GeoAI systems, its focus on data provenance, auditability, and regulatory accountability provides a clear model for integrating ethical, transparent, and compliant AI governance into spatial data ecosystems

Takeaway for Geospatial Professionals:

GeoAI initiatives should align with governance frameworks that emphasize traceability, accountability, and ethical use of spatial data. Establishing internal guardrails around data lineage and model transparency can strengthen trust and compliance readiness.

Analysis:

Australia’s approach prioritizes principle-based, auditable governance over prescriptive regulation. For GeoAI organizations, adopting similar voluntary standards can be used to demonstrate proactive commitment to responsible AI while also preparing for future regulatory oversight.

The State of State AI: Legislative Approaches to AI in 2025 (Future of Privacy Forum)

The Future of Privacy Forum’s “State of State AI 2025” report finds that U.S. states are shifting from broad, Colorado-style AI laws to narrower, disclosure-driven frameworks focused on specific technologies (e.g., generative AI, chatbots) and high-impact contexts (like healthcare or employment). For GeoAI professionals, the trend toward use- and context-specific regulation, liability clarity, and transparency mandates suggests that geospatial AI applications, particularly those supporting automated decision-making or consumer-facing insights, will increasingly face state-level compliance obligations tied to data provenance, risk disclosure, and accountability frameworks

Takeaway for Geospatial Professionals:

When applying GeoAI tools in the U.S., don’t assume that your work will be governed by comprehensive state AI laws. Instead, look out for targeted state measures that require transparency around specific use-cases, such as location-based risk scoring, mobility analytics, or environmental decision-making. Considering building documentation and checklists now anticipating these narrower but rapidly emerging obligations.

Analysis:

The report suggests a shift away from broad “high-risk AI” regimes toward use-case-specific disclosures and liability frameworks. For GeoAI, that means focusing on application context, data flows, model outputs, and state-specific obligations rather than waiting for a comprehensive federal or state law.

India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (IndiaAI)

The India AI Governance Guidelines (2025) establish a comprehensive national framework to balance AI innovation and safety through a “techno-legal” and principle-based approach emphasizing trust, accountability, inclusivity, and resilience. For GeoAI, the guidelines are significant because they promote data provenance, content authentication, and risk assessment frameworks for AI systems that process geospatial data. The guidelines also encourage Digital Public Infrastructure (DPI) integration to ensure inclusivity and privacy, and envision institutional oversight, such as the AI Safety Institute, relevant to evaluating geospatial AI models on matters such as bias, national security risk, and societal impact.

Takeaway for Geospatial Professionals:

Treat provenance logs, model audit trails, and content authenticity signals (e.g., watermarking/signing of spatial outputs) as first-class compliance artifacts. Align GeoAI workflows with privacy-by-design, DPI integration, and clear human-in-the-loop controls for safety-critical uses.

Analysis:

India’s “techno-legal” approach blends principles with operational guardrails—pushing GeoAI teams to operationalize governance (provenance, testing, escalation paths) rather than rely on policy statements alone. Expect these controls to become procurement and certification baselines for spatial AI deployed in public services and critical infrastructure.

Deep Dive

I have been reading a great deal about embeddings recently. Embeddings are vector representations of spatial, temporal, and semantic relationships and are transforming how geospatial AI models understand the world. They allow systems to integrate imagery, terrain, and text into unified spatial reasoning frameworks.

However, their power comes with legal complexity. Because embeddings are probabilistic and interpretive rather than factual, they raise questions about accuracy, data provenance, liability, and intellectual property. Governments, companies, and end-users risk treating model-inferred relationships as objective truth, expose themselves to misrepresentation, negligence, or data misuse claims if these systems are not properly validated or disclosed.

From a contractual perspective, organizations using or distributing geospatial embeddings should clearly define how data and models are sourced, what warranties apply, and who bears responsibility for downstream errors or bias. Clauses on provenance, uncertainty disclosure, and model retraining can help manage these risks. Purchasers of AI systems that use embeddings should also consider including clear indemnities tied to due diligence standards in their contracts, so liability follows failure to meet defined obligations rather than the occurrence of harm alone. Audit rights and ongoing monitoring obligations can also help, as embeddings may evolve through continuous learning and retraining.

From a governance standpoint, as noted in both India’s AI Governance Guidelines and Australia’s AI Safety Standard, transparency, explainability and risk assessments across the AI value chain are critical. Embeddings should be considered as regulated components requiring lifecycle transparency, testing, and institutional coordination.

As with other risks associated with AI, managing the legal risks of embeddings requires integrating technical, operational and legal solutions across the enterprise. From a legal standpoint, this includes contractual clarity at the micro level and institutional governance at the macro level. By embedding transparency, accountability, and explainability into both contracts and governance systems, GeoAI developers and users can harness these tools responsibly while preserving trust in the data-driven decisions that increasingly shape our understanding of the planet.

Support the Next Generation

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals. Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

From the Editor

As AI systems evolve from tools to agents, the legal frameworks around them are shifting just as quickly. This week’s developments—from Singapore’s lifecycle security guidance to the EU’s interpretation of “provider” obligations—highlight how governments are refining accountability in autonomous and data-driven systems. For geospatial professionals, these changes are not theoretical; they shape how location intelligence, analytics, and model governance will operate across jurisdictions.

What You’ll Learn This Week

• How Singapore’s Agentic AI Addendum may redefine controls for autonomous GeoAI systems

• Why the UK’s “contextual, regulator-led” model is reshaping compliance for geospatial firms

• What Reddit v. Perplexity teaches about lawful data sourcing for AI training

• When fine-tuning under the EU AI Act makes you a “provider” — and what obligations follow

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Securing Agentic AI: An Addendum to the Guidelines and Companion Guide on Securing AI Systems (CSA Singapore, 2025 Draft)

Singapore’s Cyber Security Agency (CSA) released a Draft Addendum on Securing Agentic AI extending its AI security framework to autonomous, self-managing systems. It introduces lifecycle-based security controls tailored to agentic workflows—those that autonomously collect, analyze, and act on spatial data. The Addendum emphasizes continuous risk assessment, threat modeling, data provenance, and inter-agent communication safeguards to prevent rogue actions and data leakage.

Takeaway for Geospatial Professionals:

If your GeoAI system autonomously ingests or acts on data, shift from static risk reviews to lifecycle security management. Regulators are signaling that continuous oversight is the new baseline

Analysis:

Expect similar “agentic” frameworks to emerge in the EU and Middle East—especially where geospatial automation intersects with smart-city and defense applications.

Global AI Governance Law and Policy: UK (IAPP, 2025)

The IAPP’s Global AI Governance: United Kingdom brief explains that the UK is pursuing a contextual, regulator-led approach to AI oversight rather than a single statute. The government’s white paper emphasizes fairness, accountability, and transparency, entrusting enforcement to existing sector regulators (e.g., Ofcom, ICO, and the Civil Aviation Authority). For GeoAI, this means that applications in surveillance, transport, and environmental monitoring would face regulator-specific compliance rather than one unified AI Act.

Takeaway for Geospatial Professionals:

Compliance obligations will vary by domain. Build regulatory maps early—align your legal, data, and product teams around which authority governs your particular use case.

Analysis:

The UK’s flexible model offers innovation space but also introduces fragmentation risk. For global GeoAI firms, the challenge will also be maintaining coherence between UK guidance and the EU’s far more codified AI Act regime.

Reddit Sues AI Company Perplexity and Others for ‘Industrial-Scale’ Scraping of User Comments (MSN)

Reddit has sued Perplexity AI, alleging “industrial-scale” scraping of user comments in violation of access restrictions and terms of use. According to the complaint, Perplexity and partners harvested Reddit data to train AI systems without authorization or license, which raises key issues around copyright, data contracts, and fair-use limits.

Takeaway for Geospatial Professionals:

Ensure all third-party datasets used for AI training are licensed, documented, and provenance-verified. “Publicly available” no longer equates to “lawfully usable.”

Analysis:

Courts are beginning to draw boundaries between lawful data access and systemic scraping. For GeoAI, the message is clear: treat data licensing as compliance infrastructure, not an afterthought.

Legal Concept of the Week: “Provider” Under the EU AI Act

Under Article 3(2) of the EU Artificial Intelligence Act, a “provider” is any natural or legal person who places an AI system on the market or substantially modifies an existing system. Once designated a provider, you assume compliance responsibility for conformity assessments, documentation, and transparency, regardless of whether you developed the base model.

Deep Dive

EU AI Act: What geospatial teams need to know about fine-tuning and “provider” status

Geospatial AI workflows often adapt general-purpose models to perform tasks such as feature extraction, change detection, or predictive analytics. Recent European Commission Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act clarifies when a downstream modifier becomes a “provider”, triggering full legal obligations. The decisive factor is significance: your modification must materially alter the model’s generality, capability, or systemic risk profile.

Rule of Thumb:

You are deemed the provider if your training compute exceeds one-third of that used to train the base model. If the original computer is unknown, the fallback thresholds are:

• One-third of 10²⁵ FLOP (for systemic-risk models)

• One-third of 10²³ FLOP (for all others)

For Geospatial Teams:

1. Large domain-specific fine-tunes may hit the compute threshold faster than expected.

2. Provider obligations focus on the modification: add technical documentation, disclose data sources, and implement a copyright policy.

3. If modifying a model already deemed systemic-risk, your version is presumed high-impact, thus requiring Commission notification and audit readiness.

Try This:

Estimate the compute ratio for one of your current fine-tunes. If it approaches one-third, start preparing documentation and governance as if you were the provider.

Bottom Line:

Track your compute. Document your data. Prepare for scale.
Fine-tuning today may define your compliance posture tomorrow.

Industry Implications:

AI and geospatial governance are converging rapidly. Over the next 12-18 months:

• Procurement teams will require provenance attestations for spatial data.

• Developers will face due-diligence questions on training datasets.

• Executives will be asked to demonstrate governance over autonomy and model risk.

Organizations that invest now in lightweight compliance frameworks will not only stay ahead of regulation but gain competitive advantage as trusted providers.

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals.

Support the Next Generation

Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

What’s New

Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Financial Stability Board)

The FSB report warns that reliance on a small number of GenAI and cloud service providers could create systemic vulnerabilities in finance and urges regulators to monitor AI supply-chain dependencies, data quality, and model governance. For GeoAI systems used in financial analysis, insurance, or risk modeling, expect increased emphasis on transparency about geospatial data sources and model oversight to prevent concentration, bias, and cascading failures across institutions.

US Federal Privacy Legislation Tracker: Introduced in the 119th Congress (2025-2026) (IAPP)

The 2025 Federal Privacy Tracker shows a surge in bipartisan efforts to regulate AI-enabled data use, covering automated decision making, smart-device disclosures, and geolocation tracking. For GeoAI developers, this signals that Congress is edging toward national standards that could extend privacy, consent, and algorithmic-transparency duties to geospatial data and AI systems that infer or act on location information

AI Act Service Desk: Frequently Asked Questions (European Commission)

The EU Commission’s AI Act Service Desk FAQ clarifies phased compliance and obligations for general-purpose and high-risk AI systems, including documentation, data governance, and transparency duties. For GeoAI, it confirms that models using geospatial data for mapping, surveillance, or decision making may qualify as high-risk—requiring provenance tracking, human oversight, and alignment with the forthcoming EU Code of Practice for AI

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Deep Dive

Businesses that offer geospatial products and services in California that are built on generative AI systems or services should be aware that the state’s Generative AI Training Data Transparency Act takes effect on January 1, 2026. It imposes documentation and disclosure obligations on developers of such systems released on or after January 1, 2022. Specifically, covered developers must post on their website documentation describing the data used to train, test, validate, or fine-tune the system, including:

- Sources or owners of datasets and how they support the system’s intended purpose.
- The size of datasets (ranges permitted; estimates for dynamic datasets).
- Types and characteristics of data points and labeling practices.
- Whether datasets include copyrighted, trademarked, or patented material versus public domain content.
- Whether datasets were purchased or licensed.
- Whether datasets include personal information or aggregate consumer information as defined under California law.
- Any cleaning, processing, or modifications performed and their purposes.
- Data collection periods, including whether collection is ongoing, and the dates first used in development.
- Whether synthetic data generation was used, and the functional need for it if included.

There are limited exemptions under the law including if the system or service (i) is made available only to a federal entity exclusively for national security, military or defense purposes (ii) or made available solely to a hospital medical staff member.

Geospatial organizations offering generative AI systems and services in California should consider taking the following next steps:

- Conducting a data provenance and licensing assessment for all covered systems released since January 1, 2022.
- Building a standardized disclosure template aligned with the statute’s enumerated elements to support publication before January 1, 2026 and at each substantial modification.
- Establishing change‑management triggers so that retraining or fine‑tuning that materially affects performance prompts updated disclosures.
- Mapping exemptions, if any apply, and document the basis for relying on them.

Interested in More?

Many of the legal and ethical issues associated with geospatial information are made even more complex by AI, particularly generative AI. If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

Share

Global AI Governance Law and Policy: European Union (International Association of Privacy Professionals)

The report notes that the EU’s AI Act is now in effect and rolling out in stages through 2026. As it uses a risk-based approach, the more an AI system can affect people, the more you must document how it works, manage the data it uses, and keep a human in the loop. This is addition to complying with other rules, like GDPR and the Data Act. Standards, liability, and copyright rules are still being finalized. However, for geospatial work it will be important to keep a simple, living checklist of your models and datasets (what they are, where the data came from, and where it’s sent). Pay special attention to more autonomous (“agentic”) systems and high-risk uses like public services.

Responsible by Design: Strategic Guidance Report on the Risks, Opportunities, and Governance of Artificial Intelligence in the Military Domain (Global Commission on Responsible AI in the Military Domain)

The GC REAIM report suggests a global governance framework for the responsible use of AI in military applications, emphasizing “responsibility by design” and legally grounded human oversight throughout the AI lifecycle. Its recommendations urging safeguards in data governance, testing, and international collaboration is important to the geospatial community given the dual-use nature of many geospatial technologies.

Connecticut Public Act No. 25-113 (Substitute Senate Bill 1295) — An Act Concerning Broadband Internet, Gaming, Social Media, Online Services, and Consumer Contracts (State of Connecticut)

Connecticut’s updated its privacy law to strengthen transparency rules for AI. Under the law, which went into effect in July, a company’s privacy statements must disclose whether it collects, uses or sells personal data for the purpose of training large language models. (In Connecticut, personal data includes precise geolocation data.)

Deep Dive

The Role of Insurance

Artificial intelligence is reshaping insurance products, underwriting, claims handling, and the attendant legal and coverage risks. Core AI modalities, such as machine learning, deep learning, and generative AI, are driving emerging liability trends such as AI-washing securities suits, algorithmic bias and discrimination claims, and privacy litigation tied to data sourcing and model training. Insurers’ coverage posture is evolving as well, combining affirmative AI-specific endorsements (for data poisoning, machine-learning wrongful acts, and even EU AI Act penalties) with broad exclusions. Such exclusions often include any business use of AI or content created with generative tools. Regulation is accelerating, with multi-state adoption of the NAIC Model Bulletin on AI use by insurers and the NIST AI Risk Management Framework serving as a governance scaffold.

For geospatial professionals whose work powers insurers’ risk selection, pricing, CAT analytics, and claims triage, the implications are immediate. Spatial and imagery-driven features can become vectors for disparate impact if neighborhood, land-use, or built-environment proxies correlate with protected classes, echoing allegations seen in mortgage and claims-screening cases. Training data provenance is often a flashpoint: models built on scraped, third party, or mixed-license datasets, or on location traces, can trigger privacy statutes and intellectual property exposures, especially where outputs incorporate or resemble protected content. Model integrity risks such as data poisoning, drift, and explainability constraints (“black box” outputs) bear directly on defensibility in litigation and on insurability, as carriers scrutinize audit trails, validation, and bias testing across first- and third- party data pipelines.

Operationally, geospatial vendors and GIS teams supporting insurers, or deploying AI into underwriting and claims, should align technical governance with insurability. That means documented data rights and lineage for imagery and geospatial layers; bias audits on feature engineering and model outputs across geographies and demographics; monitoring and redress mechanisms for false positives in fraud or damage detection; and incident response for model failures or data compromise. Contracting and coverage should be calibrated to today’s policy architecture: evaluate the interplay of Tech Errors and Omissions, Media/IP, Cyber, and Commercial General Liability (CGL) coverages; watch for generative AI and “business use of AI” exclusions; and consider affirmative AI endorsements covering data poisoning and ML wrongful acts.

In short, robust AI governance, transparent model documentation, and careful insurance program design are now strategic prerequisites for geospatial practitioners operating in the insurance value chain. Insurance also often helps shape compliance with evolving legal and policy frameworks by embedding governance expectations into underwriting questionnaires, warranties, and endorsements, and by conditioning or pricing coverage on documented data rights, bias testing, auditability, and incident response readiness.

Interested In More?

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

GeoAI and the Law Newsletter is free but proceeds from paid subscriptions will be used to fund law students who wish to attend local geospatial conferences.

Share

Commission Collects Feedback to Simplify Rules on Data, Cybersecurity, and Artificial Intelligence in the upcoming Digital Omnibus (European Commission)

The EU’s “Digital Omnibus” initiative seeks to simplify overlapping rules on data, cybersecurity, and AI while cutting compliance costs, with a special focus on SMEs. For GeoAI developers, this could mean lighter administrative burdens but continued obligations to align with EU standards on data use, security, and AI accountability.

AB-2013 Generative Artificial Intelligence Training Data Transparency Act (CA.gov)

California’s new AI Training Data Disclosure Law requires developers of generative AI systems to publish detailed information about the datasets used to train generative AI models. For GeoAI companies, this means they will need to reveal whether geospatial datasets include personal or proprietary information, raising compliance, intellectual property, and privacy considerations.

Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry (CA.gov)

California’s newly signed SB 53 (Transparency in Frontier AI Act) installs guardrails for “frontier” model by requiring public transparency frameworks aligned to standards. For GeoAI teams working with high-impact geospatial models, this means formal governance disclosures and incident-reporting duties for location-aware systems used in public services or critical infrastructure.

Request for Information Regulatory Reform on Artificial Intelligence (Regulations.gov)

OSTP’s AI regulatory reform RFI asks stakeholders to identify outdated Federal rules that block AI innovation, particularly where human-centered assumptions conflict with adaptive AI systems. For GeoAI, this is an opportunity to highlight regulatory gaps around geospatial data use, liability, and continuous model updates that could slow adoption in critical sectors.

Italy becomes first EU member state to pass an AI law (IAPP)

Italy’s AI law aligns with the EU AI Act while adding national requirements for health, labor, justice, and cloud infrastructure, including rules on anonymization, synthetic data, and worker protections. For GeoAI, this underscores the need to comply with both EU-wide and Italy-specific governance measures, particularly where geospatial models intersect with labor monitoring, health research, or sensitive data.

California Finalizes Regulations to Strengthen Consumers' Privacy (California Privacy Protection Agency)

California’s new CPPA regulations impose cybersecurity audits, risk assessments, and rules for automated decision-making technologies starting in 2026. For GeoAI, this means that location-based AI systems used in significant decision making (e.g., credit, housing, insurance, or employment) will face heightened compliance obligations around transparency, risk reporting, and accountability.

Deep Dive

I try to read anything Ed Parsons or Sean Gorman write about geospatial technology because they both have unique perspectives and do an excellent job explaining complex technical issues in a way that even a lawyer can understand. In the past week both wrote excellent articles that include discussions involving an issue I have been struggling: how will the geospatial community address the unique legal challenges AI poses.

In "SatCamp Hot Take: Diseconomies of Scale and the Case for Embeddings" Sean discusses the benefits of embeddings for the commercial satellite imagery sector. From Sean’s article:

“In practice, this means an imagery/model company can go from a one-off project-based business to a product-based one. The same global embedding model can support a long tail of customer needs. This means each fine-tuned slice serving a niche, but all powered by the same core. This turns “diseconomies of scale” into “economies of scope” with the ability to address more problems, faster, with less incremental cost.”

The problem, as described by Sean, is that “embeddings for satellite imagery are a postulation not a reality”. Yet, I regularly see organizations (companies, research institutions, etc.) that build models using embeddings highlighting the wonderful things that their GeoAI products and services can achieve. As a lawyer I wonder how much of this marketing can be put into contract.

Similarly, Ed discusses another technology empowering AI that has recently been getting a great deal of attention: the Model Context Protocol (MCP). In "Its still all about the data", Ed describes the MCP’s critical role in powering AI agents, reducing LLM hallucinations, and standardizing how models acquire the data they need. (As I served with Ed on the Board of the Open Geospatial Consortium, I pay very close attention when he speaks about standards). Ed describes the latter as the real long-term impact of MCP, stating that it shifts the focus “from how to connect data to what data to connect.”

But, as Ed points out, there are still challenges that need to be worked out with MCP. One of the most significant is that an MCP client can result in two-way connections to sensitive data. This raises significant security concerns, particularly if there is not a ‘human in the loop’.

Ed and Sean each explain how developing technologies will have a significant impact on AI – including GeoAI. (Apologies to both as I know they very much dislike the term “GeoAI”.) But they will also raise important legal considerations as these technologies are introduced more broadly in the commercial marketplace. It will be nearly impossible to address such technical complexity in law or regulation, given how fast the AI sector is developing. However, that does not mean that organizations can ignore the associated legal risks. For example, are standard contractual terms sufficient to protect a customer that procures a product or service with AI models built using embeddings. Or, what additional information security protections should be put into place when AI agents using MCPs are deployed?

The growing complexity of AI will make legal issues more challenging. As Sean and Ed point out, technologies such as MCP and embeddings can play a vital role in the growth of GeoAI. However, geospatial professionals and the legal community will need to work closely together to identify practical solutions. Geospatial professionals will need to understand the legal risks that will arise from their technological choices. Legal professionals representing geospatial companies will need to have a deeper understanding of their clients’ technology stack. The big question is whether either is ready for this new paradigm.

Interested In More?

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

GeoAI and the Law Newsletter is free but donations will be used to fund law students who wish to attend local geospatial conferences.

Share

FTC Cracks Down on 'AI Washing' (Federal Trade Commission)[KP1]

The FTC’s final order against a company offering an “AI Content Detector” highlights the risks of overstating the use of AI in products and services. The complaint alleged the company’s detector was far less accurate than advertised. The order included requirements that the company email eligible consumers about the consent order and submit compliance reports to the FTC one year after the order is issued and every year for the following three years. For companies offering GeoAI products and services, this case signals that regulators will scrutinize claims about AI model performance, especially when inaccurate claims could harm users or distort trust in AI-generated outputs. See the Deep Dive below for more.

Executive Order No. 24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians (NC Governor’s Office)

North Carolina’s order establishes a framework for “trustworthy AI” in state government, creating an AI Leadership Council and AI Accelerator to guide risk assessments, ethical governance, and transparency, including defining “high-risk” AI use cases (such as those involving sensitive or personal data). This means that AI products and services involving personal information or infrastructure data may become subject to state oversight, reporting obligations, and pilot-review processes.

California Lawmakers Pass Landmark Bill That Will Test Gavin Newsom on AI (Politico)

California lawmakers have passed a landmark AI accountability bill that would require transparency and safety assessments for companies deploying models that are considered high-risk. If the bill which now awaits Governor Newsom’s decision becomes law, certain GeoAI firms may be required to disclose how geospatial AI models are trained, validated, and monitored for bias or misuse.

Deep Dive

FTC Announcements on AI-Washing Settlements

The Federal Trade Commission (FTC) has significantly ramped up enforcement against the practice of making false, misleading, or unsubstantiated claims about the use or capabilities of artificial intelligence in products and services, referred to as “AI-washing”. The FTC has brought actions and announced settlements against companies across various sectors, including those touting AI-driven legal services, e-commerce solutions, and content detection tools. In these cases, the FTC may seek monetary penalties, require corrective consumer notifications, and prohibit future unsubstantiated AI-related claims.

Implications for Companies Promoting GeoAI

For companies promoting geospatial AI (GeoAI) products and services, these enforcement actions carry clear and immediate implications. GeoAI solutions, such as those offering advanced mapping, location analytics, or spatial data processing, often rely on complex algorithms and machine learning models. The FTC’s recent actions make it clear that any claims about the capabilities, accuracy, or benefits of such AI-driven geospatial tools must be truthful, substantiated, and not misleading. Companies must be able to provide “competent and reliable evidence” to support performance claims, especially if those claims are likely to influence purchasing decisions, involve critical decision-making or are marketed as providing significant advantages over traditional methods.

Heightened Scrutiny and Risk Management

The FTC’s focus on AI-washing means that companies in the GeoAI space should expect heightened regulatory scrutiny, particularly as the use of AI in geospatial applications becomes more widespread and commercially significant. This scrutiny is not limited to consumer-facing products; B2B solutions, government contracts, and investor communications are all within the FTC’s purview if claims about AI are made. Companies should implement robust internal review processes for marketing materials, ensure technical teams can substantiate claims with empirical evidence, and maintain clear documentation of testing and validation procedures. Failure to do so could result in enforcement actions, monetary penalties, and reputational harm.

To mitigate risk, companies promoting GeoAI should adopt best practices aligned with FTC guidance. Additionally, companies should monitor evolving regulatory expectations, as both federal and state authorities (and international regulators) are increasingly active in policing AI-related marketing.

Interested In More?

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

GeoAI and the Law Newsletter is free but donations will be used to fund law students who wish to attend local geospatial conferences.

Share

Global AI Governance Law and Policy: South Korea (International Association of Privacy Professionals)

South Korea’s new AI Basic Act (effective January 2026) positions the country as the world’s second comprehensive AI regulator after the EU, blending promotion of AI innovation with safeguards for trust, transparency, and human oversight. The law’s focus on high-impact systems, generative AI, and rights impact assessments means geospatial applications using AI (e.g., location analytics, surveillance, smart city systems) for certain applications will need to demonstrate accountability and transparency while navigating a framework that also encourages adoption and international cooperation.

FTC Announces Crackdown on Deceptive AI Claims and Schemes (Federal Trade Commission)

The FTC’s Operation AI Comply signals that regulators are moving beyond principles to active enforcement against deceptive AI claims, targeting companies that exaggerate capabilities, generate fake content, or sell AI-driven schemes. This crackdown underscores that claims about geospatial AI tools, from mapping accuracy to predictive analytics, must be transparent and evidence-based or they risk attracting regulatory scrutiny.

Generative AI Use and Management at Federal Agencies (Government Accountability Office)

The Government Accountability Office’s (GAO’s) review of federal agencies’ generative AI use highlights both rapid experimentation and serious concerns about potential risks around accuracy, security, and accountability. Of note from the report, “officials at 10 of 12 selected agencies said existing federal policy, such as data privacy policy, could present obstacles to adoption.” For companies offering products and services incorporating GeoAI, this report reinforces the need to have a clear understanding of how existing laws and policies could impact adoption.

Control Overlays for Securing AI Systems Concept Paper (National Institute of Standards and Technology)

NIST’s proposal for AI security control overlays adapts existing federal cybersecurity standards (SP 800-53) to address AI-specific risks like data integrity, model misuse, and multi-agent coordination. The proposal highlights the need to embed security and resilience into geospatial AI systems from the ground up, ensuring trustworthy mapping, analytics, and decision-support in sensitive applications.

Deep Dive

The U.S. Department of Justice’s Bulk Data Transfer Rule places unprecedented national-security controls on the collection, processing, storage, and disclosure of certain location-enabled data that is linked or linkable to a U.S. person. Companies that develop or deploy artificial-intelligence models trained on geolocation signals, or a demographic dataset capable of being linked to a person, should consider how the Rule applies to them.

Why the Rule Matters?

Breadth of “Location Information.” The Rule covers both certain types of demographic data (including addresses) and precise geolocation data, defined as any information (historical or real time) that identifies the position of an individual or device within 1,000 meters. Devices “with the capacity to store or transmit data that is linked or linkable to a U.S. person” are covered. This sweeps in smartphones, connected vehicles, wearables, IoT sensors, cameras, and more. Because only 1,000 U.S. devices’ worth of precise geolocation data meets the “bulk” threshold, even modest training or validation datasets can trigger the Rule.

Low Thresholds; High Penalties. Once location data crosses the bulk threshold, which for 736 sensitive areas on the Government-Related Location Data List is even a single datum, any “covered data transaction” with a country of concern or a covered person is either prohibited or heavily restricted. Civil penalties can reach the greater of $377,700 or twice the value of the transaction, with potential criminal exposure in egregious cases.

Hidden Transfer Risk in AI Workflows. “Transfer” is defined far beyond the traditional sale of data. Licensing an AI model (e.g., a chatbot) to third parties that can be used to access the training data, or hiring engineers who reside in a country of concern can each constitute a covered data transaction.

Due to the complexity of the Rule, and the nature of geospatial information, its applicability to any organization (the Rule applies to businesses, universities and NGOs) is fact specific. As a result, AI developers should consider mapping every downstream human and technical access path to determine whether the Rule applies.

Practical Tips

This edition’s practical tip, taken from the Australian Government’s Artificial Intelligence Model Clauses is intended to help ensure transparency in the underlying models:

“The Seller must ensure that the Approved underlying AI model conforms to the requirements:

a. stated in the Statement of Requirement/Specification; or

b. approved in writing by the Buyer, including:

1. its country of origin;

2. the details of its ownership; and

3. the location of data at rest and during processing.”

Interested In More?

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Share

AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems (Joint Cybersecurity Information)

A joint publication of the National Security Agency’s Artificial Intelligence Security Center, the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the Australian Signals Directorate’s Australian Cyber Security Centre, the New Zealand’s Government Communications Security Bureau’s National Cyber Security Centre and the United Kingdom’s National Cyber Security Centre, this document provides comprehensive guidance on safeguarding data throughout the AI system lifecycle.

Proposed Moratorium on US State AI Laws is Short-Sighted and Ill-Conceived (Tech Policy Press)

Regardless of one’s view on a bill that would put a 10-year moratorium on the ability of states to enforce restrictions on AI, this article does an excellent job of explaining the state of play in the U.S. on this issue.

In Lawsuit Over Teen's Death, Judge Rejects Arguments that AI Chatbots Have Free Speech Rights (Associated Press)

Judge finds that claims that AI’s outputs were protected by First Amendment are not enough to stop case from moving forward. Judge also reportedly found that the chatbot has attributes of a product, making it subject to product liability claims, which are often easier to prove than negligence.

Artificial Intelligence (AI) Model Clauses (Commonwealth of Australia)

Australia’s Digital Transformation Agency created standalone model clauses to assist government agencies procuring both services where the seller may be using AI systems in the provision of the services as well as bespoke AI systems. While only applicable in Australia, it is a useful reference to businesses selling AI services or systems to government agencies across the globe.

EU AI literacy not a far jump for established privacy professionals, regulator says (International Association of Privacy Professionals)

Readers of this newsletter will know that we frequently allude to the overlap between data protection and AI. As a result, it was not surprising for us to read that an Irish data protection commissioner said privacy and data protection professionals are well suited to bring their institutions up to speed on EU artificial intelligence literacy requirements.

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law.

Share

Driving Efficient Acquisition of Artificial Intelligence in Government (White House)

This White House memorandum, M-25-22, provides guidance to federal agencies on how to efficiently and responsibly acquire artificial intelligence (AI) systems and services, emphasizing competition, performance tracking, risk management, and cross-functional engagement. It directs agencies to update their policies and establish processes for protecting intellectual property rights and privacy when procuring AI.

California Attorney General’s Legal Advisory on the Application of Existing California Laws to Artificial Intelligence (Attorney General of California)

This California Attorney General's legal advisory provides guidance to consumers and entities developing or using AI about their rights and obligations under existing California laws, including those related to consumer protection, civil rights, competition, and data privacy.

Updated EU AI model contractual clauses (European Commission)

The Public Buyers Community of Interest has released an updated version of the EU model contractual clauses for AI procurement. These clauses are designed to support public buyers in acquiring trustworthy, fair, and secure AI-enabled solutions. The updated resource includes a full version for high-risk AI aligned with the EU AI Act, a customizable light version for non-high-risk AI, and a commentary providing guidance on their use.

Third Draft of the General-Purpose AI Code of Practice published, written by independent experts

The third draft of the General-Purpose AI Code of Practice has been published by independent experts to gather stakeholder feedback for finalization in May. This version features a more streamlined structure with refined commitments and measures related to transparency, copyright, and safety/security, with specific obligations for models posing systemic risks. This Code aims to be a tool for general-purpose AI model providers to demonstrate compliance with the AI Act by incorporating state-of-the-art practice.

NYT case against OpenAI and Microsoft can advance (Axios)

The court in this case addressed motions to dismiss copyright infringement and related claims brought by The New York Times, Daily News, and The Center for Investigative Reporting against Microsoft and OpenAI. The court denied motions to dismiss claims of direct infringement pertaining to the statute of limitations as well as contributory copyright infringement against both defendants. However, the court granted motions to dismiss on other claims including common law unfair competition claims and several Digital Millenium Copyright Act (DMCA) claims.

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law.

Share