Editor’s Note

I published the first issue of this newsletter in March 2024. While the pace of change in artificial intelligence of both the technology and its adoption since then has been obvious to even the most casual of observers, developments in law and policy have been less obvious. But it would be a mistake to think that there has been none, or that AI is unregulated. After reviewing the past 49 issues of this newsletter, it is clear that while the legal landscape for AI is fragmented, it is becoming more concrete and is beginning to affect the geospatial sector.

This special edition does two things. First, it identifies five news items since March 2024 that I believe have, or will have, the most defined impact on geospatial AI from a legal standpoint. Second, it reviews the Deep Dive series and the arcs it traced.

Part 1: Top 5 Articles

1. EU Passes Comprehensive AI Rules (March 18, 2024) (European Parliament News)

In March 2024, the EU passed a comprehensive law regulating AI. The EU’s passing of the AI Act is certainly one the most significant legal and policy developments over the past two years. The AI Act is intended to balance innovation with perceived risk, but raises a number of questions. Companies that sell GeoAI products and services in Europe should determine whether they will be subject to the AI Act provisions that regulate 'high-risk AI systems', as these are the most onerous, and consequential.

2. DOJ’s Bulk Data Transfer Rule Applied to AI (September 4, 2025) (Federal Register)

The U.S. Department of Justice's Bulk Data Transfer Rule (the “Rule”) places unprecedented national-security controls on the collection, processing, storage, and disclosure of certain location-enabled data that is linked or linkable to a U.S. person. Companies that develop or deploy artificial-intelligence models trained on certain types of geospatial information capable of being linked to a person, should consider how the Rule applies to them. The Rule covers both certain types of demographic data (including addresses) and precise geolocation data, defined as any information (historical or real time) that identifies the position of an individual or device within 1,000 meters. Because only 1,000 U.S. devices' worth of precise geolocation data meets the 'bulk' threshold, even modest training and validation datasets can trigger the Rule. 'Transfer' is defined far beyond the traditional sale of data. For example, licensing an AI model (e.g., a chatbot) to third parties that can be used to access the training data, or hiring engineers who reside in a country of concern can each constitute a covered data transaction.

3. California AB-2013 — Generative AI Training Data Transparency Act (October 3, 2025) (California Legislative Information)

California's new AI Training Data Disclosure Law requires developers of generative AI systems to publish detailed information about the datasets used to train generative AI models. For GeoAI companies, this means they will need to reveal whether geospatial datasets include personal or proprietary information, raising compliance, intellectual property, and privacy considerations.

4. GSA's Proposed AI Contract Clause 552.239-7001 (March 24, 2026) (GSA.gov)

The U.S. General Services Administration (GSA) released a draft contract clause designated 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems, that if finalized, will be inserted into every GSA solicitation and contract for AI capabilities. For geospatial companies selling AI-powered products and services to the federal government, this proposed clause represents a consequential shift in the procurement landscape. The clause touches upon many aspects of a geospatial AI vendor;s products and pipelines, including strict data ownership rules to an outright prohibition on foreign AI components.

5. European Commission Draft Guidelines on High-Risk AI Classification under Article 6 (June 4, 2026) (European Commission)

On June 4, 2026, the European Commission published draft guidelines for stakeholder consultation on the classification of high-risk AI systems under Article 6 of the EU AI Act (Regulation (EU) 2024/1689). Issued pursuant to Article 6(5) of the Act, the package consists of a general-principles document and two annex-specific chapters addressing the two routes by which an AI system becomes 'high-risk'. One such route is Article 6(1), covering AI that is itself a product, or a safety component of a product, regulated under the legislation listed in Annex I. The other route is Article 6(2), covering the eight use-case areas listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice).

For geospatial organizations, the draft offers something the Act itself did not: concrete examples, several of which specifically reference satellite imagery, drones, thermal sensors, and spatial-analytics platforms. The most important takeaway for geospatial professionals is that classification turns on the intended purpose a provider assigns to a system, not on the technology used or where it is deployed.

Part 2: Review of the Deep Dive Series

Most of the issues featured a Deep Dive on a specific legal topic. But two threads run longest and matter most for practitioners: how the EU AI Act's high-risk framework reaches geospatial systems, and how contracts are becoming the primary mechanism for allocating GeoAI risk. Part 2 traces those two arcs through the Deep Dives that built them.

Theme 1: High-Risk Systems Under the EU AI Act — What It Means for Geospatial

The high-risk thread opened in March 2024 with coverage of the AI Act’s passage and an early flag that “high-risk AI systems” would be the regulatory category most critical for geospatial vendors to track. A July 2024 Deep Dive then walked through what “high-risk” actually means under the Act, particularly the Annex III categories most likely to capture GeoAI applications: critical infrastructure, law enforcement, migration and border control, and essential public services.

By September 2024, the analysis became concrete: how does the Act apply when a geospatial business fine-tunes a foundation model such as NASA/IBM’s Prithvi? That fine-tuning question was revisited in November 2025 under Article 3(2), with attention to the compute thresholds that determine provider status, because who counts as the “provider” determines who bears the bulk of the compliance burden under the Act.

By March 2026, the focus shifted to operational compliance. A Deep Dive walked through what a high-risk geospatial AI vendor needs to have in place before the high-risk obligations begin (e.g., technical documentation under Annex IV, post-market monitoring, conformity assessment, quality management systems, and registration in the EU database). In May 2026, the EU Digital Omnibus reform pushed several of these deadlines back but did not change the substantive obligations.

And in June 2026, the Commission’s draft Article 6 guidance gave the clearest answer yet to the foundational question for any geospatial vendor: when is a system actually high-risk? The Commission’s illustrative examples (i.e., satellite imagery for search-and-rescue versus border-control surveillance; thermal sensors detecting human presence in uninhabited areas versus at frontiers) read like a glossary of geospatial practice.

The arc has a clear message: high-risk classification is not a single yes/no determination but a chain of judgments. Factors to consider include the system’s intended purpose, whether the vendor is acting as a provider or a downstream deployer, and which Annex III use case (if any) applies. Two years of Deep Dives have moved the field from “watch the EU AI Act” to “manage your high-risk classification as a live document, with the Commission’s guidance as your starting framework.”

Theme 2: Allocating GeoAI Risk Through Contracts

A separate but converging thread is the emergence of contract law as driving the most significant legal obligations associated with GeoAI. The first Deep Dive on this theme, in early 2025, made an argument that has continued to hold up. For most geospatial buyers and vendors, contract law would do more practical regulatory work than statutes. (Of note, this was often the case with privacy and cybersecurity - contractual requirements, particularly from large enterprises - predated comprehensive legal frameworks.) Limitation-of-liability clauses, liability caps, and accuracy disclaimers would be where GeoAI adoption was actually shaped or stalled. AI vendors were marketing performance parity claims while disclaiming any liability for failures in the systems. Even then, the gap between contractual risk allocation and marketing language was an issue.

By late 2025, the analysis became specific. A Deep Dive enumerated the AI-specific contract clauses geospatial counsel should consider drafting or negotiating. These included data rights (separating training-data inputs from derivative outputs), accuracy service-level commitments, bias-testing obligations, privacy and data-residency provisions, and national-security clauses (particularly where federal or defense contracts are in play). Each clause maps to a specific GeoAI risk, an imagery model that drifts, a routing model that misclassifies a sensitive site, a fine-tuned model whose outputs leak protected data.

Insurance entered the picture in early 2026, when carrier appetite for AI risk narrowed. A Deep Dive documented the new exclusions, sublimits, and deepfake-specific carve-outs that firms could expect to encounter on renewal. Contract counterparties cannot simply assume that residual risk allocated under indemnities or liability caps will actually be backed by an insurance recovery, if it materializes. The contract has to do more work because the insurance is doing less.

By March 2026, the contract story became a procurement story. A Deep Dive on GSA’s proposed clause 552.239-7001 showed how a single federal acquisition clause was poised to vest broad ownership of “Government Data” and any “Custom Development” in the United States, prohibit use of customer data to improve commercial models, and impose strict data-localization and segregation requirements. For many geospatial vendors, that one clause is more consequential than any U.S. AI statute. In April 2026, the California Executive Order N-5-26 Deep Dive showed the same pattern at the state level: procurement, not legislation, was leading the substantive governance work.

The arc’s message for geospatial professionals is that today’s operative legal framework for most GeoAI risk allocation is the contract, not the statute. The questions to consider in every deal include who owns the inputs and outputs, who is the “provider” for downstream regulatory purposes, what accuracy and bias guarantees are being made (and at what liability cap), and whether insurance will actually respond to the risks the contract assigns. And, for sales to government customers, what procurement clauses apply.

Closing

Fifty issues is a small number against the time horizon of the legal questions this newsletter tracks. The EU AI Act will be revised and reinterpreted for years. State patchworks will strengthen, conflict, and be litigated. Procurement clauses will be incorporated into laws. New foundation-model architectures (i.e., world models) will raise new issues.

But if you work in geospatial, my advice after fifty issues is the same as it was in Issue #1: the legal exposure from AI in your work is real, and the rules aren’t waiting for you to catch up. Read your contracts. Read the procurement clauses. Keep an eye on state bills and EU AI Act implementation. And where you can, get involved by contributing to the policies, standards bodies, and Bodies of Knowledge that are moving faster than legislators.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Deep Dive

When is Your GeoAI System “High-Risk”? The EU Commission Draws the Lines

In May, the European Commission published draft guidelines for stakeholder consultation on the classification of high-risk AI systems under Article 6 of the EU AI Act (Regulation (EU) 2024/1689). Issued pursuant to Article 6(5) of the Act, the package consists of a general-principles document and two annex-specific chapters addressing the two routes by which an AI system becomes “high-risk”: Article 6(1), covering AI that is itself a product, or a safety component of a product, regulated under the legislation listed in Annex I; and Article 6(2), covering the eight use-case areas listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice).

The guidelines are not binding, and authoritative interpretation ultimately rests with the Court of Justice. But they are the clearest signal yet of how the Commission expects providers and deployers to self-assess classification. This timing matters as under the recently agreed Digital Omnibus, the high-risk obligations these guidelines interpret are now staggered, with Annex III duties applying from 2 December 2027 and Annex I duties from 2 August 2028. For geospatial organizations, the draft offers something the Act itself did not: concrete examples, several of which specifically reference satellite imagery, drones, thermal sensors, and spatial-analytics platforms.

Intended Purpose, Not the Sensor, Decides

The most important takeaway for geospatial professionals is classification turns on the intended purpose a provider assigns to a system, not on the technology used or where it is deployed. The Commission states plainly, in the migration and border-control context, that “the place of deployment and the sensor modality are not decisive.” The same satellite feed or thermal camera can be high-risk or out of scope depending entirely on what the provider says the system is for.

The guidelines illustrate this with examples that map directly onto geospatial practice:

• A system that uses drone or satellite imagery to detect human presence in vast uninhabited areas to support search and rescue, relying on non-biometric cues, is not high-risk.

• But “AI-combined satellite imagery services, surveillance towers or unmanned platforms that flag human presence” to cue a border-control response fall squarely within Annex III, point 7(d), and are high-risk. So does maritime surveillance that detects and tracks persons for border operations. Of note, the Commission is explicit that this holds “irrespective of whether the platform operates in territorial waters, the contiguous zone or on the high seas.”

While the sensing capability is the same, the uses differ. The line is the purpose the provider markets and documents.

This carries a sharp consequence for vendors of general-purpose or multi-use geospatial tools. The general-principles guidance warns that where a system is presented as “broadly applicable across a generality of contexts” and does not “consistently limit its application or exclude high-risk uses,” its intended purpose will be deemed to encompass high-risk use cases. Critically, a disclaimer is not enough: “merely asserting (for example in the terms of service) that high-risk uses are excluded is insufficient” where the provider’s overall presentation, examples, or product positioning effectively promotes such uses. Any limitation must be “clearly, concretely, and coherently described across all materials.”

Critical Infrastructure: Only “Safety Components” Count

Although GeoAI is woven into the management of roads, utilities, and networks, the guidelines confirm that not every such system is high-risk. Under Annex III, point 2, a system qualifies only if it is a safety component that directly protects the physical integrity of the infrastructure by preventing, controlling, or mitigating risks of physical harm. Systems that are “merely supportive, informational, organizational or optimization-oriented” do not qualify.

The Commission’s worked example is instructive: an AI-enabled traffic-flow optimization platform built on real-time data “provides insights but [does] not directly protect physical integrity,” and is therefore not high-risk, while a system that detects abnormal infrastructure behavior and triggers a protective response is. A second condition is easy to overlook: the system must actually be used by an entity formally identified as a critical entity, though, as the guidance notes, that status need not be disclosed to the provider, and many deployers will simply demand high-risk-grade compliance in procurement.

For Annex III systems, there is an escape hatch under Article 6(3) A system that performs only a narrow procedural task, improves a completed human activity, detects decision patterns, or performs a preparatory task may be exempted. Indexing, searching, format conversion, and de-duplication of imagery or case files may qualify under this exemption. But two limits matter for geospatial work. First, the exemption never applies to the Annex I (product-safety) route. Second, the filter is unavailable to any system that performs profiling, and the Commission’s definition expressly includes evaluating a person’s “location or movements” as profiling Much location-analytics work that infers patterns of life from spatial traces will therefore remain high-risk regardless of how narrow the task appears. Providers claiming the exemption must document the assessment and register the system in the EU database.

What Geospatial Professionals Should Do Now?

The runway created by the Digital Omnibus is time to prepare. Practitioners should:

1. Pin down intended purpose in writing. Audit your instructions for use, sales materials, and technical documentation to ensure any limitation on high-risk uses is concrete, consistent, and credible (i.e., not a buried disclaimer).

2. Classify by route. For each product, determine whether it travels the Annex I (safety-component) or Annex III (use-case) path as they carry different obligations (e.g., only the latter can use the 6(3) filter.)

3. Watch the surveillance line. Treat any system that detects, tracks, or identifies persons for border, migration, or law-enforcement response as high-risk. Conversely, clearly segregate genuine search-and-rescue or navigation-safety functions.

4. Test the filter carefully. Before relying on Article 6(3), confirm the system does not profile (including through inference of location or movement) and document the analysis.

5. Push the obligations into procurement. Deployers in critical-infrastructure and public-authority contexts should require high-risk-grade compliance contractually, regardless of vendor claims.

These draft guidelines remain open for feedback through June 23, 2026: geospatial organizations that are doing business in Europe should consider responding while the examples are still being written.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• How NATO’s call for common standards on AI-enhanced geospatial intelligence will reshape model documentation, training-data provenance, and confidence-threshold requirements for commercial GeoAI vendors selling into allied defense markets.

• Why Colorado’s pivot from algorithmic risk management to transparency disclosures under SB 189 narrows the immediate compliance burden on GeoAI vendors but raises the documentation bar for spatial decision systems.

• How the EU’s May 2026 Digital Omnibus political agreement reshapes the AI Act compliance timeline for geospatial professionals, and the concrete steps GeoAI organizations should take during the additional runway before December 2027.

What’s New

NATO Needs Policies, Standards for Sharing AI-Enhanced Geospatial Intel: Official (Breaking Defense)

Speaking at GEOINT on May 5, 2026, UK Royal Marine Maj. Gen. Paul Lynch, NATO Deputy Assistant Secretary General for Intelligence, told attendees that “the path to AI-enabled, allied intelligence advantage runs primarily through governance, not necessarily through additional capability,” noting the need to address “a set of legal and contractual frameworks that were written for most of those capabilities existed”. For commercial GeoAI vendors selling into the defense and intelligence community, Lynch’s remarks suggests that NATO will increasingly require model documentation, training-data provenance, and confidence-threshold disclosures as contractual obligations associated with use within allied intelligence workflows.

Amendments Move Colorado AI Act’s Focus from Risk to Transparency (IAPP)

Colorado Senate Bill 189, introduced in May 2026, and signed into law by Colorado’s governor on May 14, postpones the Colorado AI Act’s effective date from June 30, 2026 to January 1, 2027 and fundamentally restructures the law from a risk-management regime into a transparency-focused one. For GeoAI organizations, the new law reduces the immediate substantive compliance burden of the Colorado AI Act but shifts the operational focus to documentation.

Deep Dive

What the EU AI Act Reform Means for Geospatial Professionals

On May 7, 2026, EU legislators reached a provisional political agreement on the "Digital Omnibus on AI", the long-awaited reform of the EU Artificial Intelligence Act (the “AI Act”). For the geospatial community, the key element of the reform package is that the original compliance deadline of August 2, 2026, for high-risk AI systems has been split into two staggered dates. Organizations with systems involving biometrics, critical infrastructure, education, employment, law enforcement, migration, asylum, and border control management now have until December 2, 2027, to comply. Compliance for AI systems embedded in regulated products is not required until August 2, 2028.

Other changes worth noting for geospatial professionals include:

• The Commission has clarified that organizations may process personal data "where strictly necessary to detect and correct biases, with proper safeguards, both in high-risk and non-high-risk AI systems";

• The deadline for establishing national AI regulatory sandboxes has shifted to 2 August 2027, with a new EU-level sandbox added to the mix;

• Certain SME accommodations have been extended to small mid-cap companies;

• The obligation to register high-risk systems in the EU public database has been reinstated.

• The grace period for AI-generated content transparency has been compressed from six months to three, with a new deadline of 2 December 2026.

Why the AI Act Matters: Many GeoAI Applications Are Already High-Risk

The EU Act will impact many geospatial companies offering GeoAI products and services in Europe. For example, as noted in the 2025 publication, “From Bias to Accountability: How the EU AI Act Confronts Challenges in European GeoAI Auditing”, a number of common GeoAI applications meet the AI Act's definition of high-risk systems. As the authors point out these include a number of the eight high-risk contexts listed in Annex III of the AI Act:

What to do Between Now and December 2027

The political agreement still needs formal endorsement and adoption by Parliament and Council, followed by legal-linguistic revision and publication in the Official Journal, with co-legislators aiming for adoption before August 2, 2026. Geospatial professionals selling products and services in Europe should use the additional time to take a number of steps:

1. Inventory your AI by identifying every model, pipeline, and downstream product in your organization that ingests geospatial data and produces predictions, recommendations, or decisions.

2. Run a regulatory impact assessment that classifies each system as prohibited, high-risk, limited-risk, or minimal-risk (For systems used in critical infrastructure or law enforcement contexts, assume high-risk classification by default.)

3. Build a bias-audit capability now that provides on steady normalization of transparent, context-specific audits.

4. Prepare for the high-risk registry.

5. Align AI Act work with GDPR governance particularly for any product that combines location traces with demographic inference.

6. Engage with the national and EU-level sandboxes to test high-risk GeoAI in a supervised environment before the full EU AI Act regime comes into force.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

Virginia Becomes Third State to Ban Sale of Consumers’ Precise Geolocation Data (Regulatory Oversight)

On April 13, 2026, Virginia Governor Abigail Spanberger signed SB338 into law, amending the Virginia Consumer Data Protection Act (VCDPA) to prohibit data controllers from selling consumers' precise geolocation data, defined as information identifying a person's location within a 1,750-foot radius. The amendment, which takes effect July 1, 2026, replaces the prior consent-based regime for this category of sensitive data with an outright sales ban and makes Virginia the third state, after Maryland and Oregon, to adopt this approach.

GAO Report on Federal AI Acquisitions: Lessons from NGA's Maven Program (U.S. Government Accountability Office)

The GAO released report GAO-26-107859 on April 13, 2026, examining how the Department of Defense, Department of Homeland Security, General Services Administration, and Department of Veterans Affairs are acquiring AI capabilities. The report finds that agencies are repeatedly learning the same lessons in isolation and uses the National Geospatial-Intelligence Agency's Maven program, which applies machine learning and computer vision to geospatial imagery for object detection and target identification, as a benchmark of mature federal AI procurement, while flagging persistent challenges around defining requirements, securing IP and data rights, and maintaining vendor accountability under Agile development cycles.

Deep Dive

Why Every Geospatial Organization Should Pay Attention to the Royal Institution of Chartered Surveyors (RICS) AI Guidance

On September 2025, the Royal Institution of Chartered Surveyors (RICS) published its first-ever professional standard on the responsible use of artificial intelligence in surveying practice, effective March 9, 2026. At first glance, this may seem like a narrow document aimed at the surveying profession. But it is a useful tool for geospatial professionals across all disciplines.

This Deep Dive unpacks what the RICS standard requires, maps those requirements against the emerging legal and regulatory landscape, and explains why every geospatial organization should treat this document as a model for its own AI governance.

What the RICS Standard Requires

The standard is organized around seven pillars, each of which maps directly to an area of active regulatory development:

1. Baseline Knowledge. Members who use AI systems should develop and maintain a basic understanding of the different types and subsets of AI systems and their limitations, the risk of erroneous output, the inherent risk of bias, and data usage and data risks

2. Data Governance. Firms should safeguard private and confidential data by storing it securely, restricting access to staff who strictly need it, training staff at least annually on privacy and confidentiality risks, preparing data in ways that protect privacy such as anonymization, and refraining from uploading private and confidential data to AI systems except where there is express written consent and the firm has taken reasonable steps to confirm the system does not pose an unacceptable risk.

3. System Governance. Before using an AI system with material impact, firms should carry out and record in writing an assessment of whether AI is the most appropriate tool, considering the nature of the task, alternative tools, environmental and stakeholder impact, data risks, and the risk of erroneous or biased output. Firms should also maintain a written register of every AI system used, the purpose for which it is used, the date of first use, and the date on which its appropriateness will next be reviewed. And they should develop responsible use policies that detail roles, responsibilities, and liabilities, require at least annual training, state how human control and judgment will interact with AI, and provide guidance on identifying and mitigating risks.

4. Risk Management. Firms should create and operate a risk register documenting overarching risks, such as bias, erroneous outputs, data quality limitations, and retention of input data. Each risk should be rated by likelihood, impact, and mitigation plan and updated at least quarterly.

5. Procurement, Due Diligence, and Use. Before procuring a third-party AI system, firms should conduct detailed due diligence including written requests for information about the system's environmental impact, development stakeholders, data law compliance, permissions for individual data, the accuracy, relevance, and diversity of training datasets including known gaps and bias risks, and the type and extent of the provider's liability. Firms should apply professional judgment to assess the reliability of every AI output with material impact and document that assessment in writing, including assumptions, key reliability concerns, and a conclusion on whether the output can reasonably be used for its intended purpose.

6. Transparency and Client Communication. Firms should make clear to clients, in writing and in advance, when and for what purpose AI is to be used. Engagement terms must detail which parts of the service involve AI, the extent of professional indemnity cover for AI use, internal processes to contest AI use, processes for client redress, and how a client can opt out of AI use. Firms must be able to explain the type of AI system used, its basic workings and limitations, the due diligence carried out, how risks are managed, and the reliability decisions made about its outputs.

7. AI Development. Firms directly developing AI systems should apply these provisions to the development process, record the system's identifiable application, potential risks and benefits, and other approaches to the same task. They should carry out a sustainability impact assessment, select diverse stakeholders for development, document compliance with data and confidentiality laws, obtain written permissions for personal data use, and have policies to assess data quality and reliability.

Why This Matters: Alignment with the Global Regulatory Trajectory

The RICS standard lands when AI governance is transitioning from voluntary principle to enforceable obligation across every major jurisdiction where geospatial organizations operate. For example, there are strong parallels between the RICS standard and the EU AI Act’s high-risk obligations. The RICS requirements for risk management, data governance documentation, human oversight through professional judgment, transparency to clients, and procurement due diligence all map directly onto the Act’s mandatory framework. Geospatial AI uses can fall across the EU risk spectrum, from minimal-risk map rendering to high-risk applications that influence safety-critical navigation, critical infrastructure, or significant eligibility determinations. Any geospatial organization that implements the RICS standard’s governance structure will find itself well-positioned to demonstrate compliance with the EU AI Act’s core requirements.

The RICS standard’s transparency and client communication requirements (e.g., requiring advance written disclosure of AI use, detailed terms of engagement, and explainability on request) are directly responsive to the disclosure obligations emerging across U.S. states. For geospatial professionals operating across state lines, the RICS framework provides a compliance-forward posture that anticipates the convergence these state laws are driving toward.

The Geospatial-Specific Case for Adoption

Geospatial AI demands governance because location data can be highly identifying, spatial outputs often drive consequential decisions about people and infrastructure, and spatial errors can propagate widely through dependent systems. Privacy and security are amplified by the sensitivity of precise geolocation and the risk of linkability across datasets. Fairness demands careful management of geographic and demographic disparities in data coverage and model performance. Safety and reliability require controls against false detections, and spurious correlations.

The RICS standard addresses these domain-specific risks with practical requirements that any geospatial organization can adapt. Its insistence on data governance, including restrictions on uploading confidential data and requirements for anonymization, directly addresses geolocation privacy concerns. Its due diligence requirements for training data accuracy, relevance, diversity, and known gaps in data address the spatial bias risks that are endemic to geospatial AI. [Its transparency requirements for client-facing disclosures anticipate both the EU AI Act’s user-information obligations and the U.S. state-level disclosure mandates described above. Even if your organization has no connection to RICS, the standard provides a practical governance template that positions you ahead of regulatory requirements.

Practical steps to consider include:

• Conduct a Gap Assessment. Mapping your current AI policies, processes, and controls against the RICS standard's requirements for data governance, system governance, risk management, procurement due diligence, output assurance, and client transparency. Identify where your practices fall short.

• Build Your AI Register. The RICS requirement to maintain a written register of every AI system with material impact, including its purpose, first use date, and next review date, is one of the simplest and most powerful governance controls available.

• Formalize Your Risk Management. Establish a risk register that documents bias, accuracy, data quality, and data retention risks for every AI system, with RAG ratings and quarterly reviews. Risk management should adopt spatially aware metrics for reliability, fairness, and safety and embed testing for spatial drift and adversarial behavior.

• Strengthen your procurement process. When evaluating AI vendors, adopt the RICS due diligence checklist as a baseline: demand written information about training data provenance, accuracy, diversity, known bias risks, data law compliance, and liability allocation. Third-party risk management should incorporate contract clauses for spatial data provenance, allowed territories and use cases, resolution limits, and audit rights.

• Update your client-facing disclosures. Review your terms of engagement, service agreements, and client communications to ensure they disclose when and how AI is used, what parts of the service involve AI, and how clients can seek redress or opt out.

• Invest in professional development. The RICS standard's baseline knowledge requirements is a model for any geospatial organization's training program. Geospatial organizations should integrate interdisciplinary curricula that combine geospatial science, AI methodologies, and legal requirements.

Conclusion

The RICS standard is not just another set of guidelines gathering dust in a professional body’s publication archive. The requirements it sets forth (i.e., documented risk management, structured due diligence, written output assessments, advance client disclosure, and ongoing competency development) are the same requirements now being codified into law in jurisdictions around the world. Compliance burdens are present and increasing, and AI governance will become an important part of daily life for all geospatial professionals.

Geospatial organizations that adopt these practices now will not only reduce their legal and professional risk but will also build the trust and credibility that clients increasingly demand. Those that wait may find themselves scrambling to catch up as regulation overtakes them.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Deep Dive

California’s Executive Order N-5-26: A Case Study in Procurement-Driven AI Governance

On March 30, 2026, California Governor Gavin Newsom signed Executive Order N-5-26, aimed at shaping the responsible procurement and deployment of Generative AI across state government operations. The order builds on California’s earlier Executive Order N-12-23, issued in September 2023, which initiated the state’s efforts to safely learn, innovate, and use GenAI for the benefit of Californians and state workers.

The new executive order is notable for the mechanism it employs: rather than enacting new substantive legislation or promulgating traditional administrative regulations, it directs state agencies to embed AI safety and accountability standards directly into the state contracting and procurement process. The order explicitly recognizes that “public procurement represents one of the most powerful tools available to governments to shape market behavior and encourage responsible innovation”.

Specifically, the order directs the Department of General Services (DGS) and the Department of Technology (CDT) to submit recommendations for new certifications that may be incorporated into state contracting processes, requiring entities seeking to do business with California to attest to and explain their policies and safeguards to protect public safety. These certifications must address, among other things, the exploitation or distribution of illegal content, the utilization of models that display harmful bias or lack governance to reduce such bias, and the violation of civil rights and civil liberties including free speech, voting, human autonomy, and protections against unlawful discrimination, detention, and surveillance.

The order also directs the Government Operations Agency (GovOps) to recommend reforms to contractor responsibility provisions, including suspension and ineligibility authorities, to ensure state entities do not contract with companies judicially determined to have unlawfully undermined privacy or civil liberties. Additional provisions require state agencies to share best practices on responsible AI procurement, update the State Digital Strategy to leverage GenAI for transparency and accountability, and publish a data minimization toolkit with best practices, templates, special contract provisions, and program review checklists. The order further mandates that CDT issue best practice guidance for departments to appropriately watermark AI-generated or significantly manipulated images or video in accordance with California Business & Professional Code §§ 22757.2 & 22757.3.

For geospatial professionals, the watermarking and provenance requirements deserve special attention. As AI is increasingly used to generate or manipulate satellite imagery, aerial photography, and geospatial visualizations, the ability to distinguish between authentic and AI-generated or AI-altered spatial data will become a critical issue of professional practice and legal compliance.

The Contract, Not the Statute: How U.S. AI Law Is Being Shaped by Procurement and Contractual Terms

Perhaps the most important takeaway from California’s approach for geospatial professionals is what it reveals about the primary mechanism through which AI governance is taking shape in the United States. Unlike the European Union, which has enacted comprehensive AI legislation through the EU AI Act, the United States has not passed broad federal AI legislation. Nor has the federal government, particularly under the current administration, pursued an aggressive regulatory posture toward AI. The result is a governance vacuum that is increasingly being filled not by statutes or regulations, but by contractual terms.

California’s Executive Order N-5-26 is a leading example of this dynamic. The order does not create new enforceable legal rights or benefits. In fact, in a likely nod to the recent White House Executive Order intended to restrict state legal oversight of AI, it expressly states that it “is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity”. Instead, it works through the contracting power of the state. Companies that wish to sell AI products and services to California (the fifth-largest economy in the world) will need to meet certification, attestation, and safeguard requirements as a condition of doing business. In effect, the terms of procurement contracts, not statutes, become the binding rules governing AI safety, bias mitigation, data privacy, and civil liberties protection.

This procurement-driven model has several important implications for geospatial professionals. Specifically, it:

• Means that the legal obligations governing your use and deployment of GeoAI tools may not be found in any statute or regulation at all, but rather in the terms and conditions of the contracts under which you procure or license those tools. Vendor agreements, service-level agreements, data-use licenses, and government procurement contracts are becoming the de facto regulatory instruments for AI in the United States.

• Means that the landscape is inherently fragmented. Different government agencies, at the state and local level, may impose different procurement-based requirements. California’s approach, shaped by its status as home of many of the top AI companies may differ significantly from what other states require. Geospatial firms operating across multiple jurisdictions will need to track and comply with a patchwork of contractual obligations rather than a single, uniform regulatory framework.

• Shifts the burden of due diligence onto the practitioner. In the absence of clear legislative standards, geospatial professionals must proactively evaluate the AI tools they use. This includes assessing whether those tools have been vetted for bias, whether the underlying training data implicates privacy concerns, whether outputs are appropriately watermarked or documented, and whether the contractual terms under which those tools are procured adequately allocate risk. The California order’s emphasis on data minimization toolkits and special contract provisions underscores this point.

• Signals that procurement power, particularly the purchasing power of large state governments, is likely to be the most significant driver of AI standards in the near term. California’s CDT Chief Information Security Officer (CISO) is also empowered to review federal supply chain designations and federal procurement changes, and to issue guidance allowing state agencies to continue procuring from companies if the CISO concludes that a federal designation is improper. This creates a layer of state-level procurement oversight that may, in practice, set the floor for responsible AI standards in the geospatial industry and beyond.

What Geospatial Professionals Should Do Now

The rapid evolution of GeoAI governance through contractual and procurement mechanisms imposes additional requirements upon geospatial professionals. Practitioners should begin by auditing the contractual terms with vendors under which they procure or license AI-powered geospatial tools, paying particular attention to provisions related to data privacy, bias governance, output provenance, and civil liberties protections. Firms doing business with California or other state governments should anticipate new certification and attestation requirements and begin developing internal policies and documentation that demonstrate responsible AI practices. Finally, because the law in this space is being written in contracts rather than codified in statutes, geospatial professionals should consider engaging legal counsel experienced in both technology procurement and AI governance to ensure that as this landscape continues to evolve, their practices remain compliant.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

European Parliament votes to delay EU AI Act implementation (CIO)

The European Parliament voted to delay application of the EU AI Act's rules on high-risk AI systems, pushing key deadlines to as late as 2027 and 2028, though the delay still requires approval from the Council of the European Union. Analysts broadly cautioned CIOs against treating the delay as a reprieve, warning that the operational, legal, and reputational risks of poorly governed AI are already present and that organizations should use the extra time to strengthen compliance and governance frameworks rather than wait for final regulatory clarity.

Deep Dive

Last edition of the newsletter referenced two different visions of what federal law in the U.S. should look like: the Trump Administration’s White House National Policy Framework for Artificial Intelligence Legislative Recommendations (March 2026) and the Artificial Intelligence Regulation and Safeguards Act, introduced by Sen. Blackburn (the “Act”). As each would have different impacts on the geospatial sector, I have prepared a comparison of the key points:

Comparison Chart

(Generated by Harvey AI)

Key Considerations for Geospatial Professionals

Key considerations for geospatial professionals include the following:

• The Act, draws a statutory distinction between “precise geolocation information” (location within 5 miles or less) and “approximate geolocation information” (greater than 5 miles precision) in the context of algorithmic ranking and content personalization systems. While these definitions are scoped to consumer-facing online platforms and the Filter Bubble Transparency subtitle, they signal a Congressional willingness to regulate the use of location data in AI systems broadly, which could foreshadow future restrictions on how geospatial AI models ingest, process, and act upon precise location data derived from connected devices. Geospatial practitioners should monitor whether these definitional frameworks migrate into future AI or privacy legislation with broader sectoral application.

• The duty of care and product liability provisions in of the Act carry significant operational implications for geospatial professionals who develop or deploy AI systems used in high-stakes decision-making environments. The Act imposes negligence-based liability, encompassing design defects, failure to warn, and breach of express warranty, as well as strict liability for unreasonably dangerous AI products. AI-driven spatial analysis tools used in “high-risk” sectors, such as critical infrastructure assessment, land use planning supporting law enforcement decisions, or emergency management, could expose their developers to liability under these provisions. This is in contrast to the White House Framework’s caution against open-ended liability that could stifle innovation.

• The Act directs the Office of Science, Technology and Policy to prioritize Federal investment in curated, publicly available datasets for AI training, explicitly listing agriculture, transportation, weather services, and other sectors where geospatial data plays a foundational role. The White House Framework similarly calls for making federal datasets accessible in AI-ready formats for industry and academia. For geospatial professionals, these provisions could unlock expanded access to satellite imagery, environmental monitoring data, census geographic files, and infrastructure datasets maintained by agencies such as USGS, NOAA, and the Census Bureau thereby accelerating the development of geospatially-trained AI models for environmental monitoring, urban planning, disaster response, and national security applications.

• The intellectual property and content provenance provisions of the Act have direct implications for geospatial professionals who create, license, or rely on AI-generated spatial content. The Act’s exclusion of AI training from fair use means that organizations using commercially licensed satellite imagery, proprietary map datasets, or curated geographic databases to train geospatial AI models could face copyright infringement claims if they have not secured explicit authorization from data rights holders. The proposed subpoena mechanism further empowers data owners to discover exactly what training datasets AI developers used, making due diligence in data licensing a critical compliance priority for geospatial AI developers.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• Why the “Trump AI Act’s” expanded geolocation definition could reshape how geospatial companies collect and use location data.

• How the White House’s push for a unified federal AI standard could upend the state-level regulatory landscape for geospatial companies.

• Why the GSA’s proposed AI contract clause could be the most consequential shift in federal procurement for geospatial vendors in years.

What’s New

Artificial Intelligence Regulation and Safeguards Act (Senate.gov)

The Artificial Intelligence Regulation and Safeguards Act (commonly referenced as the “Trump AI Act”) is a sweeping, omnibus legislative framework that seeks to regulate artificial intelligence across numerous domains, including minimum safety standards for AI developers, liability standards for AI systems, copyright and training data transparency, and content provenance requirements for synthetic media.

Analysis:

Of particular note to geospatial professionals, the Act includes a definition of “precise geolocation information” (information identifying an individual’s location to within a range of 5 miles or less) than in existing privacy regimes (generally between 1,750-1,850 feet). It also includes provisions related to “approximate geolocation information”, defined as information that identifies an individual’s location with a precision of less than 5 miles. Moreover, the Act permits treatment of a user’s current precise geolocation but puts restrictions on the use of previous geographical locations.

National Policy Framework for Artificial Intelligence (Whitehouse.gov)

The White House’s National Policy Framework for Artificial Intelligence: Legislative Recommendations, published this week, outlines the Trump Administration’s priorities for Congressional action on AI across seven thematic areas. The framework broadly seeks to protect children, safeguard communities, respect intellectual property, defend free speech, drive American AI dominance, develop an AI-ready workforce, and establish a unified federal AI regulatory standard that preempts a fragmented patchwork of state AI laws.

Analysis:

The framework’s emphasis on making federal datasets accessible in AI-ready formats for industry and academia, combined with its push to streamline AI infrastructure development, could benefit geospatial professionals by broadening access to government-held geospatial data for use in AI training and applications.

Deep Dive

GSA’s Proposed AI Contract Clause: What Geospatial Companies Need to Know

The U.S. General Services Administration (GSA) has released a draft contract clause , designated 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems, that, if finalized, will be inserted into every GSA solicitation and contract for AI capabilities. For geospatial companies selling AI-powered products and services to the federal government, this proposed clause represents a consequential shift in the procurement landscape. From strict data ownership rules to an outright prohibition on foreign AI components, the clause touches many aspects of geospatial AI vendors’ products and pipelines. Companies that move early to understand and adapt to these requirements will be better positioned to take advantage of the huge market opportunity the U.S. government provides.

One important consideration is that the proposed terms would vest the U.S. Government with full ownership of all “Government Data”, defined broadly to include not only data submitted to the AI system (such as satellite imagery, sensor feeds, or mission-specific queries) but also all outputs generated by the system, including analyses, derivative data, metadata, and logs. “Custom Development”, meaning any modification, fine-tuning, configuration, or enhancement to an AI system made specifically for a government client, also belongs to the Government, with contractors retaining only ownership of their underlying base models. For geospatial companies whose competitive edge lies in proprietary models trained or refined on rich geospatial datasets, this distinction is commercially vital. Any customization performed under contract becomes a government asset, and contractors are expressly prohibited from using that customized work or the government’s data to improve their commercial products, train other models, or inform their broader business strategy. Consequently, the common commercial practice of using client interactions to iteratively improve an AI platform will be a prohibited use under federal contracts.

The clause’s operational and security requirements will also demand significant investment from geospatial vendors. Contractors and their service providers must i restrict human review of government data, maintain logical segregation of government data from all other customer data, comply with strict data localization requirements, and securely delete all government data upon contract expiration. Compounding this, the clause mandates that AI systems using agentic or reasoning processes provide a full, summarized audit trail of intermediate processing steps, model routing decisions, and data retrieval methods, complete with source attribution and direct links to materials used in generating outputs. For geospatial AI tools that synthesize data from multiple sensor streams or perform complex spatial analyses, building that level of explainability and traceability into the system architecture will be a non-trivial engineering challenge.

Two other important provisions include careful consideration. First, the clause requires that contractors use only “American AI Systems”, defined as AI systems developed and produced in the United States per OMB Memorandum M-25-22, and expressly prohibits the use of any foreign AI components or systems controlled by non-U.S. entities. Geospatial companies that rely on foreign-sourced AI components, whether for image processing, object detection, or natural language interfaces, will need to audit and potentially overhaul their supply chains to remain eligible for federal work. Second, the clause imposes “Unbiased AI Principles” requiring that AI systems be truthful, neutral, and nonpartisan. Combined with the government’s reserved right to conduct automated benchmark assessments of deployed AI systems at any time, without any obligation to disclose its methodologies, this creates a regime of ongoing performance accountability that geospatial vendors selling AI to the federal government must be prepared to sustain for the full duration of any contract.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

Part 539 - Acquisition of Information and Communication Technology 539.71 Clauses (GSA Federal Acquisition Service)

The GSA's proposed AI FAR clause for federal AI system acquisitions would introduce significant compliance obligations around matters such as data localization, human oversight and traceability for agentic workflows, mandatory use of American AI systems, and adherence to "unbiased AI" performance standards. For geospatial firms pursuing federal contracts, the clause would require careful review of existing GeoAI architectures and vendor agreements.

NIST Trustworthy and Responsible AI: Challenges to the Monitoring of Deployed AI Systems (National Institute of Standards and Technology)

NIST's new AI 800-4 report documents significant gaps in validated methodologies, information sharing, and incident monitoring practices across the AI ecosystem. For GeoAI developers and deployers, these gaps are particularly acute given that spatial AI systems operating across dynamic real-world environments are especially susceptible to several identified risks, such as “unforeseen outputs” that occur due to, “dynamic input conditions”. Organizations developing or procuring GeoAI systems should treat this report as both a compliance signal and a design checklist, particularly as federal customers increasingly expect post-deployment monitoring practices consistent with the NIST AI Risk Management.

Deep Dive

EU AI Act Compliance for High-Risk Geospatial AI Systems: What You Need to Know Before August 2026

With the EU AI Act’s (the AI Act) August 2026 compliance deadline now just five months away, geospatial AI providers face a narrowing window to address the regulation’s most demanding obligations. This isn’t simply a matter of updating privacy policies. The Act’s “replayability” requirement for high-risk AI creates technical and legal challenges. Replayability mandates that providers maintain the ability to reconstruct and audit AI decision-making processes after the fact, requiring comprehensive logging of input data, model states, and outputs. For geospatial systems processing continuous streams of satellite imagery, sensor data, or location information, this could translate into significant infrastructure investments and careful architectural planning that cannot be implemented overnight.

High-risk AI systems are those the EU has determined could significantly impact citizens’ health, safety, or fundamental rights. Despite the potential risk they are allowing them to be deployed because their benefits (such as improved disaster response or infrastructure planning) outweigh the risks. But such high-risk AI systems are subject to substantial compliance requirements. The EU categorizes AI as high-risk based upon both the product’s safety implications and its application domain. Annexes I and III of the AI Act provide specific examples. Many of these directly affect GeoAI-including systems used for critical infrastructure management, environmental monitoring that informs emergency decisions, or location-based identification technologies. Providers should begin conducting a thorough classification analysis, recognizing that the boundary between “limited risk” transparency obligations and “high-risk” conformity requirements can turn simply upon intended use and deployment context.

For systems classified as high-risk, conformity assessment is the central compliance hurdle. For many high-risk AI systems, self-assessment of compliance is sufficient. But others will require assessment by independent third-party organizations (known as notified bodies). Geospatial companies should be tracking guidance published by notified bodies on documentation requirements, technical standards, and audit methodologies specific to AI systems. Geospatial providers subject to third party assessment can anticipate rigorous examination of data governance practices, particularly around training data provenance, geographic representativeness, and bias testing across different regions and populations.

Finally, geospatial professionals should be aware of an emerging compliance gap that has received attention from policy analysts: the divergence between military and civilian AI governance frameworks. Many advanced GeoAI capabilities originated in defense contexts where different rules apply. As these technologies migrate to civilian applications, providers face the challenge of retrofitting compliance measures onto systems not originally designed with the EU AI Act’s transparency and accountability requirements in mind. Organizations with dual-use geospatial AI portfolios should prioritize a clear-eyed assessment of which systems require civilian compliance measures and develop transition roadmaps that account for both technical modifications and documentation gaps inherited from their military-origin architectures.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Subscribe now

I recently reviewed the Artificial Intelligence Governance Professional (AIGP) Body of Knowledge and Exam Blueprint, published by the International Association of Privacy Professionals, in anticipation of becoming AIGP certified. The AIGP covers technical, legal, operational, policy, and ethical issues, highlighting that effective AI governance requires cross-disciplinary coordination and professionals willing to venture outside their comfort zones.

Given the uniqueness of geospatial data as compared to other types of data used to train models (its power, versatility, numerous types), the wide range of applications that use geospatial information, the increased focus on world models, and the complexity of the legal and governance issues, I decided to begin creating an ancillary Body of Knowledge for Geospatial AI Governance to be used in conjunction with the AIGP Body of Knowledge. Geospatial organizations occupy complex roles in the AI value chain, often simultaneously acting as developers, deployers, and users of AI-enabled services. This demands governance across the entire lifecycle: from use-case definition and data sourcing through training, testing, deployment, monitoring, and system retirement. In the domain, where models must continuously evolve to address new geospatial information sources and types, update map features, and novel applications using geospatial information, these governance obligations require sustained attention.

With global standards and AI-specific regulations now classifying risk levels and imposing escalating compliance obligations, geospatial professionals must apply risk-based governance approaches that remain jurisdiction-aware and technology-agnostic. By adapting established AI governance domains to the specific context of spatial data and analytics, this body of knowledge can help provide accountability obligations as regulatory landscapes continue to evolve.

This is very much a work in progress. So, I welcome your comments and plan to update it periodically as technology, applications, and the law continue to develop.

Geospatial AI Governance Body of Knowledge

Domain I — Foundations of Geospatial AI Governance

Domain II — AI Laws, Standards, and Frameworks for Geospatial Use Cases

Domain III — Governing the Development of Geospatial AI Systems

Domain IV — Governing the Deployment and Use of Geospatial AI

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• Why AI-generated geospatial analyses and reports may not be protected by attorney-client privilege.

• How the FTC’s crackdown on exaggerated AI marketing claims raises legal risk for geospatial companies promoting “AI-powered” analytics.

• How emerging federal AI literacy standards are likely to shape training expectations for geospatial professionals using GeoAI systems

• How GeoAI “world models” will expand cybersecurity, data governance, and liability risks.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

AI-generated Docs Aren't Covered by Attorney-Client Privilege, Judge Says (Mashable)

A federal judge ruled that documents created by AI tools and shared with attorneys are admissible in court and not protected by attorney-client privilege, establishing that geospatial firms using AI to analyze satellite imagery, generate location intelligence reports, or create spatial risk assessments for litigation cannot assume those AI-generated materials will remain confidential even when shared with counsel.

Analysis:

This ruling raises some complex legal issues. But for geospatial professionals it could increase documentation risk for GeoAI organizations that rely on AI tools to prepare defensible analyses of spatial data for regulatory compliance, land-use disputes, or environmental litigation, making it critical to segregate privileged legal strategy from AI-assisted technical work products.

FTC Resolves Another Case Involving “AI-Washing” (The AI Counsel)

The FTC's settlement with Growth Cave prohibits misrepresenting that products use AI or that AI will enhance profitability and efficiency, signaling that geospatial firms marketing "AI-powered" location analytics, automated spatial analysis, or intelligent mapping tools must substantiate claims about the degree of automation, the role of AI in processing spatial data, and the performance improvements AI actually delivers.

Analysis:

For GeoAI developers, this enforcement pattern makes exaggerated claims about autonomous feature extraction, predictive spatial modeling, or AI-driven decision-making legally risky, particularly where manual processes, rule-based systems, or limited machine learning actually underpin the geospatial workflow.

US Department of Labor Releases AI Literacy Framework Providing Foundational Content Areas, Delivery Principles to Guide Nationwide Efforts (U.S. Department of Labor)

The Department of Labor's new AI Literacy Framework establishes five content areas and seven delivery principles to guide workforce development in AI skills, signaling that geospatial professionals will need structured training pathways to understand how AI systems process spatial data, interpret location-based patterns, and generate automated geospatial decisions.

Analysis:

For GeoAI organizations, this creates an opportunity to shape sector-specific literacy standards around spatial AI capabilities. But it also raises a potential compliance expectation that workers handling geospatial AI systems demonstrate foundational understanding of model behavior, data provenance, and algorithmic limitations.

Deep Dive

Security (and Legal Considerations) for World Models

I have following “world models” with increasing interest both because of the geospatial context as well as the legal implications. While GeoAI applications built on “world models” that reason over the physical environment are still emerging, their direction is becoming clearer. As geospatial computer vision, foundation models, and agentic AI systems converge, future GeoAI platforms will increasingly integrate satellite imagery, maps, sensor feeds, and enterprise geospatial data into unified systems capable of supporting operational decision-making and, in some cases, initiating actions.

My sense is that as these systems move from pilots into enterprise and government deployments, security, privacy, and export control obligations will shape core design choices around system architecture, data pipelines, access control, hosting environments, and product scope. U.S. government cybersecurity frameworks (e.g., the NIST Cybersecurity Framework (CSF), NIST SP 800-53 security controls, and emerging NIST AI Risk Management Framework (AI RMF) guidance) already provide a baseline for how GeoAI systems will be expected to manage risk. At the same time, commercial contracts will increasingly allocate responsibility for data security, model behavior, and regulatory compliance through representations and warranties, liability caps, indemnities, audit rights, and service-level commitments. The design opportunity today is to anticipate these technical and legal constraints early, so that compliance, resilience, and safety are engineered into GeoAI platforms rather than bolted on after broad operational deployment.

Looking ahead, GeoAI world models will combine multiple technical layers: computer vision models that extract features from imagery and point clouds; foundation or multimodal models that reason across geospatial and non-geospatial context; and agentic components that orchestrate tools across mapping platforms, tasking systems, and analytic services. This convergence materially expands the attack surface. Training pipelines will become more exposed to data poisoning, tainted third-party geospatial datasets, and license or provenance conflicts. Inference-time workflows will increasingly involve tool use, retrieval from large geospatial knowledge bases, and automated reporting, creating new vectors for indirect prompt injection, unauthorized data access, and goal hijacking. As GeoAI systems are integrated into enterprises, these risks will intersect directly with contractual obligations. For example, large enterprise customers will expect vendors to warrant that systems are developed and operated in accordance with recognized security standards, that access controls prevent cross-tenant data leakage, and that model outputs do not expose restricted or export-controlled content. This suggests that GeoAI platforms should treat external data sources and user inputs as untrusted by default and enforce least-privilege access at the API and tool layer and implement testing, red-teaming, and assurance practices consistent with NIST-aligned secure development lifecycle expectations.

Future GeoAI systems will also operate in a physical sensing environment that is already contested. GNSS jamming and spoofing, now well documented in conflict zones and increasingly observed in civilian aviation and maritime operations, illustrate the conditions under which some GeoAI world models may function. As GeoAI platforms fuse positioning, timing, imagery, and sensor metadata into higher-level situational awareness, silent reliance on single-source GNSS could become an architectural liability. Consequently. forward-looking GeoAI designs will assume that PNT inputs may become degraded, manipulated, or unavailable and will incorporate uncertainty modeling, anomaly detection, and multi-source sensor fusion from the outset. These design choices are not only good engineering practice; they also matter for liability and risk allocation. As GeoAI outputs inform safety, compliance, or operational decisions, vendors may be asked to represent in their contracts that systems are securely designed and/or disclose known limitations and failure modes.

The forward-looking design challenge, therefore, is to align emerging GeoAI architectures with the regulatory, cybersecurity, and contractual environment they will soon inhabit. Teams developing early world-model should adopt provenance-rich training sources; modularize pipelines so export-controlled or sensitive components can be isolated; and integrate practices such as uncertainty representation and human validation for high-impact outputs. In parallel, legal and compliance teams should map these technical controls to contractual commitments around security controls, auditability, incident response, and allocation of liability. Organizations that internalize these constraints early will be better positioned to market their GeoAI systems to large enterprises that are by their nature are risk adverse and security conscious.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

In this issue, you will navigate the escalating legal complexities of Agentic AI, starting with an analysis of how Amazon v. Perplexity could define the boundaries of authorization, transparency, and access for autonomous geospatial systems. You will also explore the European Parliament’s pivotal move to link data governance directly to copyright compliance, alongside insights from the 2025 Federal Agency AI Use Case Inventory that reveal how the US government categorizes high-impact AI risks. Finally, our Deep Dive equips you with a framework for managing liability in autonomous geospatial workflows, detailing the critical governance, contracting, and technical safeguards needed as AI shifts from passive tool to active agent.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Perplexity v. Amazon (Court Listener)

Amazon has brought a lawsuit against Perplexity framing agentic AI not as a novel interface issue, but as a question of authorization, transparency, and computer access under existing federal and state law, particularly the Computer Fraud and Abuse Act and California’s computer access statutes. The lawsuit emphasizes Perplexity’s alleged concealment of automated activity, evasion of technical controls, and continued access after explicit notice.

Analysis:

For GeoAI developers, the case has implications well beyond e-commerce. Spatial AI systems that rely on autonomous agents to interact with third-party platforms, APIs, or protected datasets, often at scale and across jurisdictions, increases legal risk as agentic GeoAI tools blur the line between user-authorized access and independent system action. This makes clear disclosure, platform consent, and technical traceability increasingly critical to avoiding liability as autonomous geospatial systems become more capable and widespread.

Protect Copyrighted Work Used by Generative AI, Say Legal Affairs MEPs (European Parliament)

The Legal Affairs Committee of the European Parliament has proposed a decisive shift toward treating training data governance as a core copyright compliance obligation for generative AI systems placed on the EU market, regardless of where training occurs. The report will be put to a Parliament vote in plenary in March. By linking transparency failures directly to potential copyright infringement, the report reframes disclosure of training sources, crawling records, and opt-out mechanisms from soft governance measures into enforceable legal duties.

Analysis:

For GeoAI developers, the implications are particularly acute given the reliance on maps, imagery, and other spatial datasets that are frequently protected by copyright and distributed across public and private sources. The proposals point toward rising compliance risk where training data provenance is unclear, opt-out signals are ignored, or licensing terms are insufficiently granular. This makes dataset inventories, provenance tracking, and licensing documentation central to lawful GeoAI development in the EU. As these expectations harden, geospatial firms may need to reassess data sourcing strategies, training pipelines, and cross-border model deployment to ensure that spatial content used in AI systems is both transparent and properly authorized.

2025 Federal Agency AI Use Case Inventory (Office of the Federal Chief Information Officer — GitHub)

The 2025 Federal Agency AI Use Case inventory operationalizes recent statutory and executive AI mandates that requires federal agencies to maintain detailed, public-facing inventories of AI use cases, with heightened disclosure and risk-management obligations for systems deemed “high-impact.” This results in standardized reporting fields across the AI lifecycle, including training data descriptions, outputs, testing, impact assessments, and ongoing monitoring.

Analysis:

The Use Case tool not only provides GeoAI vendors and partners with valuable business insight into how the federal government is using AI products and services. It is also can be used to help identify uses of AI that are high risk (and subsequently might require additional technical safeguards) or that involve data that might not be suitable for that use.

Deep Dive

Agentic AI in Geospatial Applications

Autonomous software that initiates actions, sequences workflows, and interacts with external systems with minimal human oversight (Agentic AI) will transform geospatial operations. Unlike traditional AI tools that wait for user commands, agentic systems autonomously decide when to act, chain multiple operations together, and integrate directly with databases and APIs. For GIS professionals, this means systems that might automatically update property boundaries from new imagery, trigger evacuation alerts from flood models, or modify zoning recommendations without per-decision human review.

The use of AI agents in the geospatial sector will result in heightened risk exposure in several domains: property and land records (where automated cadastral updates could disrupt transactions or create title issues), emergency management (where false positives waste resources and false negatives cost lives), environmental compliance (where autonomous reporting could penalize innocent parties or miss violations), autonomous navigation (where misclassified road conditions create safety hazards), and urban planning (where encoded biases could perpetuate historical discrimination patterns like redlining).

When agentic AI causes harm, the question arises as to liability. Should it attach to the deploying organization under agency principles? To answer this questions, courts will examine whether a company delegated authority, could have controlled the system, and whether affected parties reasonably believed the AI acted on the company’s behalf. The multi-party nature of these deployments (foundation model providers, system developers, enterprise deployers, and data providers) complicates but does not eliminate this exposure. Additionally, statutory risks span anti-discrimination laws, environmental regulations, consumer protection, and privacy statutes, and these will likely apply based on outcomes, not intent.

Organizations should implement concrete safeguards: define precise boundaries for autonomous versus human-approved decisions, build genuine (not rubber-stamp) review checkpoints for high-stakes outputs, maintain comprehensive audit trails of all inputs and decisions, and establish incident response protocols. Contractually, companies that build or deploy AI agents should negotiate audit and logging rights, model update approval requirements, clear indemnification terms, and guaranteed human override capabilities.

The core message for geospatial professionals is that agentic AI doesn’t change longstanding concerns about data accuracy and professional responsibility. Rather it accelerates how fast errors propagate and expands the scale of potential harm. Liability follows delegation and control: the more autonomous the system, the more critical the need for governance.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• How AI liability is beginning to reshape insurance underwriting and what that means for insurability of GeoAI systems.

• Why the federal–state conflict over AI regulation is likely to create layered compliance uncertainty for nationwide geospatial operations.

• How the Department of War’s “AI-first” strategy is driving new expectations for interoperable geospatial data pipelines and modular architectures.

• Why documented governance, provenance, and technical controls are becoming critical to both legal compliance and risk management in GeoAI.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

How AI Liability Risks are Challenging the Insurance Landscape (IAPP)

The IAPP article describes how emerging AI liability risks are reshaping the insurance market, with insurers beginning to scrutinize AI governance practices, data controls, and human-in-the-loop safeguards before underwriting coverage, while also experimenting with new endorsements for deepfakes and chatbot-related harms.

Analysis:

The article shows that AI liability is beginning to reshape underwriting practices even before clear legal rules exist, with insurers informally probing governance, data controls, and human-in-the-loop safeguards as proxies for risk. This blurs the line between legal compliance and insurability: firms that cannot demonstrate disciplined AI practices may find coverage narrower, more expensive, or unavailable, effectively making insurance markets a parallel form of private regulation.

For GeoAI organizations, this dynamic is particularly salient because spatial systems often combine sensitive data, cloud infrastructure, and automated decision tools. Insurers are likely to focus on documentation, access controls, incident logging, and safeguards against deepfakes or misuse of imagery, meaning that governance artifacts are becoming not only compliance tools but also prerequisites for maintaining cyber, E&O, and professional liability coverage.

DOJ Creates Task Force to Challenge State AI Regulations (CBS News)

The Department of Justice has created a new AI Litigation Task Force to challenge state-level AI laws on preemption and interstate-commerce grounds, signaling a likely period of federal–state conflict over how AI systems may be regulated in the United States.

Analysis:

The creation of a DOJ AI Litigation Task Force signals that federal–state conflict over AI governance is likely to intensify, with the federal government prepared to challenge state laws on preemption and interstate-commerce grounds rather than waiting for comprehensive federal legislation. This suggests that AI regulation in the United States may evolve not only through new statutes, but through litigation that reshapes the boundaries of what states can require of AI developers and deployers. For GeoAI firms operating across multiple states, this does not eliminate compliance obligations but rather introduces a period of layered uncertainty: companies must prepare for diverging state rules on transparency, data use, and deployment while also anticipating that some of those rules could be narrowed or invalidated through federal challenges.

Accelerating America's Military AI Dominance (Secretary of War)

The Department of War’s new Artificial Intelligence Strategy directs the military to become an “AI-first” force through seven Pace-Setting Projects, massive expansion of AI compute and federated data access, and a wartime approach to removing bureaucratic barriers to rapid AI deployment.

Analysis:

The Department of War’s Artificial Intelligence Strategy articulates an explicit shift to an “AI-first” posture, pairing aggressive experimentation with a systematic build-out of foundational enablers. For commercial GeoAI and dual-use spatial technology providers, the strategy signals sustained and likely expanding demand for interoperable geospatial data pipelines, real-time catalogs, and modular systems that can plug directly into government architectures. At the same time, the emphasis on rapid model updates, edge compute, and federated data access raises compliance stakes around security controls, export restrictions, and data governance, making alignment with DoD data standards and rigorous documentation increasingly important for firms seeking to participate in this ecosystem or support military AI applications.

Deep Dive

Insurers reportedly are narrowing coverage for AI-related losses through new exclusions, higher retentions, and sublimits, thus treating AI as a specialty exposure rather than a risk absorbed by legacy cyber or tech E&O lines. Coverage is increasingly contingent on demonstrable AI governance (e.g., inventories, testing, bias/drift monitoring, change control), with underwriters using governance maturity to decide appetite, pricing, and whether to narrow exclusions or offer affirmative endorsements. The market posture mirrors early coverage of other insurance, suc has cyber. As a result, claims placement may seem unsettled, as capacity is cautious, and carriers are experimenting with bespoke endorsements while they gather loss data.

Carriers report uncertainty over where AI-caused losses “fit,” especially when bodily injury or property damage is tied to automated decisioning, which can fall awkwardly between CGL and cyber or into tech E&O with new AI carve-outs. At the same time, insurers have begun to launch targeted affirmative solutions (for example, deepfake endorsements with incident response and crisis communications), even as others pursue “absolute AI” or training-data/content-use exclusions that materially narrow coverage for AI outputs. Claims trends also show privacy litigation risk tied to embedded tools (e.g., chatbots cited in a measurable share of web privacy suits under state “digital wiretapping” statutes), reinforcing that AI incidents are already flowing into cyber/privacy programs.

For geospatial applications where models analyze imagery, infer location attributes, or power mapped decision tools the market’s exclusions heighten three exposures: location privacy, data provenance/IP, and analytic misstatement. Privacy claims tied to precise geolocation or automated collection/inference are most likely to route to cyber/privacy coverage but may meet standard coverage carve-outs, such as statutory-violation, or AI-specific carve-outs. Training-data and content-use exclusions mean geospatial firms will need to evidence clean license chains and provenance for satellite/aerial imagery, base maps, and derived datasets to preserve IP and contractual liability coverage for model training and outputs. Finally, absent explicit E&O grants for AI-generated outputs, errors in probabilistic classifications or forecasts (e.g., risk mapping, asset condition scoring) resulting in losses could be characterized as excluded algorithmic “misconduct.”

Documented AI governance (model inventories, pre-deployment testing, human-in-the-loop for consequential inferences, drift monitoring, and audit logs linking outputs to model versions and data sources) is now a lever for insurability, narrower exclusions, and claims defensibility. On coverage wording, seek affirmative grants for AI outputs in tech E&O, confirm cyber/privacy treatment of precise geolocation, and negotiate carve-backs where training/data-use exclusions would otherwise hurt licensed geospatial workflows.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• How the AI LEAD Act could convert GeoAI “engineering choices” into product-liability exposure

• How “global AI governance” is converging on lifecycle controls even as laws fragment

• Why robots.txt is not a legal “gate”and what actually reduces scraping and training-data misuse risk

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

AI LEAD Act — Bill S. 2937 (Congress.gov)

By defining training data selection, model tuning, and unexpected behaviors as part of a system’s “design,” the AI LEAD Act could make GeoAI developers legally accountable for harms linked to how spatial models are built, trained, and deployed. For geospatial companies, this raises the stakes around dataset choice, model validation, warnings, and post-deployment monitoring.

Analysis:

The AI LEAD Act would extend traditional product-liability doctrines into the AI context by treating AI systems as regulated products and defining “design” to include training data selection, tuning, testing, and even emergent behaviors. This shifts legal risk upstream into technical and operational choices that GeoAI developers have historically treated as engineering or research decisions rather than legal ones.

For GeoAI companies, the practical implication is that dataset choice, validation, documentation, warnings, and post-deployment monitoring become central to legal defensibility, not just governance best practices. The bill also clarifies when deployers assume developer-level liability through substantial modification or unanticipated use, creating incentives to define intended uses, system limits, and responsibility allocation with much greater precision.

Global AI Governance Law and Policy 2025 Series (IAPP)

The report maps how jurisdictions are shaping AI governance through legislation, regulatory guidance, and standards, while showing that many are operationalizing oversight through lifecycle controls (testing, monitoring, transparency, accountability) rather than AI-specific bans. For GeoAI deployments, this means that risk assessments, documentation, traceability, and vendor diligence are becoming baseline compliance expectations across markets.

Analysis:

The Global AI Governance Law and Policy 2025 Series illustrates that AI governance is fragmenting into a patchwork of national approaches built on shared principles but very different institutional and legal architectures, ranging from comprehensive, risk-based statutory regimes (EU, China) to standards-led, sectoral, and voluntary frameworks (Australia, UK, U.S., Singapore). Rather than convergence on a single global model, the series shows increasing functional interoperability: jurisdictions are aligning around similar governance tools (e.g. risk classification, transparency, accountability, human oversight, and lifecycle governance) even as they embed them into different legal systems.

For GeoAI actors operating across borders, this means that compliance is less about mapping to one “global rulebook” and more about managing a layered governance stack: product liability, privacy, cybersecurity, IP, sectoral regulation, and public-sector rules combine differently in each jurisdiction. The emergence of agentic and foundation models as governance focal points also signals that regulatory attention is shifting from narrow application risks to system-level capabilities, autonomy, and scale thus increasing the importance of governance design, documentation, and risk controls as portable compliance assets across markets.

Links to each jurisdiction’s overview are available here: Global AI Governance Law and Policy 2025 Jurisdiction Overviews

Are Robots.txt Instructions Legally Binding?–Ziff Davis v. OpenAI (Technology & Marketing Law Blog)

A federal court in Ziff Davis v. OpenAI rejected the argument that ignoring a website’s robots.txt constitutes “circumvention” under the DMCA, holding that robots.txt functions more like a “keep off the grass” sign than an access control that “effectively controls” access. For GeoAI platforms concerned about scraping or model-training misuse, the decision reinforces that robots.txt is best treated as notice and evidence, and should be paired with contractual restrictions and real technical gates (authentication, rate limits, API controls) to strengthen both security and legal posture.

Analysis:

The court’s ruling clarifies that robots.txt does not qualify as a “technological measure that effectively controls access” under the DMCA, characterizing it as a request rather than a technical gate and rejecting the argument that ignoring it constitutes circumvention. This narrows the legal effect of robots.txt to signaling and notice, while leaving open its relevance under other doctrines such as contract, trespass to chattels, or the CFAA, but in each case only where actual technical or legal “gates” are present.

As discussed in more detail in the Deep Dive, for GeoAI platforms, the decision reinforces that scraping risk management cannot rely on robots.txt alone: if control over training data, model inputs, or downstream reuse matters, it must be implemented through enforceable licenses, authentication, rate-limiting, API controls, and monitoring that create real access barriers and legal leverage. Robots.txt remains useful as evidence of intent and scope, but not as a standalone access control or liability trigger.

Deep Dive

Recent court cases suggest geospatial platforms should treat robots.txt as a signaling tool (rather than as a gate) and pair it with real access controls and clear contracts to reduce scraping risk and strengthen enforcement options. Courts have recently held that robots.txt does not qualify as a “technological measure that effectively controls access” under the DMCA’s anti-circumvention provisions, likening it to a “keep off the grass” sign that can be ignored without any affirmative bypassing step. The practical takeaway is simple: robots.txt alone is unlikely to carry a 17 U.S.C. § 1201(a) theory, so use it to put scrapers on notice while building genuine “gates up” protections.

For map tiles, imagery, and feature services, that means preferring authenticated APIs and gated endpoints over open URLs, and supported with rate limits, CAPTCHAs/challenges, user authentication, anomaly detection, API key controls (including rotation), request signing, and server-side throttling. The goal is to deploy controls that actually constrain automated access to tiles, feature collections, and elevation rasters, so that a scraper must avoid or defeat something concrete to operate at scale. Recent litigation suggests the most promising DMCA-style theory is not “they ignored robots.txt,” but “they circumvented bona fide technical controls”. This translates for geospatial providers into session-bound tokens, signed URLs, and challenge flows that require additional information or processes.

Contracts remain a central lever when technical gates are combined with well-presented terms. Courts can be skeptical of browsewrap, but allegations of actual notice (especially for sophisticated parties) and evidence that a scraper bypassed an available licensed API can strengthen breach-of-contract theories. For geospatial workflows, consider binding access to clickthrough or token-gated terms that expressly prohibit unlicensed scraping, bulk extraction, and AI training; cross-reference robots.txt and API terms; and clearly delineating approved bulk channels (APIs, feeds, data shares) versus prohibited extraction routes. Finally, logging and attribution tools that tie user agents, IPs, tokens, and request patterns to ignored directives and defeated controls can be used to distinguish authorized API use from scraping, show knowledge and intent, and support claims ranging from contract to unfair competition.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• Why human conception still governs AI-assisted inventorship and why companies must document human decision-making in model design, training choices, and system architecture to preserve patent rights.

• How data-license restrictions can undermine AI systems, such as why legacny “internal use” and non-competitive clauses may prohibit model training, embeddings, or customer-facing AI outputs, even if raw data is never disclosed.

• What Texas’s new Responsible Artificial Intelligence Governance Act means in practice, including new disclosure, transparency, and oversight expectations for AI systems deployed in or affecting Texas starting in 2026.

• How emerging NIST AI cybersecurity guidance could shape GeoAI procurement and contracts, particularly around data supply-chain risk, model integrity, and AI-specific attack vectors such as data poisoning and model inversion.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Revised Inventorship Guidance for AI-Assisted Inventions (Federal Registrar)

The USPTO has issued revised guidance clarifying that AI systems can never be named as inventors and that inventorship for AI-assisted inventions turns entirely on whether a human conceived the claimed invention under traditional patent law standards, with AI treated strictly as a tool. For GeoAI companies, this reinforces the need to document human decision-making and conception in model design, training choices, and outputs to preserve patentability.

Analysis:

The USPTO’s revised guidance reinforces that inventorship for AI-assisted inventions turns exclusively on human conception, with AI treated as a tool rather than a co-inventor. For GeoAI companies, this heightens the need to clearly document human decision-making around model design, training choices, and system architecture, as weak evidence of conception could undermine patentability for AI-driven geospatial innovations.

Fastcase, Inc. v. Alexi Technologies Inc. (LawSites)

A newly filed lawsuit in federal court alleges that an AI legal-research company breached a narrowly scoped data-license agreement by using licensed legal data to train and power a commercial generative AI product, alleging breach of contract, trade-secret misappropriation, and trademark infringement. For GeoAI and data-driven AI companies, the case underscores that using licensed datasets for model training or downstream AI products can trigger significant legal exposure if the license limits use to “internal use” or prohibits competitive or commercial deployment.

Analysis:

This case squarely tests the legal boundary between licensed data use and impermissible AI commercialization, with the complaint framing model training, embeddings, and user-facing outputs as derivative uses that can violate narrow “internal use” licenses. For GeoAI companies, the lesson is structural rather than sector-specific: as AI products evolve from human-in-the-loop tools into autonomous, customer-facing platforms, legacy data licenses may no longer fit the operational reality, creating significant breach, IP, and trade-secret exposure unless license scope, training rights, and downstream uses are expressly renegotiated.

Texas Responsible Artificial Intelligence Governance Act (LegiScan)

Texas has enacted the Texas Responsible Artificial Intelligence Governance Act, establishing a broad, state-level framework that imposes disclosure, anti-manipulation, anti-discrimination, and transparency obligations on developers and deployers of AI systems. For GeoAI companies operating in or serving Texas, the law signals heightened scrutiny beginning January 1, 2026 of AI systems while also offering a regulatory sandbox for testing GeoAI applications.

Analysis:

Texas’s Responsible Artificial Intelligence Governance Act establishes a broad, enforceable state framework that emphasizes transparency and centralized oversight. For GeoAI companies, the key takeaway is operational: developers and deployers should be prepared to justify data sources, disclosure practices, and post-deployment monitoring.

Cybersecurity Framework Profile for Artificial Intelligence (NIST)

NIST’s Cybersecurity Framework Profile for AI (NIST IR 8596, initial preliminary draft) proposes CSF 2.0–aligned, technology-neutral guidance to manage cybersecurity risk in AI systems and to identify where AI can strengthen cyber defense.

Analysis:

As models in many GeoAI systems depend on complex data supply chains, distributed compute, and automated decision-making, the draft profile highlights the need to anticipate AI-specific failure modes such as data poisoning, model inversion, and AI-enabled cyber-attacks on geospatial infrastructure. Over time, even in the absence of binding regulation, this framework is likely to shape procurement requirements, audits, and contractual expectations for GeoAI providers.

Deep Dive

Why Data Licenses In Matter in AI Training

As GeoAI systems grow more powerful, many companies are discovering, sometimes too late, that access to data does not equal permission to use it for AI training. As noted above, the recently filed federal complaint noted above, Fastcase, Inc. v. Alexi Technologies Inc. provides a timely illustration of how traditional data-license restrictions can collide with modern AI development practices.

At the center of the dispute is a familiar licensing construct: a restricted data license limited to “internal research purposes,” with explicit prohibitions on commercial use, competitive use, and redistribution. According to the complaint, the licensee allegedly used the licensed dataset not merely to support internal workflows, but to train and power a commercial, generative AI legal-research platform, which is a use the licensor claims was never authorized and directly violated the agreement’s core restrictions. While the merits will be decided by the court, the facts alleged mirror issues emerging across the GeoAI ecosystem.

For geospatial companies, the lesson is straightforward but often overlooked: AI training is rarely “neutral” from a licensing perspective. Many data licenses, especially legacy agreements drafted before broad use of large language models, draw sharp distinctions between internal use, derivative works, publication, and competitive products. Training a model on licensed geospatial data can implicate all of these concepts at once. Even if the underlying data are never directly exposed to end users, training may still be characterized as a commercial or competitive use, particularly where the resulting model substitutes for the licensor’s own products or services.

The complaint also underscores a second risk. In geospatial datasets, much of the commercial value lies not in raw data alone, but in curated layers, metadata schemas, normalization, and harmonization across sources. Licensors increasingly argue that these compilations constitute protectable trade secrets or proprietary assets, even when individual data points may be publicly available. Training an AI system on such curated datasets can therefore raise not only contract claims, but also trade-secret and unfair-competition exposure.

Perhaps most importantly, the dispute highlights a governance gap common in AI development: licenses are static, but business models evolve. The agreement at issue was allegedly negotiated when the licensee operated a human-in-the-loop research service. As the service evolved into a fully automated, AI-driven platform, the license terms remained unchanged. From a legal standpoint, that mismatch can be fatal. Courts tend to interpret licenses based on their text, not on how technology later evolves or how the licensee subjectively understood AI training to fit within “research.”

For GeoAI developers, this case reinforces several practical takeaways.

1. Training rights should be treated as a distinct, negotiated permission, not assumed to fall within general research or internal-use clauses.

2. Companies should inventory not only the data they ingest, but also the license lineage attached to each dataset used in training, fine-tuning, or retrieval-augmented systems.

3 Where business models are shifting from internal analytics to external products licenses must be revisited before models are deployed, not after.

As GeoAI systems increasingly monetize insights derived from licensed data, understanding the limits of license agreements is a core architectural requirement for building legally sustainable AI systems.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

This week, you will learn how Australia’s new AI policy is reshaping the regulatory environment for GeoAI by relying on existing laws rather than AI-specific rules. You will also see why AI agents present a new category of risk for geospatial systems and what safeguards are emerging to manage autonomous, multistep workflows. You will gain clarity on how different classes of AI are being adopted across the space and Earth-observation enterprise. Finally, you will learn why geospatial sovereignty increasingly will depend on the alignment of technical architectures with enforceable legal and governance controls.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Australia Unveils AI Policy Roadmap (IAPP)

Australia’s new National AI Plan shifts away from strict, AI-specific regulation and instead relies on existing legal frameworks and a forthcoming AI Safety Institute, creating a more investment-friendly environment but leaving ambiguity around high-risk uses of spatial and sensor-derived data. For GeoAI, the roadmap signals that governance expectations, such as provenance, privacy protections, and risk-assessment duties, will be enforced through general laws and institutional oversight rather than sector-specific mandates.

Analysis:

By avoiding AI-specific regulation, Australia is betting that general, technology-neutral laws combined with a central AI Safety Institute will provide enough flexibility for innovation. For GeoAI, this creates a mixed environment: compliance may be simpler in the short term, but the absence of clear obligations could lead to uncertainty and increased reliance on contractual obligations between parties. standards.

Understanding AI Agents: New Risks and Practical Safeguards (IAPP)

AI agents introduce far greater autonomy, system access, and operational variability than traditional AI models, creating new security, privacy, and decision-risk exposure that directly affects geospatial systems that rely on automated data retrieval, tool use, or multistep spatial reasoning. For GeoAI, this means agent-based workflows require stronger safeguards around data provenance, access control, logging, and human-in-the-loop decision boundaries to prevent unintended propagation of errors across spatial datasets and analytic pipelines.

Analysis:

Because AI agents can trigger multistep operations, access external tools, and act on incomplete or ambiguous instructions, they present higher-risk failure modes than traditional GeoAI models. For geospatial organizations, this means agent deployments should include sandboxed training environments, enhanced auditing, human decision checkpoints, and clear limits on which datasets and APIs an agent may access. As agents become integrated into mapping, mobility, and satellite-analysis workflows, governance will need to shift from model-level oversight to full system-level controls.

Artificial Intelligence and the Space Enterprise: Taxonomy and Emerging Opportunities (Center for Space Policy and Strategy)

The report highlights how AI is rapidly reshaping the space enterprise, including remote sensing by enabling autonomous onboard decision-making, large-scale sensor data analysis, and mission optimization. But the impact varies widely across mission areas due to uneven data availability, compute constraints, and organizational readiness. For geospatial professionals, the paper underscores that the most transformative opportunities arise when AI is applied to high-volume Earth observation data and when agencies precisely define which AI technologies are being used and why.

Analysis:

The Aerospace Corporation stresses that “AI” is not a single capability but a spectrum of tools with varying maturity, technical requirements, and operational risk. For GeoAI, this reinforces the need to distinguish between classical ML, foundation models, autonomous agents, and onboard inferencing, as each introduces different governance, transparency, and reliability challenges. As space agencies adopt more advanced AI, geospatial organizations may need stronger lifecycle oversight, to include model cards, data sourcing and mission-specific performance thresholds.

Geospatial Sovereignty in the Age of AI: A Layered Approach (CARTO)

The article argues that true geospatial sovereignty in the AI era requires a layered architecture (e.g., open data formats, flexible compute environments, portable AI models, and interoperable semantics) to avoid vendor lock-in and ensure national control over spatial data and AI-driven decision systems. For GeoAI, the piece underscores that sovereignty is not isolation but the ability to run geospatial analytics and AI pipelines anywhere while preserving provenance, resilience, and strategic independence.

Analysis:

The article reframes sovereignty not as restricting access but as preserving the ability to run geospatial data and AI workflows anywhere, without dependency on a single commercial stack. For GeoAI, the tools include open standards, transparent provenance, cloud-agnostic deployment models, and AI architectures. These facilitate models, embeddings, and inference workflows to move freely across environments. As governments adopt stricter requirements around data control and autonomy, these design principles may increasingly determine which GeoAI solutions can be deployed at national scale.

Deep Dive

Digital Sovereignty From a Legal Standpoint

As GeoAI systems increasingly shape infrastructure planning, emergency response, transportation, finance, and national security, digital sovereignty has become an operational requirement rather than a political aspiration. Organizations are investing in sovereign clouds, open formats, and diversified analytics stacks. But technology alone does not ensure sovereignty. True geospatial sovereignty requires an alignment between technical architecture and legal rights, regulatory obligations, operational controls, and institutional accountability. Without that alignment, digital sovereignty remains fragile, no matter how advanced the platform.

As Javier de la Torre notes in his excellent blog post described above, at the technical level, modern sovereignty depends on layered architecture across data, compute, and AI. Open and interoperable data formats preserve ownership and portability. Modular compute environments reduce dependency on any single cloud or jurisdiction. Configurable AI layers prevent lock-in to opaque, non-substitutable models. But technical optionality is only capacity. It does not establish enforceability. Governance is what transforms architectural freedom into legally defensible control.

Governance challenges track these same layers. At the data layer, sovereignty hinges on whether organizations actually hold the rights to use, combine, train, commercialize, or transfer geospatial information across borders and applications. At the compute layer, jurisdiction, access controls, backups, administrative visibility, and government access all shape regulatory exposure. At the AI layer, accountability becomes central, covering explainability, bias, model drift, training provenance, automated decision-making risks, and the real-world consequences of erroneous spatial outputs. Regulators and customers increasingly expect documented oversight structures, human-in-the-loop controls, and traceable model governance.

Digital sovereignty is built, and sustained, through continuous alignment between architecture, law, contracts, and institutional responsibility. Documentation, auditability, vendor oversight, and contractual alignment are now critical to GeoAI governance.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

What You’ll Learn This Week

• How the EU’s new Digital Omnibus proposal could reshape GeoAI development, including stricter rules on data provenance, lawful training bases, and cross-border data handling across the EU AI Act, Data Act, GDPR, and related frameworks.

• How a potential U.S. federal preemption of state AI laws could impact GeoAI compliance, and what geospatial companies should prepare for as transparency, bias-testing, and data-handling obligations may shift, or disappear, under a national framework.

• Why AI-specific contract clauses are becoming unavoidable for geospatial professionals, and the key responsibilities emerging around data rights, training-data documentation, accuracy, bias testing, privacy, and national-security-related data restrictions.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Regulation of the European Parliament and of the Council (European Commission)

This European Commission “Digital Omnibus” proposal streamlines and consolidates major EU data and digital laws (including the EU AI Act, the Data Act, GDPR) in ways that directly affect how GeoAI systems access, share, and reuse public-sector and commercial data, and how they lawfully train models on personal and non-personal data.

Takeaway for Geospatial Professionals:

The Digital Omnibus proposal would reshape how GeoAI teams handle data access, reuse, and compliance by consolidating major EU digital laws and tightening rules around data provenance, training on personal or mixed datasets, and cross-border data handling. Geospatial organizations operating in Europe will want to track this proposal to understand documentation and governance requirements across models, datasets, and data-sharing workflows.

Guidance for Risk Management of Artificial Intelligence Systems (European Data Protection Supervisor)

The EDPS’s Guidance for Risk Management of AI Systems outlines a rigorous, ISO-aligned framework for identifying, mitigating, and documenting data-protection risks across the full AI lifecycle—emphasizing fairness, accuracy, minimization, security, and explainability. For GeoAI, the guidance reinforces that spatial AI models relying on personal or location-linked data must incorporate transparent provenance, bias controls, and continuous monitoring to prevent rights-impacting errors or discriminatory outputs.

Takeaway for Geospatial Professionals:

The EDPS guidance underscores that GeoAI systems using location-linked personal data must embed strong, end-to-end risk controls, including provenance tracking, fairness testing, and continuous monitoring. Geospatial teams should treat these requirements as core compliance obligations when deploying spatial models that influence decisions or services.

What to Know About Trump’s Draft Proposal to Curtail State AI Regulations (AP)

The draft executive order would pressure states to halt or roll back their AI regulations, creating a single federal framework that overrides state-level rules. This shift could directly affect geospatial AI systems that must comply with state privacy, transparency, and anti-discrimination requirements. For GeoAI companies, this could reshape compliance obligations, particularly around data provenance, automated decision-making, and geospatial models used in high-impact contexts such as lending, housing, or public services.

Takeaway for Geospatial Professionals:

The proposal highlights the growing tension between innovation-driven federal policy and risk-mitigation-focused state laws. GeoAI organizations should monitor whether preemption will create regulatory gaps, shifting liability and risk-management responsibilities back onto companies until a federal framework is established.

Deep Dive

As geospatial professionals increasingly integrate AI into imagery analysis, mapping, routing, and predictive modeling, the contractual landscape surrounding these tools is shifting just as quickly as the technology itself. Governments are building new AI regulatory regimes, such as the EU AI Act, and various national laws in the U.S. and Asia, that rely heavily on documentation, data governance, and accountability. At the same time, customers are requiring AI-specific representations and warranties be written into contracts. For those working in GeoAI, these parallel trends mean that understanding contractual obligations related to AI is no longer optional; it is becoming a core professional responsibility.

The pressure is increasing because AI introduces risks that traditional geospatial contracts were never designed to address. For example, many GeoAI models depend on complex training datasets that often include satellite imagery, aerial photography, LIDAR, or web-scraped geospatial layers. In some instances, these materials are licensed, restricted, or copyright-protected. If any portion of this data is used without the appropriate rights, both developers and downstream users may face claims of copyright infringement or breach of licensing restrictions. Buyers and investors now routinely demand assurances that the data used to train a model was lawfully obtained, properly licensed, and appropriately documented. In short: you will be asked to assert in your contracts that data governance is real, not aspirational.

Quality, accuracy, and bias are emerging as additional contractual pressure points. Because GeoAI systems rely on high-precision inputs, even small defects in training data (e.g., an outdated imagery layer, mislabeled building footprint, or inaccurate coordinate reference) can ripple outward into flawed outputs. And flawed outputs can lead to operational, financial, or regulatory harm. For this reason, AI clauses in contracts will increasingly require geospatial organizations to disclose data sources, demonstrate the accuracy and provenance of training datasets, and explain how models are tested for bias or error. These obligations will tie directly to broader AI governance requirements, including human-in-the-loop oversight and robust monitoring procedures.

Privacy and data protection concerns add another layer of contractual complexity. Location traces, facility coordinates, and mobility data can contain highly sensitive insights about individuals and critical infrastructure. When this kind of information is fed into public or third-party generative AI tools, companies lose control over how the data is stored, retained, or reused. As a result, many contracts will now include strict promises that employees will not enter sensitive or proprietary geospatial information into public AI systems, and that internal policies exist to enforce these restrictions. For organizations working with regulated location data or operating across borders, these privacy-related contract terms often interplay directly with data sovereignty and national security rules, including export controls.

For all these reasons, AI clauses are becoming standard components of data licenses, model-as-a-service offerings, procurement contracts, and even insurance policies. They serve as both a risk-allocation tool and an accountability mechanism. Companies unable to articulate how their AI systems are built, what data they rely on, or how they comply with emerging regulations will increasingly be seen as high-risk partners. The takeaway is clear: GeoAI success now depends not only on technical capabilities but also on the ability to demonstrate contractual, operational, and governance maturity. Understanding and shaping the AI terms in your contracts is quickly becoming just as important as understanding the models themselves.

Support the Next Generation

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals. Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What You’ll Learn This Week

This issue explores how courts and policymakers across the world are reshaping the legal landscape for GeoAI in areas such as copyright and data provenance to governance, liability, and compliance frameworks.

• Copyright and Model Training:
  Two landmark rulings reach different conclusions on whether use of training data constitutes infringement. You’ll learn what these cases mean for GeoAI models trained on licensed imagery, maps, or sensor data, and how to mitigate infringement risk through lawful data sourcing and provenance controls.

• Governance and Accountability Frameworks:
  Australia’s Voluntary AI Safety Standard and India’s AI Governance Guidelines (2025) highlight global moves toward “techno-legal” frameworks emphasizing transparency, provenance, and human oversight. This issue explains how GeoAI developers can operationalize these principles by embedding auditability, ethical safeguards, and compliance readiness into geospatial workflows.

• Emerging State-Level AI Regulation in the U.S.:
  The Future of Privacy Forum’s latest report shows U.S. states shifting toward targeted, disclosure-based AI laws. Learn how these narrower, use-specific rules could affect GeoAI applications in sectors like mobility analytics, environmental modeling, and automated decision support.

• The Legal Complexity of Embeddings:
  A deep dive into the legal issues surrounding embeddings, the mathematical “vectors” powering GeoAI reasoning. You’ll understand how embeddings blur the line between data and inference, raising questions around accuracy, liability, and IP ownership. The article offers practical guidance on contractual protections, audit rights, and governance mechanisms to manage these evolving risks.

What’s New

GEMA Ruling Against OpenAI (Justiz in Bayern — Justice in Bavaria)

The Munich I Regional Court ruled that OpenAI’s models unlawfully reproduced copyrighted German song lyrics, finding that “memorization” within language models constitutes a copyright-relevant reproduction not protected by text and data mining exceptions. For GeoAI, the case signals growing legal scrutiny around embedded reproductions of training data and raises questions about whether geospatial models trained on licensed satellite or sensor data could similarly infringe when internal model parameters “store” the underlying data

Takeaway for Geospatial Professionals:

GeoAI developers using copyrighted imagery, mapping layers, or sensor data in model training should treat “internal storage” of those materials as potentially infringing. Moving forward, data provenance and lawful basis documentation will be as essential as accuracy and performance metrics.

Analysis:

This ruling is among the first to suggest that model training can trigger copyright liability. For GeoAI teams, it reinforces the importance of licensed or synthetic training data, strong data provenance records, and legal vetting before integrating third-party spatial datasets into AI workflows.

AI Companies Get a Big Legal Win in the U.K. as Getty Images Loses Stability Lawsuit (Forbes)

The U.K. High Court’s dismissal of Getty Images’ copyright claims against Stability AI clarifies that training AI models on copyrighted materials doesn’t necessarily constitute infringement if the models don’t reproduce or store exact copies.
For GeoAI, this signals that using geospatial datasets for AI model training may face lower legal risk provided outputs and embeddings don’t replicate proprietary imagery or map data

Takeaway for Geospatial Professionals:

This decision offers cautious reassurance that using geospatial data for AI training may be permissible where the model does not “memorize” or reproduce the underlying data. However, clear documentation of lawful data sources remains essential.

Analysis:

The ruling favors innovation over restriction, but highlights how the boundary between inspiration and reproduction remains fact-specific. GeoAI developers should continue to maintain data use records and avoid generating outputs that too closely mirror proprietary datasets.

White Paper on AI Governance: Leadership Insights and the Voluntary AI Safety Standard in Practice (Governance Institute of Australia)

Australia’s Governance Institute white paper outlines a national framework for responsible AI adoption, emphasizing data governance, provenance, risk management, and human oversight through the Voluntary AI Safety Standard’s ten guardrails. For geospatial and GeoAI systems, its focus on data provenance, auditability, and regulatory accountability provides a clear model for integrating ethical, transparent, and compliant AI governance into spatial data ecosystems

Takeaway for Geospatial Professionals:

GeoAI initiatives should align with governance frameworks that emphasize traceability, accountability, and ethical use of spatial data. Establishing internal guardrails around data lineage and model transparency can strengthen trust and compliance readiness.

Analysis:

Australia’s approach prioritizes principle-based, auditable governance over prescriptive regulation. For GeoAI organizations, adopting similar voluntary standards can be used to demonstrate proactive commitment to responsible AI while also preparing for future regulatory oversight.

The State of State AI: Legislative Approaches to AI in 2025 (Future of Privacy Forum)

The Future of Privacy Forum’s “State of State AI 2025” report finds that U.S. states are shifting from broad, Colorado-style AI laws to narrower, disclosure-driven frameworks focused on specific technologies (e.g., generative AI, chatbots) and high-impact contexts (like healthcare or employment). For GeoAI professionals, the trend toward use- and context-specific regulation, liability clarity, and transparency mandates suggests that geospatial AI applications, particularly those supporting automated decision-making or consumer-facing insights, will increasingly face state-level compliance obligations tied to data provenance, risk disclosure, and accountability frameworks

Takeaway for Geospatial Professionals:

When applying GeoAI tools in the U.S., don’t assume that your work will be governed by comprehensive state AI laws. Instead, look out for targeted state measures that require transparency around specific use-cases, such as location-based risk scoring, mobility analytics, or environmental decision-making. Considering building documentation and checklists now anticipating these narrower but rapidly emerging obligations.

Analysis:

The report suggests a shift away from broad “high-risk AI” regimes toward use-case-specific disclosures and liability frameworks. For GeoAI, that means focusing on application context, data flows, model outputs, and state-specific obligations rather than waiting for a comprehensive federal or state law.

India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (IndiaAI)

The India AI Governance Guidelines (2025) establish a comprehensive national framework to balance AI innovation and safety through a “techno-legal” and principle-based approach emphasizing trust, accountability, inclusivity, and resilience. For GeoAI, the guidelines are significant because they promote data provenance, content authentication, and risk assessment frameworks for AI systems that process geospatial data. The guidelines also encourage Digital Public Infrastructure (DPI) integration to ensure inclusivity and privacy, and envision institutional oversight, such as the AI Safety Institute, relevant to evaluating geospatial AI models on matters such as bias, national security risk, and societal impact.

Takeaway for Geospatial Professionals:

Treat provenance logs, model audit trails, and content authenticity signals (e.g., watermarking/signing of spatial outputs) as first-class compliance artifacts. Align GeoAI workflows with privacy-by-design, DPI integration, and clear human-in-the-loop controls for safety-critical uses.

Analysis:

India’s “techno-legal” approach blends principles with operational guardrails—pushing GeoAI teams to operationalize governance (provenance, testing, escalation paths) rather than rely on policy statements alone. Expect these controls to become procurement and certification baselines for spatial AI deployed in public services and critical infrastructure.

Deep Dive

I have been reading a great deal about embeddings recently. Embeddings are vector representations of spatial, temporal, and semantic relationships and are transforming how geospatial AI models understand the world. They allow systems to integrate imagery, terrain, and text into unified spatial reasoning frameworks.

However, their power comes with legal complexity. Because embeddings are probabilistic and interpretive rather than factual, they raise questions about accuracy, data provenance, liability, and intellectual property. Governments, companies, and end-users risk treating model-inferred relationships as objective truth, expose themselves to misrepresentation, negligence, or data misuse claims if these systems are not properly validated or disclosed.

From a contractual perspective, organizations using or distributing geospatial embeddings should clearly define how data and models are sourced, what warranties apply, and who bears responsibility for downstream errors or bias. Clauses on provenance, uncertainty disclosure, and model retraining can help manage these risks. Purchasers of AI systems that use embeddings should also consider including clear indemnities tied to due diligence standards in their contracts, so liability follows failure to meet defined obligations rather than the occurrence of harm alone. Audit rights and ongoing monitoring obligations can also help, as embeddings may evolve through continuous learning and retraining.

From a governance standpoint, as noted in both India’s AI Governance Guidelines and Australia’s AI Safety Standard, transparency, explainability and risk assessments across the AI value chain are critical. Embeddings should be considered as regulated components requiring lifecycle transparency, testing, and institutional coordination.

As with other risks associated with AI, managing the legal risks of embeddings requires integrating technical, operational and legal solutions across the enterprise. From a legal standpoint, this includes contractual clarity at the micro level and institutional governance at the macro level. By embedding transparency, accountability, and explainability into both contracts and governance systems, GeoAI developers and users can harness these tools responsibly while preserving trust in the data-driven decisions that increasingly shape our understanding of the planet.

Support the Next Generation

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals. Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

From the Editor

As AI systems evolve from tools to agents, the legal frameworks around them are shifting just as quickly. This week’s developments—from Singapore’s lifecycle security guidance to the EU’s interpretation of “provider” obligations—highlight how governments are refining accountability in autonomous and data-driven systems. For geospatial professionals, these changes are not theoretical; they shape how location intelligence, analytics, and model governance will operate across jurisdictions.

What You’ll Learn This Week

• How Singapore’s Agentic AI Addendum may redefine controls for autonomous GeoAI systems

• Why the UK’s “contextual, regulator-led” model is reshaping compliance for geospatial firms

• What Reddit v. Perplexity teaches about lawful data sourcing for AI training

• When fine-tuning under the EU AI Act makes you a “provider” — and what obligations follow

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Securing Agentic AI: An Addendum to the Guidelines and Companion Guide on Securing AI Systems (CSA Singapore, 2025 Draft)

Singapore’s Cyber Security Agency (CSA) released a Draft Addendum on Securing Agentic AI extending its AI security framework to autonomous, self-managing systems. It introduces lifecycle-based security controls tailored to agentic workflows—those that autonomously collect, analyze, and act on spatial data. The Addendum emphasizes continuous risk assessment, threat modeling, data provenance, and inter-agent communication safeguards to prevent rogue actions and data leakage.

Takeaway for Geospatial Professionals:

If your GeoAI system autonomously ingests or acts on data, shift from static risk reviews to lifecycle security management. Regulators are signaling that continuous oversight is the new baseline

Analysis:

Expect similar “agentic” frameworks to emerge in the EU and Middle East—especially where geospatial automation intersects with smart-city and defense applications.

Global AI Governance Law and Policy: UK (IAPP, 2025)

The IAPP’s Global AI Governance: United Kingdom brief explains that the UK is pursuing a contextual, regulator-led approach to AI oversight rather than a single statute. The government’s white paper emphasizes fairness, accountability, and transparency, entrusting enforcement to existing sector regulators (e.g., Ofcom, ICO, and the Civil Aviation Authority). For GeoAI, this means that applications in surveillance, transport, and environmental monitoring would face regulator-specific compliance rather than one unified AI Act.

Takeaway for Geospatial Professionals:

Compliance obligations will vary by domain. Build regulatory maps early—align your legal, data, and product teams around which authority governs your particular use case.

Analysis:

The UK’s flexible model offers innovation space but also introduces fragmentation risk. For global GeoAI firms, the challenge will also be maintaining coherence between UK guidance and the EU’s far more codified AI Act regime.

Reddit Sues AI Company Perplexity and Others for ‘Industrial-Scale’ Scraping of User Comments (MSN)

Reddit has sued Perplexity AI, alleging “industrial-scale” scraping of user comments in violation of access restrictions and terms of use. According to the complaint, Perplexity and partners harvested Reddit data to train AI systems without authorization or license, which raises key issues around copyright, data contracts, and fair-use limits.

Takeaway for Geospatial Professionals:

Ensure all third-party datasets used for AI training are licensed, documented, and provenance-verified. “Publicly available” no longer equates to “lawfully usable.”

Analysis:

Courts are beginning to draw boundaries between lawful data access and systemic scraping. For GeoAI, the message is clear: treat data licensing as compliance infrastructure, not an afterthought.

Legal Concept of the Week: “Provider” Under the EU AI Act

Under Article 3(2) of the EU Artificial Intelligence Act, a “provider” is any natural or legal person who places an AI system on the market or substantially modifies an existing system. Once designated a provider, you assume compliance responsibility for conformity assessments, documentation, and transparency, regardless of whether you developed the base model.

Deep Dive

EU AI Act: What geospatial teams need to know about fine-tuning and “provider” status

Geospatial AI workflows often adapt general-purpose models to perform tasks such as feature extraction, change detection, or predictive analytics. Recent European Commission Guidelines on the scope of obligations for providers of general-purpose AI models under the AI Act clarifies when a downstream modifier becomes a “provider”, triggering full legal obligations. The decisive factor is significance: your modification must materially alter the model’s generality, capability, or systemic risk profile.

Rule of Thumb:

You are deemed the provider if your training compute exceeds one-third of that used to train the base model. If the original computer is unknown, the fallback thresholds are:

• One-third of 10²⁵ FLOP (for systemic-risk models)

• One-third of 10²³ FLOP (for all others)

For Geospatial Teams:

1. Large domain-specific fine-tunes may hit the compute threshold faster than expected.

2. Provider obligations focus on the modification: add technical documentation, disclose data sources, and implement a copyright policy.

3. If modifying a model already deemed systemic-risk, your version is presumed high-impact, thus requiring Commission notification and audit readiness.

Try This:

Estimate the compute ratio for one of your current fine-tunes. If it approaches one-third, start preparing documentation and governance as if you were the provider.

Bottom Line:

Track your compute. Document your data. Prepare for scale.
Fine-tuning today may define your compliance posture tomorrow.

Industry Implications:

AI and geospatial governance are converging rapidly. Over the next 12-18 months:

• Procurement teams will require provenance attestations for spatial data.

• Developers will face due-diligence questions on training datasets.

• Executives will be asked to demonstrate governance over autonomy and model risk.

Organizations that invest now in lightweight compliance frameworks will not only stay ahead of regulation but gain competitive advantage as trusted providers.

GeoAI and the Law Newsletter is a reader-supported publication. Subscribe to receive new posts and support the next generation of geospatial law professionals.

Support the Next Generation

Paid subscriptions directly fund law student scholarships to attend local geospatial events. Three recipients, based in the U.S., Europe, and the UAE, have already participated, strengthening global capacity in geospatial law and ethics.

Edited by Kevin Pomfret

Executive Director, Centre for Spatial Law and Policy, Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law
Centre for Spatial Law & Policy | LinkedIn

Share

What’s New

Monitoring Adoption of Artificial Intelligence and Related Vulnerabilities in the Financial Sector (Financial Stability Board)

The FSB report warns that reliance on a small number of GenAI and cloud service providers could create systemic vulnerabilities in finance and urges regulators to monitor AI supply-chain dependencies, data quality, and model governance. For GeoAI systems used in financial analysis, insurance, or risk modeling, expect increased emphasis on transparency about geospatial data sources and model oversight to prevent concentration, bias, and cascading failures across institutions.

US Federal Privacy Legislation Tracker: Introduced in the 119th Congress (2025-2026) (IAPP)

The 2025 Federal Privacy Tracker shows a surge in bipartisan efforts to regulate AI-enabled data use, covering automated decision making, smart-device disclosures, and geolocation tracking. For GeoAI developers, this signals that Congress is edging toward national standards that could extend privacy, consent, and algorithmic-transparency duties to geospatial data and AI systems that infer or act on location information

AI Act Service Desk: Frequently Asked Questions (European Commission)

The EU Commission’s AI Act Service Desk FAQ clarifies phased compliance and obligations for general-purpose and high-risk AI systems, including documentation, data governance, and transparency duties. For GeoAI, it confirms that models using geospatial data for mapping, surveillance, or decision making may qualify as high-risk—requiring provenance tracking, human oversight, and alignment with the forthcoming EU Code of Practice for AI

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Deep Dive

Businesses that offer geospatial products and services in California that are built on generative AI systems or services should be aware that the state’s Generative AI Training Data Transparency Act takes effect on January 1, 2026. It imposes documentation and disclosure obligations on developers of such systems released on or after January 1, 2022. Specifically, covered developers must post on their website documentation describing the data used to train, test, validate, or fine-tune the system, including:

- Sources or owners of datasets and how they support the system’s intended purpose.
- The size of datasets (ranges permitted; estimates for dynamic datasets).
- Types and characteristics of data points and labeling practices.
- Whether datasets include copyrighted, trademarked, or patented material versus public domain content.
- Whether datasets were purchased or licensed.
- Whether datasets include personal information or aggregate consumer information as defined under California law.
- Any cleaning, processing, or modifications performed and their purposes.
- Data collection periods, including whether collection is ongoing, and the dates first used in development.
- Whether synthetic data generation was used, and the functional need for it if included.

There are limited exemptions under the law including if the system or service (i) is made available only to a federal entity exclusively for national security, military or defense purposes (ii) or made available solely to a hospital medical staff member.

Geospatial organizations offering generative AI systems and services in California should consider taking the following next steps:

- Conducting a data provenance and licensing assessment for all covered systems released since January 1, 2022.
- Building a standardized disclosure template aligned with the statute’s enumerated elements to support publication before January 1, 2026 and at each substantial modification.
- Establishing change‑management triggers so that retraining or fine‑tuning that materially affects performance prompts updated disclosures.
- Mapping exemptions, if any apply, and document the basis for relying on them.

Interested in More?

Many of the legal and ethical issues associated with geospatial information are made even more complex by AI, particularly generative AI. If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

Share

Global AI Governance Law and Policy: European Union (International Association of Privacy Professionals)

The report notes that the EU’s AI Act is now in effect and rolling out in stages through 2026. As it uses a risk-based approach, the more an AI system can affect people, the more you must document how it works, manage the data it uses, and keep a human in the loop. This is addition to complying with other rules, like GDPR and the Data Act. Standards, liability, and copyright rules are still being finalized. However, for geospatial work it will be important to keep a simple, living checklist of your models and datasets (what they are, where the data came from, and where it’s sent). Pay special attention to more autonomous (“agentic”) systems and high-risk uses like public services.

Responsible by Design: Strategic Guidance Report on the Risks, Opportunities, and Governance of Artificial Intelligence in the Military Domain (Global Commission on Responsible AI in the Military Domain)

The GC REAIM report suggests a global governance framework for the responsible use of AI in military applications, emphasizing “responsibility by design” and legally grounded human oversight throughout the AI lifecycle. Its recommendations urging safeguards in data governance, testing, and international collaboration is important to the geospatial community given the dual-use nature of many geospatial technologies.

Connecticut Public Act No. 25-113 (Substitute Senate Bill 1295) — An Act Concerning Broadband Internet, Gaming, Social Media, Online Services, and Consumer Contracts (State of Connecticut)

Connecticut’s updated its privacy law to strengthen transparency rules for AI. Under the law, which went into effect in July, a company’s privacy statements must disclose whether it collects, uses or sells personal data for the purpose of training large language models. (In Connecticut, personal data includes precise geolocation data.)

Deep Dive

The Role of Insurance

Artificial intelligence is reshaping insurance products, underwriting, claims handling, and the attendant legal and coverage risks. Core AI modalities, such as machine learning, deep learning, and generative AI, are driving emerging liability trends such as AI-washing securities suits, algorithmic bias and discrimination claims, and privacy litigation tied to data sourcing and model training. Insurers’ coverage posture is evolving as well, combining affirmative AI-specific endorsements (for data poisoning, machine-learning wrongful acts, and even EU AI Act penalties) with broad exclusions. Such exclusions often include any business use of AI or content created with generative tools. Regulation is accelerating, with multi-state adoption of the NAIC Model Bulletin on AI use by insurers and the NIST AI Risk Management Framework serving as a governance scaffold.

For geospatial professionals whose work powers insurers’ risk selection, pricing, CAT analytics, and claims triage, the implications are immediate. Spatial and imagery-driven features can become vectors for disparate impact if neighborhood, land-use, or built-environment proxies correlate with protected classes, echoing allegations seen in mortgage and claims-screening cases. Training data provenance is often a flashpoint: models built on scraped, third party, or mixed-license datasets, or on location traces, can trigger privacy statutes and intellectual property exposures, especially where outputs incorporate or resemble protected content. Model integrity risks such as data poisoning, drift, and explainability constraints (“black box” outputs) bear directly on defensibility in litigation and on insurability, as carriers scrutinize audit trails, validation, and bias testing across first- and third- party data pipelines.

Operationally, geospatial vendors and GIS teams supporting insurers, or deploying AI into underwriting and claims, should align technical governance with insurability. That means documented data rights and lineage for imagery and geospatial layers; bias audits on feature engineering and model outputs across geographies and demographics; monitoring and redress mechanisms for false positives in fraud or damage detection; and incident response for model failures or data compromise. Contracting and coverage should be calibrated to today’s policy architecture: evaluate the interplay of Tech Errors and Omissions, Media/IP, Cyber, and Commercial General Liability (CGL) coverages; watch for generative AI and “business use of AI” exclusions; and consider affirmative AI endorsements covering data poisoning and ML wrongful acts.

In short, robust AI governance, transparent model documentation, and careful insurance program design are now strategic prerequisites for geospatial practitioners operating in the insurance value chain. Insurance also often helps shape compliance with evolving legal and policy frameworks by embedding governance expectations into underwriting questionnaires, warranties, and endorsements, and by conditioning or pricing coverage on documented data rights, bias testing, auditability, and incident response readiness.

Interested In More?

If you are interested in learning more about how the law is impacting the geospatial ecosystem, you might consider the book Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law. All royalties received from sales of the book will be used to support law students attending geospatial events.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

GeoAI and the Law Newsletter is free but proceeds from paid subscriptions will be used to fund law students who wish to attend local geospatial conferences.

Share