What’s New

FTC Opens Investigation into AI Developers, Including Anthropic and OpenAI (Reuters)

On September 30, the New York Post reported, and Reuters confirmed, that the Federal Trade Commission has opened a broad investigation into the safety of AI systems. The probe examines whether AI developers have engaged in unfair or deceptive practices and whether their products pose risks to consumers.. The investigation was announced a day after President Trump met with AI executives, who agreed to a set of voluntary industry standards. As discussed in last week’s Deep Dive, the absence of an AI-specific statute does not mean the absence of legal risk. GeoAI companies that build or deploy agentic tools should expect their marketing claims, safety testing, and incident disclosures to be measured against existing consumer protection law.

GSA Finalizes AI Acquisition Clause for New Contracts (FedScoop)

The General Services Administration has issued its artificial intelligence acquisition clause as a class deviation from the GSA Acquisition Regulation. It takes effect October 19, 2026, but contracting officers may use it now. The clause applies when the government buys AI systems. It does not cover a contractor’s internal use of AI tools unless those tools are delivered to or accessed by the government. See the Deep Dive below for more details.

Thomson Reuters v. ROSS Intelligence (3d Cir. Sept. 29, 2026) (United States District Court | District of Delaware)

In Thomson Reuters v. ROSS Intelligence, the Third Circuit held that using copyrighted Westlaw headnotes to train a competing legal search tool was not fair use, when the infringing party used the content to compete, emphasizing that “ease is not a justification for copying” when unprotected source material (the judicial opinions themselves) was freely available. World model developers in particular should assess the risk of using a competitor’s curated data products to train models that serve the same market when public-domain, openly licensed, or first-party data is available.

Deep Dive

The General Services Administration (GSA) has issued a new contract clause, GSAR 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems (GSAR Deviation, Sept 2026). It sets detailed data-protection, transparency, and change-management requirements for companies that provide large language model (LLM) products and services to federal customers through GSA vehicles. The clause takes effect on October 19, 2026 although contracting officers can use it now. If you sell, or plan to sell, AI-enabled offerings to the U.S. government, this clause should be on your radar now

Who is Covered

The clause applies when the government is buying an LLM, generative assistant, chatbot, agentic system, or LLM-enabled productivity tool where LLM functionality is a material feature and government data is submitted to or produced by the model. It is "self-deleting," meaning it imposes no obligations, where:

• LLM use is limited to the contractor’s internal back-office or operational tools that the government does not access; or

• LLM features are incidental to a commercial product whose primary purpose is not AI, and those features are not required by the contract, used by the government, or used to process government data.

Prime contractors must flow down the relevant requirements to subcontractors that perform AI design, development, deployment, or operation and monitoring work involving government data.

Key Obligations

• Data Ownership and Use Limits. The government owns all government data (inputs and outputs) and any custom developments, including fine-tuning. Contractors keep their base models and pre-existing "Background Data." Using government data to train or improve models, inform business or marketing decisions, or sell to third parties is prohibited.

• Precedence over commercial terms. The clause overrides conflicting terms of service, license agreements, and click-wrap terms.

• Disclosure. Contractors must disclose the LLMs they use by the date the contract sets or, if none is set, within 120 days of starting work. Any model modification made at the request of a foreign government must be disclosed within 30 days.

• Incident Reporting. Contractors must report incidents affecting government data within 72 hours, send daily status updates, preserve forensic artifacts for 90 days, and file the CISA incident form. FedRAMP and CISA reports may satisfy overlapping requirements. A separate 72-hour notice applies to material violations of the clause itself.

• Data Handling. Contractors must restrict, log, and time-limit human access to government data, keep it within agreed locations, and logically segregate it from other customers' data. Maintaining the required FedRAMP authorization is deemed to satisfy the segregation requirement.

• Closeout Deletion. At the end of the contract, contractors must permanently delete government data and custom developments, including fine-tuned weights, embeddings, indexes, caches, and backups, and confirm the deletion in writing.

• Foreign Control. Contractors must maximize use of U.S.-developed and U.S.-operated LLMs and may not use core components controlled by adversary foreign governments. Foreign-developed open-source components are generally allowed on a risk-based basis.

• Transparency and Oversight. Where the model uses reasoning, retrieval, or agentic steps, contractors must give the government a summary of those steps through the interface, an API, and an audit trail. On request, they must also provide compliance documentation such as model or system cards and information on known biases.

• Change Management. Contractors must give 30 days' notice before adding or replacing models or key providers. That notice is not required if they provide concurrent access to the successor model, which they must use reasonable efforts to do for 30 days for major versions and 15 days for minor versions. If a third-party provider deprecates a model, the contractor must notify the government within five business days. Material safety or performance degradation must be reported within seven days.

• Portability. Contractors must support export of government data in standard formats and may not impose lock-in.

• Government Evaluation Rights. The government may benchmark the deployed model at any time for bias, truthfulness, safety, and unsolicited ideological content, and may suspend use of the model. If the contract is terminated for cause after an uncured, noticed non-compliance, the contractor is liable for decommissioning costs, capped at 25% of the affected order's value.

Recommended Next Steps

1. Assess whether your current and planned GSA offerings fall within the clause’s scope or a self-deleting exception.

2. Map your model supply chain, including model developers, hosting providers, and subprocessors, and plan the required flowdowns.

3. Review your commercial terms and data-use practices, especially any use of customer data for model training or analytics.

4. Confirm you can delete fine-tuned weights, embeddings, indexes, and backups at closeout, and that you can document the deletion.

5. Align your incident response, change management, and model-deprecation processes with the clause’s timelines.

6. Gather existing compliance materials that can satisfy the disclosure and documentation requirements.

Feel free to contact me if you have any questions as to whether your GeoAI product or service will be impacted by this new FAR clause.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, LLC

📘 Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | Licensing in the Age of GeoAI: What Every Geospatial Professional Needs to Know

🎓 Geospatial Law Academy | geospatiallawacademy.com

LinkedIn | Twitter

Share

What’s New

Newsom Vetoes Ban on Selling Precise Geolocation and Other Sensitive Data (Consumer Reports)

Governor Newsom vetoed AB 1542, which would have amended the CCPA to prohibit businesses from selling or sharing sensitive personal information, including precise geolocation, replacing the current opt-out structure with a flat ban. The veto leaves California behind several other states that now bar the sale of precise location data.

California Extends Deletion Rights to Personal Data Obtained from Third Parties (California Privacy Protection Agency)

Newsom signed SB 923, which extends the CCPA deletion right to personal information a business obtained from third parties and allows businesses to keep suppression lists so deleted consumers stay deleted. Effective January 1, 2027, it impacts the path that brokered location data often travels.

Atlanta Proposes Tiered Rules for City Surveillance Technology (Atlanta News First)

Mayor Andre Dickens’ proposed ordinance would require City Council approval for high-impact tools such as facial recognition, monthly police audits, and a ban on vendors monetizing city surveillance data. The monetization ban is a contract term that surveillance and analytics vendors should expect to see elsewhere.

Missouri Governor Orders License Plate Reader Safeguards, Citing Location Data Concerns (St. Louis Public Radio)

Governor Mike Kehoe issued an executive order directing the Department of Public Safety to set ALPR safeguards for state-funded agencies, stating that indefinite storage of location data on law-abiding citizens raises “substantial, valid constitutional and privacy concerns.”

Irish Data Protection Commission Fines Google €403 Million Over Location Data Processing (Data Protection Commission)

Ireland’s Data Protection Commission fined Google €403 million for GDPR violations in how the company processed location data through Web & App Activity, Location History, and Location Accuracy features between 2018 and 2020. The decision underscores that regulators treat inferences drawn from location data, not just raw coordinates, as a core privacy concern which is an issue central to many GeoAI applications.

Italy Attaches Criminal Liability to AI Governance Failures (IAPP)

Italy’s Legislative Decree No. 160, effective September 30, adds criminal sanctions and corporate administrative liability for inadequate AI governance on top of the EU AI Act. For geospatial companies deploying GeoAI systems in Italy, documentation such as system inventories, data lineage records, and validation results may now be evidence required in a dispute, not just a compliance formality.

Deep Dive

When GeoAI Gets It Wrong: The Questions Geospatial Companies Should Be Asking

If you are a company selling GeoAI products or services to government or commercial customers, you should be following two recent developments. The first is Bloomberg’s investigation into the February 28 U.S. strike on an elementary school in Minab, Iran, which killed more than 150 people, most of them children. U.S. databases had listed the site as military for years, even though commercial satellite imagery showed the school had been walled off from an adjacent base since around 2017. As HuffPost summarized the findings, “[i]n the rushed and chaotic run-up to the Iran war, some personnel expected the software to flag outdated information or inconsistencies that it was not trained to do.”

The second is last week’s disclosure that an OpenAI research agent, tasked with researching public data on medicine spending, found a workaround when a Services Australia portal refused its requests and retrieved non-public data. OpenAI acknowledged that “our models took actions we did not intend,” but did not notify the Australian government for roughly 84 days.

I am frequently asked by geospatial and remote sensing companies whether they are subject to any new GeoAI laws or regulations. I think that is the wrong question. AI laws and regulations are coming, but in the meantime, traditional legal principles such as contract law, product liability, and negligence still apply. The better questions are: (1) do our contracts adequately protect us if our GeoAI product or service makes a mistake or goes “rogue”; and (2) do we have documented policies and procedures sufficient to protect us in a lawsuit if it does?

Traditional Law Already Applies. The “AI did it” may not be a defense. In Brocklesby v. United States (9th Cir. 1985), an aeronautical chart publisher was held liable for a defective approach chart even though it had faithfully reproduced FAA data it had no authority to change. That is worth keeping in mind given Palantir’s response to the Iran reporting that it “is not responsible for the underlying data.” Its Pentagon contracts may well support that position, but contracts do not bind injured third parties. Some courts are applying the same principles to AI. In Europe, the new Product Liability Directive, which Member States must transpose by December 9, 2026, expressly treats software, including AI, as a product.

Question One: Do Your Contracts Protect You? Most GeoAI vendors still rely on warranty disclaimers and liability caps drafted for traditional data and software licenses. Companies should consider the following:

• Intended use. Does the agreement state what the product does not do, such as validate whether input data is current, and who is responsible for doing so?

• Warranties, caps, and indemnities. Do disclaimers limit reliance for life-safety, navigation, or targeting uses? Do caps reflect the actual risk, and are the warranties you give customers backed by those you receive from your data and model suppliers?

• Autonomous actions. If your product includes AI agents, does the agreement define what they may access and execute, who is responsible if they exceed that authority, and how the customer can halt them?

• Insurance. Insurers are adding AI exclusions to general liability and professional liability policies. An indemnity you cannot insure may be one you cannot pay.

Question Two: Can You Prove You Acted Reasonably? A negligence claim may turn on whether you exercised reasonable care in designing, testing, deploying, and monitoring your product, and the answer will depend largely on your records. These include governance policies aligned with the NIST AI Risk Management Framework or ISO/IEC 42001; model cards documenting intended uses, known limitations, and data currency assumptions; testing and validation records; human oversight and escalation procedures; logs of agent actions; and an incident response plan that provides for timely notification. In the Iran case, an analyst reportedly noted changes to the site in 2019, but in a system that was not connected to the targeting database. A process that captures anomalies but never escalates them can be worse than none, because it shows the problem was knowable.

The bottom line is that the absence of a GeoAI-specific law does not mean the absence of legal risk. Every GeoAI product will eventually make a mistake. The question is whether, when it does, your contracts and your records will stand up.

Go Deeper: Many of the risk-allocation questions raised here, including data quality warranties, disclaimers, limitations of liability, and indemnification, are covered in Part III of my new book, Licensing in the Age of GeoAI: What Every Geospatial Professional Needs to Know, available at https://geospatiallawacademy.com/store. Subscribers get a 25% discount by using the code GEOAILAW. For the broader legal framework governing liability for geospatial information, see Geospatial Law, Policy, and Ethics (Routledge, 2024).

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, LLC

📘 Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law |

🎓 Geospatial Law Academy | geospatiallawacademy.com

LinkedIn | Twitter

Share

Deep Dive

Licensing in the Age of GeoAI: Why GeoAI Breaks the Inherited Legal Framework

I am pleased to announce the publication of Licensing in the Age of GeoAI: What Every Geospatial Professional Needs to Know, a practical guide written for the geospatial professionals who are being asked licensing questions they were never trained to answer. It is not a treatise, and it is not a substitute for legal advice. It is a reference for the GIS analyst trying to determine the potential legal issues in building a new model, the product manager answering a government procurement questionnaire about training-data provenance, and the data lead facing diligence questions that did not exist two funding rounds ago.

The reason I wrote a guide about licensing is that most geospatial professionals do not realize that the license is where many of the legal issues associated with geospatial information come to life: as contractual obligations. That is true regardless as to whether the data is licensed under a proprietary commercial license, an “open” license, or through the terms of use of a government data portal. And most of those agreements were drafted before anyone in the room imagined the data being fed into a model that would learn from it, generalize from it, and produce outputs affecting decisions about real places and real people. While the EU AI Act and emerging state statutes are important, for most organizations, the binding constraint on what they can legally build tomorrow is a license they signed three years ago.

The guide opens by identifying five specific ways GeoAI stresses a legal framework that traditional geospatial licensing took for granted. Legacy licenses were not drafted for model training, so a grant of rights for “internal use” says nothing useful about an artifact with unbounded downstream possibilities. GeoAI severs the link between data and downstream visibility: a model’s outputs may not visibly contain the training data, and the model may be deployed by parties who never learned what it was trained on. Territorial restrictions become ambiguous when a model is trained on European imagery, combined with data created in Asia, deployed from a server in the United States, and used to produce outputs about mines in Brazil. Which “use” does the territorial clause govern? A traditional licensee produced one downstream artifact; a GeoAI licensee produces at least three: model weights, inference outputs, and the analytical products built from them. And regulatory obligations, long a separate conversation, now attach based partly on what data was used for training.

Operationally, the guide also highlights why training data, inference data, and output data should be considered three distinct legal categories. Authorization for one use does not imply authorization for the others. A data broker who licenses data “for analytical use” may have authorized inference without authorizing training. A customer who submits data “for processing by the model” may have authorized inference without authorizing retention or retraining. The increasingly common practice of using inference logs to fine-tune a model quietly converts inference data into training data, a conversion most customer agreements do not address at all. Organizations that separate these three categories in their data inventories and vendor records may find a gap that a single-category review will not surface.

The guide closes with two developments that will likely reshape geospatial licensing within a few years. The first is world models, which learn primarily from video, imagery, LiDAR, and sensor data rather than text. For example, remote sensing law has always assumed that controlling the imagery controls the information. A model trained on lawful, unclassified, commercially available imagery may be able to synthesize a navigable reconstruction of a sensitive facility that is more operationally useful than any single licensed product, and that no remote sensing license ever touched. The second is digital sovereignty. A growing number of jurisdictions now treat high-value geospatial data as a strategic national asset, imposing requirements on where it must reside, which entities may control it, and whether it may cross a border at all. A single global license may be unlawful in key markets. Therefore, a consequential drafting question becomes who bears the risk when a sovereignty regime is breached.

The guide also includes a full geospatial license review checklist and a glossary of the licensing and AI terms that appear most often in these agreements.

The thesis of the guide is that well-drafted licenses are not obstacles to innovation. They are what makes it possible to scale products by combining datasets responsibly, deploying AI systems lawfully, and allocating liability in environments where errors can carry real consequences. The organizations best positioned to succeed with GeoAI will be those that understand not only what their licenses say, but what those licenses mean in practice.

Go Deeper

Licensing in the Age of GeoAI is available now at https://geospatiallawacademy.com/store. (You can find a preview here.)

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, LLC

📘 Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law |LinkedIn | Twitter

Subscribe now

What You’ll Learn This Week

• How a major lawsuit by Sony Music Publishing and Warner Chappell against Anthropic over copyrighted song lyrics could shape the legal landscape for companies training AI models on protected creative works, including geospatial content.

• Why Flock Safety’s growing backlash over police misuse of its license plate reader and drone network underscores the urgent need for robust internal policies governing location-based surveillance tools, even before formal regulations exist.

• How to structure a risk-based GeoAI governance framework, spanning risk classification, lifecycle management, vendor oversight, and documentation that aligns with the EU AI Act, the Colorado AI Act, and other emerging state laws.

What’s New

Sony, Warner Music Sue Anthropic Over Songs Used in AI Training (MSN)

Sony Music Publishing, Warner Chappell, and a group of other music publishers sued Anthropic PBC and co-founders Dario Amodei and Benjamin Mann in the Northern District of California, alleging that the company trained its Claude models on tens of thousands of copyrighted musical compositions. The complaint alleges a “brazen campaign of illegally torrenting, scraping, and downloading copyrighted works,” including millions of copies of books containing song lyrics and sheet music from the Beatles, Taylor Swift, Michael Jackson, and hundreds of other artists. The publishers seek statutory damages of up to $150,000 per infringed work along with an injunction barring Anthropic from further use of their compositions. GeoAI companies should follow this case closely, as there are several similarities between music and geospatial information

Flock CEO Calls for ‘Compromise’ as Surveillance Company Faces Growing Backlash (Tech Crunch)

Facing sustained criticism of its license plate reader, camera, and drone network, Flock Safety CEO Garrett Langley called for a “compromise between privacy and safety” and urged states to pass legislation making unlawful use of Flock data a criminal offense, acknowledging the current absence of regulation and accountability in the sector. The backlash follows Washington Post reporting documenting 46 instances in which police officers allegedly used Flock technology to surveil ex-partners and acquaintances. The company has reduced default data retention from 30 days to seven days and now requires case codes for data access, though both controls can be overridden through an “Evidence Mode” setting that permits longer storage. As discussed in the Deep Dive, having robust policies and procedures in place are critical for GeoAI companies even with the lack of regulations.

Deep Dive

Navigating State Laws and the EU AI Act In Developing GeoAI Governance Program

Geospatial professionals build and deploy GeoAI systems that classify satellite imagery, detect objects, predict movement, optimize routes, manage infrastructure, and support decisions about people and places. Because these systems combine AI with location intelligence, their consequences can extend beyond model accuracy. A land-use classifier may shape permitting, a mobility model may enable surveillance, and a mapping tool may influence access to housing, insurance, employment, emergency services, or public benefits. GeoAI governance therefore must address not only algorithms, but also geospatial data, intended uses, affected communities, and the downstream decisions that maps and predictions inform.

Every program needs a foundational policy that defines GeoAI for the organization, sets its scope, and establishes principles such as fairness, transparency, accountability, safety, privacy, and security. It should apply to internally developed systems, third-party tools, embedded AI, and material modifications to existing systems. The policy also should assign responsibility through a cross-functional governance board that includes geospatial, data science, operational, privacy, cybersecurity, legal, and compliance expertise. Such executive sponsorship gives the program authority. Implementing operational standards translate principles into repeatable, auditable requirements. Further, aligning the policy with the NIST AI Risk Management Framework and ISO 42001 can provide a common structure across jurisdictions.

Risk Classification. Both the EU AI Act and state laws such as the Colorado AI Act use risk-based approaches. The EU AI Act distinguishes prohibited, high-risk, limited-risk, and minimal-risk systems, with extensive duties for high-risk systems. For GeoAI, classification depends primarily on intended purpose, safety function, and person-level impact, not merely on the use of imagery or coordinates. The same satellite image might support low-risk crop analysis, high-risk critical-infrastructure operations, or rights-sensitive monitoring of identifiable people. Your intake process should therefore identify the system’s role, deployment geography, users, affected populations, and whether outputs influence consequential decisions. It also should distinguish aggregate geographic analytics from profiling or scoring individuals. Colorado focuses on high-risk systems that make or substantially contribute to consequential consumer decisions and calls for risk management, impact assessments, transparency, and protections against algorithmic discrimination. Other state laws may separately regulate precise geolocation, biometrics, employment tools, profiling, chatbots, or training-data disclosures, so the program must maintain a current legal inventory rather than rely on one universal checklist.

Lifecycle Governance. The program should be structured around concept review and approval, design and deployment, and continuous monitoring. At concept review, the intended purpose, legal role, risk tier, data sources, geographic scope, and unacceptable uses should all be defined. During design, positional and thematic accuracy, robustness, cybersecurity, privacy, and performance across regions and demographic groups should be tested. Companies should also examine whether incomplete coverage, outdated imagery, sampling bias, or proxy variables create spatially concentrated harms. Before deployment, meaningful human oversight, escalation criteria, user notices, appeal paths where required, and technical guardrails should be Vendors should assess training-data rights, geospatial data provenance, model limitations, subcontractors, monitoring support, audit rights, incident reporting, and liability allocation. Procurers of GeoAI products and services should conduct risk and vendor assessments, notice and disclosure processes, and training. Technical testing should be built into ordinary product and procurement workflows.

Document Monitor. Regulators and customers increasingly expect companies to document governance. Such documentation includes maintaining a GeoAI system inventory, impact assessments, model cards, dataset and license records, data lineage, validation results, approvals, change logs, user notices, and incident-response plans. A system that begins as an informational mapping aid can become higher risk if later integrated into automated enforcement, eligibility, or resource-allocation decisions. Therefore after a product launch, companies should continue to monitor for model drift, data drift, geographic performance gaps, misuse, security events, and changes in law or intended purpose.

The bottom line is that GeoAI governance should be an operating system for responsible innovation, not a one-time legal review. Well-designed governance can reduce risk while increasing confidence and adoption across the enterprise. By combining clear accountability, use-case classification, spatial data governance, testing, human oversight, vendor controls, documentation, and continuous monitoring, geospatial organizations can meet evolving state and EU expectations while delivering GeoAI that is accurate, lawful, explainable, and worthy of public trust.

Launching Soon!

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, LLC

📘 Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law |

🎓 Geospatial Law Academy | geospatiallawacademy.com

LinkedIn | Twitter

Share

What You’ll Learn This Week

• Why the FTC’s proposed “suppression of accuracy” policy means a GeoAI vendor that quietly tunes its outputs to comply with a state law may be deceiving its customers under Section 5 of the FTC Act.

• How Nebraska’s recently enacted LB 525 creates a farmer’s rights in its data.

• Why the EU AI Office’s whistleblower channel, which is now backed by full anti-retaliation protection as of August 2, 2026, changes the internal-governance calculus for any geospatial firm placing high-risk AI on the EU market.

What’s New

Federal Trade Commission's Proposed Policy Statement Concerning The Suppression of Accuracy in Artificial Intelligence Systems (FTC.gov)

On July 1, 2026, the Federal Trade Commission issued a proposed policy statement concerning the “suppression of accuracy” in artificial intelligence systems. Issued at the direction of Executive Order 14365, the statement asserts consumers reasonably rely on AI companies explicitly and implicitly represent that their systems “aim to produce the best output” and achieving users’ stated objectives. Consequently, a company that steers outputs “toward unexpected objectives, and away from the objectives set by or reasonably expected by users” is therefore likely to deceive consumers in violation of Section 5 of the FTC Act. Critically, the Commission states that this holds “even when a company engages in a deceptive act or practice in order to comply with a state law,” reasoning that such state law is impliedly preempted. Adding a disclaimer is possible, but disclosure must be prominent and persistent and “not be buried in terms of service” and must be prominent and persistent. . For geospatial companies, the means stating where and why outputs are restricted in product documentation and specifications, not buried in the license.

Nebraska’s LB 525 Also Closes Farm Data to Public Records Requests (NebraskaLegislaturve.gov)

LB 525, adopts the Agricultural Data Privacy Act, which vests ownership of agricultural data, including “land data,” defined to cover soils, topography, elevation, watershed, drainage, and “geospatial information regarding such parcel”, in the agricultural producer, and bars controllers and processors from selling that data without express written consent obtained through a disclosure “separate from the primary terms of service.” Enforcement runs exclusively through the Attorney General at $1,000 per violation. Beginning January 1, 2027, every new contract involving the collection or processing of agricultural data in Nebraska must recite the sale prohibition. It also amends section 84-712.05 to add a thirtieth public-records exception, permitting custodians to withhold agricultural data without prior written consent from its owner.

AI Act Whistleblower Tool (European Commission)

The European Commission’s AI Office now operates an AI Act Whistleblower Tool, a secure and confidential channel through which individuals “professionally connected to providers of general-purpose AI (GPAI) models or of AI systems falling within the AI Office’s enforcement remit” can report suspected AI Act violations directly to Brussels. Reports may be submitted anonymously, in any EU official language, with supporting documents, through a secure inbox that lets the reporter track progress and answer follow-up questions while remaining anonymous. Geospatial companies offering GeoAI products and services in Europe should maintain a working internal reporting channel.

Deep Dive

Nebraska’s New Farm Data Law: What Remote Sensing Companies Need to Know

The Scenario: Your company sells satellite-derived crop health analytics to agribusiness customers. A grain trading firm asks you to provide field-level yield estimates for 500 Nebraska farms, identified by operator name. Under Nebraska’s new Agricultural Data Privacy Act (LB 525), signed April 14, 2026 and effective July 17, 2026, that request now carries a new legal risk.

What the Law Does: Nebraska now declares that agricultural producers own data originating from their farms, including “land data,”, which explicitly covers “geospatial information regarding such parcel.” Controllers and processors cannot sell producer-linked data without separate, conspicuous written consent. Violations carry $1,000 per-violation penalties and injunctive relief, enforced exclusively by the Attorney General.

The Ambiguity for Remote Sensing. The Act covers data that “originates from” the producer’s land. Unfortunately, it is unclear whether remotely sensed data of a Nebraska farm, collected by a third party with no relationship to the farmer, qualifies as “land data” the producer owns? However, a literal reading could support producer ownership, as the imagery describes physical attributes of the parcel and is linkable to the producer through assessor records.

What’s Protected (and What Isn’t). Publicly available government data is excluded, so uses of public parcel, soils, and elevation data remain clear. But, as discussed above, going forward it is not clear how much agricultural data will be publicly available. Second, “derived data”, defined as anything “significantly modified, processed, analyzed, or compiled” into insights, reports, or predictive models, falls outside the Act entirely. Crop classifications, yield estimates, and analytic products built from imagery are likely excluded. It is also important to note that the restrictions apply to “controllers and processors”. These terms fit a direct data relationship with producers more naturally than EO companies selling imagery to the market.

Practical Guidance. Remote sensing companies selling farm-level analytics into Nebraska, particularly those delivering data identified by grower or operation rather than by scene, should assess now whether any products constitute producer-linked data subject to the consent requirement.

Go Deeper. Readers of this newsletter will see the Nebraska law as a growing trend that will impact GeoAI: continued movement towards restricting the collection and transfer of geospatial information. The impact of that shift for companies that collect, use and distribute geospatial information is discussed in more detail in Geospatial Law, Policy, and Ethics (Routledge, 2024).

Launching Soon!

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, LLC

📘 Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law |

🎓 Geospatial Law Academy | geospatiallawacademy.com

LinkedIn | Twitter

Share

What You’ll Learn This Week

• Why the Ninth Circuit’s Amazon v. Perplexity ruling which found that an AI agent acts as a “tool,” not a “person”, narrows CFAA protection for geospatial data providers, leaving DMCA anti-circumvention, Terms of Service, and technical controls as the primary defenses.

• What Senator Warner’s draft “AI AGENT Act” would mean for geospatial licensing if platforms must admit authorized AI agents “on the same terms as a user.”

• Why the rising wave of AI-liability suits could put the “who pays” question on GeoAI deployers, through claims of negligence and contract, not any bespoke AI statute.

What’s New

The Federal AI AGENT Act: Consumer Protection in AI Clothing? (DWT.com)

On June 29, 2026, Senator Mark Warner released a discussion draft of the Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer (AI AGENT) Act, a proposed federal framework governing how consumer-facing autonomous AI agents interact with large online platforms. As drafted, covered “gatekeeper” platforms would be required to let authorized third-party AI agents access their services functionally “on the same terms as a user,” through interoperable, non-discriminatory interfaces.

Making Companies Liable Could Rein in Runaway AI (Axios)

An Axios article argues that liability (i.e., regulatory fines and civil damages brought under existing law) may be the strongest near-term lever for curbing AI harms as the rapid spread of AI agents has made the question urgent (and AI-specific legislation stalls at the federal level).

Deep Dive

The Ninth Circuit Reverses Amazon v. Perplexity — What the Appellate Ruling Means for Geospatial Data Licensing in the Age of AI Agents

Imagine an agricultural technology startup deploys an AI agent called “CropWatch.” A licensed user of a commercial platform with aerial and satellite imagery and points CropWatch at the platform’s API. The user has valid credentials and a standard seat license limited use for crop-monitoring analysis of a particular region. But CropWatch doesn’t stop at answering the user’s question. It systematically queries the API, extracts high-resolution imagery tiles, vegetation indices, and time-series data across thousands of fields, then transmits those to the startup’s servers. The data is subsequently used for model training. The user clicked “accept” on the terms of use, but the startup never did. Is such use permitted, and if not, who is liable? A federal court in California just took a step in answering those questions, and the answer favored data providers. A Ninth Circuit decision has changed the analysis.

The Ruling: The Ninth Circuit Vacates the Injunction

On August 4, 2026, the United States Court of Appeals for the Ninth Circuit issued its decision in Amazon.com Services, LLC v. Perplexity AI, Inc., No. 3:25-cv-09514, 2026 WL 223758A (9th Cir. Aug. 4, 2026), vacating a preliminary injunction that had barred Perplexity’s Comet browser from interacting with Amazon’s website. The court addressed a question of first impression (i.e., a legal issue that has not previously been decided by a controlling court) whether an AI “agent” that assists a user in navigating a website constitutes unauthorized “access” under the Computer Fraud and Abuse Act (“CFAA”). The court found that it does not.

The court’s reasoning turned on the phrase in the CFAA,“whoever … intentionally accesses” a protected computer. If found that “whoever” means a person, and Perplexity’s AI Assistant, “however advanced,” is a tool, not a person for statutory purposes. The court concluded that as Perplexity’s servers never communicated directly with Amazon’s servers, since it was the user’s browser that transmitted requests to Amazon.com at all times, the user, not Perplexity, was the one who “accessed” Amazon’s computers. In distinguishing this case from precedents the district court had relied on, the court found that extending the CFAA to cover this conduct would require a “novel interpretation far afield” from the statute’s anti-hacking purpose and could “expose users themselves to criminal liability” simply for using an AI-assisted browser.

Of note, the court was careful to limit its holding. It stated explicitly, “[w]e do not establish a new legal regime governing agentic AI.” The decision turned on the specific technical architecture at issue and left open whether a different architecture, for example one in which the developer’s servers directly query a third party’s systems, might yield a different result. Importantly, the court also clarified that its ruling does not impair a platform’s ability to enforce access restrictions through it Terms of Service.

Applying the Ninth Circuit’s Ruling to the CropWatch Scenario

Returning to the CropWatch scenario, under the district court’s framework, the startup could have been found to have violated the CFAA as the user’s credentials did not confer the platform’s authorization. But the Ninth Circuit has now redrawn the analytical framework. If CropWatch’s architecture mirrors Comet’s, a CFAA claim could be off the table. Rather, a court could view the user as the party “accessing” the platform, with CropWatch serving as a “tool” rather than a “person” under the statute.

Legal Considerations After the Ninth Circuit Decision

This is a single appellate decision, and courts in other circuits may reach different conclusions. As AI agent technology and related litigation continue to evolve, geospatial professionals should not rely on this ruling as the final word. That said, the decision highlights several considerations for all parties (data providers, users and developers):

• Understanding contractual and technical protections: Terms of Service, bot detection, and rate limiting remain enforceable even where the CFAA does not apply.

• Is user-device access distinguished from server-to-server access: The court’s holding turns on technical architecture, so should licensing terms address each pattern separately?

• Allocation of Risk: Should risks be allocated to developers through flow-down terms and indemnities that expressly cover AI agents and automated systems?

• Monitor Legal Developments: It will be important to monitor how courts and lawmakers treat increasingly autonomous agents as the “tool vs. person” distinction, as this may shift as AI agents act with less human oversight.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• Why the geospatial community does not need to reinvent “trust” for GeoAI — the same laws, regulations, and contracts that underpin food safety, driving, and building codes already offer the template

• How the EU AI Act’s August 2 GPAI enforcement deadline puts geospatial foundation models on the clock for model documentation, training-data summaries, and copyright policies..

What’s New

European Commission Receives Final Version of General-Purpose AI Code of Practice (IAPP)

Obligations for general-purpose AI (GPAI) model providers under the EU AI Act, in force since August 2, 2025, take another big step August 2, 2026, as that is when the AI Office gains full enforcement powers (including fines of up to 3% of global annual turnover or €15 million). The voluntary GPAI Code of Practice (published July 10, 2025) expects providers to maintain technical model documentation, publish a summary of training-data content, respect rightsholders’ reserved rights and opt-outs, and share information with downstream developers.

Authors Have Mixed Feelings About the $1.5B Anthropic Copyright Infringement Ruling (NPR)

A federal judge has approved a roughly $1.5 billion settlement between Anthropic and a class of authors who alleged the company pirated their books to train its Claude models. It is the largest AI copyright settlement to date, with payment of about $3,000 for each of some 465,000 works. The settlement follows Judge William Alsup’s June 2025 ruling in Bartz v. Anthropic, which found that while training AI on copyrighted books can be transformative fair use, downloading those works from pirate sites to build a permanent library is infringement.

Deep Dive

No Need to “Reinvent Trust”

There is a good deal of discussion within the geospatial community about building trust when it comes to GeoAI. But the discussions often fail to include the critical role that laws, regulations and contracts will play in building this trust.

When I wake up in the morning and make myself breakfast, I don’t “trust” the farmers who grew the food or the companies that process, ship, or sell it. Rather, I expect that they comply with food safety laws and regulations, that their contracts and insurance policies require that compliance, that regulators inspect the food supply chain and fine or shut down violators, and that lawsuits will follow if those laws or contracts are broken.

When I drive my car to work, I don't "trust" the other drivers on the road, the manufacturers that built our vehicles, or the crews that paved and maintain the streets. I trust that drivers are licensed, insured, and required to follow traffic laws, and that vehicle manufacturers must comply with extensive safety standards. I also trust that auto insurance policies require compliance with applicable driving laws. I trust that government regulators and law enforcement conduct inspections, enforce traffic laws, and revoke licenses or impose fines on those who violate them. And I trust that lawsuits will be filed-and insurance claims paid-if a driver or manufacturer causes harm by breaking those rules.

When I enter my office building and ride the elevator, I don't "trust" the building owner, the construction company that built it, or the technicians who maintain the elevator. I trust that the building was constructed and is maintained in compliance with fire, safety, and building codes, and that the elevator is regularly inspected and certified under applicable safety regulations. I also trust that the owner's and maintenance company's insurance policies require this compliance. I trust that government inspectors audit these systems and can fine or shut down any building or elevator that fails to meet code. And I trust that lawsuits will be filed if the owner or maintenance company is negligent and someone is injured.

Conclusion

As this newsletter has tried to illustrate, a growing body of legal, regulatory, and contractual developments in AI is already shaping the geospatial community. On the regulatory side, frameworks such as the EU AI Act, the NIST AI Risk Management Framework, and emerging state-level statutes are establishing baseline obligations around transparency, risk assessment, and accountability for AI systems, including those that process geospatial data. On the contractual side, vendor and customer agreements increasing address issues that are relevant to GeoAI, including data provenance and licensing restrictions on training data, ownership and permitted use of AI-generated outputs, allocation of liability for positional or classification errors, and audit and reporting rights to verify compliance with applicable laws and standards.

One way for the geospatial ecosystem to build trust in GeoAI, consistent with how trust is built in other industries, is to show that are complying with these legal and regulatory requirements. Another is to incorporate the relevant contractual terms into their vendor and customer contracts. The geospatial community does not need to redefine “trust”: it can simply apply lessons learned from other domains.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Deep Dive

Geospatial Foundation Models Have Arrived — And the Legal Questions Came With Them

For the last couple of years, I’ve been exploring the complex legal issues that will arise as geospatial foundation models are integrated into existing geospatial workflows. Last week, that that future took one step closer to becoming a reality. At its 2026 User Conference, Esri announced that foundation models are becoming part of ArcGIS. Geospatial models such as NASA and IBM’s Prithvi, the open Clay models, and ESA’s TerraMind have been maturing for a while. But as these capabilities become part of a platform used daily by thousands of geospatial professionals, accessible through the same tools analysts already use, the legal questions move into the mainstream.

So, it’s worth stepping back and asking why a geospatial foundation model changes the legal calculus.

What Makes These Models Different

A geospatial foundation model learns a general, reusable representation of places, imagery, or geographic features; an embedding rather than being trained for one narrow task. Fed with satellite imagery, demographic data, or a map, and it can produce a compact numerical fingerprint that similar places share. That fingerprint can then power similarity search, prediction, classification, or natural-language queries with far less task-specific training data than before.

There are several categories of geospatial foundation models. There are location and geodemographic encoders, such as Esri’s new USA Geodemographic Embeddings, which distills Census, American Community Survey, housing, and environmental data into a 256-dimension vector for every hexagon in the country. There are vision-language models that let you query imagery in plain English. And there are remote sensing models, such as Prithvi, Clay, and TerraMind, which are increasingly offered as ready-to-use components.

Why the Legal Calculus Shifts

Regulators will see an AI system where we see a GIS tool. Under the EU AI Act, a model trained broadly for adaptation across many downstream tasks is considered a general-purpose AI model, with obligations that have been in force since August 2025. However, there is a significant risk is that no one in the compliance chain realizes a new geoprocessing step may have become a regulated AI system.

The privacy question moves from the input to the inference. Each dataset feeding a geodemographic model may be lawful, public, and aggregated. But the entire point of an embedding is inference (i.e., profiling places, and by extension the people in them) at scale and near-zero cost. State privacy laws increasingly treat inferences as personal data, and the same demographic fingerprint that helps a planner site a clinic can serve, intentionally or unintentionally, as an efficient proxy for personal variables such as race, income, or health in an underwriting or lending model, or in other cases, for gender, sexual orientation or religion. Coarse aggregation is not a legal safe harbor when downstream users join these embeddings to finer data. To further complicate matters the potentially offending variable is not visible anywhere.

The provenance chain breaks. A traditional geospatial work product can cite its inputs. An embedding cannot be decomposed that way. When a decision rests on “similar locations” surfaced by a model trained on data no one on the project has seen, the standard of care for validating the output gets harder? Who is liable when the model quietly misses the flood-prone parcel: the analyst, the firm, the platform, or the upstream model developer?

The models arrive wrapped in other people’s terms. Open-source backbones each carry their own licenses, training-data pedigrees, and use restrictions. For anyone serving regulated or government clients, provenance, and the beta and early-adopter terms under which many of these tools currently ship, become critical.

What to Do Now

• Inventory which teams are using foundation models and which specific models sit behind each workflow.

• Understand the beta and early-adopter terms before building new products or piloting anything on client work.

• Treat embedding-derived outputs as inferences for privacy purposes. Screen for proxy discrimination before they enter any underwriting, pricing, or eligibility model.

• Document model provenance, including the model and version, and how a competent professional can validate the output.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Editor’s Note

I published the first issue of this newsletter in March 2024. While the pace of change in artificial intelligence of both the technology and its adoption since then has been obvious to even the most casual of observers, developments in law and policy have been less obvious. But it would be a mistake to think that there has been none, or that AI is unregulated. After reviewing the past 49 issues of this newsletter, it is clear that while the legal landscape for AI is fragmented, it is becoming more concrete and is beginning to affect the geospatial sector.

This special edition does two things. First, it identifies five news items since March 2024 that I believe have, or will have, the most defined impact on geospatial AI from a legal standpoint. Second, it reviews the Deep Dive series and the arcs it traced.

Part 1: Top 5 Articles

1. EU Passes Comprehensive AI Rules (March 18, 2024) (European Parliament News)

In March 2024, the EU passed a comprehensive law regulating AI. The EU’s passing of the AI Act is certainly one the most significant legal and policy developments over the past two years. The AI Act is intended to balance innovation with perceived risk, but raises a number of questions. Companies that sell GeoAI products and services in Europe should determine whether they will be subject to the AI Act provisions that regulate 'high-risk AI systems', as these are the most onerous, and consequential.

2. DOJ’s Bulk Data Transfer Rule Applied to AI (September 4, 2025) (Federal Register)

The U.S. Department of Justice's Bulk Data Transfer Rule (the “Rule”) places unprecedented national-security controls on the collection, processing, storage, and disclosure of certain location-enabled data that is linked or linkable to a U.S. person. Companies that develop or deploy artificial-intelligence models trained on certain types of geospatial information capable of being linked to a person, should consider how the Rule applies to them. The Rule covers both certain types of demographic data (including addresses) and precise geolocation data, defined as any information (historical or real time) that identifies the position of an individual or device within 1,000 meters. Because only 1,000 U.S. devices' worth of precise geolocation data meets the 'bulk' threshold, even modest training and validation datasets can trigger the Rule. 'Transfer' is defined far beyond the traditional sale of data. For example, licensing an AI model (e.g., a chatbot) to third parties that can be used to access the training data, or hiring engineers who reside in a country of concern can each constitute a covered data transaction.

3. California AB-2013 — Generative AI Training Data Transparency Act (October 3, 2025) (California Legislative Information)

California's new AI Training Data Disclosure Law requires developers of generative AI systems to publish detailed information about the datasets used to train generative AI models. For GeoAI companies, this means they will need to reveal whether geospatial datasets include personal or proprietary information, raising compliance, intellectual property, and privacy considerations.

4. GSA's Proposed AI Contract Clause 552.239-7001 (March 24, 2026) (GSA.gov)

The U.S. General Services Administration (GSA) released a draft contract clause designated 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems, that if finalized, will be inserted into every GSA solicitation and contract for AI capabilities. For geospatial companies selling AI-powered products and services to the federal government, this proposed clause represents a consequential shift in the procurement landscape. The clause touches upon many aspects of a geospatial AI vendor;s products and pipelines, including strict data ownership rules to an outright prohibition on foreign AI components.

5. European Commission Draft Guidelines on High-Risk AI Classification under Article 6 (June 4, 2026) (European Commission)

On June 4, 2026, the European Commission published draft guidelines for stakeholder consultation on the classification of high-risk AI systems under Article 6 of the EU AI Act (Regulation (EU) 2024/1689). Issued pursuant to Article 6(5) of the Act, the package consists of a general-principles document and two annex-specific chapters addressing the two routes by which an AI system becomes 'high-risk'. One such route is Article 6(1), covering AI that is itself a product, or a safety component of a product, regulated under the legislation listed in Annex I. The other route is Article 6(2), covering the eight use-case areas listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice).

For geospatial organizations, the draft offers something the Act itself did not: concrete examples, several of which specifically reference satellite imagery, drones, thermal sensors, and spatial-analytics platforms. The most important takeaway for geospatial professionals is that classification turns on the intended purpose a provider assigns to a system, not on the technology used or where it is deployed.

Part 2: Review of the Deep Dive Series

Most of the issues featured a Deep Dive on a specific legal topic. But two threads run longest and matter most for practitioners: how the EU AI Act's high-risk framework reaches geospatial systems, and how contracts are becoming the primary mechanism for allocating GeoAI risk. Part 2 traces those two arcs through the Deep Dives that built them.

Theme 1: High-Risk Systems Under the EU AI Act — What It Means for Geospatial

The high-risk thread opened in March 2024 with coverage of the AI Act’s passage and an early flag that “high-risk AI systems” would be the regulatory category most critical for geospatial vendors to track. A July 2024 Deep Dive then walked through what “high-risk” actually means under the Act, particularly the Annex III categories most likely to capture GeoAI applications: critical infrastructure, law enforcement, migration and border control, and essential public services.

By September 2024, the analysis became concrete: how does the Act apply when a geospatial business fine-tunes a foundation model such as NASA/IBM’s Prithvi? That fine-tuning question was revisited in November 2025 under Article 3(2), with attention to the compute thresholds that determine provider status, because who counts as the “provider” determines who bears the bulk of the compliance burden under the Act.

By March 2026, the focus shifted to operational compliance. A Deep Dive walked through what a high-risk geospatial AI vendor needs to have in place before the high-risk obligations begin (e.g., technical documentation under Annex IV, post-market monitoring, conformity assessment, quality management systems, and registration in the EU database). In May 2026, the EU Digital Omnibus reform pushed several of these deadlines back but did not change the substantive obligations.

And in June 2026, the Commission’s draft Article 6 guidance gave the clearest answer yet to the foundational question for any geospatial vendor: when is a system actually high-risk? The Commission’s illustrative examples (i.e., satellite imagery for search-and-rescue versus border-control surveillance; thermal sensors detecting human presence in uninhabited areas versus at frontiers) read like a glossary of geospatial practice.

The arc has a clear message: high-risk classification is not a single yes/no determination but a chain of judgments. Factors to consider include the system’s intended purpose, whether the vendor is acting as a provider or a downstream deployer, and which Annex III use case (if any) applies. Two years of Deep Dives have moved the field from “watch the EU AI Act” to “manage your high-risk classification as a live document, with the Commission’s guidance as your starting framework.”

Theme 2: Allocating GeoAI Risk Through Contracts

A separate but converging thread is the emergence of contract law as driving the most significant legal obligations associated with GeoAI. The first Deep Dive on this theme, in early 2025, made an argument that has continued to hold up. For most geospatial buyers and vendors, contract law would do more practical regulatory work than statutes. (Of note, this was often the case with privacy and cybersecurity - contractual requirements, particularly from large enterprises - predated comprehensive legal frameworks.) Limitation-of-liability clauses, liability caps, and accuracy disclaimers would be where GeoAI adoption was actually shaped or stalled. AI vendors were marketing performance parity claims while disclaiming any liability for failures in the systems. Even then, the gap between contractual risk allocation and marketing language was an issue.

By late 2025, the analysis became specific. A Deep Dive enumerated the AI-specific contract clauses geospatial counsel should consider drafting or negotiating. These included data rights (separating training-data inputs from derivative outputs), accuracy service-level commitments, bias-testing obligations, privacy and data-residency provisions, and national-security clauses (particularly where federal or defense contracts are in play). Each clause maps to a specific GeoAI risk, an imagery model that drifts, a routing model that misclassifies a sensitive site, a fine-tuned model whose outputs leak protected data.

Insurance entered the picture in early 2026, when carrier appetite for AI risk narrowed. A Deep Dive documented the new exclusions, sublimits, and deepfake-specific carve-outs that firms could expect to encounter on renewal. Contract counterparties cannot simply assume that residual risk allocated under indemnities or liability caps will actually be backed by an insurance recovery, if it materializes. The contract has to do more work because the insurance is doing less.

By March 2026, the contract story became a procurement story. A Deep Dive on GSA’s proposed clause 552.239-7001 showed how a single federal acquisition clause was poised to vest broad ownership of “Government Data” and any “Custom Development” in the United States, prohibit use of customer data to improve commercial models, and impose strict data-localization and segregation requirements. For many geospatial vendors, that one clause is more consequential than any U.S. AI statute. In April 2026, the California Executive Order N-5-26 Deep Dive showed the same pattern at the state level: procurement, not legislation, was leading the substantive governance work.

The arc’s message for geospatial professionals is that today’s operative legal framework for most GeoAI risk allocation is the contract, not the statute. The questions to consider in every deal include who owns the inputs and outputs, who is the “provider” for downstream regulatory purposes, what accuracy and bias guarantees are being made (and at what liability cap), and whether insurance will actually respond to the risks the contract assigns. And, for sales to government customers, what procurement clauses apply.

Closing

Fifty issues is a small number against the time horizon of the legal questions this newsletter tracks. The EU AI Act will be revised and reinterpreted for years. State patchworks will strengthen, conflict, and be litigated. Procurement clauses will be incorporated into laws. New foundation-model architectures (i.e., world models) will raise new issues.

But if you work in geospatial, my advice after fifty issues is the same as it was in Issue #1: the legal exposure from AI in your work is real, and the rules aren’t waiting for you to catch up. Read your contracts. Read the procurement clauses. Keep an eye on state bills and EU AI Act implementation. And where you can, get involved by contributing to the policies, standards bodies, and Bodies of Knowledge that are moving faster than legislators.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Deep Dive

When is Your GeoAI System “High-Risk”? The EU Commission Draws the Lines

In May, the European Commission published draft guidelines for stakeholder consultation on the classification of high-risk AI systems under Article 6 of the EU AI Act (Regulation (EU) 2024/1689). Issued pursuant to Article 6(5) of the Act, the package consists of a general-principles document and two annex-specific chapters addressing the two routes by which an AI system becomes “high-risk”: Article 6(1), covering AI that is itself a product, or a safety component of a product, regulated under the legislation listed in Annex I; and Article 6(2), covering the eight use-case areas listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice).

The guidelines are not binding, and authoritative interpretation ultimately rests with the Court of Justice. But they are the clearest signal yet of how the Commission expects providers and deployers to self-assess classification. This timing matters as under the recently agreed Digital Omnibus, the high-risk obligations these guidelines interpret are now staggered, with Annex III duties applying from 2 December 2027 and Annex I duties from 2 August 2028. For geospatial organizations, the draft offers something the Act itself did not: concrete examples, several of which specifically reference satellite imagery, drones, thermal sensors, and spatial-analytics platforms.

Intended Purpose, Not the Sensor, Decides

The most important takeaway for geospatial professionals is classification turns on the intended purpose a provider assigns to a system, not on the technology used or where it is deployed. The Commission states plainly, in the migration and border-control context, that “the place of deployment and the sensor modality are not decisive.” The same satellite feed or thermal camera can be high-risk or out of scope depending entirely on what the provider says the system is for.

The guidelines illustrate this with examples that map directly onto geospatial practice:

• A system that uses drone or satellite imagery to detect human presence in vast uninhabited areas to support search and rescue, relying on non-biometric cues, is not high-risk.

• But “AI-combined satellite imagery services, surveillance towers or unmanned platforms that flag human presence” to cue a border-control response fall squarely within Annex III, point 7(d), and are high-risk. So does maritime surveillance that detects and tracks persons for border operations. Of note, the Commission is explicit that this holds “irrespective of whether the platform operates in territorial waters, the contiguous zone or on the high seas.”

While the sensing capability is the same, the uses differ. The line is the purpose the provider markets and documents.

This carries a sharp consequence for vendors of general-purpose or multi-use geospatial tools. The general-principles guidance warns that where a system is presented as “broadly applicable across a generality of contexts” and does not “consistently limit its application or exclude high-risk uses,” its intended purpose will be deemed to encompass high-risk use cases. Critically, a disclaimer is not enough: “merely asserting (for example in the terms of service) that high-risk uses are excluded is insufficient” where the provider’s overall presentation, examples, or product positioning effectively promotes such uses. Any limitation must be “clearly, concretely, and coherently described across all materials.”

Critical Infrastructure: Only “Safety Components” Count

Although GeoAI is woven into the management of roads, utilities, and networks, the guidelines confirm that not every such system is high-risk. Under Annex III, point 2, a system qualifies only if it is a safety component that directly protects the physical integrity of the infrastructure by preventing, controlling, or mitigating risks of physical harm. Systems that are “merely supportive, informational, organizational or optimization-oriented” do not qualify.

The Commission’s worked example is instructive: an AI-enabled traffic-flow optimization platform built on real-time data “provides insights but [does] not directly protect physical integrity,” and is therefore not high-risk, while a system that detects abnormal infrastructure behavior and triggers a protective response is. A second condition is easy to overlook: the system must actually be used by an entity formally identified as a critical entity, though, as the guidance notes, that status need not be disclosed to the provider, and many deployers will simply demand high-risk-grade compliance in procurement.

For Annex III systems, there is an escape hatch under Article 6(3) A system that performs only a narrow procedural task, improves a completed human activity, detects decision patterns, or performs a preparatory task may be exempted. Indexing, searching, format conversion, and de-duplication of imagery or case files may qualify under this exemption. But two limits matter for geospatial work. First, the exemption never applies to the Annex I (product-safety) route. Second, the filter is unavailable to any system that performs profiling, and the Commission’s definition expressly includes evaluating a person’s “location or movements” as profiling Much location-analytics work that infers patterns of life from spatial traces will therefore remain high-risk regardless of how narrow the task appears. Providers claiming the exemption must document the assessment and register the system in the EU database.

What Geospatial Professionals Should Do Now?

The runway created by the Digital Omnibus is time to prepare. Practitioners should:

1. Pin down intended purpose in writing. Audit your instructions for use, sales materials, and technical documentation to ensure any limitation on high-risk uses is concrete, consistent, and credible (i.e., not a buried disclaimer).

2. Classify by route. For each product, determine whether it travels the Annex I (safety-component) or Annex III (use-case) path as they carry different obligations (e.g., only the latter can use the 6(3) filter.)

3. Watch the surveillance line. Treat any system that detects, tracks, or identifies persons for border, migration, or law-enforcement response as high-risk. Conversely, clearly segregate genuine search-and-rescue or navigation-safety functions.

4. Test the filter carefully. Before relying on Article 6(3), confirm the system does not profile (including through inference of location or movement) and document the analysis.

5. Push the obligations into procurement. Deployers in critical-infrastructure and public-authority contexts should require high-risk-grade compliance contractually, regardless of vendor claims.

These draft guidelines remain open for feedback through June 23, 2026: geospatial organizations that are doing business in Europe should consider responding while the examples are still being written.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• How NATO’s call for common standards on AI-enhanced geospatial intelligence will reshape model documentation, training-data provenance, and confidence-threshold requirements for commercial GeoAI vendors selling into allied defense markets.

• Why Colorado’s pivot from algorithmic risk management to transparency disclosures under SB 189 narrows the immediate compliance burden on GeoAI vendors but raises the documentation bar for spatial decision systems.

• How the EU’s May 2026 Digital Omnibus political agreement reshapes the AI Act compliance timeline for geospatial professionals, and the concrete steps GeoAI organizations should take during the additional runway before December 2027.

What’s New

NATO Needs Policies, Standards for Sharing AI-Enhanced Geospatial Intel: Official (Breaking Defense)

Speaking at GEOINT on May 5, 2026, UK Royal Marine Maj. Gen. Paul Lynch, NATO Deputy Assistant Secretary General for Intelligence, told attendees that “the path to AI-enabled, allied intelligence advantage runs primarily through governance, not necessarily through additional capability,” noting the need to address “a set of legal and contractual frameworks that were written for most of those capabilities existed”. For commercial GeoAI vendors selling into the defense and intelligence community, Lynch’s remarks suggests that NATO will increasingly require model documentation, training-data provenance, and confidence-threshold disclosures as contractual obligations associated with use within allied intelligence workflows.

Amendments Move Colorado AI Act’s Focus from Risk to Transparency (IAPP)

Colorado Senate Bill 189, introduced in May 2026, and signed into law by Colorado’s governor on May 14, postpones the Colorado AI Act’s effective date from June 30, 2026 to January 1, 2027 and fundamentally restructures the law from a risk-management regime into a transparency-focused one. For GeoAI organizations, the new law reduces the immediate substantive compliance burden of the Colorado AI Act but shifts the operational focus to documentation.

Deep Dive

What the EU AI Act Reform Means for Geospatial Professionals

On May 7, 2026, EU legislators reached a provisional political agreement on the "Digital Omnibus on AI", the long-awaited reform of the EU Artificial Intelligence Act (the “AI Act”). For the geospatial community, the key element of the reform package is that the original compliance deadline of August 2, 2026, for high-risk AI systems has been split into two staggered dates. Organizations with systems involving biometrics, critical infrastructure, education, employment, law enforcement, migration, asylum, and border control management now have until December 2, 2027, to comply. Compliance for AI systems embedded in regulated products is not required until August 2, 2028.

Other changes worth noting for geospatial professionals include:

• The Commission has clarified that organizations may process personal data "where strictly necessary to detect and correct biases, with proper safeguards, both in high-risk and non-high-risk AI systems";

• The deadline for establishing national AI regulatory sandboxes has shifted to 2 August 2027, with a new EU-level sandbox added to the mix;

• Certain SME accommodations have been extended to small mid-cap companies;

• The obligation to register high-risk systems in the EU public database has been reinstated.

• The grace period for AI-generated content transparency has been compressed from six months to three, with a new deadline of 2 December 2026.

Why the AI Act Matters: Many GeoAI Applications Are Already High-Risk

The EU Act will impact many geospatial companies offering GeoAI products and services in Europe. For example, as noted in the 2025 publication, “From Bias to Accountability: How the EU AI Act Confronts Challenges in European GeoAI Auditing”, a number of common GeoAI applications meet the AI Act's definition of high-risk systems. As the authors point out these include a number of the eight high-risk contexts listed in Annex III of the AI Act:

What to do Between Now and December 2027

The political agreement still needs formal endorsement and adoption by Parliament and Council, followed by legal-linguistic revision and publication in the Official Journal, with co-legislators aiming for adoption before August 2, 2026. Geospatial professionals selling products and services in Europe should use the additional time to take a number of steps:

1. Inventory your AI by identifying every model, pipeline, and downstream product in your organization that ingests geospatial data and produces predictions, recommendations, or decisions.

2. Run a regulatory impact assessment that classifies each system as prohibited, high-risk, limited-risk, or minimal-risk (For systems used in critical infrastructure or law enforcement contexts, assume high-risk classification by default.)

3. Build a bias-audit capability now that provides on steady normalization of transparent, context-specific audits.

4. Prepare for the high-risk registry.

5. Align AI Act work with GDPR governance particularly for any product that combines location traces with demographic inference.

6. Engage with the national and EU-level sandboxes to test high-risk GeoAI in a supervised environment before the full EU AI Act regime comes into force.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

Virginia Becomes Third State to Ban Sale of Consumers’ Precise Geolocation Data (Regulatory Oversight)

On April 13, 2026, Virginia Governor Abigail Spanberger signed SB338 into law, amending the Virginia Consumer Data Protection Act (VCDPA) to prohibit data controllers from selling consumers' precise geolocation data, defined as information identifying a person's location within a 1,750-foot radius. The amendment, which takes effect July 1, 2026, replaces the prior consent-based regime for this category of sensitive data with an outright sales ban and makes Virginia the third state, after Maryland and Oregon, to adopt this approach.

GAO Report on Federal AI Acquisitions: Lessons from NGA's Maven Program (U.S. Government Accountability Office)

The GAO released report GAO-26-107859 on April 13, 2026, examining how the Department of Defense, Department of Homeland Security, General Services Administration, and Department of Veterans Affairs are acquiring AI capabilities. The report finds that agencies are repeatedly learning the same lessons in isolation and uses the National Geospatial-Intelligence Agency's Maven program, which applies machine learning and computer vision to geospatial imagery for object detection and target identification, as a benchmark of mature federal AI procurement, while flagging persistent challenges around defining requirements, securing IP and data rights, and maintaining vendor accountability under Agile development cycles.

Deep Dive

Why Every Geospatial Organization Should Pay Attention to the Royal Institution of Chartered Surveyors (RICS) AI Guidance

On September 2025, the Royal Institution of Chartered Surveyors (RICS) published its first-ever professional standard on the responsible use of artificial intelligence in surveying practice, effective March 9, 2026. At first glance, this may seem like a narrow document aimed at the surveying profession. But it is a useful tool for geospatial professionals across all disciplines.

This Deep Dive unpacks what the RICS standard requires, maps those requirements against the emerging legal and regulatory landscape, and explains why every geospatial organization should treat this document as a model for its own AI governance.

What the RICS Standard Requires

The standard is organized around seven pillars, each of which maps directly to an area of active regulatory development:

1. Baseline Knowledge. Members who use AI systems should develop and maintain a basic understanding of the different types and subsets of AI systems and their limitations, the risk of erroneous output, the inherent risk of bias, and data usage and data risks

2. Data Governance. Firms should safeguard private and confidential data by storing it securely, restricting access to staff who strictly need it, training staff at least annually on privacy and confidentiality risks, preparing data in ways that protect privacy such as anonymization, and refraining from uploading private and confidential data to AI systems except where there is express written consent and the firm has taken reasonable steps to confirm the system does not pose an unacceptable risk.

3. System Governance. Before using an AI system with material impact, firms should carry out and record in writing an assessment of whether AI is the most appropriate tool, considering the nature of the task, alternative tools, environmental and stakeholder impact, data risks, and the risk of erroneous or biased output. Firms should also maintain a written register of every AI system used, the purpose for which it is used, the date of first use, and the date on which its appropriateness will next be reviewed. And they should develop responsible use policies that detail roles, responsibilities, and liabilities, require at least annual training, state how human control and judgment will interact with AI, and provide guidance on identifying and mitigating risks.

4. Risk Management. Firms should create and operate a risk register documenting overarching risks, such as bias, erroneous outputs, data quality limitations, and retention of input data. Each risk should be rated by likelihood, impact, and mitigation plan and updated at least quarterly.

5. Procurement, Due Diligence, and Use. Before procuring a third-party AI system, firms should conduct detailed due diligence including written requests for information about the system's environmental impact, development stakeholders, data law compliance, permissions for individual data, the accuracy, relevance, and diversity of training datasets including known gaps and bias risks, and the type and extent of the provider's liability. Firms should apply professional judgment to assess the reliability of every AI output with material impact and document that assessment in writing, including assumptions, key reliability concerns, and a conclusion on whether the output can reasonably be used for its intended purpose.

6. Transparency and Client Communication. Firms should make clear to clients, in writing and in advance, when and for what purpose AI is to be used. Engagement terms must detail which parts of the service involve AI, the extent of professional indemnity cover for AI use, internal processes to contest AI use, processes for client redress, and how a client can opt out of AI use. Firms must be able to explain the type of AI system used, its basic workings and limitations, the due diligence carried out, how risks are managed, and the reliability decisions made about its outputs.

7. AI Development. Firms directly developing AI systems should apply these provisions to the development process, record the system's identifiable application, potential risks and benefits, and other approaches to the same task. They should carry out a sustainability impact assessment, select diverse stakeholders for development, document compliance with data and confidentiality laws, obtain written permissions for personal data use, and have policies to assess data quality and reliability.

Why This Matters: Alignment with the Global Regulatory Trajectory

The RICS standard lands when AI governance is transitioning from voluntary principle to enforceable obligation across every major jurisdiction where geospatial organizations operate. For example, there are strong parallels between the RICS standard and the EU AI Act’s high-risk obligations. The RICS requirements for risk management, data governance documentation, human oversight through professional judgment, transparency to clients, and procurement due diligence all map directly onto the Act’s mandatory framework. Geospatial AI uses can fall across the EU risk spectrum, from minimal-risk map rendering to high-risk applications that influence safety-critical navigation, critical infrastructure, or significant eligibility determinations. Any geospatial organization that implements the RICS standard’s governance structure will find itself well-positioned to demonstrate compliance with the EU AI Act’s core requirements.

The RICS standard’s transparency and client communication requirements (e.g., requiring advance written disclosure of AI use, detailed terms of engagement, and explainability on request) are directly responsive to the disclosure obligations emerging across U.S. states. For geospatial professionals operating across state lines, the RICS framework provides a compliance-forward posture that anticipates the convergence these state laws are driving toward.

The Geospatial-Specific Case for Adoption

Geospatial AI demands governance because location data can be highly identifying, spatial outputs often drive consequential decisions about people and infrastructure, and spatial errors can propagate widely through dependent systems. Privacy and security are amplified by the sensitivity of precise geolocation and the risk of linkability across datasets. Fairness demands careful management of geographic and demographic disparities in data coverage and model performance. Safety and reliability require controls against false detections, and spurious correlations.

The RICS standard addresses these domain-specific risks with practical requirements that any geospatial organization can adapt. Its insistence on data governance, including restrictions on uploading confidential data and requirements for anonymization, directly addresses geolocation privacy concerns. Its due diligence requirements for training data accuracy, relevance, diversity, and known gaps in data address the spatial bias risks that are endemic to geospatial AI. [Its transparency requirements for client-facing disclosures anticipate both the EU AI Act’s user-information obligations and the U.S. state-level disclosure mandates described above. Even if your organization has no connection to RICS, the standard provides a practical governance template that positions you ahead of regulatory requirements.

Practical steps to consider include:

• Conduct a Gap Assessment. Mapping your current AI policies, processes, and controls against the RICS standard's requirements for data governance, system governance, risk management, procurement due diligence, output assurance, and client transparency. Identify where your practices fall short.

• Build Your AI Register. The RICS requirement to maintain a written register of every AI system with material impact, including its purpose, first use date, and next review date, is one of the simplest and most powerful governance controls available.

• Formalize Your Risk Management. Establish a risk register that documents bias, accuracy, data quality, and data retention risks for every AI system, with RAG ratings and quarterly reviews. Risk management should adopt spatially aware metrics for reliability, fairness, and safety and embed testing for spatial drift and adversarial behavior.

• Strengthen your procurement process. When evaluating AI vendors, adopt the RICS due diligence checklist as a baseline: demand written information about training data provenance, accuracy, diversity, known bias risks, data law compliance, and liability allocation. Third-party risk management should incorporate contract clauses for spatial data provenance, allowed territories and use cases, resolution limits, and audit rights.

• Update your client-facing disclosures. Review your terms of engagement, service agreements, and client communications to ensure they disclose when and how AI is used, what parts of the service involve AI, and how clients can seek redress or opt out.

• Invest in professional development. The RICS standard's baseline knowledge requirements is a model for any geospatial organization's training program. Geospatial organizations should integrate interdisciplinary curricula that combine geospatial science, AI methodologies, and legal requirements.

Conclusion

The RICS standard is not just another set of guidelines gathering dust in a professional body’s publication archive. The requirements it sets forth (i.e., documented risk management, structured due diligence, written output assessments, advance client disclosure, and ongoing competency development) are the same requirements now being codified into law in jurisdictions around the world. Compliance burdens are present and increasing, and AI governance will become an important part of daily life for all geospatial professionals.

Geospatial organizations that adopt these practices now will not only reduce their legal and professional risk but will also build the trust and credibility that clients increasingly demand. Those that wait may find themselves scrambling to catch up as regulation overtakes them.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

Deep Dive

California’s Executive Order N-5-26: A Case Study in Procurement-Driven AI Governance

On March 30, 2026, California Governor Gavin Newsom signed Executive Order N-5-26, aimed at shaping the responsible procurement and deployment of Generative AI across state government operations. The order builds on California’s earlier Executive Order N-12-23, issued in September 2023, which initiated the state’s efforts to safely learn, innovate, and use GenAI for the benefit of Californians and state workers.

The new executive order is notable for the mechanism it employs: rather than enacting new substantive legislation or promulgating traditional administrative regulations, it directs state agencies to embed AI safety and accountability standards directly into the state contracting and procurement process. The order explicitly recognizes that “public procurement represents one of the most powerful tools available to governments to shape market behavior and encourage responsible innovation”.

Specifically, the order directs the Department of General Services (DGS) and the Department of Technology (CDT) to submit recommendations for new certifications that may be incorporated into state contracting processes, requiring entities seeking to do business with California to attest to and explain their policies and safeguards to protect public safety. These certifications must address, among other things, the exploitation or distribution of illegal content, the utilization of models that display harmful bias or lack governance to reduce such bias, and the violation of civil rights and civil liberties including free speech, voting, human autonomy, and protections against unlawful discrimination, detention, and surveillance.

The order also directs the Government Operations Agency (GovOps) to recommend reforms to contractor responsibility provisions, including suspension and ineligibility authorities, to ensure state entities do not contract with companies judicially determined to have unlawfully undermined privacy or civil liberties. Additional provisions require state agencies to share best practices on responsible AI procurement, update the State Digital Strategy to leverage GenAI for transparency and accountability, and publish a data minimization toolkit with best practices, templates, special contract provisions, and program review checklists. The order further mandates that CDT issue best practice guidance for departments to appropriately watermark AI-generated or significantly manipulated images or video in accordance with California Business & Professional Code §§ 22757.2 & 22757.3.

For geospatial professionals, the watermarking and provenance requirements deserve special attention. As AI is increasingly used to generate or manipulate satellite imagery, aerial photography, and geospatial visualizations, the ability to distinguish between authentic and AI-generated or AI-altered spatial data will become a critical issue of professional practice and legal compliance.

The Contract, Not the Statute: How U.S. AI Law Is Being Shaped by Procurement and Contractual Terms

Perhaps the most important takeaway from California’s approach for geospatial professionals is what it reveals about the primary mechanism through which AI governance is taking shape in the United States. Unlike the European Union, which has enacted comprehensive AI legislation through the EU AI Act, the United States has not passed broad federal AI legislation. Nor has the federal government, particularly under the current administration, pursued an aggressive regulatory posture toward AI. The result is a governance vacuum that is increasingly being filled not by statutes or regulations, but by contractual terms.

California’s Executive Order N-5-26 is a leading example of this dynamic. The order does not create new enforceable legal rights or benefits. In fact, in a likely nod to the recent White House Executive Order intended to restrict state legal oversight of AI, it expressly states that it “is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity”. Instead, it works through the contracting power of the state. Companies that wish to sell AI products and services to California (the fifth-largest economy in the world) will need to meet certification, attestation, and safeguard requirements as a condition of doing business. In effect, the terms of procurement contracts, not statutes, become the binding rules governing AI safety, bias mitigation, data privacy, and civil liberties protection.

This procurement-driven model has several important implications for geospatial professionals. Specifically, it:

• Means that the legal obligations governing your use and deployment of GeoAI tools may not be found in any statute or regulation at all, but rather in the terms and conditions of the contracts under which you procure or license those tools. Vendor agreements, service-level agreements, data-use licenses, and government procurement contracts are becoming the de facto regulatory instruments for AI in the United States.

• Means that the landscape is inherently fragmented. Different government agencies, at the state and local level, may impose different procurement-based requirements. California’s approach, shaped by its status as home of many of the top AI companies may differ significantly from what other states require. Geospatial firms operating across multiple jurisdictions will need to track and comply with a patchwork of contractual obligations rather than a single, uniform regulatory framework.

• Shifts the burden of due diligence onto the practitioner. In the absence of clear legislative standards, geospatial professionals must proactively evaluate the AI tools they use. This includes assessing whether those tools have been vetted for bias, whether the underlying training data implicates privacy concerns, whether outputs are appropriately watermarked or documented, and whether the contractual terms under which those tools are procured adequately allocate risk. The California order’s emphasis on data minimization toolkits and special contract provisions underscores this point.

• Signals that procurement power, particularly the purchasing power of large state governments, is likely to be the most significant driver of AI standards in the near term. California’s CDT Chief Information Security Officer (CISO) is also empowered to review federal supply chain designations and federal procurement changes, and to issue guidance allowing state agencies to continue procuring from companies if the CISO concludes that a federal designation is improper. This creates a layer of state-level procurement oversight that may, in practice, set the floor for responsible AI standards in the geospatial industry and beyond.

What Geospatial Professionals Should Do Now

The rapid evolution of GeoAI governance through contractual and procurement mechanisms imposes additional requirements upon geospatial professionals. Practitioners should begin by auditing the contractual terms with vendors under which they procure or license AI-powered geospatial tools, paying particular attention to provisions related to data privacy, bias governance, output provenance, and civil liberties protections. Firms doing business with California or other state governments should anticipate new certification and attestation requirements and begin developing internal policies and documentation that demonstrate responsible AI practices. Finally, because the law in this space is being written in contracts rather than codified in statutes, geospatial professionals should consider engaging legal counsel experienced in both technology procurement and AI governance to ensure that as this landscape continues to evolve, their practices remain compliant.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

European Parliament votes to delay EU AI Act implementation (CIO)

The European Parliament voted to delay application of the EU AI Act's rules on high-risk AI systems, pushing key deadlines to as late as 2027 and 2028, though the delay still requires approval from the Council of the European Union. Analysts broadly cautioned CIOs against treating the delay as a reprieve, warning that the operational, legal, and reputational risks of poorly governed AI are already present and that organizations should use the extra time to strengthen compliance and governance frameworks rather than wait for final regulatory clarity.

Deep Dive

Last edition of the newsletter referenced two different visions of what federal law in the U.S. should look like: the Trump Administration’s White House National Policy Framework for Artificial Intelligence Legislative Recommendations (March 2026) and the Artificial Intelligence Regulation and Safeguards Act, introduced by Sen. Blackburn (the “Act”). As each would have different impacts on the geospatial sector, I have prepared a comparison of the key points:

Comparison Chart

(Generated by Harvey AI)

Key Considerations for Geospatial Professionals

Key considerations for geospatial professionals include the following:

• The Act, draws a statutory distinction between “precise geolocation information” (location within 5 miles or less) and “approximate geolocation information” (greater than 5 miles precision) in the context of algorithmic ranking and content personalization systems. While these definitions are scoped to consumer-facing online platforms and the Filter Bubble Transparency subtitle, they signal a Congressional willingness to regulate the use of location data in AI systems broadly, which could foreshadow future restrictions on how geospatial AI models ingest, process, and act upon precise location data derived from connected devices. Geospatial practitioners should monitor whether these definitional frameworks migrate into future AI or privacy legislation with broader sectoral application.

• The duty of care and product liability provisions in of the Act carry significant operational implications for geospatial professionals who develop or deploy AI systems used in high-stakes decision-making environments. The Act imposes negligence-based liability, encompassing design defects, failure to warn, and breach of express warranty, as well as strict liability for unreasonably dangerous AI products. AI-driven spatial analysis tools used in “high-risk” sectors, such as critical infrastructure assessment, land use planning supporting law enforcement decisions, or emergency management, could expose their developers to liability under these provisions. This is in contrast to the White House Framework’s caution against open-ended liability that could stifle innovation.

• The Act directs the Office of Science, Technology and Policy to prioritize Federal investment in curated, publicly available datasets for AI training, explicitly listing agriculture, transportation, weather services, and other sectors where geospatial data plays a foundational role. The White House Framework similarly calls for making federal datasets accessible in AI-ready formats for industry and academia. For geospatial professionals, these provisions could unlock expanded access to satellite imagery, environmental monitoring data, census geographic files, and infrastructure datasets maintained by agencies such as USGS, NOAA, and the Census Bureau thereby accelerating the development of geospatially-trained AI models for environmental monitoring, urban planning, disaster response, and national security applications.

• The intellectual property and content provenance provisions of the Act have direct implications for geospatial professionals who create, license, or rely on AI-generated spatial content. The Act’s exclusion of AI training from fair use means that organizations using commercially licensed satellite imagery, proprietary map datasets, or curated geographic databases to train geospatial AI models could face copyright infringement claims if they have not secured explicit authorization from data rights holders. The proposed subpoena mechanism further empowers data owners to discover exactly what training datasets AI developers used, making due diligence in data licensing a critical compliance priority for geospatial AI developers.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What You’ll Learn This Week

• Why the “Trump AI Act’s” expanded geolocation definition could reshape how geospatial companies collect and use location data.

• How the White House’s push for a unified federal AI standard could upend the state-level regulatory landscape for geospatial companies.

• Why the GSA’s proposed AI contract clause could be the most consequential shift in federal procurement for geospatial vendors in years.

What’s New

Artificial Intelligence Regulation and Safeguards Act (Senate.gov)

The Artificial Intelligence Regulation and Safeguards Act (commonly referenced as the “Trump AI Act”) is a sweeping, omnibus legislative framework that seeks to regulate artificial intelligence across numerous domains, including minimum safety standards for AI developers, liability standards for AI systems, copyright and training data transparency, and content provenance requirements for synthetic media.

Analysis:

Of particular note to geospatial professionals, the Act includes a definition of “precise geolocation information” (information identifying an individual’s location to within a range of 5 miles or less) than in existing privacy regimes (generally between 1,750-1,850 feet). It also includes provisions related to “approximate geolocation information”, defined as information that identifies an individual’s location with a precision of less than 5 miles. Moreover, the Act permits treatment of a user’s current precise geolocation but puts restrictions on the use of previous geographical locations.

National Policy Framework for Artificial Intelligence (Whitehouse.gov)

The White House’s National Policy Framework for Artificial Intelligence: Legislative Recommendations, published this week, outlines the Trump Administration’s priorities for Congressional action on AI across seven thematic areas. The framework broadly seeks to protect children, safeguard communities, respect intellectual property, defend free speech, drive American AI dominance, develop an AI-ready workforce, and establish a unified federal AI regulatory standard that preempts a fragmented patchwork of state AI laws.

Analysis:

The framework’s emphasis on making federal datasets accessible in AI-ready formats for industry and academia, combined with its push to streamline AI infrastructure development, could benefit geospatial professionals by broadening access to government-held geospatial data for use in AI training and applications.

Deep Dive

GSA’s Proposed AI Contract Clause: What Geospatial Companies Need to Know

The U.S. General Services Administration (GSA) has released a draft contract clause , designated 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems, that, if finalized, will be inserted into every GSA solicitation and contract for AI capabilities. For geospatial companies selling AI-powered products and services to the federal government, this proposed clause represents a consequential shift in the procurement landscape. From strict data ownership rules to an outright prohibition on foreign AI components, the clause touches many aspects of geospatial AI vendors’ products and pipelines. Companies that move early to understand and adapt to these requirements will be better positioned to take advantage of the huge market opportunity the U.S. government provides.

One important consideration is that the proposed terms would vest the U.S. Government with full ownership of all “Government Data”, defined broadly to include not only data submitted to the AI system (such as satellite imagery, sensor feeds, or mission-specific queries) but also all outputs generated by the system, including analyses, derivative data, metadata, and logs. “Custom Development”, meaning any modification, fine-tuning, configuration, or enhancement to an AI system made specifically for a government client, also belongs to the Government, with contractors retaining only ownership of their underlying base models. For geospatial companies whose competitive edge lies in proprietary models trained or refined on rich geospatial datasets, this distinction is commercially vital. Any customization performed under contract becomes a government asset, and contractors are expressly prohibited from using that customized work or the government’s data to improve their commercial products, train other models, or inform their broader business strategy. Consequently, the common commercial practice of using client interactions to iteratively improve an AI platform will be a prohibited use under federal contracts.

The clause’s operational and security requirements will also demand significant investment from geospatial vendors. Contractors and their service providers must i restrict human review of government data, maintain logical segregation of government data from all other customer data, comply with strict data localization requirements, and securely delete all government data upon contract expiration. Compounding this, the clause mandates that AI systems using agentic or reasoning processes provide a full, summarized audit trail of intermediate processing steps, model routing decisions, and data retrieval methods, complete with source attribution and direct links to materials used in generating outputs. For geospatial AI tools that synthesize data from multiple sensor streams or perform complex spatial analyses, building that level of explainability and traceability into the system architecture will be a non-trivial engineering challenge.

Two other important provisions include careful consideration. First, the clause requires that contractors use only “American AI Systems”, defined as AI systems developed and produced in the United States per OMB Memorandum M-25-22, and expressly prohibits the use of any foreign AI components or systems controlled by non-U.S. entities. Geospatial companies that rely on foreign-sourced AI components, whether for image processing, object detection, or natural language interfaces, will need to audit and potentially overhaul their supply chains to remain eligible for federal work. Second, the clause imposes “Unbiased AI Principles” requiring that AI systems be truthful, neutral, and nonpartisan. Combined with the government’s reserved right to conduct automated benchmark assessments of deployed AI systems at any time, without any obligation to disclose its methodologies, this creates a regime of ongoing performance accountability that geospatial vendors selling AI to the federal government must be prepared to sustain for the full duration of any contract.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

What’s New

Part 539 - Acquisition of Information and Communication Technology 539.71 Clauses (GSA Federal Acquisition Service)

The GSA's proposed AI FAR clause for federal AI system acquisitions would introduce significant compliance obligations around matters such as data localization, human oversight and traceability for agentic workflows, mandatory use of American AI systems, and adherence to "unbiased AI" performance standards. For geospatial firms pursuing federal contracts, the clause would require careful review of existing GeoAI architectures and vendor agreements.

NIST Trustworthy and Responsible AI: Challenges to the Monitoring of Deployed AI Systems (National Institute of Standards and Technology)

NIST's new AI 800-4 report documents significant gaps in validated methodologies, information sharing, and incident monitoring practices across the AI ecosystem. For GeoAI developers and deployers, these gaps are particularly acute given that spatial AI systems operating across dynamic real-world environments are especially susceptible to several identified risks, such as “unforeseen outputs” that occur due to, “dynamic input conditions”. Organizations developing or procuring GeoAI systems should treat this report as both a compliance signal and a design checklist, particularly as federal customers increasingly expect post-deployment monitoring practices consistent with the NIST AI Risk Management.

Deep Dive

EU AI Act Compliance for High-Risk Geospatial AI Systems: What You Need to Know Before August 2026

With the EU AI Act’s (the AI Act) August 2026 compliance deadline now just five months away, geospatial AI providers face a narrowing window to address the regulation’s most demanding obligations. This isn’t simply a matter of updating privacy policies. The Act’s “replayability” requirement for high-risk AI creates technical and legal challenges. Replayability mandates that providers maintain the ability to reconstruct and audit AI decision-making processes after the fact, requiring comprehensive logging of input data, model states, and outputs. For geospatial systems processing continuous streams of satellite imagery, sensor data, or location information, this could translate into significant infrastructure investments and careful architectural planning that cannot be implemented overnight.

High-risk AI systems are those the EU has determined could significantly impact citizens’ health, safety, or fundamental rights. Despite the potential risk they are allowing them to be deployed because their benefits (such as improved disaster response or infrastructure planning) outweigh the risks. But such high-risk AI systems are subject to substantial compliance requirements. The EU categorizes AI as high-risk based upon both the product’s safety implications and its application domain. Annexes I and III of the AI Act provide specific examples. Many of these directly affect GeoAI-including systems used for critical infrastructure management, environmental monitoring that informs emergency decisions, or location-based identification technologies. Providers should begin conducting a thorough classification analysis, recognizing that the boundary between “limited risk” transparency obligations and “high-risk” conformity requirements can turn simply upon intended use and deployment context.

For systems classified as high-risk, conformity assessment is the central compliance hurdle. For many high-risk AI systems, self-assessment of compliance is sufficient. But others will require assessment by independent third-party organizations (known as notified bodies). Geospatial companies should be tracking guidance published by notified bodies on documentation requirements, technical standards, and audit methodologies specific to AI systems. Geospatial providers subject to third party assessment can anticipate rigorous examination of data governance practices, particularly around training data provenance, geographic representativeness, and bias testing across different regions and populations.

Finally, geospatial professionals should be aware of an emerging compliance gap that has received attention from policy analysts: the divergence between military and civilian AI governance frameworks. Many advanced GeoAI capabilities originated in defense contexts where different rules apply. As these technologies migrate to civilian applications, providers face the challenge of retrofitting compliance measures onto systems not originally designed with the EU AI Act’s transparency and accountability requirements in mind. Organizations with dual-use geospatial AI portfolios should prioritize a clear-eyed assessment of which systems require civilian compliance measures and develop transition roadmaps that account for both technical modifications and documentation gaps inherited from their military-origin architectures.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Subscribe now

I recently reviewed the Artificial Intelligence Governance Professional (AIGP) Body of Knowledge and Exam Blueprint, published by the International Association of Privacy Professionals, in anticipation of becoming AIGP certified. The AIGP covers technical, legal, operational, policy, and ethical issues, highlighting that effective AI governance requires cross-disciplinary coordination and professionals willing to venture outside their comfort zones.

Given the uniqueness of geospatial data as compared to other types of data used to train models (its power, versatility, numerous types), the wide range of applications that use geospatial information, the increased focus on world models, and the complexity of the legal and governance issues, I decided to begin creating an ancillary Body of Knowledge for Geospatial AI Governance to be used in conjunction with the AIGP Body of Knowledge. Geospatial organizations occupy complex roles in the AI value chain, often simultaneously acting as developers, deployers, and users of AI-enabled services. This demands governance across the entire lifecycle: from use-case definition and data sourcing through training, testing, deployment, monitoring, and system retirement. In the domain, where models must continuously evolve to address new geospatial information sources and types, update map features, and novel applications using geospatial information, these governance obligations require sustained attention.

With global standards and AI-specific regulations now classifying risk levels and imposing escalating compliance obligations, geospatial professionals must apply risk-based governance approaches that remain jurisdiction-aware and technology-agnostic. By adapting established AI governance domains to the specific context of spatial data and analytics, this body of knowledge can help provide accountability obligations as regulatory landscapes continue to evolve.

This is very much a work in progress. So, I welcome your comments and plan to update it periodically as technology, applications, and the law continue to develop.

Geospatial AI Governance Body of Knowledge

Domain I — Foundations of Geospatial AI Governance

Domain II — AI Laws, Standards, and Frameworks for Geospatial Use Cases

Domain III — Governing the Development of Geospatial AI Systems

Domain IV — Governing the Deployment and Use of Geospatial AI

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• Why AI-generated geospatial analyses and reports may not be protected by attorney-client privilege.

• How the FTC’s crackdown on exaggerated AI marketing claims raises legal risk for geospatial companies promoting “AI-powered” analytics.

• How emerging federal AI literacy standards are likely to shape training expectations for geospatial professionals using GeoAI systems

• How GeoAI “world models” will expand cybersecurity, data governance, and liability risks.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

AI-generated Docs Aren't Covered by Attorney-Client Privilege, Judge Says (Mashable)

A federal judge ruled that documents created by AI tools and shared with attorneys are admissible in court and not protected by attorney-client privilege, establishing that geospatial firms using AI to analyze satellite imagery, generate location intelligence reports, or create spatial risk assessments for litigation cannot assume those AI-generated materials will remain confidential even when shared with counsel.

Analysis:

This ruling raises some complex legal issues. But for geospatial professionals it could increase documentation risk for GeoAI organizations that rely on AI tools to prepare defensible analyses of spatial data for regulatory compliance, land-use disputes, or environmental litigation, making it critical to segregate privileged legal strategy from AI-assisted technical work products.

FTC Resolves Another Case Involving “AI-Washing” (The AI Counsel)

The FTC's settlement with Growth Cave prohibits misrepresenting that products use AI or that AI will enhance profitability and efficiency, signaling that geospatial firms marketing "AI-powered" location analytics, automated spatial analysis, or intelligent mapping tools must substantiate claims about the degree of automation, the role of AI in processing spatial data, and the performance improvements AI actually delivers.

Analysis:

For GeoAI developers, this enforcement pattern makes exaggerated claims about autonomous feature extraction, predictive spatial modeling, or AI-driven decision-making legally risky, particularly where manual processes, rule-based systems, or limited machine learning actually underpin the geospatial workflow.

US Department of Labor Releases AI Literacy Framework Providing Foundational Content Areas, Delivery Principles to Guide Nationwide Efforts (U.S. Department of Labor)

The Department of Labor's new AI Literacy Framework establishes five content areas and seven delivery principles to guide workforce development in AI skills, signaling that geospatial professionals will need structured training pathways to understand how AI systems process spatial data, interpret location-based patterns, and generate automated geospatial decisions.

Analysis:

For GeoAI organizations, this creates an opportunity to shape sector-specific literacy standards around spatial AI capabilities. But it also raises a potential compliance expectation that workers handling geospatial AI systems demonstrate foundational understanding of model behavior, data provenance, and algorithmic limitations.

Deep Dive

Security (and Legal Considerations) for World Models

I have following “world models” with increasing interest both because of the geospatial context as well as the legal implications. While GeoAI applications built on “world models” that reason over the physical environment are still emerging, their direction is becoming clearer. As geospatial computer vision, foundation models, and agentic AI systems converge, future GeoAI platforms will increasingly integrate satellite imagery, maps, sensor feeds, and enterprise geospatial data into unified systems capable of supporting operational decision-making and, in some cases, initiating actions.

My sense is that as these systems move from pilots into enterprise and government deployments, security, privacy, and export control obligations will shape core design choices around system architecture, data pipelines, access control, hosting environments, and product scope. U.S. government cybersecurity frameworks (e.g., the NIST Cybersecurity Framework (CSF), NIST SP 800-53 security controls, and emerging NIST AI Risk Management Framework (AI RMF) guidance) already provide a baseline for how GeoAI systems will be expected to manage risk. At the same time, commercial contracts will increasingly allocate responsibility for data security, model behavior, and regulatory compliance through representations and warranties, liability caps, indemnities, audit rights, and service-level commitments. The design opportunity today is to anticipate these technical and legal constraints early, so that compliance, resilience, and safety are engineered into GeoAI platforms rather than bolted on after broad operational deployment.

Looking ahead, GeoAI world models will combine multiple technical layers: computer vision models that extract features from imagery and point clouds; foundation or multimodal models that reason across geospatial and non-geospatial context; and agentic components that orchestrate tools across mapping platforms, tasking systems, and analytic services. This convergence materially expands the attack surface. Training pipelines will become more exposed to data poisoning, tainted third-party geospatial datasets, and license or provenance conflicts. Inference-time workflows will increasingly involve tool use, retrieval from large geospatial knowledge bases, and automated reporting, creating new vectors for indirect prompt injection, unauthorized data access, and goal hijacking. As GeoAI systems are integrated into enterprises, these risks will intersect directly with contractual obligations. For example, large enterprise customers will expect vendors to warrant that systems are developed and operated in accordance with recognized security standards, that access controls prevent cross-tenant data leakage, and that model outputs do not expose restricted or export-controlled content. This suggests that GeoAI platforms should treat external data sources and user inputs as untrusted by default and enforce least-privilege access at the API and tool layer and implement testing, red-teaming, and assurance practices consistent with NIST-aligned secure development lifecycle expectations.

Future GeoAI systems will also operate in a physical sensing environment that is already contested. GNSS jamming and spoofing, now well documented in conflict zones and increasingly observed in civilian aviation and maritime operations, illustrate the conditions under which some GeoAI world models may function. As GeoAI platforms fuse positioning, timing, imagery, and sensor metadata into higher-level situational awareness, silent reliance on single-source GNSS could become an architectural liability. Consequently. forward-looking GeoAI designs will assume that PNT inputs may become degraded, manipulated, or unavailable and will incorporate uncertainty modeling, anomaly detection, and multi-source sensor fusion from the outset. These design choices are not only good engineering practice; they also matter for liability and risk allocation. As GeoAI outputs inform safety, compliance, or operational decisions, vendors may be asked to represent in their contracts that systems are securely designed and/or disclose known limitations and failure modes.

The forward-looking design challenge, therefore, is to align emerging GeoAI architectures with the regulatory, cybersecurity, and contractual environment they will soon inhabit. Teams developing early world-model should adopt provenance-rich training sources; modularize pipelines so export-controlled or sensitive components can be isolated; and integrate practices such as uncertainty representation and human validation for high-impact outputs. In parallel, legal and compliance teams should map these technical controls to contractual commitments around security controls, auditability, incident response, and allocation of liability. Organizations that internalize these constraints early will be better positioned to market their GeoAI systems to large enterprises that are by their nature are risk adverse and security conscious.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

In this issue, you will navigate the escalating legal complexities of Agentic AI, starting with an analysis of how Amazon v. Perplexity could define the boundaries of authorization, transparency, and access for autonomous geospatial systems. You will also explore the European Parliament’s pivotal move to link data governance directly to copyright compliance, alongside insights from the 2025 Federal Agency AI Use Case Inventory that reveal how the US government categorizes high-impact AI risks. Finally, our Deep Dive equips you with a framework for managing liability in autonomous geospatial workflows, detailing the critical governance, contracting, and technical safeguards needed as AI shifts from passive tool to active agent.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

Perplexity v. Amazon (Court Listener)

Amazon has brought a lawsuit against Perplexity framing agentic AI not as a novel interface issue, but as a question of authorization, transparency, and computer access under existing federal and state law, particularly the Computer Fraud and Abuse Act and California’s computer access statutes. The lawsuit emphasizes Perplexity’s alleged concealment of automated activity, evasion of technical controls, and continued access after explicit notice.

Analysis:

For GeoAI developers, the case has implications well beyond e-commerce. Spatial AI systems that rely on autonomous agents to interact with third-party platforms, APIs, or protected datasets, often at scale and across jurisdictions, increases legal risk as agentic GeoAI tools blur the line between user-authorized access and independent system action. This makes clear disclosure, platform consent, and technical traceability increasingly critical to avoiding liability as autonomous geospatial systems become more capable and widespread.

Protect Copyrighted Work Used by Generative AI, Say Legal Affairs MEPs (European Parliament)

The Legal Affairs Committee of the European Parliament has proposed a decisive shift toward treating training data governance as a core copyright compliance obligation for generative AI systems placed on the EU market, regardless of where training occurs. The report will be put to a Parliament vote in plenary in March. By linking transparency failures directly to potential copyright infringement, the report reframes disclosure of training sources, crawling records, and opt-out mechanisms from soft governance measures into enforceable legal duties.

Analysis:

For GeoAI developers, the implications are particularly acute given the reliance on maps, imagery, and other spatial datasets that are frequently protected by copyright and distributed across public and private sources. The proposals point toward rising compliance risk where training data provenance is unclear, opt-out signals are ignored, or licensing terms are insufficiently granular. This makes dataset inventories, provenance tracking, and licensing documentation central to lawful GeoAI development in the EU. As these expectations harden, geospatial firms may need to reassess data sourcing strategies, training pipelines, and cross-border model deployment to ensure that spatial content used in AI systems is both transparent and properly authorized.

2025 Federal Agency AI Use Case Inventory (Office of the Federal Chief Information Officer — GitHub)

The 2025 Federal Agency AI Use Case inventory operationalizes recent statutory and executive AI mandates that requires federal agencies to maintain detailed, public-facing inventories of AI use cases, with heightened disclosure and risk-management obligations for systems deemed “high-impact.” This results in standardized reporting fields across the AI lifecycle, including training data descriptions, outputs, testing, impact assessments, and ongoing monitoring.

Analysis:

The Use Case tool not only provides GeoAI vendors and partners with valuable business insight into how the federal government is using AI products and services. It is also can be used to help identify uses of AI that are high risk (and subsequently might require additional technical safeguards) or that involve data that might not be suitable for that use.

Deep Dive

Agentic AI in Geospatial Applications

Autonomous software that initiates actions, sequences workflows, and interacts with external systems with minimal human oversight (Agentic AI) will transform geospatial operations. Unlike traditional AI tools that wait for user commands, agentic systems autonomously decide when to act, chain multiple operations together, and integrate directly with databases and APIs. For GIS professionals, this means systems that might automatically update property boundaries from new imagery, trigger evacuation alerts from flood models, or modify zoning recommendations without per-decision human review.

The use of AI agents in the geospatial sector will result in heightened risk exposure in several domains: property and land records (where automated cadastral updates could disrupt transactions or create title issues), emergency management (where false positives waste resources and false negatives cost lives), environmental compliance (where autonomous reporting could penalize innocent parties or miss violations), autonomous navigation (where misclassified road conditions create safety hazards), and urban planning (where encoded biases could perpetuate historical discrimination patterns like redlining).

When agentic AI causes harm, the question arises as to liability. Should it attach to the deploying organization under agency principles? To answer this questions, courts will examine whether a company delegated authority, could have controlled the system, and whether affected parties reasonably believed the AI acted on the company’s behalf. The multi-party nature of these deployments (foundation model providers, system developers, enterprise deployers, and data providers) complicates but does not eliminate this exposure. Additionally, statutory risks span anti-discrimination laws, environmental regulations, consumer protection, and privacy statutes, and these will likely apply based on outcomes, not intent.

Organizations should implement concrete safeguards: define precise boundaries for autonomous versus human-approved decisions, build genuine (not rubber-stamp) review checkpoints for high-stakes outputs, maintain comprehensive audit trails of all inputs and decisions, and establish incident response protocols. Contractually, companies that build or deploy AI agents should negotiate audit and logging rights, model update approval requirements, clear indemnification terms, and guaranteed human override capabilities.

The core message for geospatial professionals is that agentic AI doesn’t change longstanding concerns about data accuracy and professional responsibility. Rather it accelerates how fast errors propagate and expands the scale of potential harm. Liability follows delegation and control: the more autonomous the system, the more critical the need for governance.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share

• How AI liability is beginning to reshape insurance underwriting and what that means for insurability of GeoAI systems.

• Why the federal–state conflict over AI regulation is likely to create layered compliance uncertainty for nationwide geospatial operations.

• How the Department of War’s “AI-first” strategy is driving new expectations for interoperable geospatial data pipelines and modular architectures.

• Why documented governance, provenance, and technical controls are becoming critical to both legal compliance and risk management in GeoAI.

GeoAI and the Law is not legal advice. The reader should consult with a trained lawyer on legal matters associated with GeoAI.

What’s New

How AI Liability Risks are Challenging the Insurance Landscape (IAPP)

The IAPP article describes how emerging AI liability risks are reshaping the insurance market, with insurers beginning to scrutinize AI governance practices, data controls, and human-in-the-loop safeguards before underwriting coverage, while also experimenting with new endorsements for deepfakes and chatbot-related harms.

Analysis:

The article shows that AI liability is beginning to reshape underwriting practices even before clear legal rules exist, with insurers informally probing governance, data controls, and human-in-the-loop safeguards as proxies for risk. This blurs the line between legal compliance and insurability: firms that cannot demonstrate disciplined AI practices may find coverage narrower, more expensive, or unavailable, effectively making insurance markets a parallel form of private regulation.

For GeoAI organizations, this dynamic is particularly salient because spatial systems often combine sensitive data, cloud infrastructure, and automated decision tools. Insurers are likely to focus on documentation, access controls, incident logging, and safeguards against deepfakes or misuse of imagery, meaning that governance artifacts are becoming not only compliance tools but also prerequisites for maintaining cyber, E&O, and professional liability coverage.

DOJ Creates Task Force to Challenge State AI Regulations (CBS News)

The Department of Justice has created a new AI Litigation Task Force to challenge state-level AI laws on preemption and interstate-commerce grounds, signaling a likely period of federal–state conflict over how AI systems may be regulated in the United States.

Analysis:

The creation of a DOJ AI Litigation Task Force signals that federal–state conflict over AI governance is likely to intensify, with the federal government prepared to challenge state laws on preemption and interstate-commerce grounds rather than waiting for comprehensive federal legislation. This suggests that AI regulation in the United States may evolve not only through new statutes, but through litigation that reshapes the boundaries of what states can require of AI developers and deployers. For GeoAI firms operating across multiple states, this does not eliminate compliance obligations but rather introduces a period of layered uncertainty: companies must prepare for diverging state rules on transparency, data use, and deployment while also anticipating that some of those rules could be narrowed or invalidated through federal challenges.

Accelerating America's Military AI Dominance (Secretary of War)

The Department of War’s new Artificial Intelligence Strategy directs the military to become an “AI-first” force through seven Pace-Setting Projects, massive expansion of AI compute and federated data access, and a wartime approach to removing bureaucratic barriers to rapid AI deployment.

Analysis:

The Department of War’s Artificial Intelligence Strategy articulates an explicit shift to an “AI-first” posture, pairing aggressive experimentation with a systematic build-out of foundational enablers. For commercial GeoAI and dual-use spatial technology providers, the strategy signals sustained and likely expanding demand for interoperable geospatial data pipelines, real-time catalogs, and modular systems that can plug directly into government architectures. At the same time, the emphasis on rapid model updates, edge compute, and federated data access raises compliance stakes around security controls, export restrictions, and data governance, making alignment with DoD data standards and rigorous documentation increasingly important for firms seeking to participate in this ecosystem or support military AI applications.

Deep Dive

Insurers reportedly are narrowing coverage for AI-related losses through new exclusions, higher retentions, and sublimits, thus treating AI as a specialty exposure rather than a risk absorbed by legacy cyber or tech E&O lines. Coverage is increasingly contingent on demonstrable AI governance (e.g., inventories, testing, bias/drift monitoring, change control), with underwriters using governance maturity to decide appetite, pricing, and whether to narrow exclusions or offer affirmative endorsements. The market posture mirrors early coverage of other insurance, suc has cyber. As a result, claims placement may seem unsettled, as capacity is cautious, and carriers are experimenting with bespoke endorsements while they gather loss data.

Carriers report uncertainty over where AI-caused losses “fit,” especially when bodily injury or property damage is tied to automated decisioning, which can fall awkwardly between CGL and cyber or into tech E&O with new AI carve-outs. At the same time, insurers have begun to launch targeted affirmative solutions (for example, deepfake endorsements with incident response and crisis communications), even as others pursue “absolute AI” or training-data/content-use exclusions that materially narrow coverage for AI outputs. Claims trends also show privacy litigation risk tied to embedded tools (e.g., chatbots cited in a measurable share of web privacy suits under state “digital wiretapping” statutes), reinforcing that AI incidents are already flowing into cyber/privacy programs.

For geospatial applications where models analyze imagery, infer location attributes, or power mapped decision tools the market’s exclusions heighten three exposures: location privacy, data provenance/IP, and analytic misstatement. Privacy claims tied to precise geolocation or automated collection/inference are most likely to route to cyber/privacy coverage but may meet standard coverage carve-outs, such as statutory-violation, or AI-specific carve-outs. Training-data and content-use exclusions mean geospatial firms will need to evidence clean license chains and provenance for satellite/aerial imagery, base maps, and derived datasets to preserve IP and contractual liability coverage for model training and outputs. Finally, absent explicit E&O grants for AI-generated outputs, errors in probabilistic classifications or forecasts (e.g., risk mapping, asset condition scoring) resulting in losses could be characterized as excluded algorithmic “misconduct.”

Documented AI governance (model inventories, pre-deployment testing, human-in-the-loop for consequential inferences, drift monitoring, and audit logs linking outputs to model versions and data sources) is now a lever for insurability, narrower exclusions, and claims defensibility. On coverage wording, seek affirmative grants for AI outputs in tech E&O, confirm cyber/privacy treatment of precise geolocation, and negotiate carve-backs where training/data-use exclusions would otherwise hurt licensed geospatial workflows.

Edited by Kevin Pomfret

Partner at Pierson Ferdinand, Author of Geospatial Law, Policy and Ethics: Where Geospatial Technology is Taking the Law | LinkedIn

Share