Dechert Cyber Bits

NYDFS Urges Regulated Entities to Prepare for Frontier AI Cyber Threats 

On May 21, 2026, the New York State Department of Financial Services (“NYDFS”) issued an  Industry Letter warning the public, and NYDFS-regulated entities specifically, of the heightened cybersecurity risks associated with “Frontier AI Models.” The letter is a response to the increasing concern that AI will not only help chief information security officers identify and remediate vulnerabilities but will also help threat actors find and exploit those same security flaws. NYDFS urged regulated entities to improve their security posture before those capabilities become broadly available.

This new guidance builds on NYDFS’s October 2024 Guidance on cybersecurity risks arising from AI, which focused on AI-enabled deepfakes, phishing schemes, and enhanced cyberattacks. It also follows New York’s December 2025 enactment of the RAISE Act, which requires certain frontier AI developers to publish safety protocols, report critical-harm incidents, and submit to oversight by a new office within NYDFS.

The letter urges regulated entities to reassess risk assessments, vulnerability management timelines, legacy systems, third-party dependencies, and secure programming practices. New York State Acting Chief Cyber Officer Michaela Lee framed the letter as a proactive blueprint aimed to “strengthen financial resilience” and push the state as a leader in “innovation and security.”

Takeaway: Regulated financial institutions cannot sit on the sidelines as AI reshapes cybersecurity. Although this latest guidance imposes no new legal obligations, companies should expect regulators to ask a simple question: what did you do when AI-enabled cyber risk became foreseeable? Companies will want to revisit risk assessments, accelerate vulnerability management where warranted, map critical third-party dependencies, and test incident response and recovery plans against AI-enabled threat scenarios.

FTC Puts “Nudify” Platforms on Notice Under the TAKE IT DOWN Act

On May 20, 2026, just one day after the TAKE IT DOWN Act (“TIDA”) went into effect, the Federal Trade Commission (“FTC”) sent warning letters to 12 companies offering so-called “nudify” tools—AI-enabled tools that allow users to transform clothed images into nonconsensual sexualized images. The FTC warned that platforms must provide a process for victims to request removal of nonconsensual intimate images. The warning letters followed an earlier round of letters from FTC Chairman Andrew N. Ferguson to major web hosting and social media platforms, reminding them that TIDA’s notice-and-removal requirements took effect on May 19, 2026.

Signed into law in May 2025, TIDA criminalizes the nonconsensual publication of intimate images, including AI-generated deepfakes, and gives the FTC authority to enforce the statute’s platform notice-and-removal requirements. Covered platforms must provide a clear process for victims to request removal, remove covered images and known identical copies within 48 hours of receiving a valid request, and make reasonable efforts to identify and remove duplicate content on their platforms.

FTC Commissioner Mark Meador identified enforcement as a “top priority” for the agency. Violation of TIDA could result in civil penalties of up to $53,088 per violation. The Department of Justice has already initiated two actions under the law.

Takeaway: The FTC is not easing into TIDA enforcement. It is moving first against the obvious targets—major platforms and AI “nudify” services—but the law sweeps more broadly. Businesses that host, curate, or distribute user-generated intimate content should review whether they qualify as covered platforms, confirm that their takedown process is clear and accessible, build a 48-hour response workflow, and test whether they can identify and remove known identical copies once a valid request arrives.  While the penalties may seem modest, “per violation” penalties rack up very quickly to substantial sums when talking about high usage platforms.

FTC Settles with Cox Media Group and Its Partners for Marketing an “Active Listening” AI Service That Never Actually Listened

On May 28, 2026, the Federal Trade Commission (“FTC”) announced proposed settlements with Georgia-based CMG Media Corporation, doing business as Cox Media Group (“CMG”), and two marketing partners, New Hampshire-based MindSift LLC (“MindSift”) and Wisconsin-based 1010 Digital Works LLC (“1010 Digital Works”), resolving allegations that the companies violated Section 5 of the FTC Act by allegedly deceiving customers about an “Active Listening” branded marketing service.

In complaints against each of CMG, MindSift, and 1010 Digital Works, the FTC alleged that the companies falsely marketed an AI-powered service purportedly capable of listening to consumers’ conversations through smart devices to target localized advertising. In reality, the FTC alleged, the service did not use voice data or listen to consumers’ conversations, nor did it accurately place ads in customers’ desired locations, but rather consisted of reselling email lists obtained from other data brokers. Critically, the allegations included that the companies misrepresented that consumers had “opted in” to the service (when they had simply accepted the mandatory terms of service for the app). Finally, the FTC alleged that MindSift and 1010 Digital Works bore direct responsibility for CMG’s deceptive practices, having supplied marketing materials and responses to customer inquiries that misrepresented the Active Listening service’s capabilities. None of the companies admitted any wrongdoing in connection with the settlements.

Under the proposed orders, CMG agreed to pay $880,000, while MindSift and 1010 Digital Works each settled for $25,000, with such funds to be used to redress impacted CMG customers. Each company is also prohibited on a go forward basis from misrepresenting the qualities or features of its advertising or marketing services, the data-collection and use of voice data and whether consumers have provided consent, and the geographic targeting capabilities of its advertising or marketing services.

Takeaway: The settlements are notable for several reasons. First, the three-party settlement structure demonstrates that the FTC is prepared to pursue enforcement across marketing vendors that it perceives as enabling deceptive practices, not limiting its action to those with direct consumer relationships. Second, the FTC’s willingness to bring Section 5 charges over an operationally nonexistent AI capability, rather than one that worked but caused harm, sets a precedent for any company whose AI marketing claims run ahead of actual technical capabilities. Finally, the settlements also reinforce that the FTC’s consent standard requires more than acceptance of mandatory terms of service. Companies offering AI-powered or data-driven advertising services will want to carefully review the accuracy of their marketing claims, the robustness of their consumer consent mechanisms, and their potential liability exposure arising from partner and vendor relationships. For more insight into the FTC’s approach to AI regulation, see Cyber Bits Issue 95.

European Commission Fines Temu €200 Million Under EU Digital Services Act 

On June 4, 2026, the European Commission issued a €200 million fine against Temu, the Chinese-owned e-commerce platform, for failing to comply with its risk-assessment obligations under the Digital Services Act (DSA).

Under the DSA, organizations designated as providing “very large online platforms” are required to “diligently identify, analyze and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems”. According to the Commission, Temu’s assessment of the risks of illegal products on the platform was deficient.  The Commission alleged that Temu’s 2024 risk assessment was inadequate because: (a) it relied on generic, sector-wide information rather than platform-specific data; (b) it significantly underestimated the likelihood of EU consumers encountering illegal products on the platform; and (c) it did not properly address how systems within the platform could increase dissemination of illegal products.

Among the evidence relied on by the Commission was a mystery shopping exercise it had commissioned that revealed that a very high percentage of chargers sampled from Temu's platform failed basic electrical safety tests, while a high percentage of tested baby toys posed safety risks of medium to high severity, either due to the presence of chemicals exceeding legal safety limits or suffocation hazards from detachable parts. The Commission has required Temu to submit an action plan before the end of August 2026 setting out proposed measures to remedy the alleged risk-assessment failures.

Temu has stated publicly that it disagrees with the Commission’s decision and considers the amount of the fine to be disproportionate, as well as explaining that the decision (relating-back to 2024) did not reflect its current systems.

Takeaway: Temu has until 28^th August to respond to the ruling. They may follow X and appeal to the General Court. The Commission has been active in investigating the relatively short list of platforms designated as “very large online platforms” under the DSA and issuing preliminary findings against a number of them. The fine issued against Temu is, however, one of the first fines under the DSA and indicates the Commission’s expectation that risk assessments under the DSA be targeted and based on platform-specific evidence of how the platform is operating in practice. Organizations designated as “very large online platforms” will want to consider reviewing their risk assessments against real-world data.

Dechert Tidbits

Bank of England, UK Financial Conduct Authority and UK Treasury Publish Joint Statement on Frontier AI Models and Cyber Resilience

In a joint statement the Bank of England, FCA and HM Treasury warned that malicious use of AI is reshaping the cyber threat landscape and posing material risks to operational resilience, customers, and market stability in the financial sector. The statement sets out high-level recommendations for governance, risk management and incident response for regulated financial firms.