Johnie T Young
Governance & Regulation Desk
Johnie T Young is the byline of the governance and regulation desk at AI Policy Desk. The desk covers new AI laws, regulator orders, court rulings and the decisions a small team has to make because of them: the EU AI Act, US state statutes, FTC and state attorney general actions, privacy rules for AI tools. A post under this name starts from the primary document (the statute text, the agency order, the vendor's terms) and a source log where every number, date and name has a row with a quoted passage. The desk says which clause or paragraph it relied on, says what it could not read, and gives an opinion with the reason behind it. Posts that change after publication show an Updated date, and a Last reviewed date when the facts were rechecked.
- Starts from the statute or order
- Every fact traced to a source row
- Dated checks on each post
300 articles by Johnie T Young
Miasma and Phantom Gyp: npm Supply Chain Worm Explained
A self-spreading worm compromised 57 npm packages in under 2 hours using binding.gyp instead of postinstall scripts, bypassing security scanners. What it means for teams that run npm install, and the 5 controls that limit your exposure.
AI Support Chatbots With Account Actions: Takeover Risk
Hackers social-engineered Meta AI into resetting passwords on high-profile Instagram accounts by simply asking. What the attack means for any team deploying an AI chatbot that can take account actions, and the 6 controls that prevent it.
EU AI Act August 2026: What's Delayed and What Still Applies
The EU AI Act Omnibus is in force: standalone high-risk AI moves to Dec 2, 2027, embedded products to Aug 2, 2028. Article 50 has applied since Aug 2, 2026.
AI Spend Governance: Token Budget Controls for Runaway Bills
5 token budget controls to stop runaway AI bills. Copy-paste usage caps, alerts, per-seat limits, and a kill switch for AI spend governance.
Who Owns AI-Generated Content? Copyright Rules Your Business Needs to Know (2026)
Generative AI copyright ownership 2026: raw AI output isn't protectable, but your edits and prompts often are. Here's how to document and protect them.
Vetting AI Tools: How to Avoid Fake AI Apps and Malware
Fake AI apps and malware sites now outrank the real download on Google. Run this 7-step check for vetting AI tools before your team installs anything.
Agentic AI Liability: Who Is Responsible When AI Agents Err
Agentic AI liability 2026 -- who's responsible when your AI agent sends a wrong email or deletes data? You are, not the AI. What to check before deploying.
AI Agent Memory and GDPR: Handling Persistent Context
Can your AI agent erase a user from its vector database? Spanish regulators found most cannot. Fix AI agent GDPR memory compliance before an audit.
AI Output Copyright Risk: Which Providers Indemnify You
Which AI providers indemnify your output? Compare policies and use this pre-publish checklist to manage AI output copyright risk in 2026.
State Chatbot Disclosure Laws 2026: SaaS Checklist
State chatbot disclosure laws 2026: which states make a bot say it is AI, why California SB 243 only reaches companion bots, and a SaaS checklist.
AI Employee Monitoring Laws: What Employers Can Do
What US and EU law lets employers monitor with AI tools, and the notices, consents and limits that come first, checked against each statute.
GenAI Vendor Risk Assessment Framework: FS AI RMF and SOC 2
Does your SOC 2 cover bias audits and hallucination testing? Usually not. Here is a GenAI vendor risk assessment framework mapped to Treasury's FS AI RMF that does.