Lawyer outlines three frameworks for CISO AI liability
Original title: 3 Frameworks to Protect CISOs & Orgs Against AI Liability
Daniel Garrie told ISC2 attendees to score AI risk, record board appetite, and lock vendor evidence into contracts.
At ISC2 Strategic Congress 2026 in Denver, Daniel B. Garrie, CEO of Law and Forensics, described frameworks meant to help CISOs judge whether an AI feature is safe to run and to leave a paper trail if liability follows a compromise. He said the work traces to the June 2024 JAMS AI Rules, which he helped write as guidance for handling technical evidence in AI disputes. He urged cybersecurity leaders to negotiate, at contract time, for model snapshots, logs, and preservation rights from AI vendors.
Unconfirmed: The piece is advice from one speaker; it does not report a specific AI incident or legal outcome.
- Practices named: an AI deployment risk score, board risk-appetite records, and incident data preservation.
- JAMS AI Rules, set in June 2024, guide arbitrators on technical evidence, not every litigant.
- Garrie said post-incident forensic evidence from AI vendors is hard to obtain without contract terms.
- The article quotes him asking whether a vendor can snapshot the model at incident time.
- Organizations
- Law and ForensicsJAMSISC2
From the original article
9 min read at darkreading.com
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
By Becky Bracken · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.