How AI Lawsuits Will Serve as Shadow Regulation

On March 31, 2026, Mercor (Mercor.io) publicly disclosed that “there was a recent security incident that affected our systems along with thousands of other organizations worldwide.”¹ At first glance, this may appear to be another cybersecurity incident.  However, it exposes a critical vulnerability in the AI supply chain and underscores the growing importance of data governance and AI defensibility. 

Prior to the incident, Mercor was not one of the well-known AI companies.  Its primary business provides AI-driven tools and analytics for sourcing, recruiting, and evaluating candidates. This includes aggregating significant amounts of personal data from public and private sources, along with biometric and AI-based analysis of interviews. In addition, Mercor was involved in creating bespoke datasets used by large AI companies in training models.²

The breach appears to be linked to a widely reported software supply chain compromise involving LiteLLM, an open-source tool broadly used across the AI ecosystem and attributed to threat actor TeamPCP.³ This open-source tool is broadly used in the AI software ecosystem, and impacted thousands of enterprises.⁴ The issue for Mercor was the highly sensitive nature of their data, and the exfiltration of at least some of this data.

Meta and other AI companies have either cancelled projects with Mercor, or have indicated they are reviewing the nature of the data it provides, its provenance, and security.⁵ Left unsaid (and unclear), is whether any of the data obtained through the recruiting line of business was being used in the AI training part of their business.

Enter the Lawyers

Several Federal lawsuits have already been filed against Mercor, including one in the Northern District of California.⁶ In addition to expected privacy related causes of action, a claim arising from the California Record Act is included. This 2010 statute states:

 “A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by (a) shredding, (b) erasing, or (c) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.” ⁷  

It is instructive that an existing recordkeeping statute is being used to bring a claim following a cybersecurity attack against the AI supply chain, something few would have anticipated 16 years ago when it was drafted. The lesson is simple; we do not need new AI legislation for the Plaintiff’s Bar, or regulators or State AG’s for that matter, to initiate litigation. And this is where Zubulake,⁸ a 20+ year old piece of civil litigation widely regarded as foundational in eDiscovery and modern data compliance.

What started as an otherwise straightforward employment claim for gender discrimination and retaliation against a former employer, led to rulings on procedures that still guide discovery and record keeping practices to this day. Ironically, the Court never ruled on the merits of the case (it settled prior to trial). The primary discovery issues related to whether the defendant/bank had appropriately preserved (or inappropriately destroyed) electronic communication, under its SEC record keeping obligations, along with civil procedure requirements for anticipated litigation.⁹

In her decision(s), Judge Scheindlin did not make new law, or promulgate new regulations. Instead, she used existing regulation and procedural requirements and applied it to new technology and practices. She cited applicable record keeping requirements, which had been established several years prior by the SEC, under authority of a statute passed in 1934. The regulation, SEC Rule 17a-4 in place at the time stated:

“Every broker and dealer shall preserve for a period of not less than 3 years, the first two years in an accessible place . . . [originals of all communications received and copies of all communications sent by such member, broker or dealer (including inter-office memoranda and communications) relating to his business as such.”

Note there was no specific reference in the regulation to email, electronic means of communication, backup tools, or any of the technologies that became part of the discovery battle. The judge simply applied the requirement to keep and produce firm communications, to email and its associated technical infrastructure. The procedural rulings clarified that email was subject to established record keeping rules, and technologies were instruments to meet those and other discovery requirements.

What Zubulake established for email, cases like Mercor may now establish for AI: that data used to train and operate AI systems is a governed, discoverable business asset subject to existing legal and regulatory obligations.

History Does Not Repeat, But it Rhymes  

Zubulake coincided with Elliott Spitzer’s tenure as Attorney General for New York. In numerous actions brought against Wall Street executives and firms, emails played a significant role in the cases and the court of public opinion. And in those actions, he also was not relying on any new law or regulation, but rather on new technology and practices on Wall Street to expand the scope of enforcement.

The key takeaway from Zubulake and Spitzer’s actions against Wall Street is that applying existing laws to new technologies can have as much impact as creating new regulations.

There is plenty of discussion related to new AI legislation, which is largely developing at a state-level in the US, given the fractious nature of politics at the federal level. According to the National Conference of State Legislatures, thirty-eight states have enacted or are planning some form of AI legislation.¹⁰ The EU AI Act is potentially the broadest reaching thus far, but even its enforcement for high-risk system does not really take hold until 2027.¹¹ Perhaps that is why we should expect regulators to rely on existing authorities to govern AI, as evidenced by a DOJ, CFPB, and EEOC issued release in 2023.¹²

And while we are already seeing some lawsuits brought under AI legislation, including actions to block its enforcement,¹³ Mercor shows that privacy, cybersecurity, recordkeeping, and other existing regulations and statutes will serve as the basis for much AI related litigation and enforcement actions. This type of litigation may drive an equal change in behavior, as any new regulation. And consider the reasons why Mercor is applicable to so many other use cases, and companies developing and using AI:

• Sensitive data is being intentionally collected, processed, and managed by AI systems on behalf of multiple third parties
• AI training datasets are often aggregated from multiple sources, raising questions about data provenance and permissible use
• Uncertainty around data lineage can disrupt commercial relationships and trigger legal scrutiny
• Limited transparency in how models are trained increases regulatory and litigation risk
• AI systems operate at scale, amplifying the impact of data misuse or breach
• Shared reliance on common open-source tools introduces systemic supply chain vulnerabilities 

I would be remiss for not including some suggestions on how to mitigate the risk.  NIST’s AI Risk Management Framework and ISO 42001 provide strong program-level governance frameworks. An overlooked but excellent resource, which is particularly instructive and addresses issues that surfaced in Mercor, is a joint publication by CISA, the DOJ, NSA, along with their foreign counterparts. This guide on AI Data Security, and Best Practices for Securing Data Used to Train and Operate AI Systems¹⁴ is particularly useful. Its objective is to:

“Provide a brief overview of the AI system life cycle and general best practices to secure data used during the development, testing, and operation of AI-based systems. These best practices include the incorporation of techniques such as data encryption, digital signatures, data provenance tracking, secure storage, and trust infrastructure.”

The recommendations within the document are practical, should be incorporated into governance strategies, and represent good examples of what “reasonable” looks like in the age of AI. And these are the types of controls courts and regulators will consider, regardless of whether new AI regulations or statutes emerge.

Conclusion

Whenever we see disruption by new technologies, and its transformative potential across industries and society, an interest and perceived need for new laws and regulations also arise. But as we have seen previously, new regulation and law-making is slow, often a blunt instrument that can stifle innovation, or arrives too late to be meaningful. It is more likely we will see regulators and lawyers rely on existing authorities than wait for new AI rules and statutes.

There are plenty of regulations and laws already on the books, which can be applied to issues that arise around AI…today. Organizations waiting for clarity on AI governance from regulators or lawmakers will be disappointed, when the plaintiff’s bar and enforcement actions arrive at the door in the interim.

 ⁶ Ramos v. Mercor.io Corp., No. 4:26-cv-03215-KAW (N.D. Cal. Apr. 17, 2026) (amended class action complaint). 

¹¹ Reuters, EU lawmakers approve landmark AI rules (Mar. 2024) (noting phased implementation with full application extending into 2026–2027).

 ¹³ Complaint in Intervention of the United States, X.AI LLC v. Weiser, No. 1:26-cv-01515-DDD-CYC (D. Colo. Apr. 24, 2026).