AI, Cyber Regulations Moving Fast

Executive Summary

AI and cybersecurity regulation accelerated sharply between 2024 and early 2026. A single cyberattack in March 2026 made the stakes impossible to ignore.

When a pro-Iranian hacking group wiped more than 200,000 devices at Stryker Corporation, it triggered Securities and Exchange Commission (SEC) disclosures, federal investigations, delayed surgeries, and a class action lawsuit (PDF). All within two weeks. That sequence is the regulatory landscape in practice. This post breaks down what changed, what Stryker illustrates about where enforcement is heading, and how business leaders can start keeping up before they become the next example.

For years, companies adopted cloud platforms, automation, and AI tools with limited regulatory oversight. That era is over. AI and cybersecurity are no longer technical concerns delegated to IT teams. They are legal, financial, and operational risks that owners and executive leaders must actively govern. The regulatory landscape is moving fast, and businesses that treat compliance as someone else's problem are the ones that end up reacting to enforcement actions, lost contracts, and avoidable crises. The Dunning-Kruger effect is alive and well in cybersecurity leadership.

What Stryker Showed the World

On March 11, 2026, employees at Stryker Corporation arrived at work to find the login screens on their company systems had been replaced by the logo of a pro-Iranian hacking group. Laptops were wiped. Phones were dead. Within hours, tens of thousands of workers across 79 countries had been sent home, and one of the largest medical device companies in the world was running on pen and paper.

The attack didn't use malware in the traditional sense. Hackers obtained Stryker employee credentials, likely purchased from dark web brokers, used adversary-in-the-middle phishing to capture session tokens, and logged into Stryker's Microsoft environment as a trusted administrator. From there, they accessed Microsoft Intune, the platform Stryker used to manage its global device fleet, and issued a remote wipe command to every enrolled device simultaneously. Stryker's early statement that it found no indication of malware was technically accurate. The hackers looked like authorized users because they were using authorized credentials.

What followed wasn't just an operational crisis. Within days, Stryker filed with the SEC confirming a global network disruption. A proposed consumer class action was filed alleging the company failed to implement reasonable cybersecurity measures to protect consumer and employee data. Employee lawsuits were filed raising concerns about personal data exposure. The Cybersecurity and Information Security Agency (CISA) launched a formal investigation and issued an alert urging all companies to harden endpoint management systems. The FBI seized four domains linked to Iran's Ministry of Intelligence and Security. The State Department launched a new Bureau of Emerging Threats.

That cascade from breach to SEC filing to federal investigation to class action litigation in under two weeks is the current reality for any company that suffers a significant incident without the governance in place to respond to it. The attack vector that brought down Stryker works against any business running Microsoft 365 and Intune without the right controls.

Transparency, Risk Management

There is no single federal AI law in the United States, but that doesn't mean there are no rules. Lawmakers introduced more than a thousand AI-related bills in 2025 alone. Dozens became enforceable, creating obligations around transparency, risk management, and automated decision-making that affect private-sector businesses, not just government agencies.

Colorado's Artificial Intelligence Act, scheduled to take effect June 30, 2026, is the most comprehensive state-level example to date. It applies to businesses that develop or deploy high-risk AI systems and requires documented risk assessments, governance programs, and disclosures when AI is used in consequential decisions such as employment, lending, housing, health care, or insurance. States including California New York, Texas, Utah, and Illinois have enacted similar requirements. For multi-state or national businesses, the result is a patchwork of obligations similar to early data privacy laws. Compliance depends on where customers, employees, and affected individuals reside, not just where a business is headquartered.

On the cybersecurity side, the SEC's disclosure rules require public companies to report material cybersecurity incidents within four business days of determining materiality and to describe cybersecurity governance and board oversight in annual filings. Stryker's rapid SEC filing after the March attack wasn't optional. It was a legal obligation triggered the moment the company determined the incident was material. The influence of those rules extends well beyond publicly traded firms. Private companies increasingly face similar expectations from customers, insurers, lenders, and supply chain partners. Those that can't explain how they assess cyber risk, manage vendors, and respond to breaches are seeing higher insurance premiums, contract delays, and lost opportunities.

New Federal Cybersecurity Enforcement

The federal response to the Stryker attack unfolded alongside a broader shift in Washington's approach to cybersecurity. In March 2026, the White House issued a new executive order (PDF) focused on combatting cybercrime alongside the release of the Cyber Strategy for America (PDF). The order does not create new compliance checklists, but it signals increased federal coordination, stronger international enforcement, and higher expectations for public-private cooperation. The strategy treats cybersecurity as a national security and economic stability issue, particularly when foreign criminal organizations or hostile governments are involved.

For business leaders, the takeaway is not deregulation. It's accountability. The creation of the State Department's Bureau of Emerging Threats, the FBI's domain seizures, and CISA's rapid investigation into Stryker all reflect an institutional acknowledgment that the existing response framework wasn't built for the pace or scale of what is currently active. Businesses should expect closer scrutiny of supply chain dependencies, cross-border technology relationships, and incident readiness. Those without documented cybersecurity programs will have less room to operate quietly following a breach.

EU AI Act Global Reach

Even businesses without a physical presence in Europe are affected by the EU Artificial Intelligence Act. Adopted in 2024 and becoming fully enforceable in 2026, the law applies to any firm whose AI systems affect individuals in the European Union. It establishes a risk-based framework that categorizes AI systems as minimal risk, limited risk, high risk, or prohibited.

High-risk systems face strict requirements for data governance, documentation, human oversight, monitoring, and accountability. Critically, responsibility rests with the business deploying the technology, not just the software vendor. Using an off-the-shelf AI tool does not eliminate governance or oversight obligations. Leaders must understand how AI is used inside their company and whether it could create bias, safety risks, or regulatory exposure.

Threat Landscape Accelerating Alongside Regulation

New regulatory requirements are arriving at the same time that the threat environment is becoming more sophisticated. The Stryker attack is one data point in a broader pattern. Researchers tracking Iranian cyber operations documented more than 100 attacks globally in the weeks following the conflict's escalation, spanning industries from health care to banking. This Iran-Israel cyber war dashboard tracks the ongoing threat activity in real time.

AI has further changed the equation. In a widely cited IBM experiment, researchers found AI generated a phishing campaign in roughly five minutes that was as effective as one human experts spent 16 hours crafting. Enhanced ransomware leverages AI to craft highly personalized attacks with greater success rates. Supply chain weaknesses present entry points that have nothing to do with a firm's own security posture.

These threats intersect directly with the regulatory landscape. A ransomware incident or destructive wiper attack is no longer just an operational crisis. Depending on the business, it may trigger SEC disclosure obligations, state breach notification requirements, and potential class action exposure. Governance, risk management, and compliance must work together rather than in isolation.

Reasonable Cybersecurity Measures

Regulators, insurers, and enterprise customers expect businesses to know their technology, document their decisions, and manage risk intentionally. The class action filed against Stryker centers on a simple allegation: the company failed to implement reasonable cybersecurity measures. Whether or not that allegation holds up in court, the standard it reflects is the one every business will be judged against in the event of a breach.

Executive teams should know where their business uses AI today. They should also know where the company is making automated decisions about people, finances, or access to services. They should be able to explain their controls and governance to a regulator, insurer, or major customer.

Frequently Asked Questions (FAQs)

What does the Stryker cyberattack mean for other businesses?

The attack vector used against Stryker, stolen credentials combined with legitimate administrative tools, works against any company running Microsoft 365 and Intune without the proper controls in place. Stryker was likely targeted because of a business acquisition that gave a pro-Iranian hacking group its justification. Any company with ties to industries, regions, or partners that could make it a symbolic target faces a similar risk profile. The operational, legal, and regulatory consequences that followed within two weeks of the attack represent the current standard for what a significant breach looks like.

Do new AI and cybersecurity regulations apply to small and mid-sized businesses?

Yes. Many AI and cybersecurity laws apply based on activity, not company size. Colorado's AI Act, the SEC's cybersecurity disclosure framework, and state-level breach notification laws can affect private businesses and smaller firms that handle sensitive data or make automated decisions affecting customers. Private companies also feel regulatory pressure indirectly through contracts, cyber insurance underwriting, lending requirements, and supply chain security expectations from larger partners.

Does using off-the-shelf software reduce a business's regulatory responsibility?

No. Regulators increasingly hold businesses accountable for how technology is used, not who built it. Both Colorado's AI Act and the EU AI Act place compliance obligations on the deploying company, not the software vendor. If your business uses an AI tool in hiring, lending, health care, or other high-risk decisions, you're responsible for the governance around that deployment regardless of whether you built the technology yourself.

What did the March 2026 White House executive order change for businesses?

The executive order didn't create new compliance checklists for private businesses. It signaled a stronger federal enforcement posture around cybercrime, greater coordination across agencies, and heightened expectations for public-private cooperation. The federal response to the Stryker attack, including CISA's investigation, the FBI's domain seizures, and State Department's Bureau of Emerging Threats, reflects what that posture looks like in practice. Businesses should expect increased scrutiny of supply chain security and incident response readiness.

Is compliance the same as security?

No. Compliance establishes a minimum baseline a business must meet to satisfy legal or contractual obligations. Security is the broader, ongoing practice of managing risk and protecting assets. A company can satisfy a compliance requirement on paper while remaining significantly vulnerable. The class action filed against Stryker does not allege a compliance failure. It alleges a failure to implement reasonable security measures.

Where does a business start with Cyber GRC?

Start with visibility. Inventory where AI is used in your business, assess your current cybersecurity maturity, and determine which regulatory requirements apply to your industry and customer base. Assign clear ownership, document your policies, and align controls with a recognized framework such as NIST CSF 2.0, ISO 27001, or SOC 2. A cybersecurity risk assessment can help identify your greatest exposures and prioritize the steps with the greatest impact before new enforcement timelines arrive.