Key points: Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement (RISE) and Privacy + Cyber + AI practice groups worked with the firm’s innovation team using AI to collect and curate five years of data concerning state AG activities and actions related to privacy, security, and AI. This Regulatory Intelligence offering provides firm clients with valuable insights, risk assessment capabilities, and advantages in defending state AG actions and complying with relevant laws. The firm’s first privacy-focused Regulatory Intelligence report is now available and new reports will come out on a quarterly basis. Troutman plans to make detailed state AG data and intelligence available to clients through an online dashboard.

Introduction

At a high level, privacy, information security, and AI legal risks are influenced by three factors: (1) new legislation; (2) private litigation (often consumer class actions); and (3) regulatory enforcement. Troutman’s 360 approach combines the experience and knowledge of its RISE group and Privacy + Cyber + AI litigation and advisory teams to address all three prongs. We have taken it a step further using AI to analyze over 300 privacy, security, and AI regulator activities since 2020 conducted by state AGs and privacy regulators. Troutman’s resulting Regulatory Intelligence AI model provides insights that were previously untapped and gives our clients an advantage in addressing AG actions, as well as insights that support data-driven and risk-based compliance.

The firm’s synergistic use of AI combines our lawyers’ decades of institutional knowledge and specific experience to train a model to ingest AG activity data, organize it, analyze risk and patterns, and process to help enable better outcomes for our clients. This is not a story of AI replacing lawyers — this is a tale of AI making already excellent lawyers with deep on-the-ground relationships and specific subject-matter experience even better at what they do.

This post describes how we developed the Regulatory Intelligence model and the analytics and insights it provides. We discuss use cases for the offering and how we plan on leveraging our data insights to gain efficiencies and, more importantly, to provide value and better results for our clients. We then address our first Regulatory Intelligence report. The post then discusses next steps and how we plan to make our data and insights available directly to clients and potential clients.

Troutman’s Regulatory Intelligence Platform

Traditional methods for locating and analyzing AG actions are limited in an increasingly active and aggressive regulatory environment — particularly in the fast-moving areas of cybersecurity, data privacy, and AI. Not only has regulator activity spiked, but state regulators have become more sophisticated and empowered as they fill a space that has traditionally been occupied by federal agencies.

While state AGs once appeared to operate in isolation, that is no longer the case. Today, state AGs and privacy regulators regularly participate in national organizations and coalitions — such as the National Association of Attorneys General, the Attorney General Alliance, and partisan AG associations — where they share information, refine strategies, and identify enforcement priorities. They increasingly coordinate with, and take the lead in, investigations with federal agencies. State AGs now routinely launch multistate investigations and enforcement sweeps aimed at particular industries, business practices, or technologies. They use press releases and public statements to disclose settlements, signal priorities, highlight theories of harm, and set expectations for industry conduct. In short: by coordinating, they gain advantages not only around resource sharing, but also as to intelligence gathering concerning companies and industries they target.

Risk management requires an informed understanding of the regulatory environment, but the relevant “signals” are difficult to find, inconsistently formatted, and dispersed. Troutman Pepper Locke’s Regulatory Intelligence solution is built to close the data gap. Our Privacy + Cyber + AI practice and our RISE team combined decades of enforcement experience with modern AI tools to create a purpose-built solution for the privacy, cybersecurity, and AI landscape.

Troutman’s Regulatory Intelligence platform addresses these visibility and analysis gaps and seeks to neutralize regulators’ advantage. The platform is a curated, AI-enabled database and intelligence platform of state AG and privacy regulator enforcement activity including enforcement actions, settlements, regulatory sweeps, and publicly stated enforcement priorities.

The data is broken down as structured components designed to enable practical defense and compliance advice, such as:

• Issues, fact patterns, and legal theories raised by regulators
• Industries and business models targeted
• Timeframes related to regulator actions and resolution
• The identities and patterns of specific states, regulators, and key personnel
• Monetary settlement amounts and structures
• Injunctive relief structures and components

Regulatory Intelligence then layers Troutman Pepper Locke’s deep experience on top of this data — contextualizing trends, identifying patterns, and connecting the dots across jurisdictions. The result is not just a database but a set of actionable insights that help clients anticipate, respond to, and shape state AG engagement and proactively manage compliance and risk.

How We Use the Regulatory Intelligence Platform to Advantage Our Clients

For years, understanding state AG risk meant sending teams of lawyers and staff on a scavenger hunt across the public record. Junior attorneys combed through press releases, websites, consent decrees, complaints, court dockets, and news reports to find prior enforcement actions and settlements. They tried to identify relevant matters, extract key terms, and extrapolate potential exposure from scattered and incomplete information across 50 states and other jurisdictions, multiple regulators, and disparate information systems. Even the best of these efforts presented a fragmented picture of regulatory enforcement that left companies making high-stakes decisions with incomplete information.

Traditional legal research tools were never designed to track the “case law” of regulatory actions in an efficient and actionable manner.

• Regulatory investigation response and action defense.

When a CID or AG inquiry arrives, Regulatory Intelligence allows our lawyers to simultaneously understand larger trends while enabling deep data insights tied to specific AG actions, approaches, and outcomes. The platform helps Troutman formulate and implement our clients’ defense strategies at every stage of the matter:

• State-level and jurisdictional insights. The platform helps our clients understand the jurisdiction and the behavior of specific regulators. By analyzing an AG office’s historical activity and the specific staff assigned to your matter, we can identify priority areas, specific allegations and approaches, working styles, preferences on timing and process, and past resolutions in similar cases. We combine the broader data insights with the intelligence our RISE team members provide — many of our RISE lawyers served in AGs’ offices themselves and continue to maintain deep relationships with current regulators. Moreover, our team has collected and curated non-public information from hundreds of AG responses to complement our data. This allows us to position our clients well for responding to inquiries.
• Relying on precedent. CIDs often cast a wide net, resulting in significant burden and cost. Regulatory Intelligence gives us insights from the “case law” existing in the regulator space. By drawing on precedent from similar matters, we can seek to narrow demands and propose targeted limitations on the scope of data, documents, and time periods. We can also negotiate confidentiality protections and production protocols, building on a concrete historical foundation. We can get to the issues that truly interest regulators efficiently, avoiding a costly and drawn-out discovery process.
• Telling our clients’ story. Regulatory Intelligence informs and helps create a consistent narrative for our clients when dealing with regulators. We provide an additional layer of understanding gained from dealing with hundreds of state AGs on top of the data generated through Regulatory Intelligence to highlight priority issues for regulators. When we know the issues that are of greatest importance to regulators based on actual data and insights we glean from it, we can ensure that our responses, presentations, and proposed solutions resonate.
• Information advantage. Our wide perspective and ability to perform a “deep dive” on the data strengthens our clients’ ability to negotiate. When monetary penalties, restitution, or injunctive terms are on the table, Regulatory Intelligence allows us to more precisely benchmark proposed resolutions against comparable cases across time and location. We can identify when a proposal is out of step with precedent and advocate for terms that reflect how similar matters have been resolved by these regulators and others around the country.

Of course, we use the same intelligence in the defense context to help our clients look around the corner, identify trends, proactively avoid becoming a regulator target, set up defenses, and make more informed risk-based decisions to protect their business models, products, and services.

• Compliance, risk reduction, and enabling our clients’ business plans using Regulatory Intelligence

The Regulatory Intelligence platform supports risk-based compliance and business planning. Our Privacy + Cyber + AI practice group obtains a level of visibility unavailable to the public without extensive data collection and AI processing. This point of view helps our advisory team detect regulatory patterns that are invisible when the data dots are not connected and analyzed by experts. The platform can also help our clients assess risk on a wider and more objective basis, facilitating practical risk mitigation and compliance:

• Near real-time data provides for early warnings. By aggregating our data across regulators, industries, and topics, we are able to detect potential enforcement trends and better understand whether particular issues are prioritized by regulators. This is difficult to do based on anecdotes and incomplete rumblings and innuendo. The data, and our ability to combine and curate it in an actionable fashion, can help get ahead of regulatory risk.
• A more objective basis by which to gauge risk. Regulatory Intelligence helps our advisor lawyers establish legal positions based on data and risk. We help numerous clients address privacy, security, and AI compliance and legal risk in the business context. Much of that advice revolves around gray area statutory provisions that have not been interpreted by courts. Before Regulatory Intelligence, our compliance and regulatory lawyers could draw on decades of experience and anecdotal knowledge to ascertain regulator intent and assess risk. Now, we have the data and insights to more precisely measure regulator intent, fines and penalties, settlement impacts, and risk. This additional precision coupled with the real-time ability to monitor for material changes in the risk environment helps to calibrate our clients’ risk tolerance and directly fuels their business strategies.

Overall, the platform limits much of the guesswork that goes into compliance and risk mitigation when it comes to regulatory compliance. It helps clients more precisely measure risk, establish defensible positions, and position their business plans within a risk band they are comfortable with.

Our First Regulatory Intelligence Report and Going-Forward Plans

In conjunction with our launch, we have developed a report that crunches the privacy, security, and AI regulatory activity data between 2020 and April 30, 2026. The report is self-contained and internally navigable. It breaks down the AG and privacy regulatory activities in a variety of ways to show trends, spot hot-button regulator priorities, and identify higher-risk industries and practices. The PDF version of this report is the foundation for our future quarterly reports, which we will host on an online platform for our clients in the near future. Clients and potential clients who register for the online platform will be provided with more access to detailed information and insights, which enable the use of the platform as a tool to defend AG actions and investigations and address compliance issues. If you would like to be informed of future developments and the launch of our online platform, please send an email to regintelligence@troutman.com, and we will put you on the list to receive updates and future access to the platform.