THE BOARD BRIEF Weekly Intelligence for Directors Who Want to See What's Coming
March 11, 2026 | Issue #6
THE BIG STORY The Federal Government Just Told You Which AI Laws It Plans to Kill. Your Compliance Team Needs to Know Today. Two publications from the federal government are due today that, taken together, represent the most significant single-day shift in the AI regulatory landscape since states began legislating in earnest. Your board should understand what they mean and what they require.
First, the Commerce Department is publishing its evaluation of state AI laws, identifying those deemed inconsistent with federal policy and recommending referral to the DOJ's AI Litigation Task Force for legal challenge. Second, the FTC is issuing a policy statement describing how the FTC Act applies to AI and when state laws requiring alteration of "truthful outputs" are preempted by federal law.
These are not abstract regulatory developments. They directly affect any company deploying AI systems across multiple states, which, at this point, is nearly every large enterprise.
The Commerce review targets state laws that the administration considers "onerous" or burdensome to AI innovation. Colorado's AI Act, which takes effect June 30 and requires impact assessments, transparency disclosures, and documentation of AI decision-making processes, is specifically cited in the underlying executive order as potentially forcing AI systems to produce "false results." California's Transparency in Frontier AI Act, Texas's Responsible AI Governance Act, and New York's RAISE Act are among the other likely targets. States enacted 145 AI-related laws in 2025, a more than 50% increase over the prior year, and the pace has not slowed.
The FTC statement introduces an even more provocative legal theory. The administration's position is that if an AI model is trained on data reflecting societal patterns, forcing developers to alter the model's outputs to mitigate bias compels them to produce results that are less faithful to the underlying data. Under this interpretation, state-mandated bias mitigation is itself a deceptive trade practice. Policy statements are interpretive rather than binding regulation, and courts may reject the premise entirely. But the statement creates a new axis of legal uncertainty for any company that has implemented bias mitigation in response to state requirements.
Why this matters for your board, specifically.
The immediate governance question is straightforward but uncomfortable: has your company been complying with state AI laws that the federal government is about to challenge? If so, what happens next?
The answer, for now, is that nothing changes operationally. An executive order cannot preempt state law. The DOJ's AI Litigation Task Force must win court challenges state by state, a process that will take years. As one trade lawyer at Hogan Lovells advised: "For a company that is in compliance with a state law, until you see an injunction by a district court, I think they should just continue to comply with it." The most prudent approach remains compliance with the most restrictive applicable requirements.
But the strategic question is different. The administration is conditioning access to $42 billion in broadband infrastructure funding (under the BEAD program) on states' avoidance of "onerous" AI laws. The FCC has been directed to consider a federal reporting and disclosure standard that would preempt conflicting state requirements. The DOJ task force is operational. The direction of travel is clear, even if the timeline is not.
For boards, this creates three categories of action.
First, know what your company is actually doing with AI and which state laws apply. This sounds basic. It is not. KPMG, which has been testing client AI systems against governance frameworks, has found cases where third-party AI systems had guardrails that were "not functioning as intended," including risks around data exposure. If your AI governance program was built around state requirements that are about to be challenged, you need to know whether those requirements were providing genuine protection or merely compliance theater.
Second, build modular compliance architectures. The companies that will navigate this best are those that can toggle between compliance frameworks without rebuilding their AI governance programs from scratch. The organizations that built rigid, single-framework compliance programs face the highest switching costs if the legal landscape shifts.
Third, treat AI governance as a board-level competency, not a delegated compliance function. The convergence of the Anthropic blacklisting (Issue #5), the Commerce Department review, the FTC statement, the NIST AI agent security standards, and the EU AI Act's approaching general application date (August 2) means that AI governance decisions carry strategic, legal, regulatory, and reputational consequences simultaneously. Only 36% of boards have implemented a formal AI governance framework (NACD 2025 survey). Only 6% have established AI-related management reporting metrics. Those numbers were concerning six weeks ago. They are now indefensible.
Three questions your board should ask this week:
"Have we mapped which state AI laws apply to our operations, and do we understand which of those laws the federal government is targeting for challenge?"
"Is our AI governance framework modular enough to adapt if the compliance landscape shifts, or are we locked into a single regulatory assumption?"
"Who on this board can explain, in specific terms, what our AI systems do, which data they use, what bias mitigation measures are in place, and whether those measures are functioning as intended?"
ON THE RADAR Five signals board directors should be tracking this week.
Oil breached $100, then crashed, and your planning window just narrowed to days. Brent crude spiked to $119.50 per barrel on Monday before falling back to approximately $89 on Wednesday morning after President Trump signaled the war with Iran could end soon and the IEA proposed the largest emergency reserve release in its history: 400 million barrels from member stockpiles, more than double what was released during the Russia-Ukraine war. Japan has announced an independent release. A G7 leaders' call is scheduled for today. In between Monday's spike and Wednesday's retreat, South Korea triggered its second circuit breaker in four sessions, Japan's Nikkei plunged 5.2%, and the IMF warned policymakers to prepare for "the unthinkable." The Dow swung 1,200 points in a single session. The structural drivers have not been resolved by either the price retreat or the reserve proposal: the Strait of Hormuz remains contested (IRGC naval forces fired on at least three commercial vessels this morning), Iraq's production has collapsed 70%, and Gulf producers are cutting output after running out of storage. Wood Mackenzie estimates the war is cutting Gulf oil supply by approximately 15 million barrels per day. Gas prices have risen 50 cents in a week to $3.48 per gallon, with analysts projecting $4 by end of this week. For directors: the $25 single-day oil swing on Monday was driven entirely by presidential rhetoric, not by any change in supply fundamentals. The IEA reserve release, if approved, buys time but does not resolve the structural disruption. If your board is making capital allocation decisions based on where oil closed on any given day this week, the decisions may be obsolete within hours. The prudent approach is stress-testing against a range of $85-150 through mid-year, not a point estimate. Today's February CPI of 2.4% annual (core 2.5%) reflects the pre-war economy. It is the last clean data point your board will see. March data, due in April, will capture the war's first energy-price fingerprint.
The economy lost 92,000 jobs in February. This is not a rounding error. Economists expected a gain of 50,000. December was revised to a loss of 17,000. The unemployment rate ticked up to 4.4%. Net job creation has been negative since April 2025. Manufacturing has shed 100,000 positions since January 2025. Federal employment has contracted by 327,000. The Kaiser Permanente strike temporarily removed 31,000 healthcare workers, which distorted the headline, but the underlying trend is structural. Combined with 3.0% core PCE inflation, today's CPI confirming that inflation was already sticky at 2.4% before the war, oil that has now tested $120, and the $25-per-day volatility pattern, the stagflation signal is no longer a signal; it is the operating environment. For directors: if your company's 2026 financial plan was built on assumptions of labor market resilience, rate cuts, or stable input costs, those assumptions no longer hold. The Fed meets next week (March 17-18) with an impossible choice: cut to support employment (accelerating energy-driven inflation) or hold to fight inflation (deepening the jobs crisis). Boards should be asking management whether projections have been updated to reflect the post-February reality.
Private credit contagion spreads to Blackstone. Blackstone's flagship credit fund, BCRED, disclosed record withdrawal requests of $3.7 billion. This follows Blue Owl's liquidation plan (returning only 30% of capital), New Mountain Capital's asset sales, and short interest in Blue Owl reaching an all-time high. Jamie Dimon's "cockroach" warning from last fall is looking prescient. The AI displacement/private credit convergence is no longer a theoretical risk; it is producing measurable losses. For directors: if your company's pension fund, insurance contracts, or treasury investments include private credit allocations, ask whether those vehicles have software-sector concentration and whether redemption gates have been triggered. If your D&O insurer has private credit exposure through its investment portfolio, that is a second-order risk worth understanding.
Anthropic formally designated supply chain risk; legal challenge confirmed. The Pentagon officially designated Anthropic a supply chain risk on March 4. CEO Dario Amodei confirmed the company will challenge the designation in court. Microsoft publicly affirmed that Claude remains available to all non-DoD customers. Defense technology companies are preemptively moving off Claude. Discussions between Anthropic and the Pentagon have reportedly resumed. For directors: the questions from Issue #5 remain urgent. Which AI vendors are you using? Do any have government contracts or acceptable use restrictions that could create business continuity risk? The AI vendor question raised in Issue #5's Boardroom Question ("Is your AI vendor relationship a strategic asset or a single point of failure?") now has a concrete test case playing out in real time.
BlackCat ransomware sentencing tomorrow sets insider threat precedent. Two cybersecurity professionals, including a former incident response manager at cybersecurity firm Sygnia, face up to 20 years in prison for operating as BlackCat ransomware affiliates. They are accused of targeting medical device, pharmaceutical, and defense companies, collecting at least $1.2 million in ransoms. For directors: this case raises a governance question that most boards have not confronted: do you apply the same rigor in vetting, monitoring, and controlling access for your security vendors and personnel as you do for the threats they are supposed to protect against? Audit committees should verify that insider threat programs cover the security function itself.
THE BOARDROOM QUESTION Each week, one question worth raising at your next meeting.
"Can our general counsel tell us, today, which state AI laws apply to our operations and what changes if the federal government succeeds in preempting them?"
This question tests two things simultaneously. First, it tests whether your company has actually mapped its AI regulatory exposure, not in theory but in the specific terms of which states' laws govern which systems. Many companies have not done this work. They have built AI governance programs around general principles without mapping the specific legal obligations that apply to their specific deployments in their specific jurisdictions.
Second, it tests whether your company has a contingency plan for a regulatory landscape that is about to become contested. If your compliance team has been building toward Colorado's June 30 effective date, and the DOJ challenges Colorado's AI Act next month, does the company continue the compliance effort or pause it? If the FTC declares that bias mitigation constitutes deceptive practice, and your company has implemented bias mitigation to comply with a state law, which obligation prevails?
These are not hypothetical questions. They are the questions that the Commerce Department's report and the FTC's statement are designed to force. The board that has answers is the board that governs. The board that defers is the board that reacts.
REGULATORY WATCH March 2026
March 11: Commerce Department evaluation of state AI laws due (today). FTC policy statement on AI and deceptive practices due (today). February CPI release (8:30 AM): 2.4% annual, core 2.5%, in line with expectations, confirming the pre-war inflation baseline. All three publications reshape the planning landscape in a single day.
March 12: BlackCat ransomware sentencing. Will signal judicial attitudes toward insider cyber threats.
March 14: First full missed paycheck for TSA workers under the DHS shutdown.
March 17-18: Federal Reserve meeting. Rate decision in a stagflationary environment with $100+ oil volatility, negative job growth, and 3.0% core PCE.
Ongoing: Iran war (Day 12, no diplomatic channel, no defined endpoint, Mojtaba Khamenei named supreme leader, IDF threatens to target him, IRGC firing on commercial vessels in the Strait of Hormuz, Iran vowing to block all oil flows until attacks cease). IEA emergency reserve release decision (400 million barrels proposed). DHS shutdown (no resolution timeline). Anthropic supply chain risk court challenge expected. EU AI Act general application approaching (August 2, 2026). Colorado AI Act effective date approaching (June 30, 2026). IEEPA tariff refund litigation (Court of International Trade, approximately 2,000 cases pending). Section 122 tariff expiration clock (July 24). Section 122 legal challenges. Oil price whipsaw pattern ($25+ single-day swings on presidential statements). Private credit contagion monitoring (Blue Owl, Blackstone BCRED, New Mountain).
WHAT'S AHEAD Today's CPI release (2.4% annual, core 2.5%, both in line), the Commerce Department evaluation, and the FTC statement make this one of the most information-dense days for strategic planning in 2026. Boards that have deferred AI governance to "wait and see" are about to discover that the regulatory environment does not wait.
The February jobs report demands a reassessment of financial planning assumptions that many boards approved in January. The combination of labor market contraction, sticky inflation, oil that has now tested $120 per barrel, and tariff uncertainty creates a macro environment that is more challenging than anything in the 2026 plans most companies are operating under. The $25 single-day swing pattern in oil prices means that point-in-time assumptions are particularly fragile; scenario-based planning across a range of energy price outcomes is the only defensible approach. Boards should be asking whether management has stress-tested current projections against a scenario that includes sustained oil above $90, no rate cuts, and continued labor market weakness.
The private credit contagion is no longer a story about one firm. It is a story about an asset class that grew to nearly $2 trillion on the assumption that periodic liquidity could be offered on inherently illiquid loans. That assumption is being tested across multiple firms simultaneously. Boards with exposure through pension funds, insurance contracts, or treasury investments need visibility into their managers' portfolio composition, redemption dynamics, and software-sector concentration.
The war in Iran has entered its twelfth day with an expanded target set (oil infrastructure), a new supreme leader who the IDF has threatened to kill, NATO air defenses engaged over Turkey, IRGC naval forces firing on commercial vessels in the Strait of Hormuz, and no diplomatic channel. Iran has vowed not to allow "one liter of oil" to leave the Middle East until attacks cease. The IEA has proposed a record 400 million barrel emergency reserve release, a measure that buys time but does not resolve the structural supply disruption, which Wood Mackenzie estimates at 15 million barrels per day. The market is swinging on presidential statements rather than fundamentals. The gap between rhetoric ("the war is very complete") and military reality ("the most intense day of strikes" delivered yesterday) is the defining feature of the current environment. For directors, the practical implication is straightforward: do not plan based on headlines. Plan based on the structural condition, which is that the Strait of Hormuz remains contested, spare capacity has been eliminated, and no one has defined what "victory" means.
Next week's Board Brief will cover the market response to the Commerce and FTC publications, the BlackCat sentencing and its implications for insider threat governance, the Fed's rate decision, and the ongoing evolution of the Anthropic legal challenge.
Researched, written, and edited in collaboration with Claude by Anthropic.