This post was co-authored by Labor + Employment group member, Bryce Simmons.

Effective November 8, 2026, New York employers will be subject to a personnel record law that creates rights for current and former employees while imposing several new obligations on employers. Prior to this law, no such rights or compliance obligations existed related to personnel files in the state. The law applies broadly to public and private employers, regardless of size, and allows current and former employees to request copies of their personnel records and challenge information they believe is inaccurate. Personnel records may include job applications, performance evaluations, disciplinary documents, compensation information, and other records relating to hiring, promotion, compensation, transfer, or discipline. Although lawmakers are expected to consider amendments that may clarify certain provisions, manufacturers may want to begin reviewing their personnel recordkeeping, retention, and human resources procedures ahead of the law’s effective date.

What the Law Requires of Employers

  • 5 Business-Day Response Requirement: Employers must provide current and former employees with a copy of their personnel records within five business days after receiving a written request. However, employers are not required to allow employees to review their personnel file more than two times in one calendar year.
  • 10 Day Notice Requirement: Employers must notify employees within ten days after placing information in a personnel record that may negatively affect the employee’s employment, promotion, transfer, compensation, or result in disciplinary action. While the law does not define what is considered “negative” information, it will likely include unsatisfactory evaluations, written warnings, or other performance management materials. Notably, the notification of negative information placed in the file will not count toward one of the two times employees are allowed to review their file.
  • Preservation of Employee Rebuttals: If an employee disagrees with any information contained in their personnel file (and the employer and employee cannot come to an agreement on said information), the employee may submit a written statement explaining their position. Employers are required to include that statement in the personnel record, including when submitting the file to a third party.
  • 3-Year Retention Requirement: Employers must maintain former employee’s personnel records for three years after an employee’s separation from employment.
  • Anti-Retaliation Protection: Employers may not discharge, threaten, penalize, discriminate against, or retaliate against employees for exercising rights under the law.
  • Penalties: Violations may result in fines ranging from $500 to $2,500 per violation.

Key Takeaways for Manufacturers

First, pay particular attention to any records created outside the immediate attention of human resources. For example, if there are supervisors who document attendance, safety incidents, or other performance-related conduct separate from what is considered an employee’s formal personnel file, that information is subject to the law so centralizing records/personnel processes might make future disclosure simpler. Before the law takes effect, employers can identify where records are created and stored and create a process for supervisors to route any employment-related documentation to human resources for review and retention. This will help ensure that all records required to be maintained under the statute are handled consistently across facilities.

Conclusion

New York’s new personnel file law represents a significant change for New York employers. The law not only creates broad employee access rights to personnel records, but it also imposes new notice, retention, and response obligations on employers. Employers may wish to review of their current personnel file practices, retention procedures, and human resources policies to ensure they are prepared when the law takes effect on November 8, 2026.

This article was co-authored by Labor + Employment group lawyer, Christopher Costain.

As artificial intelligence (AI) continues to play a significant role in how employers streamline operations, simplify workflows, and increase productivity, some employers are turning to highly advanced “AI agents” to take over multi-step, complex tasks that go far beyond the AI chatbots with which employees have become familiar. Now, some employers are taking the next step by using such highly advanced AI agents with human names to complete complex, multi-step assignments—not simply respond to prompts. However, employers should consider the extent to which giving AI agents human names, job titles, and places on an organizational chart may impact their human employees.

An AI agent is an autonomous, goal-driven, digital system that uses a large language model embedded with an organization’s resources, tools, and information to reason, plan, and make decisions without meaningful human oversight. Unlike an AI chatbot that provides a response to a prompt, an AI agent can coordinate actions across business functions and manage an entire decision-making process from start to finish. Since AI agents can tackle more complex tasks, employers have given them email addresses and started referring to them as “colleagues” who have completed onboarding and orientation. That may make use of the technology feel more accessible, but it can also blur the line between a software tool and a human decision-maker.

Although AI agents offer exponential improvements in productivity and efficiency, there are risks that employers should consider. Like all AI software, human engagement, judgment, and accountability should be a routine part of the work performed by any AI agent. Employers should ensure that employees understand that, even though they can execute tasks at scale, ultimately, AI agents cannot be held accountable when things go wrong; that responsibility falls on the employee who deployed the AI agent for the particular task, regardless of the fact that the AI agent has a human name, is referred to as a “coworker,” or maybe even is situated above them on the organizational chart. To that end, employers should also consider where an AI agent falls within the organizational structure, who will be responsible for “supervising” the AI agent, and what that “supervision” will be. Employers should also ensure their AI-related workplace policies are clear that employees, not AI agents, are responsible for producing high-quality work product and for verifying the accuracy of an AI agent’s outputs, regardless of the fact that the AI agent is performing a multi-step task and engaging in high-level functioning across business functions.

Employers should also be cognizant of how an AI agent might impact employee relations and create employment risk. As AI agents become more adept at analyzing complex employment law issues (including, for example, related to job-protected leaves of absence and reasonable accommodations), employees are likely to turn to their AI agent colleagues for answers and guidance based on their unique circumstances. In light of this, employers should consider whether AI agents, who communicate with employees through a company email address and with a corporate signature, making those communications indistinguishable from a human actor, are capable of binding the company to a particular accommodation or leave arrangement in the same manner that a human agent could bind the company. Separately, employers should also review their leave and accommodation-related workplace policies and practices to ensure they are consistent with the law and with the information an AI agent is trained on and may ultimately provide to employees, so that the AI agent’s responses are consistent with those policies and practices.

Additionally, employers might consider the impact that AI agents will have on employee morale. Will employees like working with “AI colleagues”? An AI agent with a human name and a spot on the company intranet or organizational chart may lead employees to wonder whether the company views software as a substitute for human judgment—or even as a potential replacement for their jobs. Employers can address these concerns by explaining what the agent is designed to do—and what it is not authorized to do—how it impacts specific tasks, and that human judgment and accountability remain essential. Involving employees in implementation, providing training, and communicating openly about these changes can help build trust and show how AI agents can support work rather than diminish employees’ contributions.

On August 18, 2026, the Cybersecurity & Infrastructure Security Agency, Federal Bureau of Investigation, and U.S. Department of Health & Human Services issued an update to a previous advisory to the health care industry warning against Medusa ransomware. The advisory provided tactics, techniques, and procedures as well as the indicators of compromise gathered to assist with response and remediation.

Medusa ransomware has been hitting the healthcare space particularly hard, but it’s also affecting the defense industry, critical manufacturing information technology, and financial services.

The advisory outlines how Medusa is a ransomware-as-a-service (RaaS) variant that was first identified in June 2021. Since its inception, Medusa developers and affiliates have hit over 500 victims, including “medical, education, legal, insurance, technology, and manufacturing.”

Although Medusa originally operated as a closed organization, since 2023 it has developed into an affiliate model, selling RaaS to affiliates that are paid different amounts depending on their experience and how effective they are in extorting victims. Medusa is a double extortion program, where they deploy ransomware to decrypt data, then extort victims for payment to decrypt and suppress publication of the data.

Medusa recruits access brokers in cybercriminal forums and marketplaces. The access brokers are the ones who attack the company through phishing campaigns, or exploit unpatched software vulnerabilities, including ScreenConnect, Fortinet, Fortra, and BeyondTrust. They pay the access brokers between $100 and $1 million to break into the company and sell that access to Medusa operators. They leverage new vulnerabilities within 24 hours and sometimes before they are announced. Once in, the access brokers use legitimate tools to cover their tracks to give them time to sell their wares to Medusa (and other ransomware gangs). Medusa then uses legitimate remote monitoring software to evade detection to exfiltrate data, deploy the ransomware, and extort the victim.

The advisory lists the indicators of compromise that companies should review and block. It also provides common remediation, including eviction countermeasures, and mitigations, which should be applied as soon as possible.

The advisory reinforces how important it is to continue internal phishing tests, employee training, and patching programs as priorities to help avoid becoming a victim.

This post was co-authored by Data Privacy + Cybersecurity team and Artificial Intelligence practice co-chair Linn F. Freedman. The post is also being shared on our Data Privacy + Cybersecurity Insider blog. If you’re interested in getting updates on developments affecting data privacy and security, we invite you to subscribe to the blog.

This article was co-authored by Labor + Employment group lawyer, Christopher Costain.

Workplace issues can arise quickly and take many forms, from complaints of discrimination, harassment, retaliation, and bullying to policy and compliance violations related to workplace safety or other employee misconduct. In the post-#MeToo era, it is critically important for employers to be vigilant in addressing these issues by conducting workplace investigations that are impartial, thorough, and provide a fair process and a meaningful opportunity to be heard for the individuals involved. Thorough workplace investigations can improve culture, mitigate legal risk, and support employee relations.

In the manufacturing industry, workplace investigations often require a tailored approach due to several factors such as fragmented and varying work shifts, production pressures, and unique workplace layouts (e.g., manufacturing plant, etc.), among other issues. In this post, we outline five key essentials for workplace investigations with a focus on investigations in a manufacturing workplace.

Essential #1: Selecting an Impartial Fact Finder (Investigator)

Manufacturers should consider the importance of conducting an objective and impartial fact-finding investigation. This means that manufacturers should determine who will conduct the investigation – whether an external investigator without prior knowledge of the parties or issues involved is appropriate, or an internal investigator who may have relevant institutional or process-related knowledge is required. Once determined, it is important to consider what individual is best suited. Whether internal or external, the investigator should be skilled in conducting workplace investigations and must be impartial; even if internal personnel conduct the investigation, the individual must do so impartially.

Essential #2: Managing Investigation Logistics in a Manufacturing Workplace

Witness interviews are key to fact-gathering, and the associated logistics may require particular attention in manufacturing workplaces. Employees may travel among worksites or customer facilities, work primarily on production floors, or lack access to private offices, conference rooms, or work email accounts. Investigators should therefore plan interviews around times and locations that allow each witness to participate in a secure, private, setting free from disruption where a confidential interview may be conducted.

When coordinating witness interviews, manufacturers should account for varying schedules, break periods, and operational coverage needs so that the investigation does not significantly disrupt operations or jeopardize workplace safety. Where email is unavailable or impractical, employers should consider using alternative methods, including phone calls, written notices, or in-person communications. All communications should be limited to necessary scheduling information and avoid revealing unnecessary details about the investigation, as well as be documented so that witness communications and scheduling efforts can be tracked.

Essential #3: Maintaining Confidentiality & Prohibiting Retaliation

It is important to understand state and federal law regarding confidentiality so that witnesses can be properly informed about any obligations to maintain the confidentiality of the investigation. Under current National Labor Relations Act case law, employers may advise interviewees to maintain the confidentiality of the investigation while it is ongoing but cannot require interviewees to maintain such confidentiality after its conclusion. Additionally, confidentiality limitations should encompass only the information employees learn or provide within the course of the investigation. There may also be additional restrictions regarding confidentiality and the disclosure of information related to the investigation under local and state law of which manufacturers should be aware.

Retaliation is prohibited by the employer with regard to participating in and cooperating with the investigation and employees must understand this. To that end, expressly remind interviewees that retaliation is not tolerated, and if they are subjected to retaliation (or they retaliate against another individual) , that retaliation is prohibited under the employer’s specific policies. Manufacturers should also consider designating an individual to whom concerns regarding retaliation may be reported and ensure that witnesses know to contact that individual if they feel they have been retaliated against. A strong and clear anti-retaliation message can assist in mitigating the risk of retaliation and—at a minimum—can increase the chance that witnesses will report if retaliation occurs.

Manufacturers should consult with counsel regarding these key concepts.

Essential #4: Selecting the Report

At the outset of an investigation, determining how and through what means the employers’ findings will be communicated can be planned in advance. Depending on factors such as the nature of the allegations, the audience, privilege considerations, and the manufacturer’s needs, the investigator may prepare: a full written report; a shorter executive summary; an oral readout; or another tailored form of findings. Regardless of format, the findings report should clearly identify the scope of the investigation, the issues reviewed, and the factual findings supported by the evidence. The investigator should apply the applicable standard of proof (typically the preponderance of the evidence standard) in assessing whether the evidence shows that the alleged conduct “more likely than not” occurred. Where appropriate, and within the scope, the report may also include policy determinations.

Essential #5: Asserting the Attorney-Client Privilege

The decision whether the attorney-client privilege will apply to the investigation, relevant documents such as witness notes, and to any report that is drafted is always at play. That determination will depend on a variety of factors. If an investigation is conducted under the attorney-client privilege, this can protect the integrity of the investigation and help to mitigate legal liability by enabling the employer to make informed decisions based on the findings of the investigation. If litigation ensues, and the investigation and report are protected by the attorney-client privilege, an employer can decide whether it is prudent to waive the privilege, which will subject the investigation report and other investigation-related materials to disclosure in the discovery process. Just because an attorney has conducted or supervised the investigation, or the report is marked “privileged,” does not mean that the investigation and any report will be privileged, so it is best to consult with an attorney with regard to this key concept.

Conclusion

Many issues that arise on the manufacturing floor require prompt, thorough, and impartial investigation. Manufacturers should be mindful of these workplace investigation essentials when planning the investigation around both legal requirements and operational realities. By combining prompt action with thorough and objective fact-finding, manufacturers can support employees, build trust, and make informed, fair, and legally defensible decisions.

A recent Hartford Business Journal article examined growing acquisition activity among aerospace and advanced manufacturing suppliers, including efforts to bring family-owned machine shops together under common ownership as manufacturers respond to increased demand and evolving supply chain needs.

When asked about the trend, I noted that while buyers remain active, many business owners are evaluating opportunities through a broader lens than purchase price alone:

“Not all privately held suppliers in Connecticut [and beyond] are choosing the top buyer, the top dollar. They’re also concerned about their employees. I would say that most of our client base is focused on ‘what is your plan for the future of this company?’”

That perspective reflects an important reality in today’s manufacturing market. For many founders and family-owned businesses, a potential transaction is not simply a financial event—it’s a decision about the future of the workforce, customer relationships, and legacy they’ve spent years building.

We’re also seeing continued demand for manufacturers with specialized capabilities, particularly those serving the aerospace and defense sectors. As supply chains continue to evolve and domestic production capacity becomes increasingly important, strategic buyers are seeking businesses that can help meet growing market demand.

For owners considering succession planning, growth opportunities, or a future sale, the current environment highlights the importance of planning ahead. The strongest outcomes often come from understanding your options early and identifying partners whose long-term vision aligns with your goals for the business.

For additional insights, read the full Hartford Business Journal article: With $75M, CT-Based Acquisition Firm Targets Family-Owned Machine Shops to Build Aerospace Supplier.

This article was co-authored by Labor + Employment group lawyer, Christopher Costain.

On May 29, 2026, Connecticut Governor Ned Lamont signed into law comprehensive online safety legislation with significant impacts for employers, which takes effect on October 1, 2026. The law follows in the footsteps of similar legislation enacted recently around the country which creates various new compliance obligations for employers leveraging artificial intelligence tools to assist in making employment-related decisions. Employers seeking to harness the power of these new and emerging technologies should ensure compliance with this new framework.

Automated Employment-Related Decision Technology

The law restricts an employer’s ability to use “automated employment-related decision technology” (AEDT) to help make employment-related decisions; this is defined as any technology that processes personal data and uses computation to generate an output, prediction, ranking, recommendation, or scoring that is a substantial factor used to make or materially influence an employment-related decision, carving out common software that does not do so, such as word processing systems, spreadsheets, or other data that is purely descriptive, diagnostic, or statistical in nature. Under the law, “employment-related decision” means any decision made based on an individual’s personal data to hire, promote, discipline, or discharge such individual, or affect such individual’s terms and conditions of employment, but does not include decisions made with respect to workplace health and safety, scheduling and planning, or productivity. 

Disclosure Obligations

Beginning October 1, 2027, employers must inform any employee or applicant in plain language when they are interacting with an AEDT to the extent that such interaction would not be obvious to a reasonable person. The law also requires that employers using AEDT to generate an output for the purpose of making, or to use as a substantial factor in making an employment-related decision, must provide to the employee or applicant a written notice disclosing:

  1. That the employer is using an AEDT;
  2. The purpose of the AEDT and the nature of the employment-related decision;
  3. The trade name of the AEDT;
  4. The categories of personal data concerning such employee or applicant that will be analyzed by the AEDT, including how such data will be processed to reach a determination;
  5. The sources of the personal data used; and
  6. The employer’s contact information.

The law does not specify when an employer’s disclosure obligations are triggered within the employment-related decision-making process, as opposed to in connection with “interactions” with an employee or applicant. However, forthcoming implementing regulations may distinguish between these situations so that employers can recognize when and which disclosure obligations are triggered.

The law does not require the disclosure of trade secrets or information that is otherwise protected from disclosure by law; however, to the extent information is withheld on such basis, notice must be provided to the person from whom such information is withheld disclosing the fact that information was withheld and the basis for doing so.

If AEDT developers have the information above, they must provide that information to the employer so the employer can fulfill its disclosure obligations. Interestingly, the law specifically permits employers to enter into contracts with developers of AEDT to assume the employer’s disclosure obligations under the law, so long as the contract specifically identifies which of the employer’s disclosure obligations the developer is agreeing to assume.

Amendments to Connecticut Fair Employment Practices Act

The law amends the Connecticut Fair Employment Practices Act effective October 1, 2026, to provide that the use of an AEDT is not a defense to a complaint alleging a discriminatory employment practice. However, the law explicitly permits the Connecticut Commission on Human Rights and Opportunities, or a court, to consider evidence of anti-bias testing or other proactive efforts to avoid discriminatory outcomes in making their determination. The law specifically contemplates that such evidence may include the quality, efficacy, recency, and scope of such testing or efforts, the results of those efforts, and the employer’s response thereto.

Enforcement and Penalties

Violations of the law constitute unfair or deceptive trade practices under the Connecticut Uniform Trade Practices Act and may be enforced solely by the Attorney General. For violations occurring on or before December 31, 2027, the Attorney General may issue a notice of violation to an employer or developer if the violation can be cured, in which case such developer or employer shall have 60 days to cure such violation prior to the initiation of a formal action. 

Importantly, the law does not provide a private right of action.

Conclusion

Employers deploying AEDT should be prepared to comply with the new law, including by reviewing specifically how and to what extent an AEDT is utilized within the context of the employment-related decision-making process. Employers should also be mindful that, although the use of AEDT systems cannot be used as a shield against claims of discrimination, factfinders may consider an employer’s efforts to audit such systems to ensure the preservation of fair, non-discriminatory outcomes. To that end, regular, independent, and thorough assessments of employment processes in which AEDTs are being used and appropriate remedial actions where necessary to mitigate risk will both be increasingly important under this new law.

This article was co-authored by Labor + Employment group lawyer, Christopher Costain.

In March 2026, a Connecticut bill was signed into law which sets new compliance standards for large warehouse employers that use production quotas and related metrics in assessing worker performance. Once the law goes into effect on July 1, 2026, Connecticut will become the sixth state in the country to have enacted such a law, joining California, Minnesota, New York, Oregon, and Washington. For large manufacturers, the new law will significantly impact how employee performance is tracked.

Who Is Covered

The law defines “employer” as any commercial entity that, at any time in the prior 12 months:

  1. Employs 250 or more employees at a single warehouse distribution center in Connecticut; or
  2. Employs 1,000 or more employees at one or more warehouse distribution centers in Connecticut. 

Notably, the employee headcount thresholds include workers who are employed indirectly, such as through a third-party employer or temporary staffing service or agency. Covered employees are those workers who are non-exempt from the minimum wage and overtime requirements of the Fair Labor Standards Act of 1938, as amended.

The law applies only to employers that operate “warehouse distribution centers,” which is defined as a warehouse or warehouse complex as contained within certain North American Industry Classification Systems Codes related to warehousing and storage, merchant wholesalers, e-commerce and mail-order merchants, couriers and delivery services, and warehouse retail establishments.

Covered Quotas & Performance Standards

When the law goes into effect, covered employers will be required to disclose information to workers regarding quota and work speed data performance standards. A “quota” is defined as a work performance standard under which:

  1. An employee is assigned or required to perform at a specific productivity speed, or complete a certain number of tasks, or produce a certain amount of material within a defined time period;
  2. An employee’s time spent performing tasks when a defined time period is measured, recorded, or tallied; or
  3. An employee’s performance is ranked in relation to the performance of other employees.

The law also defines “work speed data” as the specific metrics collected by an employer indicating the amount of tasks performed or materials handled or produced by an employee within a period of time, and whether any amount of that time was spent not performing tasks or handling materials.

Quota Disclosure & Recordkeeping Obligations

The law includes several key compliance obligations for covered employers, including quota information disclosure and recordkeeping requirements:

  1. No later than August 1, 2026, for current employees, or at the time of hiring for new employees, covered employers must provide a written description of each quota to which the employee is subject, including any potential adverse employment action that may result from a failure to satisfy such quota;
  2. If a covered employer changes a quota, it must notify all employees subject to that quota before the new quota goes into effect, in addition to providing a written description of the new quota no later than two business days after the change is made; and
  3. Covered employers must maintain records of each employee’s work speed data, the aggregated work speed data for similar employees at the same warehouse distribution center, and written descriptions of quotas provided to employees, for three years.  Importantly, employers that do not assign or require quotas are not required to preserve any of the records required under the law.

Employee Requests for Quota Information

Under the law, current and former employees may request the following information from their employer or former employer, which must be provided within ten calendar days of receipt of such request, if the employee or former employee believes a quota violates the law:

  1. A written description of each quota to which the employee is/was subject;
  2. A copy of the employee’s personal work speed data for the prior 90 days/the 90 days prior to the employee’s separation from employment; and
  3. A copy of the aggregated work speed data for similar employees at the same warehouse distribution center for the prior 90 days/the 90 days prior to the employee’s separation from employment.

Permissible Quotas & Quota Restrictions

The law also prohibits employers from implementing any quotas that:

  1. Prevent compliance with meal period requirements under Connecticut law;
  2. Interfere with the use of bathroom facilities, including travel time to and from such facilities;
  3. Measure an employee’s performance over a period of time that is shorter than the employee’s workday; or
  4. Set a performance standard that is based solely on ranking the employee’s performance in relation to the performance of other employees.

Anti-Retaliation & Penalties

Employers are prohibited from (1) discharging, retaliating or discriminating against, or (2) taking any adverse employment action against, any employee or former employee for requesting information related to quotas to which they are subject. The law also establishes a presumption of retaliation for adverse employment actions taken within 90 days of protected activity. The presumption of retaliation can be rebutted by clear and convincing evidence that the adverse employment action was taken for a permissible reason or that the employee’s engagement in protected activity was not a motivating factor in the employer’s decision to take such adverse action.

Employees, or the Attorney General (on behalf of a group of employees), may bring an action in the Superior Court to recover damages, injunctive relief, and attorneys’ fees. Additionally, employers that violate the law will be assessed a civil penalty of $1,000 for a first violation, $2,000 for a second violation, and $3,000 for a third or any subsequent violation.

Key Takeaways for Manufacturers

Manufacturers who may be covered under this new law should review all existing quotas and work speed data metrics to ensure they do not violate the law (such as interfering with meal periods or monitoring employee performance for a period of time that is shorter than the employee’s workday), and ensure that records are being preserved in compliance with the law. Manufacturers should also determine whether existing quota systems are supported by written policies or descriptions, and prepare quota disclosure notices prior to the August 1, 2026, deadline. In all cases, manufacturers should consult competent employment counsel for assistance with ensuring compliance with the new law and other important employment law issues. 

This post was co-authored by Government Enforcement + White-Collar Defense Team lawyers Seth B. Orkand and Danielle H. Tangorre and Litigation group lawyer Mallori D. Thompson. This post was originally published as a Legal Update.

On April 10, 2026, the Department of Justice (DOJ) announced a nearly $17.1 million settlement with IBM to resolve allegations that IBM engaged in “illegal DEI practices” and violated the False Claims Act by failing to comply with anti-discrimination requirements in federal contracts. Notably, under the settlement agreement, IBM did not admit liability and expressly denied that it engaged in the conduct alleged. This settlement, and the underlying policy initiative on which it is based, have profound implications for entities that receive federal funding or have government contracts.

Background of DOJ’s Focus on DEI Programs

Most federal contracts contain provisions that require contractors to certify that it will abide by federal civil rights laws and not discriminate against job applicants or employees on the basis of race, color, national origin, or sex. On President Trump’s first day in office, he issued two executive orders requiring every federal contract or grant award to include a clause making compliance with federal anti-discrimination laws material to payment for purposes of the False Claims Act, and a certification that the contractor/grantee “does not operate any programs promoting DEI that violate any applicable Federal anti-discrimination laws.” The orders also direct the DOJ and other government agencies to identify and investigate “egregious” DEI practitioners in key sectors, expressly including “the medical industry.” 

On July 15, 2025, then-Attorney General Pam Bondi issued a memorandum directing aggressive DOJ enforcement against race-based, sex-based, or other DEI programs maintained by any entity receiving federal funds. This memorandum directs the DOJ Civil Rights Division and U.S. Attorneys to treat receipt of any federal funds, including Medicare, Medicaid, and HHS program funds, as creating enforceable anti-discrimination compliance obligations under:

  • Title VI of the Civil Rights Act;
  • Section 1557 of the Affordable Care Act;
  • The False Claims Act (FCA); and
  • Title IX

The IBM settlement is the FCA resolution under DOJ’s Civil Rights Fraud Initiative, launched in May 2025. 

IBM’s DEI-Related Conduct at Issue

The DOJ alleges that IBM took race, color, national origin, and sex into account when making employment decisions, including by:

  1. bonusing employees for achieving demographic recruiting targets;
  2. using methods to identify “diverse” candidates for hiring, transfer, and promotion, including the use of “diverse interview slates,” “diverse sources,” and altering interview eligibility criteria based on protected characteristics;
  3. developing race and sex demographic goals for business units and taking race and sex into account in employment decisions to make progress toward those goals; and
  4. offering training, partnerships, mentoring, leadership development programs, and educational opportunities to employees on the basis of race or sex.

Interestingly, the DOJ alleges that IBM engaged in the alleged conduct since at least January 19, 2019, to the present, meaning that DOJ is retroactively applying the Trump Administration’s current view of DEI programs to a period including the first Trump and Biden presidencies.

The settlement agreement suggests that the settlement amount IBM agreed to was determined on the basis of indirect costs (overhead) that IBM allocated to its federal contracts for these practices during the period covered by the agreement. 

Implications for Government Contractors and HR and Compliance Departments

From a risk management perspective, this settlement is a reminder that the DOJ expressly considers DEI programs as violative of federal anti-discrimination laws. Clients that receive federal funding would be well advised to require their HR and talent teams to scrutinize DEI programs that set demographic goals and program eligibility criteria and provide incentive compensation structures on the basis of race, color, national origin, or sex. 

For compliance functions, the settlement also highlights the DOJ’s continued emphasis on cooperation credit in FCA resolutions. The agreement states IBM was credited for cooperation, including early disclosure of facts relevant to the investigation gathered during IBM’s independent investigation, assistance in determining damages and penalties, and voluntary remedial measures such as terminating and/or modifying certain programs, policies, or other activities described in the covered conduct. The settlement reinforces the importance of aligning employment practices with the contractor’s government contract-incorporated obligations, and ensuring internal controls can detect and escalate potential noncompliance. The agreement’s express cooperation credit language also highlights the value the DOJ places on early factual disclosure, structured internal investigations, and documented remediation. 

For government contractors, the settlement is also a cost-charging cautionary tale. The DOJ’s allegations included that IBM allocated indirect costs associated with the challenged practices to federal contracts and sought reimbursement for them. Contractors should reconsider whether allocating costs associated with overhead for diversity-related employment goals should be charged to the government.

What We Are Watching

We anticipate that this settlement is the first of many to come during the remainder of the Trump Administration. It will undoubtedly encourage whistleblowers to come forward to report race- and sex-based DEI hiring and employment activities in the hope of obtaining a portion of the government’s settlement proceeds.

We will continue to monitor how DOJ claims to satisfy the materiality element of the False Claims Act and uses the false certification theory to prosecute recipients of federal funding, such as health care entities receiving reimbursements from federal health care programs, and awardees of federal grant money required to certify compliance with federal anti-discrimination laws.

Minnesota Governor Tim Walz issued an emergency executive order on April 7, 2026, dispatching the Minnesota National Guard after Winona County requested assistance following a cyber attack disrupting its “critical systems and digital services.” The attack occurred on April 6, 2026, and is “significantly impairing the county’s ability to deliver vital emergency and municipal services.”

The attackers are currently unknown, but it is further evidence of the increased threat of cyber-attacks following the war in Iran, which is the subject of a Joint Advisory issued by federal government agencies warning government agencies and critical infrastructure to prepare and prevent cyber-attacks during the war in Iran.

Despite a two-week cease fire, Iran has always been a formidable cyber adversary, and it is anticipated that the cyber-attacks will continue as normal.

This post was co-authored by Data Privacy + Cybersecurity Team and Artificial Intelligence team chair Linn F. Freedman. The post is also being shared on our Data Privacy + Cybersecurity Insider blog. If you’re interested in getting updates on developments affecting data privacy and security, we invite you to subscribe to the blog.

Critical infrastructure operators at the water treatment plant in Minot, North Dakota, were forced to resort to manual processes when its Supervisory Control and Data Acquisition (SCADA) system became inoperable as a result of a March 14, 2026, ransomware attack. The attackers are unidentified, but it comes in the wake of the war in Iran, and both Iran and China are known to lead cyber-attacks against water utilities, which often have vulnerabilities that make them easy targets. Last month, the Water Information Sharing and Analysis Center, along with information sharing organizations for the auto, aviation, food, health, IT, national defense, oil and natural energy, and retail and hospitality industries issued a Joint Advisory to their members, including water facilities, warning them of increased cyberattacks from Iranian hackers, as well as physical attacks against critical infrastructure entities. The warning concluded by stating that “the threat environment is likely to remain highly volatile.”

Minot’s water system provides water to approximately 80,000 users. Although the water supply and quality were not affected by the attack, operators were required to manually read gauges for 16 hours while they uninstalled the compromised SCADA system. It has taken Minot over two weeks to spin up a new server.  

Since water facilities are a target for nation state cyber actors, the state of New York recently introduced cybersecurity standards for both drinking and wastewater treatment facilities. Other states will hopefully follow suit so the water supply and quality available will be less vulnerable to attack.

Critical infrastructure operators should be aware of the heightened risk, prepare for an attack, and test their incident response processes through a cybersecurity tabletop exercise that is designed to address a shut down so processes can be improved and services restored as efficiently as possible. We all depend on the basic necessities of food, water, electricity, and access to financial services, all of which could be downed by an attack and dramatically impact our lives. We depend on critical infrastructure operators to have measures in place to prevent and mitigate the effects of an attack.

This post was co-authored by Data Privacy + Cybersecurity Team and Artificial Intelligence team chair Linn F. Freedman. The post is also being shared on our Data Privacy + Cybersecurity Insider blog. If you’re interested in getting updates on developments affecting data privacy and security, we invite you to subscribe to the blog.