New Privacy Laws Add Assessments, and Audit Teams Must Prove Them

Every new privacy law adds a document that someone must be able to produce on demand. A threshold falls, a definition widens, a new assessment appears, and the compliance team inherits another artifact to prove. The pattern is now visible across three recent developments, and together they describe a function that is being asked to assure more with the capacity it already has.

The first is a survey from Sikich. Its 2026 U.S. Internal Audit Priorities Survey, released October 20, 2026, found that 64 percent of respondents reported higher internal audit budgets and 43 percent expect to add headcount, yet 77 percent now include AI assessments in their audit plans. The second is state legislation. Delaware’s amended privacy act takes effect January 1, 2027 with lower thresholds and wider sensitive data rules, and Connecticut’s amendments already took effect in 2026. The third is a joint resolution from Canada’s privacy regulators on responsible AI in health, which calls for governance and accountability frameworks grounded in risk assessments.

None of these items is about a single incident. They are about the steady accumulation of obligations that must be evidenced, and about who will test the evidence. This post explains what each development requires, why they converge on the same artifacts, and how a Chief Compliance Officer, a Data Protection Officer or a head of internal audit can build one trail that serves all of them. It also shows where Kiteworks secure data exchange supports that trail for sensitive content, without replacing the assessments that only people can write.

Key Takeaways

1. Privacy obligations are converging on assessments and records.

Delaware and Connecticut add, and Canada’s regulators call for, risk assessments, governance frameworks and audit-ready documentation.

2. Scope keeps widening.

Lower applicability thresholds and wider sensitive data definitions pull more organizations into regimes they previously ignored.

3. Audit capacity is not keeping pace on its own.

Sikich reports rising budgets and AI coverage, but also that many organizations have yet to expand assurance beyond governance and security controls.

4. AI is now an assurance topic.

Connecticut requires disclosure of large language model training, Vermont will require the same from January 2028, and Canada’s regulators call for ongoing AI-specific assessments.

5. One evidence trail beats five.

A unified record of who accessed what, under which policy, is the common input to every assessment and audit these regimes require.

What the Sikich Survey Says, and What It Does Not

Sikich’s 2026 U.S. Internal Audit Priorities Survey, released October 20, 2026, reports that nearly two-thirds of respondents (64 percent) had higher internal audit budgets and that more than four in ten (43 percent) expect to increase headcount. It also reports that more than eight in ten (82 percent) use external partners, and that 77 percent include AI assessments in their audit plans. The firm says AI governance, data privacy and cybersecurity are growing areas of focus.

Two cautions apply. The survey is by a professional services firm that sells audit and advisory services, and the published summary does not state a sample size. Respondents are internal audit leaders across a broad range of industries, so the findings describe the U.S. audit community and not every organization.

The most useful line for compliance leaders is a quiet one. The survey says many organizations have yet to expand assurance beyond governance and security controls. In practice, that means audit teams are checking that policies and controls exist, and are only beginning to test whether AI systems perform as intended and whether decisions are sound. Testing performance and outcomes requires evidence that a policy document cannot supply, such as logs of what a system accessed and what it produced.

This is where the budget numbers need context. A bigger budget and more AI assessments in the plan do not by themselves create the underlying records. If the organization cannot show which data an AI tool reached or which vendor handled it, the auditor has nothing to test, however well funded the audit function is.

Delaware and Connecticut Widen the Net

State privacy legislation has become a moving target. According to a Morgan Lewis summary of Delaware’s House Bill 380, the amendments take effect January 1, 2027. The applicability threshold drops to controllers that control or process personal data of 10,000 or more consumers, excluding data processed solely to complete a payment transaction, down from 35,000. The threshold for businesses that derive more than 20 percent of gross revenue from the sale of personal data falls to 5,000 consumers, down from 10,000.

The scope of sensitive data also grows. The summary says covered information now includes national origin, certain health-related information, neural data, certain financial account information and government-issued identification numbers. A controller generally may not process sensitive data without consumer consent, and any sale of sensitive data must be strictly necessary to provide a requested product or service, with the consent record generally retained for five years.

Two further changes matter to evidence. Controllers that process the personal data of 50,000 or more Delaware consumers and engage in profiling for automated decisions with legal or similarly significant effects must conduct an impact assessment. And the entity-level exemption for financial institutions narrows. The revised law exempts only specific financial institutions, and their affiliates, so other financial entities may need to comply for the first time.

Connecticut moved earlier. Foley and Lardner’s summary says sweeping amendments took effect on July 1, 2026. The consumer threshold fell from 100,000 to 35,000, and triggers tied to sensitive data and data sales now apply regardless of volume. The protected age range for minors rises from 13 to 16 to 13 to 17, with a blanket prohibition on targeted advertising to, and the sale of personal data for, that group.

Connecticut also adds an AI disclosure and a new assessment. Privacy notices must now disclose whether personal data is used to train large language models, and controllers that profile for legally significant decisions must conduct a dedicated impact assessment for processing activities created or generated on or after August 1, 2026. Consumers also gain a right to obtain a list of third parties to whom their personal data was sold.

The pattern repeats in the newest comprehensive laws. A Morgan Lewis review of four new state laws lists Alabama (effective May 1, 2027), Louisiana and Oklahoma (both January 1, 2027) and Vermont (January 1, 2028). Cure periods differ, at 45 days in Alabama, 30 days in Louisiana and Oklahoma, and 60 days in Vermont. Vermont will also require controllers to disclose in their privacy notices whether personal data is used for training large language models.

For a compliance team, the practical result is a patchwork of thresholds, dates and cure periods that must be tracked, with a common core of documented assessments, consent records and third-party controls. Each of those cores is an artifact an auditor can ask for.

Canada’s Regulators Put AI Governance on the Record

The third development comes from outside the United States, and it shows the same direction of travel. Canada’s federal, provincial and territorial privacy regulators adopted a joint resolution on responsible use of artificial intelligence in health and health research. The resolution is dated September 15, 2026, and the Office of the Privacy Commissioner page shows a modification date of October 29, 2026. It is a joint position and a call for action, not a law.

The resolution asks developers to take a privacy by design approach, and it sets out six principles. AI systems should be privacy protective, valid and reliable, safe, human rights affirming, transparent and accountable. It urges governments to review, amend or adopt legislation so health AI meets those principles, and to require governance and accountability frameworks based on robust risk assessments.

The detail for organizations is instructive. Developers are asked to conduct ongoing privacy, security and AI-specific assessments throughout the life cycle of each system, and to enable auditing capabilities and routine real-world testing. Healthcare providers are asked to keep an AI risk management framework up to date, manage third-party contracts carefully, including auditing and record keeping, train staff and prevent unapproved shadow AI use, and ensure human oversight and verification of outputs.

Although the resolution is aimed at the health sector, its structure is general. It asks for assessments, governance frameworks, contract terms that allow auditing, and records that show human oversight. Those are the same artifacts that the U.S. state laws and the internal audit survey point toward.

The Convergence: Assessments, Records and Third Parties

Set the three developments side by side and the overlap is clear, and it is the kind of overlap that a mature governance, risk and compliance program is built to absorb. Each one asks the organization to assess a risk, document the result, and show that the process is repeated and overseen.

Delaware and Connecticut require impact assessments for profiling and for automated decisions. Canada’s regulators call for ongoing AI-specific assessments. Sikich reports that audit plans increasingly include AI assessments. The common thread is that an assessment is only as good as the facts it rests on, and the facts live in the systems that handled the data.

Third parties are the second thread. Delaware’s summary says the contract must allow the controller to take reasonable and appropriate steps to ensure that a third party complies with its obligations. Canada’s resolution says provider contracts should address auditing and record keeping. Connecticut gives consumers a right to a list of third parties to which their data was sold. Each of these requires the organization to know which vendors touched which data, which is a records question before it is a legal one.

The third thread is AI disclosure. Connecticut and Vermont both require privacy notices to say whether personal data trains large language models. A notice is a promise, and a regulator can ask for evidence that the promise matches what the systems do. An organization that cannot show which datasets reached which AI tools cannot confirm that its notice is accurate.

Why Internal Audit Feels the Squeeze

Internal audit sits where these threads meet. It is expected to test whether assessments were performed, whether vendor controls work, and whether AI systems behave as described. The Sikich numbers show a function that is growing, but growth in budgets does not remove the structural problem, which is that evidence is scattered.

Consider a routine audit question. Which AI tools had access to customer records last quarter, through which channels, and under whose approval? In many organizations the answer requires assembling records from email, file sharing, managed file transfer, forms and application logs, each in a different format and owned by a different team. The auditor spends the engagement collecting evidence and has little time left to test it.

That cost is borne by both sides. The compliance team spends weeks answering requests, and the audit function reports on documentation gaps instead of control effectiveness. The result is the pattern Sikich describes, in which assurance stays focused on governance and security controls because deeper testing requires data that is hard to get.

The Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report points to the same strain. In that self-reported vendor survey, 63 percent of its 459 respondents had experienced a compliance consequence such as an audit finding, a remediation plan, a board escalation, a contractual penalty or a regulatory investigation. The sample is self-reported and spans several regions and industries, so read it as a signal about compliance consequences in general and not as a measure of any one law.

Build One Evidence Trail

The efficient response to converging obligations is a single evidence trail that feeds every assessment, audit and regulator request. Five elements make it work.

The first is an inventory of sensitive data flows. List where regulated and sensitive data enters, moves and leaves, including email, file sharing, SFTP, managed file transfer, forms and APIs. This is the foundation for any state law threshold analysis and for any AI assessment, and it is the same discipline that underpins zero trust data protection. A data flow that nobody has listed is a data flow nobody can assess, and an auditor will find the unlisted flows first.

The second is a consistent record of access and sharing. For each flow, capture who accessed which content, when, through which channel and under which policy. A unified audit log across channels turns a multi-week reconstruction into a report. Kiteworks secure data exchange provides that record for content that moves through it, with customer-controlled encryption keys and a single policy engine across channels.

The third is a third-party register that connects vendors to data. For every vendor that receives sensitive data, record the contract terms on auditing and record keeping, the data categories shared and the date of the last review. This supports both Delaware-style contract requirements and the Canadian expectation of careful contract management, and it feeds third-party risk management and wider supply chain risk management. Include fourth parties where the contract allows, because a vendor’s subprocessors are often where a data flow becomes untraceable.

The fourth is an assessment library. Keep privacy impact assessments, profiling impact assessments and AI-specific assessments in one place, each linked to the evidence that supports it. A privacy impact assessment that cannot point to its inputs is hard to defend.

The fifth is an AI access policy. State which AI tools may reach which data classes, how access is limited to the authorizing user’s permissions, and how activity is logged. This is the control that lets a privacy notice about AI training be true, and it supports AI data governance more broadly. Kiteworks compliant AI applies the same access rules and audit logging when an AI client reaches for content, so the record for an AI interaction looks like the record for a human one.

What to Do in the Next Ninety Days

Start with the laws that take effect soonest. Delaware’s amendments take effect January 1, 2027, as do the new Louisiana and Oklahoma laws, so the first quarter of the year is when new thresholds will start to apply. Use the next ninety days to confirm which of them reach your organization, and treat the state data privacy laws as a single program with a state-by-state appendix.

Next, test the evidence. Pick one regulated data set and ask how long it would take to produce a consolidated view of who accessed it over the past quarter. If the answer is days or weeks, the gap is structural, and it will not close by adding audit hours.

Then align audit and compliance. Agree which assessments each function owns, where the evidence lives, and how requests are routed. Shared ownership of the evidence trail prevents the two functions from collecting the same records twice.

Do not forget the people side. Train the staff who handle assessments and access requests so that records are created at the time of the decision and not reconstructed later. A decision record written the same day is worth far more to an auditor than one assembled a year afterwards from memory and email threads.

Finally, brief the board with evidence. A one-page view of regulatory changes, assessments completed, vendors reviewed and open exceptions will say more than a policy count. The board’s question is whether the organization can show control, and the answer must come from records.

To learn more about building one evidence trail for privacy assessments and audit requests, schedule a custom demo today.

Additional Resources

• Blog Post The Tug-of-War Over Your Data: How the CLOUD and SHIELD Acts Pit Security vs. Privacy
• Blog Post Secure Sensitive Data by Mapping DSPM to Your Compliance Goals
• Brief Top 3 FERPA Violations and How to Avoid Them
• Blog Post Executive Order 14117: Protecting Americans’ Bulk Sensitive Personal Data
• Blog Post Need NIS2 Compliance? Start With ISO 27001