#legal
Legal considerations for business finance and accounting compliance
On February 11, 2026, fourteen trade groups — including the American Trucking Associations and the National Retail Federation — petitioned the NLRB to lock in a stable independent contractor standard after three different tests in roughly a decade. Here's how the NLRB test differs from the IRS and DOL frameworks, and what contractor-reliant businesses should do while the petition plays out.
Treasury Decision 10050, effective July 10, 2026, delivers the first substantial update to Qualified Domestic Trust (QDOT) regulations in three decades. Here is why the unlimited marital deduction excludes non-citizen spouses, what a QDOT requires — a U.S. trustee, an affirmative Form 706 election, and security for trusts over $2 million — and which four procedural fixes the new rules make for business owners' estates.
RentGrow paid a $2.25 million civil penalty to settle FTC allegations of FCRA violations: duplicated eviction and criminal records, an undisclosed data source, and mishandled consumer disputes. Here is what the consent order requires, and the separate FCRA obligations — permissible purpose, written consent, adverse action notices — that any business using screening reports must still meet.
SECURE 2.0 requires 401(k) and other defined contribution plans to mail at least one paper benefit statement per year starting with plan years after December 31, 2025. With Q1 2026 statements due around May 15 and the DOL's implementing rule still a proposal, Field Assistance Bulletin 2026-02 pauses enforcement for plan sponsors who comply in good faith — here's what small businesses must still do.
Vermont's H.211 (Act 138), signed June 16, 2026, raises the data broker registration fee from $100 to $900, adds a $20,000 surety bond, and imposes penalties up to $200/day for failing to register by January 1, 2027. Its narrower "direct relationship" test can classify loyalty programs, payment facilitators, SaaS platforms, and affiliate marketers as data brokers.
Virginia's House Bill 402, effective July 1, 2026, lets cottage food producers accept online orders and electronic payments, sell from any location in the Commonwealth, ship via third-party carriers within the state, and list a PO box on product labels. Production limits stay in place — home kitchens only, no potentially hazardous foods, no wholesale, no interstate shipping, and the $9,000 acidified-food sales cap — and localities can still impose their own zoning or permit requirements.
Starting January 2026, ISO endorsements CG 40 47 and CG 40 48 let U.S. carriers exclude generative AI claims from general liability policies — and over 80 percent of carrier requests for AI exclusions have been approved, while roughly 74 percent of small businesses use AI tools. Here's what falls into the coverage gap and five steps to take before your next renewal.
By mid-2026, roughly a dozen states — including Colorado, California, New York, Oregon, and Washington — regulate AI chatbots, with penalties from $1,000 per occurrence under Colorado's HB 26-1263 to $10,000 under California's proposed AB 1609. Here is which laws cover ordinary business support bots, which target companion apps only, and the low-cost disclosure steps that satisfy most of them.
The CFPB's final Regulation B rule takes effect July 21, 2026, removing disparate-impact liability from ECOA, narrowing the discouragement standard, and adding participant-level documentation requirements for for-profit special-purpose credit programs — a practical guide for small-business borrowers and lenders.
Colorado's HB26-1033, the "Tamale Act," legalizes home-kitchen sales of tamales and other temperature-sensitive foods starting January 1, 2027, and raises the cottage food revenue cap from $10,000 to $150,000 per product per year. Here are the food-safety, labeling, and transport rules producers must meet — and the bookkeeping needed to run at the new scale.
Connecticut's amended CTDPA took effect July 1, 2026, lowering the coverage threshold to 35,000 consumers, classifying neural data as sensitive, and requiring conspicuous disclosure of AI and LLM training on personal data. Processing any sensitive data — even one record — now triggers coverage, the 60-day cure period is gone, and penalties reach $5,000 per willful violation.
DOL Opinion Letter FLSA2026-5 (May 28, 2026) confirms an exempt, salaried employee can pick up hourly shifts in a separate non-exempt role without losing exempt status — if the base salary stays untouched, the exempt role remains the primary duty, and the two jobs stay genuinely distinct. Here's how to structure and track dual-role pay.
