Photo by Clo Art on Unsplash
In April 2023, a song called “Heart on My Sleeve” gained widespread attention on streaming and social media platforms. The song sounded a lot like a new collaboration between Drake and The Weeknd. However, it wasn’t the collab everyone was hoping for. An anonymous producer who goes by Ghostwriter claimed to have written and produced the track, replacing their own vocals with AI-generated vocals imitating Drake and The Weeknd.[1] Universal Music Group had the song removed within days by invoking copyright, but no federal law gave Drake or The Weeknd a right in their own voices.[2] That was three years ago, and Congress is only now getting close to addressing it.
The proposed S. 4591 bill is called the NO FAKES Act, which is short for the Nurture Originals, Foster Art, and Keep Entertainment Safe Act of 2026.[3] Coverage of the bill mostly focuses on how artists would be affected if it passes. However, far less attention has gone to a different audience that is worth paying close attention to. That audience includes the companies building the tools that make these unauthorized imitations possible, especially those raising money to build more of them.
What the Bill Would Do
The bill would create a new federal property right in one’s own voice and visual likeness that is enforceable against any party who knowingly distributes or publicly displays a digital replica without authorization. The bill would also cover platforms and provide a notice-and-takedown safe harbor, so a platform that promptly removes a replica after proper notice is protected, while one that makes no good-faith effort to comply can face damages of up to $750,000 per work.[4] It would also preempt future state-law claims over digital replicas in expressive works, while preserving certain state causes of action that existed as of January 2, 2025, like those under Tennessee’s ELVIS Act.[5] Willful violations of this bill could bring punitive damages in addition to actual or statutory damages.[6] For companies whose products are built around generating replicated performances, that is meaningful exposure. The exposure is greatest for tools designed or marketed to replicate specific, identifiable people, which the bill reaches directly (general-purpose tools get a separate safe harbor). Tennessee’s ELVIS Act already covers tools built for that purpose.[7]
Where the Bill Stands
Earlier versions of this bill (a 2023 discussion draft, a 2024 bill, and a 2025 bill) never received a committee vote, but this one finally did.[8] On June 18, 2026, the Senate Judiciary Committee advanced S. 4591 by unanimous voice vote, with support from major entertainment companies and industry groups such as Disney, the Motion Picture Association, the Recording Academy, Warner Music Group, and Universal Music Group, as well as from technology companies including OpenAI, YouTube, and TikTok.[9] But the vote left significant First Amendment concerns unresolved, including warnings that the takedown system might push platforms to remove even lawful content.[10] Those concerns resurfaced on September 30, when Sen. Ted Cruz blocked an attempt to pass the bill by unanimous consent.[11] Due to these issues, nobody can confidently say when, or whether, the full Senate will pass it.
What It Means for Disclosure
All of this uncertainty is something that companies building voice-replication tools may need to disclose. Some companies that build AI voice cloning and performance replication tools are public or preparing to be, and they must describe their material risks in SEC filings.[12] Yet, currently, disclosure in this area is often generic. One filer describes evolving AI regulation only in general terms, without naming a specific bill or explaining how it would affect the business.[13] A full-text EDGAR search for “NO FAKES” from January 2023 through October 2, 2026, returned only one annual report or registration statement that mentions the phrase, and that filing refers to “so-called ‘NO FAKES’-type laws” without naming the Act, though it does explain how such laws could affect the company’s products.[14]
Item 105 of Regulation S-K requires registration statements and annual reports to discuss the material factors that make an investment in the company speculative or risky.[15] The SEC tightened this requirement back in 2020, replacing the old “most significant” standard with materiality, and discouraged companies from padding their filings with boilerplate language. While generic risks are still allowed, they now specifically belong at the end of the section under a separate “General Risk Factors” heading.[16] A brief line about evolving AI regulation might be fine there for an ordinary software company, but it may not be sufficient for a company whose core product generates voices that belong to others. For that company, a bill that cleared committee unanimously, is supported by major entertainment companies, and would create a new federal cause of action directly relevant to its business is not a remote risk. It is a company-specific one.
Item 303 points in the same direction. It requires management to discuss known trends or uncertainties that are reasonably likely to have a material effect on revenue or income, and pending legislation can fit that description.[17] Private companies don’t escape this issue either. A startup raising a venture round is not ordinarily required to file a registration statement, so Item 105 never applies, but antifraud rules do. Rule 10b-5 applies to fraud in connection with the purchase or sale of any security, including private placements, and prohibits half-truths, or statements that become misleading because of what they leave out. Silence alone, however, is different. The Supreme Court has held that failing to make a required Item 303 disclosure is not, on its own, sufficient for a private Rule 10b-5(b) claim, since an omission must make one of the company’s actual statements misleading.[18] In a private round, that Rule 10b-5 half-truth exposure is often seen in the representations and warranties. A company cannot tell its investors that it has no significant legal exposure while simultaneously remaining silent about a pending bill that, if passed, could expose its core product to liability.
Notably, neither Item 105 nor Item 303 requires a company to predict whether NO FAKES will become law. They may, however, require treating the uncertainty itself as a material, disclosable fact. A well-drafted risk factor could name the bill specifically, describe the liability it would create for distributors, developers, and platforms, and explain how that liability could affect the company’s product, revenue, or licensing arrangements if the bill passes in its current form.[19] That is a very different document from one generic line under a broad heading about technology risk, and investors trying to understand an AI entertainment company’s real exposure deserve that difference.
Many versions of this bill have circulated since 2023 without becoming law, and this one has already stalled once on the Senate floor.[20] But a unanimous committee vote, with both major entertainment and technology companies on board, means that companies building voice and likeness replication technology can no longer treat NO FAKES as a problem for later. The risk is real enough to put in writing now.
Erin Lee is a Second Year Law Student at Benjamin N. Cardozo School of Law and a Staff Editor for the Cardozo Arts & Entertainment Law Journal. Erin is interested in corporate law and artificial intelligence. She also serves on the executive board of the Cardozo AI & the Law Society.
[1] Jordan Pearson, A Viral AI-Generated Drake Song by ‘Ghostwriter’ Has Millions of Listens, Vice (Apr. 17, 2023), https://www.vice.com/en/article/heart-on-my-sleeve-ai-ghostwriter-drake [https://perma.cc/5XDU-JMRN].
[2] Chloe Veltman, When You Realize Your Favorite New Song Was Written and Performed by . . . AI, NPR (Apr. 21, 2023), https://www.npr.org/2023/04/21/1171032649/ai-music-heart-on-my-sleeve-drake-the-weeknd [https://perma.cc/2VQ3-SD2P]; see U.S. Copyright Off., Copyright and Artificial Intelligence, Part 1: Digital Replicas 22–23 (2024), https://www.copyright.gov/ai/Copyright-and-Artificial-Intelligence-Part-1-Digital-Replicas-Report.pdf [https://perma.cc/VT2A-2KC7] (concluding that new federal legislation is needed because not all state laws protect an individual’s voice).
[3] S. 4591, 119th Cong. § 1 (as reported by S. Comm. on the Judiciary, June 24, 2026).
[4] Id. § 2(b)(1), (b)(2)(A)(i)(I), (c)(2)(A), (c)(3)(B), (d)(1)(B), (e)(5)(A)(i)(I)(cc); Murray Stassen, NO FAKES: Senate Panel Backs Bill That Could Cost Platforms $750k per AI Deepfake, Music Bus. Worldwide (June 18, 2026), https://www.musicbusinessworldwide.com/no-fakes-senate-panel-backs-bill-that-could-cost-platforms-750k-per-ai-deepfake/ [https://perma.cc/E9M9-XA94].
[5] S. 4591 § 2(g); Stefan Modrich, Senate Judiciary Advances NO FAKES Act on Unanimous Vote, S&P Glob. Mkt. Intel. (June 23, 2026), https://www.spglobal.com/market-intelligence/en/news-insights/articles/2026/6/senate-judiciary-advances-no-fakes-act-on-unanimous-vote-103007539 [https://perma.cc/KXG2-VA5T]; Tenn. Code Ann. §§ 47-25-1101 to -1108 (West, Westlaw through 2026 2d Reg. Sess.).
[6] S. 4591 § 2(e)(5)(A)(i)–(ii), (iv).
[7] Id. § 2(c)(2)(B), (d)(1)(A); Tenn. Code Ann. § 47-25-1105(a)(3) (West, Westlaw through 2026 2d Reg. Sess.).
[8] See S. 4875, 118th Cong. (2024) (no further action); S. 1367, 119th Cong. (2025) (no further action); Nathaniel L. Bach, Congress Reintroduces the NO FAKES Act: What’s New in the 2026 Bill, Manatt, Phelps & Phillips, LLP (May 28, 2026), https://www.manatt.com/insights/newsletters/client-alert/congress-reintroduces-the-no-fakes-act-what-s-new-in-the-2026-bill [https://perma.cc/D4ZS-K7TM] (describing the 2023 discussion draft).
[9] Kirsten Donaldson, Senate Committee Advances Bill to Protect Name, Image, Likeness and Voice Against Unauthorized AI Use, Holland & Knight (June 22, 2026), https://www.hklaw.com/en/insights/publications/2026/06/senate-judiciary-committee-advances-legislation-to-protect-name [https://perma.cc/23MR-GLYG]; Jon Swartz, Senate Committee Unanimously Advances NO FAKES Act to Combat AI Deepfakes, Techstrong.ai (June 25, 2026), https://techstrong.ai/articles/senate-committee-unanimously-advances-no-fakes-act-to-combat-ai-deepfakes/ [https://perma.cc/2QJW-SSQC].
[10] Senate Judiciary Unanimously Advances NO FAKES Act to Senate Floor, Record of Record (June 19, 2026), https://recordofrecord.com/articles/2026-06-19-senate-judiciary-unanimously-advances-no-fakes-act-creating-federal-right-over-a/ [https://perma.cc/E2KD-W5X3].
[11] 172 Cong. Rec. S5206 (daily ed. Sep. 30, 2026) (statement of Sen. Ted Cruz); Ted Johnson, Ted Cruz Blocks Senators’ Effort to Pass No Fakes Act, Deadline (Sep. 30, 2026), https://deadline.com/2026/09/ted-cruz-no-fakes-act-senate-1237143753/ [https://perma.cc/B2TB-2KCK].
[12] E.g., Sound Grp. Inc., Annual Report (Form 20-F) 78 (Apr. 30, 2026); Change Agents Corp., Registration Statement (Amendment No. 3 to Form S-1) 13 (Sep. 16, 2026).
[13] Sound Grp., supra note 12, at 32.
[14] Search Results for “NO FAKES” (Jan. 1, 2023–Oct. 2, 2026), EDGAR Full Text Search, https://www.sec.gov/edgar/search/#/q=%22NO%20FAKES%22&dateRange=custom&startdt=2023-01-01&enddt=2026-10-02 [https://perma.cc/KH5Z-A5RA] (last visited Oct. 2, 2026) (returning one Form 20-F and one Form 8-K exhibit); Perfect Corp., Annual Report (Form 20-F) 35 (Mar. 13, 2026).
[15] 17 C.F.R. § 229.105(a) (2025).
[16] Modernization of Regulation S-K Items 101, 103, and 105, Securities Act Release No. 10,825, Exchange Act Release No. 89,670, 85 Fed. Reg. 63,726, 63,742–44 (Oct. 8, 2020); 17 C.F.R. § 229.105(a).
[17] 17 C.F.R. § 229.303(b)(2)(ii) (2025).
[18] 17 C.F.R. § 240.10b-5(b) (2025); Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257, 263, 265–66 (2024).
[19] See 17 C.F.R. § 229.105(b) (requiring registrants to concisely explain how each risk affects the registrant or the securities being offered); Modernization of Regulation S-K Items 101, 103, and 105, 85 Fed. Reg. at 63,746 (encouraging registrants to tailor risk factors to emphasize each risk’s specific relationship to the registrant).
[20] See supra notes 8–11.
