AI product management · Industry brief

Stripe has agreed to acquire artificial intelligence routing platform OpenRouter in a transaction valued at approximately $7.5 billion, with three law firms leading the deal, according to Law360.

The Federal Trade Commission cleared IonQ's acquisition of SkyWater Technology in January 2024 without litigation or remedies despite competitive concerns raised by Chairman Andrew Ferguson, with Commissioner Mark Meador dissenting on the finding of insufficient competitive harm. The FTC's two-commissioner deadlock—lacking a majority to pursue enforcement—created an unusual outcome that unsettles prior deal strategy assumptions. The article, published in Bloomberg Law, identifies five strategic implications for dealmakers: close-call deals need not follow the traditional Second Request-to-remedy-or-litigation progression; acquirers should recalibrate deal pricing and risk allocation provisions for the current regulatory environment rather than historical precedent; traditional mergers may warrant reconsideration versus complex ecosystem alternatives; successful advocacy should emphasize innovation, customer choice, and neutrality supported by credible business materials; and commission composition and state-level enforcement now materially affect antitrust outcomes. The temporary two-commissioner period may create a tactical window for M&A activity before additional commissioners are confirmed, though the regulatory landscape remains subject to future shifts.

The EU AI Act extends beyond European borders to capture U.S. companies developing, deploying or selling AI systems, introducing a governance framework that treats AI like regulated products with risk evaluation, documentation, oversight controls and post-market monitoring requirements. Parts of the law are already in effect, with high-risk AI system obligations postponed from August 2026 to December 2027, giving companies 12-24 months to build governance frameworks, conduct risk assessments and operationalize compliance across legal, cybersecurity, engineering and product teams. Classification as "high risk" depends on whether systems involve safety components, critical infrastructure, or designated areas like employment, education, healthcare, financial services and biometric processing, with regulators evaluating not only technical design but also marketing materials, customer documentation and demonstrated use cases to determine intended use. AI governance is becoming operational risk management similar to product safety frameworks, requiring risk management systems, quality datasets, technical documentation, logging capabilities, transparency mechanisms, human oversight and cybersecurity safeguards. Meanwhile, the U.S. lacks comprehensive federal AI law, instead presenting a fragmented landscape of state privacy laws and sector-specific regulations; California's approach under the CPPA requires risk assessment obligations beginning January 2027 for automated decision-making affecting consumers, with certification and reporting obligations following in 2028. Transparency requirements are expanding in both EU and U.S. contexts, with regulations emerging around disclosure of AI-generated content and chatbot interactions. Critically, U.S. companies face litigation risk under existing state laws before comprehensive regulation exists, with lawsuits filed under wiretapping statutes and investigations launched based on false advertising and unfair trade practices laws, making AI governance an immediate operational concern rather than a future compliance issue.