SOC 2 and the EU AI Act Now Decide Which AI Startups Get Funded

AI Compliance Audits Do Not Satisfy the SEC

Global Predictions paid the Securities and Exchange Commission 175,000 dollars on March 18, 2024, for calling itself the first regulated AI financial adviser without being able to support the claim. Delphia paid 225,000 dollars in the same action. Both cases charged violations of Section 206.2 and Section 206.4 of the Investment Advisers Act of 1940, and both involved a company describing its own AI capability in terms the underlying technology could not support. That enforcement pattern is the backdrop against which an entire new software category, automated compliance and audit tools for enterprise AI, is now selling itself into finance, health, and defense. This Substack is reader-supported. To receive new posts and support my work, consider becoming a free or paid subscriber. The commercial case for these tools is strong on paper. Enterprise AI systems in regulated sectors carry obligations under statutes that predate large language models by decades: the Investment Advisers Act of 1940 for financial advisers, the Health Insurance Portability and Accountability Act of 1996 for health systems, and Federal Acquisition Regulation cybersecurity clauses for defense contractors. Layered on top of those older statutes are two newer reference points. The National Institute of Standards and Technology published its AI Risk Management Framework, organized around four functions the agency labels Map, Measure, Manage, and Govern, as a voluntary structure with no certification mechanism. The International Organization for Standardization published ISO/IEC 42001 in December 2023 as the first certifiable AI management system standard, complete with a two stage audit and a three year recertification cycle. Platforms including Credo AI, Holistic AI, ModelOp, and Vanta have built businesses mapping enterprise AI deployments against these frameworks. Vanta advertises ISO/IEC 42001 audit readiness within two to four weeks using 70 prebuilt controls. Credo AI markets assessments spanning the EU AI Act, the NIST framework, and ISO/IEC 42001 in a single registry. Amazon Web Services, Anthropic, and Microsoft already hold ISO/IEC 42001 certification as of 2026, and enterprise buyers increasingly ask vendors and each other for the same credential before signing. Venture capital has priced this shift into how it evaluates the startups building these tools and the startups relying on them. A KPMG Private Enterprise Venture Pulse analysis found that 74 percent of late stage venture deals included a dedicated AI or technical review in 2025, up from 31 percent in 2022. Andreessen Horowitz and Sequoia Capital, the two funds most frequently named as anchor investors in AI unicorns, each manage roughly 90 billion dollars in assets and now run diligence that tests model ownership, training data sourcing, and whether commercial contracts assign AI specific liability rather than relying on generic software as a service language. Four compliance automation startups, Hadrius, Spektr, Iridius, and Haast, raised a combined 67.6 million dollars in 2026 selling directly into that demand. In contract negotiations over the past year, I have watched enterprise customers try to substitute a vendor’s ISO/IEC 42001 certificate for the indemnification language their own counsel had asked for, and in every instance the certificate covered a process, not the specific output the customer was buying. A certification audit tests whether an organization followed its documented procedures. It does not test whether the underlying AI model produced a biased credit decision, a wrong diagnosis, or a leaked medical record. The Health Insurance Portability and Accountability Act of 1996 does not excuse a data breach because the health system’s AI vendor held a clean audit score, and Section 206 of the Investment Advisers Act of 1940 does not excuse a misleading AI marketing claim because a third party platform generated the language. The statute governs the outcome. The audit governs the paperwork. The regulatory calendar makes the gap harder to ignore. The EU AI Act set August 2, 2026, as the date most remaining provisions take effect, but a May 7, 2026, political agreement postponed the compliance date for Annex III use based high risk systems, covering credit scoring, employment screening, and biometric identification, to December 2, 2027, and postponed Annex I product regulated high risk systems, covering medical devices and lifts, to August 2, 2028. Companies that built compliance programs around the original August 2026 date now have to decide whether to hold that timeline or reallocate the budget toward the deferred obligations. Noncompliance once the deadlines do arrive carries fines up to 35 million euros or 7 percent of annual worldwide turnover, whichever figure is higher, and ISO/IEC 42001 certification is not a harmonized standard under the statute, so holding the certificate does not create a presumption of conformity. The Federal Trade Commission has already shown what happens when a company’s AI claims outrun what the technology delivers. Operation AI Comply, opened in September 2024, produced roughly a dozen AI washing cases in 2025 and continued into 2026 with the Growth Cave resolution on January 27 and an action against three marketing companies over a deceptive Active Listening tool on May 21. Every one of those cases involved a company describing its AI capability in terms broader than the underlying system could support. A compliance automation vendor that overstates its own detection capability, or an enterprise that treats a purchased audit report as proof of a regulatory conformity it has not actually achieved, sits inside the identical fact pattern. None of this means the compliance automation category is a bad bet for the enterprises buying it or the investors funding it. Sector specific audit obligations are real, the frameworks these platforms map against are the ones regulators actually cite, and a documented process is better than no process when a regulator or a plaintiff’s lawyer eventually asks what the company did to manage its AI risk. What the category cannot yet do is transfer legal liability away from the company that deployed the model, and no venture partner’s diligence checklist changes what a statute written decades before generative AI actually requires. Read my full analysis here: https://theinnovationattorney.com/automated-compliance-audits-become-a-2026-condition-for-ai-venture-funding/ This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theinnovationattorney.substack.com/subscribe [https://theinnovationattorney.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_2]

AI Washing Now Carries Real Penalties

what are the penalties for ai washing under ftc and sec rules On January 16, 2025, the Federal Trade Commission voted 5 to 0 to finalize an order against DoNotPay, the company that spent years marketing itself as the world’s first robot lawyer. The order bars DoNotPay from claiming its product performs like a licensed attorney unless it has evidence to back that claim, requires notice to every subscriber from 2021 through 2023, and imposes 193,000 dollars in monetary relief. DoNotPay had promised customers they could sue for assault without a lawyer and generate perfectly valid legal documents in no time. According to the Commission’s complaint, the company never tested whether its chatbot’s output matched a human lawyer’s work, and it never hired or retained a single attorney to check. This Substack is reader-supported. To receive new posts and support my work, consider becoming a free or paid subscriber. DoNotPay is one entry in a much longer list. The Federal Trade Commission opened Operation AI Comply on September 25, 2024, with five simultaneous enforcement actions, and brought roughly a dozen more AI washing cases through 2025 under new leadership, proving the initiative survived a change in administration. Rytr LLC settled for 193,000 dollars in 2024 over a feature that let subscribers generate fabricated consumer reviews, but the Commission later reopened and set aside that order in 2025, concluding the theory placed an undue burden on artificial intelligence tool developers. That reversal narrows Section 5 exposure for the tool itself while leaving full exposure in place for anyone who markets the tool for a deceptive purpose. FBA Machine and its principal, Bratislav Rozenfeld, face a stipulated judgment exceeding 15.7 million dollars for falsely guaranteeing income from AI powered online storefronts, and Ecommerce Empire Builders and owner Peter Prusinowski were banned from selling business opportunities in May 2025 after making similar claims. The per violation civil penalty under FTC Act Section 5(m)(1)(A) rose to 53,088 dollars effective January 17, 2025. The Securities and Exchange Commission runs a parallel program with its own statute and its own penalties. On March 18, 2024, the Commission charged Delphia (USA) Inc. and Global Predictions Inc. under Sections 206(2) and 206(4) of the Investment Advisers Act of 1940, the Marketing Rule, and the Compliance Rule. Delphia had overstated its use of artificial intelligence and machine learning in its investment process. Global Predictions had falsely called itself the first regulated artificial intelligence financial adviser. Delphia paid 225,000 dollars and Global Predictions paid 175,000 dollars. On January 14, 2025, the Commission charged Presto Automation Inc., a formerly Nasdaq listed company, in the first AI washing case against a public operating company, over statements to investors about its Presto Voice speech recognition system. The Commission imposed no penalty, citing Presto’s cooperation and remedial steps, which shows that early self correction narrows exposure without eliminating the underlying violation. State attorneys general have opened a third track. The Texas Attorney General settled with healthcare AI company Pieces Technologies on September 18, 2024, the first state settlement of its kind, requiring the company to substantiate future marketing claims under the state’s consumer protection statute. The Massachusetts Attorney General reached a 2.5 million dollar settlement with student lender Earnest Operations LLC in July 2025 over AI underwriting models alleged to produce disparate outcomes for Black, Hispanic, and non-citizen applicants. Private shareholders have opened a fourth track: Apple investors sued in June 2025 after delayed Siri upgrades coincided with a stock decline that erased nearly 900 billion dollars in market value from its peak, and Microsoft investors sued in June 2026 over Copilot claims made between May 2025 and January 2026. In reviewing marketing copy, term sheets, and licensing language for technology clients, the recurring compliance gap is not the AI claim itself. It is the absence of a paper trail showing who tested the claim, when, and against what benchmark. That gap is exactly what the National Institute of Standards and Technology AI Risk Management Framework and ISO/IEC 42001 are built to close. The NIST framework, published in January 2023, organizes AI oversight around four functions: Govern, Map, Measure, and Manage. ISO/IEC 42001:2023 goes further, offering a certifiable management system that an accredited auditor can verify, and NIST has published a crosswalk mapping its own framework onto the ISO standard so companies can pursue both at once. Neither carries the force of law in the United States as of 2026, but both are becoming the documentation a company points to when a regulator asks what it actually tested before it made a claim. Outside the United States, the European Union’s AI Act imposes tiered obligations by risk category, reaching any United States company that places an AI system on the European market. Colorado took a different path in 2026, repealing its original AI Act and replacing it with Senate Bill 26-189, which shifts from European style algorithmic accountability toward procedural disclosure duties enforced solely by the Colorado Attorney General, with penalties of up to 20,000 dollars per violation. None of this makes the word artificial intelligence dangerous to use. It makes the word expensive to use carelessly. Read my full analysis here: https://theinnovationattorney.com/ai-washing-regulatory-scrutiny-penalties-and-compliance-standards/ This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theinnovationattorney.substack.com/subscribe [https://theinnovationattorney.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_2]

Agentic AI Pricing in 2026

Salesforce has changed how it charges for its Agentforce product three times in eighteen months, moving from a flat 2 dollar per resolved conversation rate to a 0.10 dollar per action Flex Credit option, and that instability inside the company with the deepest enterprise pricing data in the industry says more about the state of agentic AI monetization than any product announcement. The venture capital pouring into this category, 86 percent of the 412.7 billion dollars deployed in United States funding during the first half of 2026, is chasing a business model nobody has fully settled yet. This Substack is reader-supported. To receive new posts and support my work, consider becoming a free or paid subscriber. For thirty years the software industry solved pricing with a familiar formula: charge per seat per month, and let the customer decide how much to use the product. Agentic products break that formula because the agent, not the human seat, does the work, and a company selling an agent that completes ten tasks for one customer and one thousand tasks for another has no principled reason to charge both customers the same monthly fee. How much venture money is actually funding agentic AI in 2026 United States venture investors deployed 412.7 billion dollars in the first half of 2026, and AI companies captured 86 percent of it. Megadeals of 100 million dollars or more accounted for 87.5 percent of that total, and in the first quarter the five largest rounds, raised by OpenAI, Anthropic, xAI, Waymo, and Databricks, accounted for nearly three quarters of all venture investment recorded that quarter. Three funds, Andreessen Horowitz, Thrive Capital, and Founders Fund, took in 48.1 percent of all capital raised industry wide during the same period. A founder pitching an agentic product now competes for attention against companies already generating hundreds of millions of dollars in annual recurring revenue, and that gap should temper any fundraising narrative built on category enthusiasm alone. What is the difference between subscription, usage based, and outcome based pricing Subscription pricing charges a fixed amount per seat per month. Harvey, the legal AI company, runs 100 to 200 dollars per user per month for large firm deployments and 1,000 to 2,000 dollars per user per month for mid sized firms, with 12 month commitments and 20 seat minimums at entry. Usage based pricing charges for consumption instead of seats: Salesforce’s Flex Credits, introduced at 0.10 dollars per action, bill for what the agent actually does. Outcome based pricing goes further and charges only when the agent finishes the job. Sierra and Decagon price customer service agents at roughly 1 to 3.50 dollars per resolved interaction, and Intercom charges 0.99 dollars for each conversation its Fin agent fully resolves, with no charge for an escalation to a human agent. Why outcome based pricing has not become the default Fewer than 10 percent of AI companies have moved to pure outcome based pricing, and the holdout is not customer resistance. It is that a chief financial officer cannot forecast next quarter’s revenue against a metric the vendor, not the buyer, defines and measures. In reviewing vendor agreements for clients licensing agentic customer service platforms this year, the definition of a resolved interaction most often appears inside a usage exhibit written narrowly enough that the vendor controls when the billing meter starts. Hybrid pricing, a subscription floor paired with a usage or outcome component, has become the market’s compromise: it already covers 43 percent of SaaS companies, a figure projected to reach 61 percent by the end of 2026, and companies using it report 38 percent higher revenue growth and 38 percent higher net revenue retention than companies on pure subscription pricing. How does a startup build a position a foundation model cannot absorb A product built entirely from a prompt placed over a public foundation model faces a direct threat: the model provider can add the same capability to its own product in a later release. Investors are now applying a three part test to agentic AI companies: does the company hold a proprietary dataset the model provider cannot access, does the company own a workflow deep enough that switching costs are high, and has the company built a customer relationship in a segment, such as legal or healthcare, that a general purpose model provider has no commercial reason to pursue directly. Harvey answers the first and third questions with its custom model licensing arrangement and its base of more than 100,000 lawyers across 1,300 organizations. Sierra and Decagon answer the second question: their outcome based pricing only works because they have built enough workflow depth to define, measure, and stand behind what counts as a resolved customer interaction, engineering that goes well beyond a wrapper around a model’s application programming interface. What is the SEC watching for in AI disclosure The Securities and Exchange Commission brought its first enforcement action against a public company for overstating AI capabilities in January 2025, against Presto Automation, alleging the company misrepresented what its voice AI product for restaurant drive through orders actually did and failed to disclose that a third party owned and operated the underlying technology and that the system required substantial human intervention. In April 2025, the SEC and the Department of Justice brought parallel actions against the founder and former chief executive of Nate Inc. on a similar theory. The agency has said AI disclosure will remain an examination focus in 2026, and its comment letters now press companies to tie any AI related claim to the system’s actual deployed capability rather than marketing language, a standard that applies with equal force to a startup’s pitch deck and a public company’s annual report. The pricing model a company chooses for its agent is now the first defensibility indicator investors read before they read the product, and the vendors still arguing internally over what counts as a resolved interaction have not finished designing their product. They have finished designing their invoice. Read my full analysis here: https://theinnovationattorney.com/ai-monetization-and-agentic-revenue-models-a-venture-capital-analysis/ This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theinnovationattorney.substack.com/subscribe [https://theinnovationattorney.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_2]

SOC 2 and the EU AI Act Now Decide Which AI Startups Get Funded

Eighty three percent of enterprise buyers now require AI vendors to hold SOC 2 Type II certification before signing a vendor contract in 2026. That number climbs to 91 percent among companies with more than 5,000 employees, and it applies with equal force to a fintech underwriting tool, a hospital diagnostic assistant, and a federal contractor’s chat interface. The EU AI Act adds a second deadline: high risk obligations under Articles 9 through 17 become binding on August 2, 2026, with fines reaching 7 percent of global turnover. A founder who treats these two facts as legal housekeeping, rather than as product requirements on the same list as uptime and latency, will watch a signed term sheet or a signed enterprise contract go to a competitor instead. Complyance provides the clearest evidence of where capital is moving. The company raised a 20 million dollar Series A led by GV in February 2026 specifically to build AI agents that automate compliance work against HIPAA, ISO, and NIST control lists, the same three standards a hospital system or a bank now asks about before signing anything. Zenskar closed a 15 million dollar Series A the same quarter behind Susquehanna Venture Capital and Bessemer Venture Partners, and LeapXpert raised 180 million dollars from Riverwood Capital to push AI deeper into the recordkeeping layer that broker dealers already depend on. None of these companies sell a better model. They sell proof that a model can be trusted inside a regulated function, and investors are paying for that proof at prices that used to belong to the model itself. why enterprise buyers stopped accepting promises Enterprise vendor risk teams read SOC 2 Type II reports the way a litigator reads a deposition transcript: line by line, looking for the gap between what a vendor says and what a vendor can prove. First year SOC 2 Type II spend for an AI startup runs 40,000 to 120,000 dollars and typically takes 6 to 12 months from audit kickoff to a completed report, and 67 percent of startups that finished the process said it directly closed a deal they would otherwise have lost, at a median deal size of 120,000 dollars. ISO/IEC 42001, the first international AI management system standard, published December 2023, has followed the same trajectory: 72 percent of enterprise buyers now screen for it before the first request for proposal round, at a first year certification cost running 85,000 to 650,000 dollars. Neither certification is cheap, and neither is optional once a company is selling into a bank, a hospital system, or a federal agency. what the eu ai act actually requires by august 2026 The EU AI Act’s high risk provider obligations under Articles 9 through 17 and deployer obligations under Article 26 become binding on August 2, 2026, alongside Article 50 transparency rules, conformity assessments, CE marking, and enforcement power vested in the AI Office. High risk categories include biometric identification, credit scoring, insurance underwriting, employment decisions, and access to essential services, a definition wide enough to capture most fintech underwriting tools and most healthcare diagnostic tools sold into the European market. Maximum fines reach 7 percent of global annual turnover or 35 million euros, whichever is greater, a number calculated against the parent company’s total revenue rather than the revenue of the AI product line alone. The Council of the European Union approved a simplification package on June 29, 2026 that would defer this deadline to December 2, 2027, following European Parliament endorsement on June 16, 2026, but that act had not entered into force at the time of this analysis, and companies selling into Europe should keep building toward August 2026 until the deferral is formally published. what colorado changed and what it did not Colorado enacted the first comprehensive state AI statute, SB 24-205, in 2024, requiring deployers whose AI decides a resident’s employment, housing, credit, insurance, education, healthcare, or access to government services to complete a documented impact assessment before deployment, annually thereafter, and within 90 days of any substantial modification, backed by a risk management program aligned to the NIST AI Risk Management Framework or ISO/IEC 42001. In May 2026, Colorado enacted SB 26-189, repealing and reenacting that statute effective January 1, 2027, and stripping out the annual impact assessment, the NIST aligned program mandate, and the duty of care and Attorney General self reporting obligations that defined the original law, leaving notices, explanations, human review, developer documentation, and three year record retention as what remains mandatory. A company that spent 2025 building a NIST aligned impact assessment program for Colorado now has to decide how much of that work survives past January 1, 2027, and counsel advising a multistate deployer has to run two versions of the same state law on two different clocks in the meantime. what a healthcare or fintech ai vendor still gets wrong A HIPAA covered entity that enters patient data into a consumer version of a large language model creates a reportable breach the moment the data leaves its system, because the standard public versions of tools including ChatGPT and Google Gemini do not sign HIPAA business associate agreements, and only certain enterprise or API tiers do. The agreement a vendor signs has to specifically address whether patient data can be used to train or refine the underlying model, and the Office for Civil Rights has made vendor accountability a centerpiece of its 2026 enforcement program, with a pending rule that would require annual verification of technical safeguards rather than the occasional paperwork check that satisfied examiners in the past. On the fintech side, the Securities and Exchange Commission has already collected 400,000 dollars in combined penalties from two registered investment advisers over AI marketing claims the firms could not support, and the Federal Trade Commission’s thirteenth AI washing case since 2024, filed May 21, 2026, produced a 930,000 dollar consumer redress payment from three marketing companies. Neither agency is asking whether a company used the word AI. Both are asking whether the underlying claim was true when it was made. None of this changes the underlying calculation a founder has to make before the next enterprise call: whether the sales cycle survives waiting for a SOC 2 Type II report, and whether counsel has confirmed which version of a fast moving state or EU obligation actually governs a given launch date. Read my full analysis here: https://theinnovationattorney.com/ai-compliance-documentation-becomes-the-enterprise-sales-gate-in-2026/ This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theinnovationattorney.substack.com/subscribe [https://theinnovationattorney.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_2]

AI Capital Concentration in 2026

AI companies captured 86 percent of the $412.7 billion in U.S. venture capital deployed in the first half of 2026, and OpenAI and Anthropic alone absorbed $217.6 billion of that total. Fewer than ten companies now determine the return profile of the entire venture capital market. Every founder building an AI company outside that top tier is competing for what is left, and most of them have not adjusted their pitch to reflect it. This Substack is reader-supported. To receive new posts and support my work, consider becoming a free or paid subscriber. The shift happened fast. AI took 61 percent of global venture capital dollars in 2025, itself a record, and then climbed to 86 percent of a much larger U.S. total within two quarters. The venture capital market has not been this concentrated around a single technology theme in its history, and the concentration is compounding rather than leveling off. The mechanism is capital intensity, not hype. Training and serving a frontier model requires sustained access to graphics processing unit capacity, long-term power contracts, and data center commitments that run into the tens of billions of dollars before a product reaches a single customer. That cost structure limits credible frontier competition to a handful of companies, and it forces the venture firms backing them to raise fund sizes large enough to write single checks in the billions. Andreessen Horowitz closed $15 billion across five new funds in January 2026, lifting its assets under management to $90 billion. Thrive Capital raised $10 billion. Founders Fund raised $6 billion after deploying $4.6 billion in under a year into Anthropic, Anduril, and OpenAI. Three firms took in 48.1 percent of all capital raised by venture funds in the first half of 2026. Mega-rounds close this quickly because they happen almost entirely outside the public markets. Rule 506(c) of Regulation D permits general solicitation, and a March 12, 2025 set of compliance and disclosure interpretations from the Securities and Exchange Commission’s Division of Corporation Finance expanded the safe harbor for verifying accredited investor status. That change let an issuer publicly discuss a raise while relying on investor self-certification rather than case-by-case documentation. A private company can now close a multibillion-dollar round in weeks, without the runway a registered public offering under the Securities Act of 1933 would require. The capital that used to flow into that runway went somewhere else. Seed and angel funding fell 27 percent year over year in the second quarter of 2026. The rate at which seed-stage companies convert into Series A financings collapsed to approximately 9 percent in 2025, down from a historical range of 15 to 20 percent. Institutional limited partners directed 91 percent of new fund commitments in the first quarter of 2026 to established, brand-name venture firms, up from 74 percent a year earlier. The result is a barbell: enormous rounds at the frontier lab tier, disciplined but shrinking early-stage investing beneath it, and a hollowed-out middle where growth capital used to sit. In seed and Series A term sheet negotiations closed since January 2026, this author has observed a new provision spreading across deals: a compute cost pass-through clause tying a portion of price protection to a company’s exposure to frontier model application programming interface pricing. That clause did not appear in comparable term sheets before 2025, and it reflects how directly a vertical AI company’s cost base now depends on pricing set by two or three providers it does not control. The companies finding room to operate are not trying to out-train the frontier labs. They are building around a workflow, a regulated dataset, or a customer relationship a frontier lab cannot practically replicate. Legal, coding, and customer support specialists are winning by owning the workflow rather than the model, since frontier models improve faster than most products can absorb the improvement, which leaves the specialist room to compound an advantage the underlying model cannot capture on its own. Sovereign and regulated-language labs hold corpora that a U.S. frontier lab cannot legally assemble. Biotech-native foundation model efforts hold proprietary structural and clinical data that has nothing to do with parameter count. The same concentration that created these openings also creates a new kind of counterparty risk. When two or three foundation model providers absorb 40 percent or more of all AI investment and simultaneously set the pricing that thousands of application-layer companies depend on, the negotiating position between a frontier lab and its customers becomes asymmetric in a way concentration in most other markets does not produce. Antitrust and competition scholars have already begun examining whether that combination of capital concentration and pricing power warrants a monopoly inquiry under existing statutory authority. Whether that inquiry happens will not be decided this year, and whether the Securities and Exchange Commission’s continued simplification of Regulation D concentrates capital further or widens the door for issuers outside the top tier depends on rules the Commission has not yet finalized. Read my full analysis here: https://theinnovationattorney.com/capital-concentration-and-the-frontier-lab-effect-what-the-2026-ai-funding-data-means-for-smaller-startups/ This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theinnovationattorney.substack.com/subscribe [https://theinnovationattorney.substack.com/subscribe?utm_medium=podcast&utm_campaign=CTA_2]