Cybersecurity & Compliance
NIS2, DORA, the Cyber Resilience Act and the GDPR overlap in ways that reshape liability when systems fail. I write about how those obligations interact across borders, regulators, and contracts.
Is my subsidiary in scope of NIS2?
Why the answer is decided at group level
Supply chain email fraud: how NIS2, DORA and the GDPR reshape civil liability
NIS2, DORA, and the GDPR have done more than create regulatory fines. They have given courts statutory benchmarks against which a supplier's cybersecurity conduct can now be measured in civil proceedings.
Supply chain email fraud: which party pays when the supplier gets hacked?
When a buyer pays the wrong account because its supplier's email was compromised, the legal question is deceptively simple. The answer varies by jurisdiction, contract, and the conduct of both parties.
The EU AI Act’s operator model: what every company needs to know before deploying AI
Under the EU AI Act, the line between "user" and "provider" depends on what you do with a system, not who built it. Companies that integrate, adapt, or fine-tune AI may acquire provider obligations without realising it.
Stay in the conversation
New analysis sent when it is published.